1

Is it possible to sign a document with a client certificate programmatically in a browser using either java or javascript WITHOUT user intervention ? Could a hacker use this to impersonate a user ?

If not does it mean it is less secure to make client sign a document by delegating to a server than sign on his own machine ?

6
  • what do you mean by "sign a certificate"? one usually uses a private certificate to sign other things. to answer your other question, your trust is only as strong as the protection of your secret.
    – jtahlborn
    May 19, 2012 at 19:39
  • You might mean "accept a certificate" for which the answer is No. If that could be done programmatically it would be anarchy! May 19, 2012 at 22:31
  • Oops sorry I meant "to sign a DOCUMENT with a client certificate programmatically"
    – user310291
    May 19, 2012 at 23:30
  • If you find a way, please send details to secalert_us. May 20, 2012 at 17:20
  • @tom so it means it's not possible ;)
    – user310291
    May 21, 2012 at 17:44

1 Answer 1

1

Yes it is, by using Javascript. Called "WebCrypto", its support depends on the browser. For example, Chrome's support for WebCrypto features is listed here:

https://www.chromium.org/blink/webcrypto

Please take time to correct the question. It should be "Is it possible to sign programmatically in a browser." This is because the cryptographic action of "signing a certificate" actually exists and is used to prove a certificate is genuine, whose private key in turn can be used to "signing a document" to prove the document is genuine, forming a chain of trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.