I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or Documents etc. I have also worked on projects where openssl C libraries were used with certs for securing communication and authentication. I am also extremely familiar with openssl command line tools.
However, I have very little experience with webbased PKI projects & hence I am trying to design and code a personal project for this.
(This is a learning project - This is never going to be used in a bank)
This is the website for a bank. All Internet Banking users are allowed use any signing certificate issued by a few known CAs (verisign, Thawte, entrust etc). The Bank is not responsible for procuring certificates for the user. The user logs into the bank site with his userid/password etc. He has access to most parts of his account. However, when the user wants to do a transaction - like transferring money to different account - the bank wants him to sign the transaction with a certificate.
When user choses "Transfer" option - the website throws up a form where there are 3 entries - "Transfer To" account, the Amount of the transaction and a way for chosing a cert for doing the digital signing & do the signing.
I concatenate the "Transfer To" Account no & the amount plus a nonce and this is the string which will be signed and sent to the backend.
I have searched a lot but haven't been able to figure out how to achieve - letting the user chose a cert - do the signing.
I know how the user can add certs to his personal truststore on Windows. But how would I ask the browser to show him certs to chose from?
I have not decided on a platform/framework/language for now - so this question is rather generic.
I have searched a lot for this kind of info without luck - all I get is tutorials on digital signing, tutorials on how to enable PKI in Apache etc.
If someone feels my whole approach is wrong & there is a better way to do digital signing in a web-app - feel free to suggest those alternatives also.