I am doing an internship in a company and I am currently working on a web application that has the following features:
- This is a private application, users can only be added by an administrator of the application
- Users can add PDF files online
- Those files are stored in the application server
My mission as an intern is the following:
- I have to implement a feature that allows clients to sign the PDF files using this mechanism.
It has to be simple to use : one button "Sign" next to the file and the server signs it automatically using the user certificate. The basic idea is that each client would be granted a certificate when his account is created (the Certificate Authority would be trusted by the application). At some point I will have to get the private key of the user in plaintexte to sign the file on the server (I am thinking about using phpseclib library to read certificates).
Should I store the users' certificates and/or private keys on the server? * Isn't there a better way to store users private keys, such as a trusted web application that has REST API or some easy way to access it?
Edit : My situation has evolved and now my question is more like the following:
- Is it safe to store .pfx or p12 files on the server? I know they contain private keys but is the file as itself really secured (let's say there is one client password for each file).
Note : I am still a student and not an expert in security, please tell me if you need further information to answer.