A demo for a purely client-side single-file JS library that allows to locally generate CSRs (Certificate Signing Requests) using Web Crypto API key pairs.
After the CA issues the certificate, this lib also allows to assemble the PKCS#12 file containing the certificate chain and the private key, and to initiate a file download in the local browser, so that the user has an easy way of importing the certificate to their local browser or system.
Either just the signed leaf certificate, or the certificate chain. When providing a chain, the leaf certificate must be listed as the first one. In all cases, use the PEM format.
It is discouraged to move away from the default "3DES" setting. Many modern operating systems still don't support any more sophisticated algorithms for importing PKCS#12 containers through their standard GUI. Weak encryption is not a big deal since the PKCS#12 is supposed to be installed on the same device where it was generated. Make sure to set reasonably strong password to cover for the case when the imported PKCS#12 is left retained on the user's hard disk.
Powered by TinyPKI.