In some sections of the application I get the message: Warning: This version of Firefox no longer supports the crypto web object used to generate and archive keys from the browser. As a result expect limited functionality in this area.
Doing a little research I found this information : https://www.redhat.com/archives/pki-users/2015-September/msg00012.html It means that Firefox's API changed. The old, custom keygen / crypto API was deprecated for a long time, then removed, but the new, standardised Web Crypto API is not supported by Dogtag yet. Hope that clarifies the situation for you. -Fraser Tweedale- It was reported On Mon, Sep 07, 2015 at 03:03:03PM +0300, By Aleksey Chudov Little more than a year , so I doubt arise as follows : Do you have plans to migrate to Web Cryptography API? Could take a look at PKI.js project, have made great strides in this topic: https://github.com/PeculiarVentures/PKI.js PKIjs is a pure JavaScript library implementing the formats that are used in PKI applications. It is built on WebCrypto ( Web Cryptography API ) and aspires to make it possible to build native web applications that utilize X.509 and the related formats on the web without plug-ins. Features of the library * First and ONLY (April 2015) open-source JS library with full support for all "Suite B" algorithms in CMS messages; * First library with support for CMS Enveloped data (encrypt/decrypt) in pure JavaScript + Web Cryptography API; * Fully object-oriented library. Inhiritence is using everywhere inside the lib; * Working with HTML5 data objects (ArrayBuffer, Uint8Array, Promises, Web Cryptography API, etc.); * Has a complete set of helpers for working with types like: * GeneralName; * RelativeDistinguishedName; * Time; * AlgorithmIdentifier; * All types of ASN.1 strings, including "international" like UniversalString, UTF8String and BMPString (with help from ASN1js ); * All extension types of X.509 certificates (BasicConstraints, CertificatePolicies, AuthorityKeyIdentifier etc.); * All "support types" for OCSP requests and responces; * All "support types" for Time-Stamping Protocol (TSP) requests and responces; * Has own certification chain verification engine, built in pure JavaScript, with help from Promises and Web Cryptography API latest standard implementation; * Working with all Web Cryptography API signature algorithms: * RSASSA-PKCS1-v1_5; * RSA-PSS; * ECDSA; * Working with all "Suite B" (and more) encryption algorithms and schemas: * RSASSA-OAEP + AES-KW + AES-CBC/GCM; * ECDH + KDF on SHA-1/256/384/512 + AES-KW + AES-CBC/GCM; * Pre-defined "key encryption key" + AES-KW + AES-CBC/GCM; * Password-based encryption for CMS with PBKDF2 on HMAC on SHA-1/256/384/512 + AES-KW + AES-CBC/GCM; * Working with all major PKI-related types ("minor" types are not mentioned here but there are huge number of such "minor types"): * X.509 certificates: * Parsing internal values; * Getting/setting any internal values; * Creatiion of a new X.509 certificate "from scratch"; * Internal certificate chain validation engine ; * X.509 "certificate revocation lists" (CRLs): * Parsing internal values; * Getting/setting any internal values; * Creation of a new CRL "from scratch"; * Validation of CRL signature; * Search inside CRL for specific revoked certificate. * PKCS#10 certificate request: * Parsing internal values; * Getting/setting any internal values; * Creation of a new PKCS#10 certificate request "from scratch"; * Validation of PKCS#10 signature; * OCSP request: * Parsing internal values; * Getting/setting any internal values; * Creation of a new OCSP request "from scratch". * OCSP response: * Parsing internal values; * Getting/setting any internal values; * Creation of a new OCSP response "from scratch"; * Validation of OCSP response signature. * Time-stamping request: * Parsing internal values; * Getting/setting any internal values; * Creation of a new Time-stamping request "from scratch"; * Validation of Time-stamping request signature; * Time-stamping response: * Parsing internal values; * Getting/setting any internal values; * Creation of a new Time-stamping response "from scratch"; * Validation of Time-stamping response signature * CMS Signed Data: * Parsing internal values; * Getting/setting any internal values; * Creation of a new CMS Signed Data "from scratch"; * Validation of CMS Signed Data signature; * CMS Enveloped Data: * Parsing internal values; * Getting/setting any internal values; * Creation (encryption) with full support for "Suite B" algorithms and more; * Decryption with full support for "Suite B" algorithms and more; * CMS Encrypted Data: * Parsing internal values; * Getting/setting any internal values; * Creation (encryption) with password; * Decryption with password; * PKCS#12: * Parsing internal values; * Making any kind of internal values (SafeContexts/SafeBags) with any kind of parameters;
_______________________________________________ Pki-users mailing list [email protected] https://www.redhat.com/mailman/listinfo/pki-users
