I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems.
My idea was that every client certificate will be rejected at the first time when connecting to the server and stored in a "reject" folder. An administrator can manually move those certificates to a trusted folder, so the client will be trusted the next time he connects. I don't want to use a third party CA and everything should be kept locally on the server side, because the server is only used internally.
I am using self signed certificates both at client and server side. Because of my little knowledge in certificate handling, my first question would be, if this approach is appropriate considering security standards?
What happens if someone gets access to my trust folder containing all trusted certificates, and uses one of them for his own client? Can he get access to my server?