Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script.
so by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key.
it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself.
(note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).
Comments
You can. It's called Javascript and there are libraries to do public key encryption.
But yes, here you are right, the cert is generated by the server in this case.
Until DomCrypt[1] is implemented there is no reliable way to implement a CSPRNG in Javascript (that I am aware of!). The only way to do this securely would be to supply a page that includes some javascript to process a secret key that the user provides to the page which would then generate the CSR. It would be more effective to write all of this sites functionality into a shell script.
[1] http://www.w3.org/TR/WebCryptoAPI/
I did a CSPRNG in Javascript using mouse movements for entropy: https://github.com/fusionbox/mouseware
I don't see a detailed analysis of your RNG that would support the claim that it is suitable for use as a CSPRNG.
so by doing that you're still trusting the server not to send you evil Javascript that surreptitiously posts off your private key.
it's exactly equivalent from a security perspective, unless you read every line of Javascript, in which case you might as well read the openssl manual instead and generate the CSR yourself.
(note that there's a rarely used <input> keygen type, but to sign the CSR you'd need programmatic access to the private key, again defeating any security properties).