Took a look at this. Seems pretty good, so ACK, with a concern or two. I think we might want to consider seeing if we can somehow short circuit the display to something that won't let them send to the server, when we know we don't even have the keygen tag available. So if tested to work with Firefox and Chrome, etc, ACK once again. ----- Original Message ----- From: "Matthew Harmsen" <mharmsen@redhat.com> To: "pki-devel" <pki-devel@redhat.com> Cc: "Jack Magne" <jmagne@redhat.com> Sent: Thursday, May 12, 2016 3:45:11 PM Subject: [PATCH] Added Chrome keygen warning While testing chrome, we discovered that (a) keygen would soon not be supported: * https://groups.google.com/a/chromium.org/forum/#!topic/security-dev/pX5NbX0X... (b) although keygen is still supported, it has been disabled by default with a workaround provided to re-enable it: * https://support.quovadisglobal.com/kb/a470/deprecation-of-keygen-tag-in-chro... Please review the attached patch which supplies a warning message and instructions on how to re-enable keygen on Chrome browsers that support this: * PKI TRAC #2323 - Firefox Warning appears in EE page launched from within Chrome <https://fedorahosted.org/pki/ticket/2323> Additionally, an attempt was made to identify the case when KeyGen would not be available on Firefox and Chrome. -- Matt