Processing apparatus for monitoring and renewing digital certificates

• US 20050071630A1
• Filed: 08/13/2004
• Published: 03/31/2005
• Est. Priority Date: 08/15/2003
• Status: Abandoned Application

• Current Assignee: Imcentric Incorporated, Venafi,Inc.
• Original Assignee: Imcentric Incorporated
• Inventors: Thornton, Russell S., Seegmiller, Jayson, Hodson, Benjamin
• Application Number:
  US10/918,325
• Publication Number:
  US 20050071630A1
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A centralized certificate renewal system for automatically renewing digital certificates in a managed network, comprising:

a managing device, said managing device including processing facilities for executing software and further including network facilities for electronic communication over a network, said managing device further including a storage device group containing at least one storage device operable to contain operating system files and applications, said managing device configured to communicate with a plurality of servers utilizing said network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices;

instructions stored to said storage device group, said instructions being further executable by said processor to achieve the functions of;

(i) monitoring the expiration status of certificates stored to the plurality of servers,

(ii) detecting the expiration of a certificate stored to the plurality of servers within a specified period of time,

(iii) identifying a managed server corresponding to a detected expiring digital certificate,

(iv) communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device,

(v) transmitting a generated and received certificate signing request to a certificate authority,

(vi) receiving a certificate signed by a certificate authority generated from a certificate signing request,

(vii) identifying a destination managed server corresponding to a received certificate signed by a certificate authority,

(viii) installing a received certificate signed by a certificate authority to an identified destination managed server, and

(ix) configuring an identified destination managed server to use a private key corresponding to an installed certificate.

2. A system according to claim 1, wherein said instructions are further executable by said processor to revoke a certificate for which expiration was detected.

3. A system according to claim 1, wherein said instructions are further executable by said processor to achieve the functions of:

(ix) generating a new asymmetric key pair, and

(x) installing a generated private key of a new asymmetric key pair to an identified destination managed server; and

wherein a generated certificate signing request includes a generated public key of a new asymmetric key pair.

4. A system according to claim 1, wherein said instructions are further executable by said processor to install a received certificate signed by a certificate authority by a network interface provided by a web interface of a web server installed to an identified destination managed server.

5. A system according to claim 1, wherein said instructions are further executable by said processor to install a received certificate signed by a certificate authority by a shell interface to an identified destination managed server.

6. A system according to claim 1, wherein said instructions are further executable by said processor to install a received certificate signed by a certificate authority by an agent program installed to an identified destination managed server.

7. A system according to claim 1, wherein said instructions are further executable by said processor to restart a destination server program.

8. A system according to claim 1, wherein said instructions are further executable by said processor to restart a destination server computer.

9. A system according to claim 1, wherein said instructions are further executable by said processor to notify an administrator to restart a destination server program or destination server computer.

10. A system according to claim 1, wherein said instructions are further executable by said processor to confirm the installation of a received certificate to a destination server following the performance of a set of installation steps.

11. A system according to claim 10, wherein said instructions are further executable to generate an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.

12. A system according to claim 1, wherein said instructions are further executable by said processor to achieve the functions of:

(ix) informing an administrator of a certificate for which expiration has been detected,

(x) prior to said transmitting, requesting approval to renew a certificate for which expiration has been detected, and

(xi) receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed.

13. A system according to claim 1, wherein said instructions are further executable by said processor to achieve the functions of:

(ix) following said receiving a certificate signed by a certificate authority, informing an administrator of that renewed certificate,

(x) prior to said installing, requesting approval to install a renewed certificate received from a certificate authority, and

(xi) receiving, in response to a request for approval, an indication from an administrator that a renewed certificate is to be installed.

14. A system according to claim 1, wherein said instructions are further executable by said processor to store a received certificate signed by a certificate authority to a backup storage device.

15. A centralized certificate discovery and renewal system for automatically discovering and renewing digital certificates in a managed network, comprising:

a managing device, said managing device including processing facilities for executing software and further including network facilities for electronic communication over a network, said managing device further including a storage device group containing at least one storage device operable to contain operating system files and applications, said managing device configured to communicate with a plurality of servers utilizing said network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices;

instructions stored to said storage device group, said instructions being further executable by said processor to achieve the functions of;

(i) receiving an address range corresponding to a network or network portion to be scanned,

(ii) contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system,

(iii) for each contacted network device transmitting a digital certificate, receiving the digital certificate,

(iv) for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted,

(v) storing created certificate records in a certificate database,

(vi) monitoring the expiration status of certificates stored to the plurality of servers,

(vii) detecting the expiration of a certificate stored to the plurality of servers within a specified period of time,

(viii) identifying a managed server corresponding to a detected expiring digital certificate,

(ix) communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device,

(x) transmitting a generated and received certificate signing request to a certificate authority,

(xi) receiving a certificate signed by a certificate authority generated from a certificate signing request,

(xii) identifying a destination managed server corresponding to a received certificate signed by a certificate authority,

(xiii) installing a received certificate signed by a certificate authority to an identified destination managed server, and

(ix) configuring an identified destination managed server to use a private key corresponding to an installed certificate.

16. A centralized certificate discovery and renewal system for automatically discovering and renewing digital certificates in a managed network, comprising:

a managing device, said managing device including processing facilities for executing software and further including network facilities for electronic communication over a network, said managing device further including a storage device group containing at least one storage device operable to contain operating system files and applications, said managing device configured to communicate with a plurality of servers utilizing said network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices;

instructions stored to said storage device group, said instructions being further executable by said processor to achieve the functions of;

(i) receiving an address range corresponding to a network or network portion to be scanned,

(ii) contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system,

(iii) for each contacted network device transmitting a digital certificate, receiving the digital certificate,

(iv) for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted,

(v) storing created certificate records in a certificate database,

(vi) monitoring the expiration status of certificates stored to the plurality of servers,

(vii) detecting the expiration of a certificate stored to the plurality of servers within a specified period of time,

(viii) receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed or installed,

(ix) identifying a managed server corresponding to a detected expiring digital certificate,

(x) communicating with the managed server, the communicating causing the managed server to generate a new asymmetric key pair, the communicating further causing the managed server to generate a certificate signing request and return the request to the managing device,

(xi) transmitting a generated and received certificate signing request to a certificate authority,

(xii) receiving a certificate signed by a certificate authority generated from a certificate signing request,

(xiii) identifying a destination managed server corresponding to a received certificate signed by a certificate authority,

(xiv) installing a received certificate signed by a certificate authority to an identified destination managed server, the installing being performed by accessing the identified destination managed server using a corresponding object of said authentication objects, the installing utilizing a protocol selected from the group of a shell interface, an agent interface and a network interface provided by a web interface of a web server,

(xv) configuring an identified destination managed server to use a private key corresponding to an installed certificate,

(xvi) performing a restart action selected from the group of commanding an identified destination managed server to perform a restart, commanding an identified destination managed server to restart and notifing an administrator to restart a destination server program or destination server computer.