Web Development

Ask something
Discussion Locked

Digital Signatures

0 helpful
14 replies

by sam

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a business that employees sub-contractors who perform work for different chain stores. I am using a five part invoice that the sub-contractor has the chain store manager sign when work is complete and mails into my company. How can I capture a signature our the internet from within my web site?

14 replies

by timthetoolman

Hi,

Can you please spell out the process a little more?

Are the invoices electronically mailed? Or regular mail?

Are you looking to change the process by using a website?

I mean looking at your problem, you should be able to scan the invoices and store them online, accessible from the werbsite - but I'm not sure that's what you had in mind...

Cheers,
Tim.

by timthetoolman

Hi,

Well it seems to me that you would want each department to access the invoice online - rather than have a paper version at all... and then authorise it by logging in (The login is the authorisation in itself) and then checking an OK on the form.

Would this be the kind of thing you were after?

I know that email, for instance, is a valid authorisation these days, so I dont see why a password protected web authorisation process wouldn't be...

Otherwise you're stuck with them havingto scan the form and upload it using your website (along with the actual signature on the form) and storing that as the authorisation.

Alternatively, they could do the authorisation via the web page (as per my first suggestion) and them mail the form back to you for your records. If anyone asked, you simply pull out the real invoice and match it up with the authorisation record in your database.

Does that help?

Cheers,
Tim.

by sam

The invoices are not electronically mailed. They are regular mail.

I am looking to change the process by using a website to transfer digitaly signed forms to my server. I can then place the data into my software application. I am trying to eliminate each department from hand inputing the data from the five part copy.

Does this answer your question?

Thanks,
Sam

by rrosulescu

If you want to create a website for your process, I sugest you power it with some servlets, Java has a verry strong encryption API and gives you the power of server side logic. If you are interested I can get you some additional help.

by geert pante

Basically, you can achieve some sort of non-repudiation by having a client log in at a website, and tracking his session, so you're sure that everything that happens during that session is done from the client's browser.

A more secure way is to set up HTTPS with client authentication. You could set up your own CA and have that one deliver client certificates to your clients after you have them sign an offline contract that they will never export that certificate to somebody else.

Then you can have your webserver only accept HTTPS with client authentication, and only trust certs signed by your own CA.

In your web application you can then map client certificates to security roles or users and track these for non-repudiation.

Thecertificate chain sent by the client is also accessible at each individual request. In J2EE application servers, you get it using:

X509Certificate[] userCertificateArray =
(java.security.cert.X509Certificate[])
(request.getAttribute ("javax.servlet.request.X509Certificate"));

Greetings, Geert.

This discussion is closed to new replies.