Daniel Vygolov Daniel Vygolov - 23 days ago 7
Javascript Question

How to sign the document with a certificate's private key from the browser (CAPICOM alternative)?

So, till Windows 7 there was a Microsoft ActiveX component: CAPICOM, which one could call from Javascript and then show the contents of the certificate storage on the client's machine. The client then could choose the appropriate certificate and sign some document with the certificate's private key.
That's how the access to the certificate storage looked in Javascript:

var MyStore = new ActiveXObject("CAPICOM.Store");
var oCertificates = new ActiveXObject("CAPICOM.Certificates");
// attempt to open the personal certificate store
MyStore.Open(CAPICOM_CURRENT_USER_STORE, "My", CAPICOM_STORE_OPEN_READ_ONLY);


What’s the alternative to using CAPICOM nowadays? I want the client to be able to sign some piece of text with his private key in the browser and then send the signed text with the public key to the server. Is it still possible?

Maybe I could use Java or Silverlight instead of pure JavaScript? What about PKI.js and similar?

Answer

In general, currently is not possible due to lack of support of browsers to Java or silverlight.

Chrome has dropped support to NPAPI plugins. Firefox has announced it will discontinue it in 2017, Edge has no support. Microsoft has deprecated Silverlight and Oracle has also announced the deprecation of the Java browser plug-in. Only old versions of IE could be used.

Javascript cryptographic libraries such as PKI.js, forge or the built-in WebCryptographyApi can be used to perform digital signatures, but they do not have access to the Operative System KeyStore, so you can not access to the installed certificates

Alternatives (Not very encouraging):

  • Use WebCryptographyApi loading certificates in browser (not for smartcards)
  • Launch a local application installed on your device and invoke via protocol, using an embedded http server or with chrome messaging api
  • Wait patiently to Key Discovery Api which will provide with access to the OS keystore to WebCrypto