This solution is safe to access to user's private certificate on a web with a webSoket communication?

Question

We are developing a web page that use https protocol (two way).

We need to access to the private certificates of the user, because we need sign documents by the user

Answer 1

I see the following issues

1. Send a public key and a signed token by the server's private certificate to the native application.

You are calling a local app by protocol. For example mylocalapp://sign?securitytoken=.... You do not control which application is installed on local PC to respond to mylocalapp://. The browser shows an ugly warning because you are leaving the secure environment. An attacker could have replaced the default app, simulate the flow and get all signed documents.

2.Next, we will Check in the native application that the token it is OK with a web service to the server.

To verify identity of server and avoid a ManInTheMiddel attach you need also to set a trustore for your application with the server certificate

Your server needs also to verify identity of client. Are you planning to use TLS two ways also?

3. After, we will have to open the websocket between the native app and the web, and send the signed document by the native app by this way.

You do not need a websocket. Simply use a URL connection to download and upload the documents.

---

This solution was used by Spanish ministry of economy when chrome decided to cut the NPAPI support and signature applets began to fail. Now, they have rebuilt the system in this way

1. Install a local Java application on the user's PC. The application listens on a port as, for example 5678

2. In your page, javascript connects to the application in the form http://127.0.0.1:5678/sign and sends the data to sign.

3. The application is local and has no trouble using the operating system keystore, which includes drivers PKCS#11. Perform digital signature and sends the result to the server

4. The javascript of the page periodically query the result and retrieves it when ready

The security problem is basically the same, but install a server in localhost is harder than replace the local default app.

The solution is called @firma, I guess you probably know it. It is opensource, you can use it