Overview

Web Certificate API defines the request and response parameters and processed between user agent and RA/CA service providers

The following figure illustrates the operational flow of certificate menagement. The UA always requests one of the certificate management operation to a CA server by sending a request message. CA server then processes the request message and sends the result of oepration in a response message back to the UA. The UA handles the response message to retrieve the status and a certificate if necessary and then it optionally sends a confirmation message to CA server to notify the end of an operation.

CertMessage interface

CertMessage is the object that will contain a return value when the request of cmp is generated. The message contained in this object is sent to CA server for certificate oepration.

		
Interface CertMessage { 
        readonly attribute any msgType;
        readonly attribute any msgID;
        readonly attribute any message:
};

msgType - this indicates which certificate oepation is contained in this message.
msgID - identifier that identify any related messages during oepration
message - text based message that is encoded according to msgType
        	
		

CertResult interface

CertResult is the object that will contain a return value when the response of cmp is received from a CA Server. This object contains the result of CA operation that is requested by UA.

		
Interface CertResult { 
	readonly attribute any status;
	readonly attribute any msgID;
	readonly attribute any certificate:
};

status - this indicates the result of CA operation requested by UA.
msgID - identifier that identify any related messages during oepration
certificate - a certificate that is issued or updated by CA server
		
		

Cert interface

Cert is the object that requests a certificate operation to CA server and handles a response message from the server.

			
enum ReqType {
	// RFC 4210 Certificate Management Protocol.
	"cmp",
	// Certificate Management protocol using CMS.
	"cmc",
	// PKCS#10 type Certificate signing request.
	"pkcs10",
};


Interface Cert {
	CertMessage requestCert (ReqType reqType, KeySpec keySpec, DOMString refCode, DOMString authKey);
	CertMessage updateCert (ReqType reqType, KeySpec keySpec, DOMString certID, DOMString keyPass);
	CertMessage revokeCert (ReqType reqType, DOMString certID, DOMString keyPass);
	CertResult handleResp (CertMessage certMessage);
	CertMessage genConfirm (DOMString msgID, DOMString certID, DOMString keyPass);
}
			
		

Input parameters:

ReqType - { "cmp", "cmc", "pkcs10", …}
keySpec - keyAlgorithm, keyLength, keyParameter, priKey, pubKey 
	- priKey and pubKey should be null if key is generated in genCertReq
authKey - initial authentication key for origin of message
refCode - reference code to identify a user to request certificate

Return value:

CertMessage - this can be ASN.1 encoded initial request message if CMP is used.
					

Input parameters:

ReqType - { "cmp", "cmc", "pkcs10", …}
keySpec - keyAlgorithm, keyLength, keyParameter, priKey, pubKey 
	- priKey and pubKey should be null if key is generated in updateCertReq
certID - identifier to locate a issued certificate and related private key in a storage
keyPass - a password to decrypt an encrypted private key

Return value:

CertMessage - this can be ASN.1 encoded key update request message if CMP is used.
					

Input parameters:

ReqType - { "cmp", "cmc", "pkcs10", …}
certID - identifier to locate a certificate and private key in a storage
keyPass - a password to decrypt a encrypted private key

Return value:

CertMessage - this can be ASN.1 encoded key revocation request message if CMP is used.
					

Input parameters:

CertMessage - this can be ASN.1 encoded response message sent from CA server if CMP is used.

Return value:

CertResult - this is the result of cert oepration carried out in CA server.

					

Input parameters:

msgID - message identifier that this message confirms
certID - identifier to locate a certificate and private key in a storage
keyPass - a password to decrypt a encrypted private key

Return value:

CertMessage - this can be ASN.1 encoded key revocation request message if CMP is used.					

Certificate Chain Validation

certificate chain validation validate certificate chains up to the trusted RootCA.

Certificate CRL Validation

when validating certificate, certificate revocation list will be optionally checked.

Certificate OCSP Validation

Online Certificate Status Protocol(OCSP) can be optionally used to validate certificate.

Same-Origin Policy

Same Origin Policy is base security policy of WebCrypto API

to keep the backward compatibility, some conditional exceptions are required but it does not mean the multiple connections to multiple origins

the exceptions are only for accessing private keys that is binded to some origin initiated from different origin when the faired certificate is valid

the exceptions of same-origin policy can be allowed by following conditions

• private key access binded to valid certificate
• the certificate issued by valid CA
• the CA is listed in trusted CA list of user agent

Certificate KeyStorage

Certificate KeyStorage should be interoperable with existing TLS Key Storage

to keep the backward compatibility, when the certificate is installed into user agent, it will be listed in TLS Key Storage of user agent

but the certificate operations will be restricted by the KeyUsage defined in certificate inside.

when the certificate and private key pair is inserted via PKCS#11 interface into TLS Key Storage, it also can be used by webcrypto API with valid KeyUsage