SPKAC
Data format for sending a certificate signing request
- 1 min read
- 2 chapters
Related on Lably
Through HTML, De facto and de jure and Digital signature
Standardisation
There exists an ongoing effort to standardise SPKAC through an Internet Draft in the Internet Engineering Task Force (IETF). The purpose of this work has been to formally define what has existed prior as a de facto standard, and to address security deficiencies, particular with respect to historic insecure use of MD5 that has since been declared unsafe for use with digital signatures.
Sign in to keep reading
One more chapter is free with a Lably account.
Implementations
HTML5 originally specified the <keygen> element to support SPKAC in the browser to make it easier to create client side certificates through a web service for protocols such as WebID; however, subsequent work for HTML 5.1 placed the keygen element "at-risk", and the first public working draft of HTML 5.2 removes the keygen element entirely. The removal of the keygen element is due to non-interoperability and non-conformity from a standards perspective in addition to security concerns.
The World Wide Web Consortium (W3C) Web Authentication Working Group developed the WebAuthn (Web Authentication) API to replace the keygen element.
Bouncy Castle provides a Java class.
An implementation for Erlang/OTP exists too.
An implementation for Python is named pyspkac.
PHP OpenSSL extension as of version 5.6.0.
Node.js implementation.
Deficiencies
The user interface needs to be improved in browsers, to make it more obvious to users when a server is asking for the client certificate.