Generating WebID?-watermarked X.509 Certificates for Use with ODS

Why use X.509 Certificates for Authentication?

Password-based authentication is inherently difficult to maintain, and presents an awkward option in the context of RESTful client/server interactions over local and wide area networks (LANs and WANs).

X.509 Certificates provide an elegant alternative which is more easily maintained, with a more streamlined user experience overall.

How are X.509 Certificates generated?

Thanks to its Virtuoso underpinnings, ODS possesses built-in functionality for generating X.509 Certificates with WebID? watermarks.

With ODS, certificate generation is typically done through a web browser. The specific process varies because each browser vendor has chosen their own approach to manage Certificates and their associated Private Keys.

Below, we cover certificate generation for several browsers, with keystore persistence handled variously by the host operating system or the Browser.

Certificate Generation & Keystore Management

Browser Generation OS-based Keystore Browser-based Keystore Notes
Chrome <keygen/> Y N
Firefox .NET-based browser plug-in Y N
Firefox <keygen/> N Y
IE OpenLink X.509 Certificate Generator plug-in Y N When using the user-friendly, Wizard-style interface of this plug-in, you (the issuer) must create a root CA certificate before generating any WebID?-watermarked certificates.
IE Windows-native generator Y
(Windows only)
N Best reserved for advanced users.
Opera <keygen/> N Y
Safari <keygen/> Y N

X.509 Certificate Generation Methods

Using ODS

Using Virtuoso Certificate Generation Wizard (Windows only)

Using Windows-Native Keystore

  1. View Local Machine KeyStore and enable a snap-in.
  2. Generate Certificate Guide.
  3. Import the generated Cert in ODS by pasting its content in the X.509 Certificate text-area presented at User Profile -> Edit -> Security -> X.509 Certificates tab page.

Using openssl

You can manually use OpenSSL? to generate the certificate, and then import that Certificate to ODS through its PEM Import UI. Then, both Certificate and Private Key must be imported into the OS- and/or browser-based keystore. Finally, the Cert results in Public Key and WebID? relation in Profile Graph.

Basic Steps

  1. Generate x.509 Certificate.
  2. Set up HTTPS Support in Virtuoso.
  3. Configure your ODS Account to use the WebID Protocol.
  4. Test the setup.

Browser-Specific Notes

OS-Specific Notes