According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to send the staff). We are considering some solutions such as:
- For issuing: Simple Authority (Free-verion), Keystore Explore, Certificate Services in Windows Server...
- For PDF signing: JSignPDF, iSafePDF...
Some of my questions are the following:
- If only internal use, is it really safe? I mean that if a signed document or a digital signature can be faked or not? How to make sure that document is signed by the right manager? In fact, I have deployed in tested environment. However, I am not sure about our own security, whether it is really safe or not, and how to test it.
- What features/considerations should we carefully take?
Since I am a newbie in security, any explanation and/or suggestions are appreciated.