Log in without passwords — with a certificate anchored in the Emercoin blockchain

emerSSL is a decentralized login system. Your browser presents a client certificate; the website checks its fingerprint against a record in the Emercoin blockchain. No central authority, nothing to leak on the server, and an optional InfoCard with your profile data.

Check your certificate

This page asked your browser for an emerSSL certificate when it opened.

Checking…

Installed a certificate but your browser did not offer it? Restart the browser (it remembers the choice per site) and reopen this page. From a terminal: curl --cert you.crt --key you.key https://emerssl.emercoin.com/api/check?format=text

How it works

1. Certificate
You generate a key pair and a certificate with a random 64-bit serial number. The private key never leaves your device.

2. Blockchain record
You store ssl:<serial> = sha256=<certificate fingerprint> in Emercoin NVS. Only you can update or revoke it.

3. Login
The site receives your certificate over TLS, looks up the record and compares fingerprints. Match → you are identified by your Emercoin address.

An optional InfoCard (name, e-mail, addresses…) is stored encrypted as info:<key>; the certificate's UID field carries info:<key>:<password>, so only sites you log in to can read it. Cards can import parent cards (for example, a company card).

Get a certificate

Emercoin Core wallet: tab Manage Names → SSL creates the certificate and the blockchain record in one go.

Shell scripts: github.com/emercoin/emcssl — gen_tpl.sh / gen_crt.sh for the certificate, info_crypt.sh for an InfoCard (examples: infocard_example*.info). Import the resulting .p12 into your browser.

Certificates use ECDSA by default; if your OS cannot import ECDSA client certificates, generate an RSA one: ./gen_crt.sh your_template.tpl RSA.

Add emerSSL login to your site

Ask the browser for a client certificate (no verification by CA — the blockchain is the trust anchor), then check the fingerprint against your own Emercoin node.

Caddy

example.com {
	tls {
		client_auth {
			mode request   # ask for a certificate, accept any issuer
		}
	}
	reverse_proxy 127.0.0.1:8000 {
		header_up X-Client-Cert {http.request.tls.client.certificate_der_base64}
	}
}

nginx

ssl_verify_client      optional_no_ca;
ssl_client_certificate /etc/nginx/emcssl-ca.crt;   # EC + RSA CA: browser offers only emerSSL certs
proxy_set_header       X-Client-Cert $ssl_client_escaped_cert;   # PEM, URL-encoded

Caddy (Go) cannot load the EC CA (curve secp256k1), so it cannot send the "emerSSL only" hint for EC certificates; this site works around it with a P-256 stand-in certificate that has the same name.

The check (Python; any language with JSON-RPC will do)

import hashlib
key = "ssl:" + format(cert.serial_number, "x").rjust(16, "0")   # serial must be 16 hex digits
rec = rpc("name_show", [key])            # your Emercoin node
algo, fp = rec["value"].splitlines()[0].split("=", 1)
ok = rec["expires_in"] > 0 and hashlib.new(algo, cert_der).hexdigest() == fp.lower()
user = rec["address"] if ok else None

Full reference implementation of the check and InfoCard decoding (Python, the code behind this page): emerssl.py. The original PHP examples are under Materials.

Materials

EMCSSL.pdf — emerSSL white paper
emerdns-stat.txt.gz — emerDNS query statistics of this server, updated daily
emcssl CA certificates (hint for browsers): EC, RSA
dga-botnet.txt — emerDNS names registered by a DGA botnet (research data)

Legacy examples (PHP, kept for reference; not executed on this server)

emerSSL-Nginx.php — lightweight check for nginx
emerSSL-InfoCard-Nginx.php — check + InfoCard for nginx
emerSSL-InfoCard-Apache.php — check + InfoCard for Apache, Apache setup notes
emcssl_login_example.tar.gz — login page example
pow-addr.php, cre-addr.php, version.php, testnet-ibm.php — other demos

Used by: Drupal module emc_ssl.