Situation
I am doing an internship in a company and I am currently working on a web application that has the following features:
- This is a private application, users can only be added by an administrator of the application
- Users can add PDF files online
- Those files are stored in the application server
My mission as an intern is the following:
- I have to implement a feature that allows clients to sign the PDF files using this mechanism.
It has to be simple to use : one button "Sign" next to the file and the server signs it automatically using the user certificate. The basic idea is that each client would be granted a certificate when his account is created (the Certificate Authority would be trusted by the application). At some point I will have to get the private key of the user in plaintexte to sign the file on the server (I am thinking about using phpseclib library to read certificates).
Question
Should I store the users' certificates and/or private keys on the server? * Isn't there a better way to store users private keys, such as a trusted web application that has REST API or some easy way to access it?
Edit : My situation has evolved and now my question is more like the following:
- Is it safe to store .pfx or p12 files on the server? I know they contain private keys but is the file as itself really secured (let's say there is one client password for each file).
Note : I am still a student and not an expert in security, please tell me if you need further information to answer.