View Issue Details
|ID||Project||Category||View Status||Date Submitted||Last Update|
|0001417||Main CAcert Website||certificate issuing||public||2016-10-03 17:31||2018-05-02 23:35|
|Platform||PC Windows 10, IE11 Chrome Firef||OS||Windows 10 Pro 64bit, Ubuntu||OS Version||Current|
|Product Version||2015 Q3|
|Target Version||Fixed in Version|
|Summary||0001417: Unable to generate client certificate|
|Description||Unable to generate client certificate|
Clicking generate keypair in browser results in the error
"I didn't receive a valid Certificate Request, please try a different browser."
This happens in IE11, Edge, Chrome current version, and Firefox current version.
|Steps To Reproduce||log in to cacert.org|
click client certificate
check off wanted email address
click agree to terms
click generate keypair within browser
Immediately receive error "I didn't receive a valid Certificate Request, please try a different browser."
Same error occurs in IE11 Edge Chrome and Firefox
|Additional Information||CACerts.org is added as trusted site|
TLS and SSL are enabled
Tested running Trusted Sites on low security setting in IE
Tried on both 32 and 64 bit versions of all broswers
|Tags||browser, certificates, html|
The same bug happend to me to with
- Chromium 55 on Ubuntu 16.04
- Vivaldi 1.6 64 Bit on Ubuntu 16.04
- Edge on Windows 10
But I could create a new certificate with
- Firefox 50.1 on Ubuntu 16.04
Some other checks to create new certificates:
it does NOT work with
- Edge 38 on Windows 10
- Opera 42 on Windows 10
- Vivaldi 1.4 on Windows 10
it works still with
- Firefox 48.0 on Windows 10
I filed a bug at Chromium and at Vivaldi a few days ago. Following the answer from Chromium:
Issue 799246 in chromium: Cannot create a certificate with cacert.org
Von: asa… via monorail
Comment 0000003 on issue 799246 by email@example.com: Cannot create a certificate with cacert.org
This site is using the <keygen> element to generate a keypair. This feature is deprecated. See https://www.chromestatus.com/features/5716060992962560
Screen Shot 2018-01-05 at 4.44.07 PM.png 22.1 KB
You received this message because:
1. You reported this issue
"Since Chrome 49, <keygen>'s default behaviour has been to return the empty string, unless a permission was granted to this page. Removed in Chrome 57."
"IE/Edge do not support <keygen> and have not indicated public signals to support <keygen>. Firefox already gates <keygen> behind a user gesture, but is publicly supportive of removing it. Safari ships <keygen> and has not expressed public views regarding its continued support."
keygen.png (22,621 bytes)
keygen.png (22,621 bytes)
Further information at https://developer.mozilla.org/en-US/docs/Web/HTML/Element/keygen
This feature has been removed from the Web standards. Though some browsers may still support it, it is in the process of being dropped. Avoid using it and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time."
Alternatives to <keygen>:
Other discussions about alternatives:
Generating keys still works for me with
Firefox 57.0.4 (64-Bit, Linux) installed in openSUSE Leap 42.3.
On Fri, 2 Feb 2018 10:29:41 +1100, Peter Yuill <peter AT NO SPAM c.o.> wrote at CAcert Board List:
I went through the process of generating keys and CSR in openssl then
submitting CSR through the advanced section of “New Certificate” and it
worked perfectly for me (using current Firefox). I have to say it is not a
simple solution and it certainly requires a much higher level of technical
skill than the browser solution, but it does work.
I did some research on possible tools to simplify the process and I have a
proposal. As far as I can see the browser route is dead, so we need to look
elsewhere. I am looking at the possibility of a desktop app that would
generate keys and CSR then connect to the cacert.org <http://cacert.org/>
site through a screen scrape library to submit the CSR and store the
certificate back in a local keystone. The one extra step required is to
import the certificate into browsers/mail clients, which should not be
difficult for most people. I am starting work on a cross-platform proof of
concept which I hope to be able to demonstrate in a few weeks.
