We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or record to an external organization in an ad hoc manner. EG: notify "Zap Labs" that a specific file is awaiting download, then "Zap Labs" can authenticate and retrieve it.
I have very little experience, but pretty solid theoretical understanding. It has to operate on Windows Server, but I can prototype it using OS software on Linux or BSD to get a feel for what needs doing and work from there - I'm trying to understand more right now than implement.
What's a good resource on installing and configuring an authenticated login over HTTP? I know there are some serious issues with web app vulnerabilities that need to be considered and I am not familiar with them. Also I figure confidentiality will be ensured via HTTPS(SSL), but I have literally zero experience with how I might actually set that up.
Also, how should I manage the connection between the database and the DMZ web server? I can think of a couple ways this could be done, but none of them seem secure.