Management of SSL/TLS certificates
First Claim
1. A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:
- monitoring the expiration status of certificates stored to the plurality of servers;
detecting the expiration of a certificate stored to the plurality of servers within a specified period of time;
identifying a managed server corresponding to a detected expiring digital certificate;
communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;
transmitting a generated and received certificate signing request to a certificate authority;
receiving a certificate signed by a certificate authority generated from a certificate signing request;
identifying a destination managed server corresponding to a received certificate signed by a certificate authority;
installing a received certificate signed by a certificate authority to an identified destination managed server; and
configuring an identified destination managed server to use a private key corresponding to an installed certificate.
5 Assignments
0 Petitions
Accused Products
Abstract
Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.
63 Citations
16 Claims
-
1. A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:
-
monitoring the expiration status of certificates stored to the plurality of servers;
detecting the expiration of a certificate stored to the plurality of servers within a specified period of time;
identifying a managed server corresponding to a detected expiring digital certificate;
communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;
transmitting a generated and received certificate signing request to a certificate authority;
receiving a certificate signed by a certificate authority generated from a certificate signing request;
identifying a destination managed server corresponding to a received certificate signed by a certificate authority;
installing a received certificate signed by a certificate authority to an identified destination managed server; and
configuring an identified destination managed server to use a private key corresponding to an installed certificate. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:
-
receiving an address range corresponding to a network or network portion to be scanned;
contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system;
for each contacted network device transmitting a digital certificate, receiving the digital certificate;
for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted;
storing created certificate records in a certificate database;
monitoring the expiration status of certificates stored to the plurality of servers;
detecting the expiration of a certificate stored to the plurality of servers within a specified period of time;
identifying a managed server corresponding to a detected expiring digital certificate;
communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;
transmitting a generated and received certificate signing request to a certificate authority;
receiving a certificate signed by a certificate authority generated from a certificate signing request;
identifying a destination managed server corresponding to a received certificate signed by a certificate authority;
installing a received certificate signed by a certificate authority to an identified destination managed server; and
configuring an identified destination managed server to use a private key corresponding to an installed certificate.
-
-
16. A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:
-
receiving an address range corresponding to a network or network portion to be scanned, contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system, for each contacted network device transmitting a digital certificate, receiving the digital certificate, for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted, storing created certificate records in a certificate database, monitoring the expiration status of certificates stored to the plurality of servers, detecting the expiration of a certificate stored to the plurality of servers within a specified period of time, receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed or installed, identifying a managed server corresponding to a detected expiring digital certificate, communicating with the managed server, the communicating causing the managed server to generate a new asymmetric key pair, the communicating further causing the managed server to generate a certificate signing request and return the request to the managing device, transmitting a generated and received certificate signing request to a certificate authority, receiving a certificate signed by a certificate authority generated from a certificate signing request, identifying a destination managed server corresponding to a received certificate signed by a certificate authority, installing a received certificate signed by a certificate authority to an identified destination managed server, the installing being performed by accessing the identified destination managed server using a corresponding object of said authentication objects, the installing utilizing a protocol selected from the group of a shell interface, an agent interface and a network interface provided by a web interface of a web server, configuring an identified destination managed server to use a private key corresponding to an installed certificate, performing a restart action selected from the group of commanding an identified destination managed server to perform a restart, commanding an identified destination managed server to restart and notifying an administrator to restart a destination server program or destination server computer.
-
Specification