I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client).
In order to do this I thought of the following scheme:
1.Tomcat (server) send to SmartCard (client) the request of his digital certificate (signed by CA).
2.Client enters PIN and selects an available certificate on the smart card, then the Applet sends his certificate (signed by CA) to Tomcat. Tomcat verifies the digital certificate and, if it is correct, sends the certificate back.
3.The applet verifies the certificate of the server, and, if the certificate is correct, sends a confirm to server. The server gives full access to the client to use the web application.
I have some questions:
1.Is this scheme feasible?
2.I would like to manage everything through my applet and when the client disconnects the smart card, he loses access to the server.