I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client).

In order to do this I thought of the following scheme:

1.Tomcat (server) send to SmartCard (client) the request of his digital certificate (signed by CA).

2.Client enters PIN and selects an available certificate on the smart card, then the Applet sends his certificate (signed by CA) to Tomcat. Tomcat verifies the digital certificate and, if it is correct, sends the certificate back.

3.The applet verifies the certificate of the server, and, if the certificate is correct, sends a confirm to server. The server gives full access to the client to use the web application.

I have some questions:

1.Is this scheme feasible?

2.I would like to manage everything through my applet and when the client disconnects the smart card, he loses access to the server.

  • I strongly suggest you do not try to recreate an authentication system. There are proven authentication systems ( i.e. the SmartCard API built into Java ) that should perform your required task.
    – Ramhound
    Commented Jul 30, 2012 at 14:00

1 Answer 1


Take a look at the SmartCard API for Java

This specification describes the Java Smart Card I/O API defined by JSR 268. It defines a Java API for communication with Smart Cards using ISO/IEC 7816-4 APDUs. It thereby allows Java applications to interact with applications running on the Smart Card, to store and retrieve data on the card, etc.

The API is defined by classes in the package javax.smartcardio...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.