Microsoft haven't implemented HTML5's keygen in spite of being a "standard". The same is valid for iOS.
This makes the use of X.509 certificates quite quirky. What's the way ahead then? Since the world [apparently] is divided a better path could be to offer a web interface that allows you to implement the "keygen" you want. You see a pattern here? No? Anders