Unattended browsers

info

This feature is available from Redtrust version 4.42.3 onwards.

Overview

Unattended browsers mode lets automated systems (automations and robots) use Redtrust certificates in web browsers without the agent tracking the active URL. It removes the browser extension from the signing flow, which is the main bottleneck in high-concurrency unattended environments.

Normally, when a browser uses a Redtrust certificate to access a website, the agent intercepts the cryptographic operation, detects that the requesting process is a browser, and asks the browser extension for the active URL. The agent sends that URL to the server, which validates by policy whether the operation is allowed for that URL and certificate.

In unattended environments where many browser instances run at the same time, this URL query becomes a severe bottleneck: the extension can't handle the concurrency, which degrades performance and can cause failures. The migration from Manifest V2 to V3 made this worse and left some existing automation environments inoperative. Unattended browsers mode removes the URL query entirely, so cryptographic operations are processed directly and concurrently without the extension.

info

This mode is for unattended, automated environments. It doesn't change the flow for attended users: their browser operations still require URL validation as usual.

How it works

The agent's behavior and the server's decision are independent of each other.

• Agent: When you install the Windows agent with the UNATTENDED_BROWSERS="1" parameter, the installer skips every browser-extension component (registry keys, native messaging host, Firefox XPI, and so on). During a browser signing operation, the agent skips the URL query and sends the operation to the server without a URL, including the command line of the requesting process.
• Server: When the server receives an operation without a URL, it checks the user's policy. If the policy has the Unattended browsers flag turned on, the server ignores the missing URL and authorizes the operation. If the flag is off, the server rejects the operation.

When the server does receive a URL (for example, from an agent installed in standard mode), it evaluates the URL with the standard behavior regardless of the flag.

Certificate behavior

In the Redtrust model, a user can hold two types of certificates: personal certificates (assigned to the individual) and corporate certificates (organizational certificates where the user is the registered owner).

In unattended browsers mode, both types behave the same as usual: the user can use them in browser signing operations without URL validation. Because this also applies to corporate certificates, which carry organizational authority, it's the administrator's responsibility to assign only appropriate users to unattended environments.

Auditing

Every signing operation generates a certificate usage event that includes the user, agent ID, certificate, browser, and applied policy. In unattended browsers mode:

• The event records the Command line of the process that started the operation. This value is for audit purposes only and never affects policy evaluation or authorization.
• Because no URL is captured, the URL doesn't appear in the event. When a certificate-usage alert is sent without a URL, it refers to the site generically as "an e-government portal" instead of a specific address.

Requirements

To use this mode, you need both of the following:

• The Windows agent installed with UNATTENDED_BROWSERS="1". See Agent installation parameters.
• A policy with the Unattended browsers flag turned on, applied to the unattended user. See Policies.

For step-by-step instructions, see Set up unattended browsers.

warning

In unattended browsers mode, Redtrust can't validate the site where a certificate is used, and the URL doesn't appear in audit events. Enable this mode only for users dedicated to unattended environments, and make sure the responsible administrators accept the loss of URL control as a condition of this usage mode.