I'm not sure what API is actually in use in this scenario; if it's KeyGen, that's on a deprecation path: https://groups.google.com/a/chromium.org/forum/#!searchin/blink-dev/keygen%7Csort:relevance/blink-dev/z_qEpmzzKh8/IGGYDPcvAgAJ

I suspect it's application/x-x509-user-cert, which we only supported importing a single certificate (not a PKCS#7 chain of certificates). That's what the Technet & DigiCert articles are referring to, at least.

The change, which as Eric mentioned happened a bit ago, is that support for application/x-x509-user-cert was wholly removed. Now, it's simply downloaded (if the server is properly following the HTTP specification) and it's up to the user to import into the appropriate tool (in the case of the reporter's macOS 10.12.2, the Keychain Access tool is spawned).

So I'm going to close this as WontFix. Earlier versions of Chrome intentionally didn't support PKCS#7 blobs in application/x-x509-user-cert (which Firefox and Nokia did), and new versions simply treat it as any other unsupported-by-Chrome mimetype - defer to the OS and the OS' associations (to extension and mime-type)

I'd be fine if it just downloaded a certificate, but it doesn't.  When one of my users tries to generate a cert from Microsoft Certificate Server using their AD credentials, Safari and Firefox work, but using Chrome there's an error returned (as an HTML page) from the certificate server (see below).  It seems that Chrome is not giving the server whatever it needs to generate the cert in order to download it, whereas the other two browsers are.

Microsoft Active Directory Certificate Services  --  cciu-CERTSERVER-CA  	Home
Error

Your request failed. An error occurred while the server was processing your request.

Contact your administrator for further assistance.

Request Mode:
newreq NN - New Request (keygen)
Disposition:
(never set)
Disposition message:
(none)
Result:
Invalid pointer 0x80004003 (-2147467261 E_POINTER)
COM Error Info:
CCertRequest::Submit: Invalid pointer 0x80004003 (-2147467261 E_POINTER)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
No suggestions.

Right, so that's not related to downloading certificates, that's related to <keygen>. As Eric mentioned, it's been deprecated since Chrome 49 (you can set a permission to use it, or an enterprise flag) and is being removed in Chrome 57, as the DevTools console has been warning for a year now.

Wonderful, that's the information that I needed, thanks much and applogies for my ignorance of the mechanism.  With <keygen> re-enabled, Chrome downloads the cert as exepected.  I realize that it will be fully removed in a future version, however.  Thanks.