After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario.
I have a ASP.NET MVC Website, call it example.com, with an area that needs to be secured so only our partners can access it. Requiring our partners to register each of their employees is out of the question so I thought issuing a client certificate to our each of partners would be a more reasonable solution.
So my questions are this.
- Are client certificates the appropriate method of authenticating our partners or should we use a different authentication scheme?
- How can I issue/manage client certificates to our partners? Do I need to use a managed PKI like DigiCert or Verisign?
- If client certificates are the appropriate method how do I verify the client certificate being supplied by a partner is one our company issued and that it is still valid?
As of right now when we partner with a company an entry will be made into our database with the name of the partner, their location, ect... and they will be given a unique id.
My idea was to store the certificate serial # & thumbprint in a table with the company's unique id, is this enough info to validate a certificate? Does this seem like a reasonable solution?