RTCPeerConnection.generateCertificate() static function

The static RTCPeerConnection.generateCertificate() function creates an X.509 certificate and corresponding private key, returning a promise that resolves with the new RTCCertificate once it's generated.

Syntax

let certPromise = RTCPeerConnection.generateCertificate(keygenAlgorithm)

Parameters

keygenAlgorithm

A Web Crypto API AlgorithmIdentifier string or an Algorithm -subclassed object specifying an algorithm to use when creating the certificate's key.

Return value

A promise which resolves to a new RTCCertificate object containing a new key based on the specified options.

Exceptions

NotSupportedError DOMException

Thrown if the normalized form of keygenAlgorithm specifies an algorithm or algorithm settings that the browser doesn't support, or which it does not allow for use with an RTCPeerConnection.

Other errors may occur; for example, if the specified keygenAlgorithm can't be successfully converted into an RTCCertificateExpiration dictionary, the error that occurs during that conversion will be thrown.

Description

If a string is specified, it must be a Web Crypto API-compatible algorithm name string. Alternatively, you can provide specific details for the algorithm's configuration by providing an object based on one of the Web Crypto API's Algorithm class's subclasses.

Standard configurations

All browsers are required to support the following two configurations. It's entirely possible that a browser's default settings may be different, but these are always supported.

RSASSA-PKCS1-v1_5

let stdRSACertificate = {
  name: "RSASSA-PKCS1-v1_5",
  modulusLength: 2048,
  publicExponent: new Uint8Array([1, 0, 1]),
  hash: "SHA-256"
};

ECDSA

let stdECDSACertificate = {
  name: "ECDSA",
  namedCurve: "P-256"
};

Certificate expiration time

By default the new certificate is configured with expires set to a DOMTimeStamp value of 2592000000, or 30 days. The expiration time cannot exceed 31536000000, or 365 days. It's also useful to note that browsers may further restrict the expiration time of certificates if they choose.

Examples

Specifying algorithm details

This example requests a new RSASSA-PKCS1-v1_5 certificate using a SHA-256 hash and a modulus length of 2048.

RTCPeerConnection.generateCertificate({
    name: 'RSASSA-PKCS1-v1_5',
    hash: 'SHA-256',
    modulusLength: 2048,
    publicExponent: new Uint8Array([1, 0, 1])
}).then(function(cert) {
  var pc = new RTCPeerConnection({certificates: [cert]});
});

Specifying an algorithm by name

The example below specifies a string requesting an ECDSA certificate.

RTCPeerConnection.generateCertificate("ECDSA");

Specifications

Browser compatibility

See also

• WebRTC API
• Web Crypto API
• Web site security
• Web security
• Symmetric-key cryptography
• crypto