Java plugin replacement for digital signatures

Question

We have a custom Java applet that performs certain tasks, like loading a PDF from local filesystem, signing it with certificates from system KeyStore/smart card etc. Such actions are not possible in regular HTML/JavaScript. Now that Java is being deprecated across browsers, we are looking for possibilities to replace the applet functionality.

There is this Web Cryptography API, but unfortunately the spec does not cover using system keystore. There is another spec for this, WebCrypto Key Discovery, but I don't think it is currently supported by any browser.

Mozilla had an API that might be exactly what we need, but unfortunately it is deprecated now.

So it looks like our only options are:

Write a custom desktop GUI app
Write a custom browser plugin

Or is there some better solution? What do you suggest? I don't care if the solution would be only for Internet Explorer since most of our users use.

If you really can focus on MSIE only then custom ActiveX is IMO the best choice. — jariq, Dec 14 '16 at 13:48
@Martin S Did you implement any solution? I have the same problem and will be thankful if you help me — Hana Bzh, May 09 '17 at 08:43
Working solution using Signer.Digital Browser Extension is given in SO Answer https://stackoverflow.com/a/55676351/9659885 — Bharat Vasant, Aug 30 '19 at 10:50

score 2 · Accepted Answer · edited May 23 '17 at 11:54

Due to Java restrictions on browsers is not possible in general to use the OS native Key Store. You still can use Java in old versions of IE and Firefox, but Oracle has announced that will discontinue JRE plugin for browser, and Firefox decided to drop java support in 2017, so it is not recommended

Write a browser plugin is not possible because browsers do not allow access to several OS functions. In particular Chrome plugin API only allow access to user certificates in Chrome OS, not in Windows or Linux. For Edge, I think the plugin interface is not available yet.

There are some alternatives

Use WebCryptographyApi to load a software certificate. See How to load a PKCS#12 Digital Certificate with Javascript WebCrypto API
Use chrome messaging api (Estonian solution). See https://stackoverflow.com/a/29806091/6371459
Use a local application connected through javascript (Spanish solution) See https://stackoverflow.com/a/38658414/6371459

I personally have tested the first and the last options. For Estonian solution, I suggest to contact with the team. I think the currently support only some smartcards

Java plugin replacement for digital signatures

1 Answers1

Linked