I'm working on web authenticate system where users will digitally sign random tokens and this will be checked with X509 certificates stored on the server.
Therefore I have to store several X509 certificates (PEM or DER format) in PostgreSQL database. Sounds easy, but I want to have possibility to search certificates with subject, issuer, notBefore, notAfter and similar criteria.
My idea is to have following columns in database: X509data, notAfter, notBefore, subject, issuer etc. Than I will create object (in SQL alchemy) representing X509 certificate with methods like add_new_X509(), find_X509(search criteria) etc. So whenever I will add new certificate with method add_new_X509() it will automatically reads from certificate all data and fill up rest of the columns and put raw certificate into X509data column.
Unfortunately this solution have two disadvantages:
- I will store the same information twice (in X509 certificate itself and in separate columns for easy searching)
- Whenever I want to read X509 certificate, my application will have to crosscheck notAfter, notBefore, subject, issuer with information stored in original certificate (this is for security reasons, in case someone would try to modify this fields).
So.. anybody have better idea, or suggestion? Maybe somebody see any other security issue that can arise with this solution?