I want to build a PKI (public key infrastructure) to host certificates for users.
My use case is, that I want to use the certificates for e2e encryption between the users.
- Users must be able to download valid certificates for a random user. (sharing is initiated by the sender)
- Certificates must still be valid, even if the receiver did not log in for a long time. (in theory months, years)
For that to work,
- the user has to send me a CSR (certificate signing request)
- I have to check the CSR for validity
- I create the certificate with the CSR and my intermediate signing certificate
Now I want to prolong the existing certificate. For that I could store the CSR in the database and just repeat step 3.
- Is this a good idea? (I have the feeling that it is not, but I cannot pinpoint the exact issue with this.)
- If not, what are good and reliable alternatives? (e.g. I want to keep the certificate valid, even if the user does not log in for a longer time)