Bit of background.
Web Application that can generate Pub/Priv Keys and X.509 certificates.
How would I make use of the certificate in a web application, username and password login form to provide secure authentication?
This is for a part of a research project I'm doing so I'm not looking for 'better' methods of doing this, I'm just wondering how you'd go about this situation.
Many Thanks!
How would I make use of the certificate in a web application, username and password login form to provide secure authentication?
The point would be not to have such a form at all. You would use HTTPS. The server TLS configuration would require a client certificate (which is optional). In response to that option in the TLS connection setup, the client (web browser) would typically prompt the user to select an acceptable certificate from those he has available; you would of course have had to get the user his private key and matching certificate beforehand. The server would need the necessary CA certificates to verify the client's certificate. Once the TLS connection completes, the web server would make the authenticated client identifier available to the application in some form (e.g. environment variables with Apache mod_ssl); at least, the X.500 "distinguished name" which is the subject of the certificate.
