Subject: Creating client certificate in IE browser using xenroll.dll

From: "Sreenivasa Baddam" <[email-masked]>
Date: Mon, 14 Jul 2003 06:35:42 -0700

> Hi All,
>   I am trying to generate a public key in the client using IE browser with the active-x control xenroll.dll using the following code got from the link http://www.pseudonym.org/ssl/ssl_cook.html (a good one).  The link used certenroll.dll but since new versions of IE are using xenroll.dll, I changed in the code from certenroll to xenroll.  But still I am not able to generate it.  The error I am getting is:'Object doesn't support this property or method'.  The reason I judged is that 'GenerateKeyPair' method signature is not the right one.  
>   I searched in the internet as well as the microsoft dev site but couldn't able to get the right solution.  Anyone out there faced this kind of problem or any suggestions as to how to get the method signatures in a dll file would be greatly appreciated.
> 
> Thanks,
> Sreeni
> 
> Here is the whole code, you can run it on your own machine too & see it. 
> ############################
> <HTML><HEAD><TITLE>Client Certificate Request</TITLE></HEAD><BODY>
> 
> <!-- Use the Microsoft ActiveX control to generate the certificate -->
> <OBJECT CLASSID="clsid:33BEC9E0-F78F-11cf-B782-00C04FD7BF43"  CODEBASE=xenroll.dll ID=certHelper>
> </OBJECT>
> 
> <!-- JavaScript or Visual Basic will work. -->
> <SCRIPT LANGUAGE="JavaScript">
> <!---
> 
> // this is from JavaScript: The Definitive Guide, since
> // Microsoft implementation of Math.random() is broken
> //
> function random() {
>     random.seed = (random.seed*random.a + random.c) % random.m;
>     return random.seed/random.m;
> }
> random.m = 714025; random.a = 4096; random.c = 150889;
> random.seed = (new Date()).getTime()%random.m;
> 
> function GenReq ()
> {
>     var sessionId		= "a_unique_session_id";
>     var reqHardware     	= 0;
>     var szName          	= "";
>     var szPurpose       	= "ClientAuth";
>     var doAcceptanceUINow   	= 0;
>     var doAcceptanceUILater	= 0;
>     var doOnline        	= 1;
>     var keySpec = 1;
> 
>     szName = "";
>     
>     if (document.GenReqForm.commonName.value == "")
>     {
> 	alert("No Common Name");
> 	return false;
>     } 
>     else
>      szName = "CN=" + document.GenReqForm.commonName.value;
> 
>     if (document.GenReqForm.countryName.value == "")
>     {
> 	alert("No Country");
> 	return false;
>     }
>     else
> 	szName = szName + "; C=" + document.GenReqForm.countryName.value;
> 
>     if (document.GenReqForm.stateOrProvinceName.value == "")
>     {
> 	alert("No State or Province");
> 	return false;
>     }
>     else
> 	szName = szName + "; S=" + document.GenReqForm.stateOrProvinceName.value;
> 
>     if (document.GenReqForm.localityName.value == "")
>     {
> 	alert("No City");
> 	return false;
>     }
>     else
> 	szName = szName + "; L=" + document.GenReqForm.localityName.value;
> 
>     if (document.GenReqForm.organizationName.value == "")
>     {
> 	alert("No Organization");
> 	return false;
>     }
>     else
> 	szName = szName + "; O=" + document.GenReqForm.organizationName.value;
> 
>     if (document.GenReqForm.organizationalUnitName.value == "")
>     {
> 	alert("No Organizational Unit");
> 	return false;
>     }
>     else
> 	szName = szName + "; OU=" + document.GenReqForm.organizationalUnitName.value;
> 
>     /* make session id unique */
>     sessionId = "xx" + Math.round(random() * 1000); 
>     alert('sz10='+sz10);
>     sz10 = certHelper.GenerateKeyPair(sessionId, reqHardware, szName,
>                                       0, szPurpose, doAcceptanceUINow, 
>                                       doOnline, keySpec, "", "", 1);
> 
>     /*
>      *
>      * The condition sz10 being empty occurs on any condition in which the
>      * credential was not successfully generated. In particular, it occurs
>      * when the operation was cancelled by the user, as well as additional
>      * errors. A cancel is distinguished from other unsuccessful
>      * generations by an empty sz10 and an error value of zero.> 
>      *
>      */
> 
>     if (sz10 != "")
>     {
> 	document.GenReqForm.reqEntry.value = sz10;
>      document.GenReqForm.sessionId.value = sessionId;
>     } else {
> 	alert("Key Pair Generation failed");
> 	return false;
>     }
> }
> 
> //--->
> </SCRIPT>
> 
> <CENTER><H3>Generate key pair and client certificate request</H3></CENTER>
> 
> <FORM METHOD=POST ACTION="http://www.pseudonym.org/cgi-bin/ms_key.pl" NAME="GenReqForm"  onSubmit="GenReq()">
> <TABLE>
> <TR><TD>Common Name:</TD><TD>
> <INPUT TYPE=TEXT NAME="commonName" VALUE="Client Certificate" SIZE=64>
> 
> </TD></TR><TR><TD>Country:</TD><TD>
> <INPUT TYPE=TEXT NAME="countryName"  VALUE="US" SIZE=2>
> 
> </TD></TR><TR><TD>State or Province:</TD><TD>
> <INPUT TYPE=TEXT NAME="stateOrProvinceName" VALUE="MA">
> 
> </TD></TR><TR><TD>City:</TD><TD>
> <INPUT TYPE=TEXT NAME="localityName" VALUE="Cambridge">
> 
> </TD></TR><TR><TD>Organization:</TD><TD>
> <INPUT TYPE=TEXT NAME="organizationName" VALUE="The Open Group">
> 
> </TD></TR><TR><TD>Organizational Unit:</TD><TD>
> <INPUT TYPE=TEXT NAME="organizationalUnitName" VALUE="Research Institute">
> 
> </TD></TR></TABLE>
> 
> <INPUT TYPE=HIDDEN	NAME="sessionId">
> <INPUT TYPE=HIDDEN	NAME="reqEntry">
> 
> <INPUT TYPE="SUBMIT" name="SUBMIT">
> </FORM>
> 
> </BODY></HTML>
> 
> 
> 
> 
>