"The browser route is dead" - indeed, so solutions running natively on the platforms are necessary.
A technical discussion thread was started here:
Supporting many platforms can be challenging. Because a simple solution is better than none, I'd prefer to have console-based scripts using on-board tools such as openssl (usually available for UNIX-style systems) or certreq (on standard Windows since many years - Vista?) as a baseline. Automating the CAcert certificate request page is not essential for the simple tool variant, where a graphical, more powerful and comfortable variant can complement it and doesn't need to cover platforms on an equal level or have the same robustness.
For UNIX-style systems I created a shell/openssl based solution as proof-of-concept here:
http://70t.de/download/ , file with pattern cacert_client_certificate_<date>.tar.xz (at time of writing cacert_client_certificate_2018-04-11.tar.xz )
Read more on cacert-devel starting here
I tried out cacert_client_certificate_2018-04-09.tar.xz. Thanks for creating it. I have a few suggestions/remarks about it.
Multiple inputs of a passphrase are required:
1. Unlock the key (from the file generated in the first task)
2. Set a passphrase for the new certifcate file
3. Repeat (confirm) the passphrase from 2. above
Input area (sequence of 3 passphrases): [1. Unlock key password]
Enter Export Password: [2. passphrase for new cert]
Verifying - Enter Export Password: [3. repeat 0000002]
The three numbered items should be explicitly numbered and named in each of the prompts that come after. The first prompt of "Input area (sequence of 3 passphrases): " does not indicate that you are supposed to type on the "passphrase to protect the generated key" when generating the RSA private/public key pair.
If ready, press enter to open the certificate with the browser for import.
In the case of Firefox 59.0.2 (64-bit), Ubuntu 16.04.4,
a dialog box will ask
What should Firefox do with this file?
(*) Open with [View file (default]
( ) Save File
[ ] Do this automatically for files like this from now on.
Questions about passphrase and labels eventually displays
the certificate details but is not imported. I had to go to Firefox's Certificate Manager and
manually [Import...] the newly created new_certificate_$USER.pfx file.
You will need to unlock the .pfx file with the
"Enter Export Password: [2. passphrase for new cert]" from above.
||Oops. That note should have gone to the mailing list where cacert_client_certificate_2018-04-09.tar.xz was posted. There is no edit/delete.|
|2016-10-03 17:31||Wiesshund||New Issue|
|2016-12-24 19:29||L10N||Note Added: 0005529|
|2016-12-28 10:43||L10N||Note Added: 0005534|
|2016-12-28 10:44||L10N||Priority||normal => high|
|2016-12-28 10:44||L10N||OS||Windows 10 Pro 64bit => Windows 10 Pro 64bit, Ubuntu|
|2016-12-28 10:44||L10N||Platform||PC Windows 10, IE11 Chrome and F => PC Windows 10, IE11 Chrome Firef|
|2018-01-07 08:41||L10N||Note Added: 0005569|
|2018-01-07 08:43||L10N||Note Added: 0005570|
|2018-01-07 09:00||L10N||File Added: keygen.png|
|2018-01-07 09:03||L10N||Note Added: 0005571|
|2018-01-07 09:49||L10N||Note Added: 0005572|
|2018-01-07 09:50||L10N||Priority||high => urgent|
|2018-01-07 09:50||L10N||Status||new => confirmed|
|2018-01-14 15:03||gukk_devel||Note Added: 0005574|
|2018-01-14 17:40||bjantzen||Note Added: 0005575|
|2018-02-10 10:05||L10N||Note Added: 0005576|
|2018-02-10 10:06||L10N||Tag Attached: certificates|
|2018-02-10 10:06||L10N||Tag Attached: browser|
|2018-02-10 10:06||L10N||Tag Attached: html|
|2018-04-18 21:23||dops||Note Added: 0005585|
|2018-05-02 23:32||RogerCPao||Note Added: 0005587|
|2018-05-02 23:35||RogerCPao||Note Added: 0005588|