I'm building a webapp and for the first time I need to look in to security, because some actions should only be done by registered users.
of course these parts of the app operate trough https (actually the whole app does), but for now there are only server-side certificates involved (eg the client knows the server is really the server).
to make security as simple as possible I would like to start using client-side certificates as well (so that the server knowns the connected client is really the client).
I'm a bit at a loss, though, on how to hand out/sign client-certificates. Is it okay for this to be done over https (server-certificate) behind a normal HMAC-like login scheme. Eg the user logs in and receives/is able to sign a certificate.
I'm using php as a backend and I'm looking into the html5
<keygen> tag, although this seems pretty insecure (uses md5).
Ideally I would like to be able to hand out and install client certificates almost unnoticed and refresh them every now and then (eg they expire every week).
The webapp doesn't require extreme security at all, but it runs from a personal web server which I would like to keep uninfested. Plus doing security at transport level always seemed more safe to me, and it keeps the security aspect of the app out of the real app code.
is all the above an acceptable approach? If not, why? if so, what are some easy ways to implement it.
note: my knowledge about webapps is scarce (that's why I'm building one, so I can learn) and my knowledge about security, its protocols and best practices even scarcer. In fact I have not even got a full understanding of how SSL works (I'm looking into that!) so please be gentle.