---

From: "Ryan M. Hurst" <[email-masked]>
Date: Mon, 14 Jul 2003 13:30:46 -0700

Take a look at ICEnroll/ICEnroll2/ICEnroll4 on MSDN they implement the
interfaces you want.

Ryan M. Hurst
Program Manager
Windows Trusted Platform Infrastructure
Microsoft Corporation

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
On Behalf Of Sreenivasa Baddam
Sent: Monday, July 14, 2003 6:36 AM
To: [email-masked]
Subject: Creating client certificate in IE browser using xenroll.dll

> Hi All,
>   I am trying to generate a public key in the client using IE browser
with the active-x control xenroll.dll using the following code got from
the link http://www.pseudonym.org/ssl/ssl_cook.html (a good one).  The
link used certenroll.dll but since new versions of IE are using
xenroll.dll, I changed in the code from certenroll to xenroll.  But
still I am not able to generate it.  The error I am getting is:'Object
doesn't support this property or method'.  The reason I judged is that
'GenerateKeyPair' method signature is not the right one.  
>   I searched in the internet as well as the microsoft dev site but
couldn't able to get the right solution.  Anyone out there faced this
kind of problem or any suggestions as to how to get the method
signatures in a dll file would be greatly appreciated.
> 	szName = szName + "; S=" +
document.GenReqForm.stateOrProvinceName.value;
> 	szName = szName + "; O=" +
document.GenReqForm.organizationName.value;
> 	szName = szName + "; OU=" +
document.GenReqForm.organizationalUnitName.value;