Chrome Certificate Selection Appears Multiple Times

Chrome Certificate Selection appears multiple times

Found it:

This question mentions the configuration I want. But it doesn't say how to use it.
I found that this page here, explains how to configure policies for Chrome/Chromium. Now, in Chrome discussion forum (here), I found that in Linux both Chrome and Chromium use the same policy dir (/etc/opt/chrome/policies/managed). If you put a valid policy file there it will load it. So double check for validity. It got to be json formated as the template exemplifies. Because of that, remember that it's name ends with .json extension.
Now we can use the policy mentioned in the aforementioned question. Put this configuration in the policy file:

{
    "AutoSelectCertificateForUrls": ["{\"pattern\":\"*\",\"filter\":{\"ISSUER\":{\"CN\":\"<Your issuer CN>\"}}}"],
}

you obviously substitute <Your issuer CN> with the correct CN in your certificate.

Restart Chrome, and you're done.
To check if the policy was correctly loaded by Chrome/Chromium you can use the following url: chrome://policy

How to stop Chrome's Select a certificate window?

Chrome Version 59.0.3071.86 (64-Bit), Win 7 Enterprise:

Create registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\AutoSelectCertificateForUrls  

Here create new String value (REG_SZ) with name 1

As Value data enter:

{"pattern":"[*.]","filter":{}}

This is how the registry then looks like.

For more information on this key I found:

The value must be an array of stringified JSON dictionaries. Each dictionary must have the form { "pattern": "$URL_PATTERN", "filter" : $FILTER }, where $URL_PATTERN is a content setting pattern. $FILTER restricts from which client certificates the browser will automatically select. Independent of the filter, only certificates will be selected that match the server's certificate request. If $FILTER has the form { "ISSUER": { "CN": "$ISSUER_CN" } }, additionally only client certificates are selected that are issued by a certificate with the CommonName $ISSUER_CN. If $FILTER is the empty dictionary {}, the selection of client certificates is not additionally restricted.

on Automatically select client certificates for these sites

Chrome Version 87.0.4280.141 (64-Bit), Win 10 Enterprise:

Create registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\AutoSelectCertificateForUrls  

Here create new String value (REG_SZ) with name 1

As Value data enter:

{"pattern":"[*.]mycompany.com","filter":{"ISSUER":{"CN":"MyCompanyCA"}}}

MyCompanyCA and the subdomain mycompany.com must be replaced with your corresponding url and issuing company.

Forget which client certificate is used by Chrome for an URL

Restarting the browser will help and ask you again.
Looking forward to see better solutions.

How Chrome browser know which client certificate to prompt for a site?

The client certificate authentication is ruled in the handshake phase of the SSL/TLS protocol implemented by browsers.

1. If the server requires a client certificate authentication (it is
   optional), send a message to client with the list of the accepted
   certificate authorities (CA). Can be void if server accepts any
   certificate.

2. The client select the certificates installed in client keystore which have been issued by any of these CA's, and present the list to user. In case of Chrome, the browser selects the certificates installed by user from the operating system's Key Store.

3. User choose a certificate, and the client performs a signature with the private key of the certificate over a known data interchanged during handshake.

Only certificates with private key can be selected during step 2. This is the reason by with the browser does not select the certificates of trusted CA's installed in your device. You do not own the private key

selenium chrome driver select certificate popup confirmation not working

I had the same problem and I was able to solve it by using the robot, creating function for the url and passing it to a different thread.

    Runnable mlauncher = () -> {
    try {

      driver.get(url);
     } catch (Exception e) {
          e.printStackTrace();
       }
    };

public void myfunction {
 try {

   Thread mthread = new Thread(mlauncher);
   mthread.start

  robot.keyPress(KeyEvent.VK_ENTER);
  robot.keyRelease(KeyEvent.VK_ENTER);

 } catch (Exception e) {
          e.printStackTrace();
       }

Prevent browser from prompting for client certificate for IIS app

1. Open IIS and navigate to your web site or application and go to the SSL settings

   

2. Set the Client Certificate setting to "Ignore"

   

   Both 'Accept' and 'Require' will both challenge for a client side cert

3. Recycle your app pool and re-launch your browser to test

Note: SSL settings are inherited from your Site > Application, so you may need to apply these SSL Settings at multiple levels

Further Reading:

• Why does google chrome prompts to "select a certificate to authenticate yourself"
• How to prevent browser from prompting for a client certificate and allow the IIS to accept it (not require it)?

---

Related Topics