Well you can make web API which will sign the requests (Java, C#), and run it over SSL (HTTPS).
The secure build running web based API for signing requests, with multi-layer security filtering (firewall) and access control (physical, network, application and human factor involved), in isolated network / cabinet with physical locks.
Definitely the app should run in something like C# or Java - not PHP. Static language is far more secure, C# or Java is very good choice for the big application server, while filtering and other can be even written in C++ or use the ModSecurity.
Also you need good cryptography on each security layer - not only SSL, but also SSL based access to database, certificate authentication in database like SQL Server or Oracle, database encryption. Also session token randomization (cryptographically secure RNG), password recovery security and so on must be protected with random/crypted token.
Finally the backup of the certs and the private key preferably on different non-accessible location with replication or handling via secure copy with ssh.
As it seems properly and easy way that would work with IIS on Windows Server in C# Visual Studio, which guarantees proper isolation and resilience / filtering, as well you can use SQL Server and it's crypto API. There is also very good framework for web based API with serialization and session.