5

Is this possible with JavaScript or PHP? I want to be able to detect if my private CA is installed on the user's iOS or Android device. From there I can decide whether to provide instructions for installation or not. I've been "googlin" and haven't found anything useful. Has anyone tried this before? I want to find out what I should spend my time learning. If it's not possible, could you suggest an in browser alternative?

EDIT : I don't have a choice here and it's not my decision. A private CA certificate is going to be used for other security reasons.

Jonny Sooter
  • 2,417
  • 1
  • 24
  • 40

2 Answers2

7

I doubt there will be any sort of device query to test this.

I haven't actually done this, but you could probably come up with a test where the JavaScript makes an AJAX request to an https server that uses the certificate you want to test for. If the request succeeds, then the certificate is working. (This question seems to imply that AJAX requests will (correctly) fail if the SSL certificate doens't validate)

Note that, because the scheme (http or https) of the URL will be different (and maybe the domain depending on how you set this up), your test site will have to use the CORS Access-Control-Allow-Origin header to allow the browser to make the request. See: AJAX calls to untrusted (self-signed) HTTPS fail silently

EDIT: I had some time and put together a very simple example. Goto http://ssl_test.gjp.cc . That page will attempt to make an AJAX request to https://ssl_test2.gjp.cc, which uses a self-signed certificate. Before you trusted ssl_test2, you will see "Failed" on the ssl_test page, however once you trust the certificate for ssl_test2, you should always see "Success" on ssl_test.

Note that this doesn't prove that your user has the CA cert installed - all it proves is that they have configured their browser to trust the test site (ssl_test2). If you never directly point the user to the test site, then they will never have the chance to trust only that site, so this should work reasonably well.

Community
  • 1
  • 1
George
  • 4,147
  • 24
  • 33
  • I'd add that just because the request worked does not mean the certificate has been installed. The user might as well be curious and manually accepted the screen message asking if he trusts the unknown certificate. Bottom line: Don't use private CA certs. – Sven Aug 27 '13 at 20:21
  • @Sven maybe you'd like to suggest an alternative? – Jonny Sooter Aug 27 '13 at 22:13
  • @Sven My answer describes using an AJAX request, will mobile browsers put up a message to accept the cert in that case? – George Aug 27 '13 at 23:41
  • @GeorgeP that's crazy! Last night I put together an almost identical example based on your answer before your edit. I was going to post it here but you've done it already. I'm going to try this on our stage servers and see the results. – Jonny Sooter Aug 28 '13 at 16:25
0

Maybe this will help :

<img src="https://the_site/the_image" onerror="redirectToCertPage()" />
btpka3
  • 3,720
  • 2
  • 23
  • 26