X-Git-Url: https://sipb.mit.edu/gitweb.cgi/wiki.git/blobdiff_plain/26a26b730c55a32189026050029f7ae1cf0a9049..a8e1835c8fad770505eb24715fa15aa543656286:/doc/enabling_client_certificate_auth_in_chrome.html diff --git a/doc/enabling_client_certificate_auth_in_chrome.html b/doc/enabling_client_certificate_auth_in_chrome.html index 1990896..72cd190 100644 --- a/doc/enabling_client_certificate_auth_in_chrome.html +++ b/doc/enabling_client_certificate_auth_in_chrome.html @@ -1,32 +1,19 @@ -
So, you want to run Chrome (or Chromium), but you're annoyed by the lack of client certificate authentication on Linux. -Turns out, this is relatively easy to solve, there's just no GUI for it as of yet. (As of 12/3/2009.) -As far as I know, this only works with the daily build from the chromium-daily ppa on Launchpad. -It might work on the official chrome build, if it works, please tell us. -If you're running Debian or Ubuntu, you can add "deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main" to your -/etc/apt/sources.list and then apt-get update. --
The simplest thing to do is go to the usual web interface and follow the instructions to install certs normally. -You may also want the CSAIL CA (specifically, the Master CA). -If this works, you should be able to skip to telling chrome to use certificate by default - -Failing that, the next easiest way to install a client cert in the nss database is simply to install it on Firefox; -At that point, it should be in the list of certificates you get when you run "certutil -d sql:$HOME/.pki/nssdb -L". - -
Otherwise, you want to look at the the instructions at -Google's page on LinuxCertManagement to install the MIT CA. If you're -running Debian or Ubuntu, the short version of that LinuxCertManagement page is -to install libnss3-tools, then run "certutil -d sql:$HOME/.pki/nssdb -A -t -"C,," -n -i " for both the MIT CA and (if you want it) the CSAIL CA.- - -
Here's the last key to the puzzle: Chrome on Linux currently lacks a UI for selecting a certificate, so run it with the --auto-ssl-client-auth flag.
-To do this by default in Gnome, you want to edit both Preferred Applications and the Main Menu entry -this way links you click on outside of Chrome open this way. (Gnome Do and similar pull their data from Main Menu, among other places.) -Once you've done this, you can check your work with this demo page. If everything is working, it should welcome you by name, and tell you that a certificate for your username is installed.- -
While not strictly necessary for client authentication, most MIT users will want to add the MIT CA to the list of trusted CAs. You may also want the CSAIL CA (specifically, the Master CA). On Windows or Mac OS X, downloading the file and opening it should be sufficient. If you've already configured this for Internet Explorer or Safari, respectively, you may skip this step; Chrome uses the system certificate store.+ +
On Linux, however, Mozilla Firefox uses a private certificate store instead of the system NSS one. There is no system interface for adding certificates, but recent versions of Chrome provide one. Download the MIT or CSAIL CA linked above. Then press the wrench and go to Settings | Advanced Settings | Manage Certificates. Under the Authorities tab, press Import... and select the certificate you just downloaded.+ +
You can also use the NSS command-line tools to manage your certificates. If you're running Ubuntu or Debian, install the package libnss3-tools. To trust the MIT CA for SSL, download the file and run+ +
certutil -d sql:$HOME/.pki/nssdb -A -t "C,," -n "MIT CA" -i path/to/mitca.crt
For more information, see Mozilla's documentation on certutil.+ +
As of Chrome 7, the standard workflows should work without workarounds. Visit the usual web interface and follow the instructions to install certs normally. You can check your work with this demo page. If everything is working, it should welcome you by name, and tell you that a certificate for your username is installed.+ +
While NSS does allow you to configure your certificate store to use smart cards or protected by a password, Chrome does not support this yet. Star bug #42073 to receive updates.