I need to develop a java applet, for a mutual authentication between Tomcat 6 (server) and a SmartCard "IDGo 300" (client).
In order to do this I thought the following scheme:
Tomcat (server) send to SmartCard (client) the request of his digital certificate (signed by CA).
Client enters PIN and selects an available certificate on the smart card, then the Applet sends his certificate (signed by CA) to tomcat. tomcat verifies the digital certificate and if correct sends back his certificate.
The applet verifies the certificate of the server, and if the certificate is correct sends a confirm to server. The server gives full access to the client to use the web application.
Questions:
Is this scheme feasible?
I would like to manage everything through my applet and when the client disconnects the smart card he loses access to the server.