Clear SSL client certificate state from JavaScript

Question

I'm using client certificates in SSL sessions to authenticate users, but I'm having a bit of a problem with cached sessions. (I have configured IIS to accept—not require—client certificates.)

Normal situation:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, the user selects the desired certificate (and enters a PIN if needed), and everything goes forward as it should.

Situation where things don't work as expected:
A user accesses the page that asks for the certificate. The browser launches the certificate selector, and the user selects the desired certificate, but then cancels at the PIN dialog. The user is redirected to the previous page because no certificate was sent. The user tries to log in again, but the attempt automatically fails because the last SSL session was cached.

I solved this in IE using document.execCommand("ClearAuthenticationCache");, but it still doesn't work in FF or Chrome because they don't support the method. Is there any way to solve this?

Answer 1

You may be interested in this discussion and this Chromium issue. In particular, you should try:

if (window.crypto) window.crypto.logout();

Answer 2

For Chrome (at least in 19.0.1084.30 beta), it seems that, if you can set up a URL on the same hostname that requires a client certificate but rejects all certificates, then making a request to that URL will have the same effect as window.crypto.logout(). For example, if /ssl_logout/ is the specially-configured URL:

var xmlHttp = new XMLHttpRequest();
xmlHttp.onreadystatechange = function () {
    // put any actions to carry out upon logout here
};
xmlHttp.open( "GET", "/ssl_logout/", true );
xmlHttp.send();

(Using a page containing an iframe or img with src="/ssl_logout/" works, too.)