do CAs offer service wherein an application can request someone's public key?
i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated):
- someone with a certificate from a CA and is an authorized user in my application enters data to a web page (in a form)
- his input data are saved to mysql fields
- application (thru php and openssl) hashes and signs that data into a signed message digest *edited: 3: application allows submitting user to hash and sign that data into a signed message digest *
- signed message digest is also saved into same mysql table row of #2 (?into a binary field?)
- application viewers need to be assured that this row of data came from same person in #1
- application (thru php and openssl) re-hashes data using the same hashing algorithm used in #3 and #1's public key
- if hashes don't match, something got tampered and viewer is alerted
questions: should i have another field to accept #1's public key and save it with the data and the signed message digest as well? or can i just ask the CA for the public key of person in #1? (by passing to the CA the certificate serial number which application saved earlier with the data and signed digest)
or should i just save the whole certificate itself (from which the public key can be extracted anyway) even if the data storage requirement will be larger than if the public key alone was saved)? in that case, should i save the certificate to a blob mysql field?
thanks for any feedback or leads.
@thomas: thanks for the clarification on role of CA and on certificate-based-authentication. sorry for my step #3 wording that wrongly implied it will be the application that will sign the data.
@kiBytes and @el viejo: i edited my question.
i was thinking the application will allow the submitting user to hash and sign the data he is submitting into a signed message digest.
i was thinking of the application allowing the execution of these (client-side) commands: to allow logged-user to sign: $ openssl dgst -sha256 -sign logged-user.key -out in.txt.sha256 in.txt
to allow any viewer to verify: $ openssl dgst -sha256 -verify signer-pub.pem -signature in.txt.sha256 in.txt
@el viejo: thanks, i will read on time stamp servers as suggested.
thanks also to everyone else replying. your replies are very much appreciated.