IE中自动安装根数字证书

阅读更多

 

IE中自动安装根数字证书

基本思路:

1、在XP、Windows 2003的IE上,通过XEnroll.dll控件来完成根数字证书的自动安装。

2、在Vista,Windows 2008,Windows 7 的IE上,需要使用CertEnroll.dll来自动完成根数字证书的自动安装。

3、XEnroll.InstallPKCS7只适用于自动安装根证书。XEnroll.acceptPKCS7 用于安装用户数字证书,但需要配合CSR(Certificate signing request)才能够使用。要实现自动安装用户证书:

在IE中:需要配合Enroll.createPKCS10CSR来生成CSR(Certificate signing request)

在Firefox中:需要配合使用html的keygen标签来生成CSR

4、如果只需要能够下载证书并安装,而不要在IE浏览器中完成证书注销、证书申请等功能,可以采用下载证书文件的方式,MIME Type可以采用

application/x-pkcs12、application/pkcs-12

几个与PKI证书相关的MIME Type:

application/x-x509-ca-cert、application/x-x509-user-cert、application/pkcs10、application/x-pkcs10、application/pkcs-12、

application/x-pkcs12、application/x-pkcs7-signature、application/pkcs7-mime、application/x-pkcs7-mime、

application/pkcs7-mime、application/x-pkcs7-mime、application/x-pkcs7-certreqresp、application/pkcs7-signature

  测试代码:
 
   
<%@ page language="java" import="java.util.*" pageEncoding="GBK"%>
<%@ page import="java.lang.*,java.io.*" %>
<html>
<head>
<title>IE中自动安装数字证书测试title>
head>

<body>
IE中使用XEnroll.InstallPKCS7自动安装根数字证书<br/>
 备注:这里测试的根证书采用Base64编码 X.509格式(CER)<br/>
<%

StringBuffer server_cert =new StringBuffer();
try {
    String realPath = this.getClass().getClassLoader().getResource("liangchuan.cer").getPath();
    File file = new File(realPath);
    if (!file.exists()) {
        out.println("

"); out.println("

根证书文件不存在


"
); out.println("

"
); out.flush(); out.close(); }else{ BufferedReader bf=new BufferedReader(new FileReader(file)); String line=null; while((line=bf.readLine())!=null) server_cert.append(line); bf.close(); } }catch(Exception e){ out.println("

"); out.println("

读取证书文件出错


"
); out.println(e.toString()); out.println("

"
); out.flush(); out.close(); } String Agent = request.getHeader("User-Agent"); StringTokenizer st = new StringTokenizer(Agent,";"); st.nextToken(); String userBrowser = st.nextToken(); String userOS = st.nextToken(); out.println("你的操作系统为:"); out.println(userOS); String activexLib="XEnroll"; //检查是否是Windows Vista,Windows 2008,Windows 7,在Vista,Windows 2008,Windows 7上,需要使用 CertEnroll.dll //Windows 2008 Server, IE7 User-Agent header: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.2;... //Windows Vista, IE7 User-Agent header: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;... //Windows 7,IE8 User-Agent header: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1;... if(userOS.equals("Windows NT 6.0") || userOS.equals("Windows NT 6.1")|| userOS.equals("Windows NT 5.2")) activexLib="CertEnroll"; String sPKCS7=server_cert.toString(); %> <% if(activexLib.equals("XEnroll")) { %> <object id="XEnroll" classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="xenroll.dll">object> <SCRIPT language="VBSCRIPT"> ON ERROR resume next sPKCS7 = "<%= sPKCS7 %>" //XEnroll.InstallPKCS7用于安装根证书。 XEnroll.InstallPKCS7(sPKCS7) if err.Number <> 0 then if err.number = -2146885628 then MsgBox "Keyset does not exist" else MsgBox "证书下载时出错,错误号="&err.description end if else MsgBox "证书已成功装入" end if script> <% } else {%> //方法来源: //http://blogs.msdn.com/alejacma/archive/2009/01/28/how-to-create-a-certificate-request-with-certenroll-javascript.aspx //Vista下由于暂时没有测试环境,方法尚待验证 <object id="objCertEnrollClassFactory" classid="clsid:884e2049-217d-11da-b2a4-000e7bbb2b09">object>

你可能感兴趣的:(ie自动安装根证书)