My particular use case is that I have to access digital certificates stored on the client, and use them to perform tasks of signing, verifying, encryption and decryption on the client side and the server side. For the latter part, there are many many solutions. The sticking point is the ability to access certificates stored on the client.

Note that I am saying "certificates stored on the client" which is deliberately vague. I dont want to restrict thoughts to system store, user store, browser store, cryptographic token, java key store, where ever.

Over the years, I used the following ways. Along side each of them I give the pros and cons.

1. CAPICOM/ActiveX. While this was the easiest to work with, it restricts the user to IE on Windows. What is worse, it is now deprecated and works only on 32bit.
2. Java applet. This is cross platform and cross browser, but java in the browser is not as common as one would like it to be and is quickly fading away (apparently Apple recently removed it). So there is the added hassle of getting the user to download and install the JRE. Additionally users have to perform the relatively technical task of setting the unlimited strength cryptography extensions for the signer to work.

Things I have heard of/thought of but I have not progressed far

1. Most javascript solutions. They implement the RSA algorithm but they dont have a way to access digital certificates on the client certificate store. Most of them generate a new key pair.
2. Flash/Flex. Flash/flex seem to be the most ubiquitous client side technology. They can already access client hardware like cameras and microphones. It would be lovely if they could access certificate stores.
3. Alternatives to CAPICOM as given on the microsoft website. It prescribes alternatives to CAPICOM which are mostly do things using the .NET framework. This is great for desktop clients. But for "scripts" they say very clearly in an "important note" that you have to write your own activex controls. Which takes us back to square one.

What I am looking for is a way to get over/around the primary problem of getting access to certificates stores on the client. I am not looking for a discussion of the RSA algorithm or why PKI is stupid or some alternative to asymmetric encryption or use of architectures other than web applications, or on Apple.