I'm considering moving to certificate-based authentication for some internal browser-based resources, and I'd like to have some way of my users being able to issue and revoke their own certificates using a private CA. Not all of my users are technical so I'd like the user interface to be browser-based with the back-end running on a secure server that I'll provide.
Is there an open-source solution that can—
- issue and revoke certificates for users based on their existing credentials (i.e. the page will be protected by some other form of authentication)
- maintain a CRL for revoked certificates
- have some kind of super-user management interface?
I've looked at XCA but this is a Windows application that runs locally. I need the equivalent but in the form of a site my users can visit.