浏览器自动安装证书

微软的ICEnroll接口提供了证书的安装功能。可以通过该接口的InstallPKCS7方法把按base64编码的根证书字符串安装到用户的机器上。
例子：

<? php
$certname   =   " server.crt " ;         // 要安装的证书，由openssl生成
$fp   =   fopen ( $certname ,   " r " );
$cert   =   fread ( $fp ,   filesize ( $certname ));
fclose ( $fp );

$newcert   =   " sPKCS7 = "" " ;
$line   =   strtok ( $cert ,   " " );
while ( $line ) {
     $newcert   =   $newcert   .   "     sPKCS7 = sPKCS7 & " "   .   $line   .   " " & vbcrlf " ;
     $line   =   strtok ( " " );
}
?>

< html >
< object  id = " XEnroll "  classid = " clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1 "  codebase = " xenroll.dll " ></ object >
< script Language = " VBScript " >
ON ERROR resume  next
<? php  echo   $newcert ;  ?>
XEnroll . InstallPKCS7 sPKCS7
If  err . number   =   438  then
    msgbox  " install root certificate fail . "
Elseif  err . number   <>   0  then
    msgbox  " install root certificate fail . "
Else
    msgbox  " install root certificate success . "
End   if
</ script >
</ html >

最简单的是提供server.crt下载，让用户自己安装。