PKI Agent

PKCS1 Signatures in Your Browser

PKI Agent bridges the gap between system certificates and browsers. With PKI Agent, you can sign web application data in your browser using the certificates in your machine's local store.

If you are building a web application solution that requires user signatures, your users are not able to cryptographically sign data in their browser by default. This is due to the gulf between the browser sandbox and the system store where cryptographic certificates reside. In order for your users to to sign your web application data according to global cryptography standards like PKCS#1, you need a solution like PKI Agent to bridge the gap.

PKI Agent's narrow scope helps ensure it integrates seamlessly with your larger solution. The tool simply generates a PKCS#1 signature with a user-selected certificate for any arbitrary data in a user's browser, then provides the browser access to this signature so that it can communicated to a web application. The broader web application solution can handle or process this signature data according to whatever logic is appropriate.

THe PKI Agent UI provides users with the ability to select certificates from the local store to expose within PKI Agent's virtual layer. PKI Agent hosts a REST API on localhost that the browser can query when it needs a signature for some arbitrary data. PKI Agent processes the REST request, prompts the user to choose an available certificate, generates a PKCS#1 signature, and returns this signature data to the browser.

Example: Signing PDFs

Most in-browser PDF signatures are merely an agreement to trust a third party like DocuSign. To instead sign the PDF cryptographically following universal standards like PCKS#1, the user needs to access system certificates via a tool like PKI Agent.

With PKI Agent, developers can build web applications that allow users to sign PDF data cryptographically to ensure confirmation, trust, and non-repudiation. These signatures do not require the use of an external signature authority, but rather allow users to choose a local certificate to create a digital signature.

Since PKI Agent is a general-purpose signing tool, it is up to the developer of the web application to integrate the signature data from PKI Agent into a broader solution like a PDF signature platform. PKI agent does not determine how the web application should append the signature data to the PDF data, nor does it impose any restrictions on how the signature is used.

Online Resources

• In-Browser Demo
• Getting Started Guides:
• Getting Started with PKI Agent
• Online Documentation
• Knowledge Base
• Software License