I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm signing the client certificates with my own self-signed CA (which of course is being kept safe). I have also verified that the setup is working on a local set of computers.
One problem keeps bugging me though. As long as the certificates can be "physical" handed over i have no problem. However i can't seem to find a solution for safely transfering the client certificates to the actual clients. These are the options i have come up with so far:
1) Encryptering the certficates using symmetric encryption in PFX format. Then i'll e-mail the certificate and send the key for decrypting the certificate with good old snail-mail (that is, a physical letter)
2) Build a simple website that let's the clients log-in using a temporary URL (credentials sent to e-mail address) and then download the certificate. The site would be secured using HTTPS. The security then fully relies on the security of the clients e-mail and that no-one picks up the URL from the e-mail
I tend to prefer option 1) as the only security flaw there would be for someone to actually steal the key from the physical letter. However it seems a bit tedious to use a physcial letter.
Is there any de-facto standard for solving this issue that i am overlooking that provides reasonable security?