Refaktorování nástroje pro práci s X509 certifikáty ve firmě CZ.NIC, z.s.p.o

This bachelor thesis is aimed at using personal digital certificates in the company CZ.NIC, where digital certificates have found application at digital signing, especially in Linux environment. Previously used tool was lacking needed features, whose completion (and reworking of existing) is the goal of this thesis. Theoretical part covers besides motivation for signing and legislative framework mainly digital signature as-is, its technical properties (integrity, identification, non-repudiation) and their provision, including used cryptographical principles (used hash and encryption algorithms). Base of reliability of this system is hierarchical structure of Certificate Authorities, which after confirmation of identity issue (upon request) to user his certificate. That is special cryptographical structure definitely identify its holder. During the act of signing its copy is attached and verification of state of questioned document can be done. Its usage (including provision of password) disponent makes clear not only his identity, but also that he cares about sincerity of created signature. Space is given also to the norm X.509, which declares requirements of digital certificates and its parts. For clarity there is also a simplified description of this system and its practical application. In practical part attention is focused on contribution of the author. Based on the interviewswith colleagues following requirements were identified: simplicity of usage, generating personal qualified certificate request, creation of PKCS12 file with issued certificate and provision of program for PDF files signing. Additional requirements from the administrator's point of view are easy maintenance, simple modifications and automatic updates. There are described programs and tools selected for usage in this thesis, including appropriate reasons. Development follows methods of Extreme Programming and is followed by (mainly manual) testing and documentation. Skeleton of this project is a set of (BASH) scripts graphically communicating (thanks to Zenity framework) with user and guiding him from certificate request generation (using OpenSSL) up to digital signature of PDF file (in JSignPDF program). Project is prepared for deployment on user workstations and makes use of automatic updates (through SystemD service and timer) from internal servers of company (GitLab instance). Because it is an already deployed project for more than half a year, there is also described its multiphase deployment to practice and problem solving, on the go. Compared to previous solution, author's solution is able to completely work with user certificates, is more comfortable to use and all of required features fulfills straightforwardly and comprehensively. Flatter architecture helps with orientation and wide deployment already proved its functionality.