I'm working on a web application with simple API needing authentication. For my application nature, users have two RSA keys, for signing and encrypting messages. My protocol works based on it. The web application has access to public keys.
One solution to achieve authentication and kill MITM is to build SSL over the application API and build an authentication method using user's keys. Simple messages passing. But I'm thinking about another method... Make authentication based on SSL client certification. I'd used client certificates for previous projects but I've some problems deciding whether to use it for this project:
Is it bad idea to use one of user RSA keys to generate certificate for it?
Is there any web-server (as SSL wrapper) that can allow me to extend functionalities during SSL negotiation with external program? I mean when user sends SSL request, I look for his certificate in a database (a) and if found insert a record to a database as session ID and the web application use this (b). This means not just give access to some users, but finding out which user is logged in. ANSWER: At-least nginx supports passing received client certificate to the web application. I went by this.
Analysis about performance. I doubt about large number of users and this certificate based authentication performance, but authentication is some part in my application that should be done and SSL is too. What extra load and latency can I expect when using client and server certificates compared to just using server certificates? ANSWER: See MadHatter's answer.
Thanks for your suggestions and sorry for my bad English.