Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

CACert and MyOpenID both do this: they have a form that, when submitted, will cause the browser to generate a key and send the public part up to be signed, then deliver back down the signed certificate containing that public key which the browser binds up in its keystore and uses for authentication in the future. I know how to use SSLVerify and similar to verify the client cert once the user has it, and I know how to generate a CA and client certs normally using the openssl command line tools, but not how to do the browser interaction bit to generate the key etc.

I'm probably using Apache and Ruby/Rack or PHP if that helps :)

share|improve this question

You are looking for the keygen tag. See Mozilla's page.

You might be better off letting EJBCA do this since it handles the different browser quirks by using it's external-ra component (I did :) ).

In essence, build two instances of ejbca. One to act as your ca behind your secure network. Another instance as the frontend ra which will be used to enrol your users. The ca polls the ra by querying the ra's MySQL database ( config file), pick any outstanding CSRs, sign them and then post certificates back.

For you to enrol a user:

  • You must pre-create the user in the ca end (End entity as they are called. Which means you must create a ca, caprofile, etc)
  • Log in to the externalra interface with the end entity credentials and submit the form.
  • The client's browser will start displaying a busy icon.
  • The CSR hits the ra db, and waits for the ca to pick up the csr and drop back a cert. Once the cert hits the ra db, it's presented to the user.

Here's a simple ejbca build script I used. It won't work right off the bat but it should work. Update: Also see this question and this link for client cert usage in Apache

share|improve this answer
I knew about the HTML5 tag. I assume that's not what people were using before HTML? I'll look into EJBCA – singpolyma Jun 3 '11 at 17:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.