使用 CA 发布的数字证书签署 PDF 文档的 Web 应用程序
想象一下用 python/django 编写的 Web 应用程序，其中用户通过 apache+mod_ssl （和自定义 django 身份验证后端）使用数字证书进行身份验证，那么他们如何对文件进行签名呢？这些证书由政府批准的 CA 发布。
如果我没记错的话，文件需要使用证书的私钥进行签名，因为这是该文件确实由某人签名的证据（而不是其他人冒充某人）。
Web 应用程序如何访问用户浏览器中存储的证书的私钥？
这是否可能不需要在用户计算机上运行软件？
编辑：
所以这可以通过 ActiveX 控件或 Java 小程序来完成，对吧？这是否需要从头开始开发，或者有人知道开源解决方案吗？
Immagine a web application written in python/django in which users authenticate with digital certificates via apache+mod_ssl (and a custom django authentication backend), how can they sign files then? The certificates are released by government approved CAs.
If I'm not wrong, a file needs to be signed with the private key of a certificate, because that is the proof that the file has been really signed by someone (and not someone-else pretending to be someone).
How can a web application have access to the private key of a certificate stored in the browser of the user?
Is this possible without the need of a software running on the user's machine?
EDIT:
So this can be done either with an ActiveX control or a Java applet, right? Does this need to be developed from scratch or does anybody know an open source solution?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您是正确的，因为 Web 应用程序需要访问用户本地计算机或 PKI 存储上的私钥。我为美国空军网络上的 Web 应用程序开发了这样的解决方案。
用户使用包含 PKI 凭据和私钥的 CAC 卡登录 USAF 计算机。在我们的解决方案中，我们需要对 Web 应用程序生成的 PDF 文档进行数字签名。我们构建了一个 ActiveX 控件，该控件将通过 Web 服务从网站下载 PDF 文档，在本地对 PDF 进行数字签名，然后将签名的 PDF 文档传输回网站。
由于这些文档的签名权限非常有限，因此我们能够获得ActiveX控件的使用授权。您正在走正确的道路，因为只有本地授权的应用程序才能访问用户的密钥存储。
You are correct in that the web application requires access to the private key on the user's local computer or PKI store. I developed such a solution for a web application on the USAF network.
Users logon to USAF computer with their CAC Card containing their PKI credentials and private key. In our solution, we needed to digitally sign PDF documents generated by our web application. We built an ActiveX control that would download the PDF document from the web site via a web service, digitally sign the PDF locally, and then transmit the signed PDF document back to the web site.
Since the signature authority of these documents was such a limited audience, we were able to get authorization for the use of the ActiveX control. You are heading down the right path as only a locally authorized application will have access to the user's key store.
正如 tawman 在他的回答中所描述的，正确的方法是在浏览器中拥有一个客户端模块，并让该模块进行实际签名。您可以使用已签名的 Java 小程序或已签名的 ActiveX 控件来完成这项工作。
我们为分布式签名提供了这样的解决方案，并具有随时可用的客户端模块，但服务器端部分需要 .NET 或 VCL（抱歉，没有 python）。我们的解决方案不需要将文档传输到客户端（与 tawman 的方案不同） - 仅将一小部分数据发送到客户端并在那里签名。
旁注：用于通过 SSL 作为客户端进行身份验证的客户端证书很可能无法用于签名：这两个操作需要证书中不同的密钥使用扩展。
As tawman described in his answer, the right approach is to have a client-side module in the browser, and have this module do actual signing. You can have signed Java applet or signed ActiveX control to do the job.
We offer such solution for distributed signing with ready to use client modules, but server-side part requires either .NET or VCL (no python, sorry). Our solution doesn't need to transfer the document to the client side (unlike tawman's scheme) - only small chunk of data is sent to the client and signed there.
Side note: client-side certificate used for authentication as a client via SSL most likely won't work for signing: these two operations require different key usage extension in the certificate.
这听起来像是来自欧盟的东西。不幸的是，现有的在线签名插件有无数。请记住，许多也依赖于客户端软件（如果证书来自智能卡，则通常还需要存在智能卡中间件）。所以你最好研究一下你的目标市场。
This sounds like something from EU. Unfortunately there are countless of different existing online signature plugins. Keep in mind that many depend on the client side software as well (if the certificates come from a smart card, smart card middleware usually needs to be present as well). So you better study your target market.