Security is a larger question than the authentication or authorization mechanisms in use.
Most security people leverage a few basic principles generally:
- least privilege
- deny by default
- Fail open or Fail closed
- privilege separation
- role separation
- defense in depth (to name a few)
Then apply that to assets, in your case, a webserver, an operating system, and potentially a web application and underlying database - really the business though!
For the above technology infrastructure, I would ask if you have applied proper security hardening to each, e.g. DISA STIGs, NSA SRGs, CIS guidance, or vendor security practices. Afterwards, I'd look into the code of the web applications, and other things.
Getting to your specific question about certificates - what is a digital certificate? It is a public key, embedded into a digital certificate, with some fields in it, typically x509v3. A digital certificate is effectively an encryptor, that uses a decryptor (private key) in order to authenticate, sign, or perform some other type of transaction.
Certificates have no confidentiality generally, private keys have confidentiality and require protection. However, using private keys on an operating system may mean they are exposed and compromised. One piece of malware can be all it takes to get in. Consequently, higher security environments such as companies and governments commonly use a hardware device to store private keys and enable a more secure authentication process.
If you are not doing this for a more secure environment, software certificates may be good enough for you.
Depending on the operating system you are using, you may have a very simple path ahead using certificate based auto-enrollment schemes like SCEP or microsoft's certificate services.
Microsoft's implementation is easy to follow at http://msdn.microsoft.com/en-us/library/bb643324.aspx and you can find other competing solutions for easier auto-enrollment PKIs.
You can share a few of your needs with above links with your network administrators and ask them to start testing it out.