Program product for unified certificate requests from certificate authorities

• US 20050081025A1
• Filed: 08/13/2004
• Published: 04/14/2005
• Est. Priority Date: 08/15/2003
• Status: Active Grant

• Current Assignee: Venafi,Inc.
• Original Assignee: Imcentric Incorporated
• Inventors: Thornton, Russell S., Seegmiller, Jayson, Hodson, Benjamin
• Granted Patent: US 7,698,549 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Claims

1. A set of computer readable media containing computer instructions for operating a certificate proxy system for providing a unified certificate request interface to a plurality of certificate authorities, the proxy system including network facilities for electronic communication over a network and further including a storage device group containing at least one storage device operable to contain operating system files and applications, the set of computer readable media comprising at least one medium upon which is stored the computer instructions executable by a computing system to achieve the functions of:

presenting a uniform interface for receiving information pertaining to the submission of an individual certificate signing request to the plurality of certificate authorities, said interface providing a uniform set of entries for information items required in a certificate signing request generally;

presenting a selectable object whereby a choice of one of the plurality of certificate authorities may be entered;

receiving entry items through the uniform interface and a selection of a certificate authority;

storing items of identification sufficient to identify a requesting entity to each of the plurality of certificate authorities; and

communicating with a certificate authority interface of the selected certificate authority, the communicating presenting at least the received entry items required by the selected certificate authority, the communication it its totality presenting a certificate signing request to the selected certificate authority, the communication further presenting items of identification whereby a requesting entity may be associated to the certificate signing request.

2. A set of computer readable media according to claim 1, wherein said instructions are further executable to achieve the functions of:

provide for the setting of a default certificate authority of the plurality of certificate authorities; and

in presenting a selectable object, providing a selection of the default certificate authority setting.

3. A set of computer readable media according to claim 1, whereby the set of computer readable media further comprises at least one medium upon which is stored a set of scripts whereby each of a plurality of certificate authorities may be communicated with to present a certificate signing request.

4. A set of computer readable media according to claim 1, wherein said instructions are further executable to read a set of certificate authority records, each of the certificate authority records containing at least one default setting usable in presenting a certificate signing request to one of the certificate authorities of the plurality of certificate authorities.

5. A set of computer readable media according to claim 1, wherein the uniform interface presented has an interaction substantially similar to the interaction of a true certificate authority.

6. A set of computer readable media containing computer instructions for operating a certificate proxy system for providing a unified certificate request interface to a plurality of certificate authorities, the proxy system including network facilities for electronic communication over a network and further including a storage device group containing at least one storage device operable to contain operating system files and applications, the set of computer readable media comprising at least one medium upon which is stored the computer instructions executable by a computing system to achieve the functions of:

providing for the setting of a default certificate authority of the plurality of certificate authorities;

presenting a uniform interface for receiving information pertaining to the submission of an individual certificate signing request to the plurality of certificate authorities, said interface providing a uniform set of entries for information items required in a certificate signing request generally;

presenting a selectable object whereby a choice of one of the plurality of certificate authorities may be entered, whereby the selectable object is presented with the default certificate authority selected;

reading at least one of a set of certificate authority records, each of the certificate authority records containing at least one default setting usable in presenting a certificate signing request to one of the certificate authorities of the plurality of certificate authorities;

receiving entry items through the uniform interface and a selection of a certificate authority;

storing items of identification sufficient to identify a requesting entity to each of the plurality of certificate authorities; and

communicating with a certificate authority interface of the selected certificate authority, the communicating presenting at least the received entry items required by the selected certificate authority, the communication it its totality presenting a certificate signing request to the selected certificate authority, the communication further presenting items of identification whereby a requesting entity may be associated to the certificate signing request.

7. A set of computer readable media according to claim 6, whereby the set of computer readable media further comprises at least one medium upon which is stored a set of scripts whereby each of a plurality of certificate authorities may be communicated with to present a certificate signing request.

8. A set of computer readable media according to claim 6, wherein the uniform interface presented has an interaction substantially similar to the interaction of a true certificate authority.

9. A set of computer readable media containing computer instructions for operating a certificate proxy and installation system for providing a unified certificate request interface to a plurality of certificate authorities and for installing certificates to destination servers, the proxy and installation system including network facilities for electronic communication over a network and further including a storage device group containing at least one storage device operable to contain operating system files and applications, the set of computer readable media comprising at least one medium upon which is stored the computer instructions executable by a computing system to achieve the functions of:

presenting a uniform interface for receiving information pertaining to the submission of an individual certificate signing request to the plurality of certificate authorities, said interface providing a uniform set of entries for information items required in a certificate signing request generally;

presenting a selectable object whereby a choice of one of the plurality of certificate authorities may be entered;

receiving entry items through the uniform interface and a selection of a certificate authority;

storing items of identification sufficient to identify a requesting entity to each of the plurality of certificate authorities;

communicating with a certificate authority interface of the selected certificate authority, the communicating presenting at least the received entry items required by the selected certificate authority, the communication it its totality presenting a certificate signing request to the selected certificate authority, the communication further presenting items of identification whereby a requesting entity may be associated to the certificate signing request;

receiving a certificate signed by a certificate authority generated from a certificate signing request by way of said network interface;

identifying a destination network server corresponding to a received certificate signed by a certificate authority;

determining a network server type, said network server types providing at least the type of server software installed to the identified destination network server; and

performing a set of installation steps, the performed set of installation steps applicable to the determined network server type, the performance of the set of installation steps including the transferring of the received certificate to the destination network server by way of said network interface.

10. A set of computer readable media according to claim 9, wherein said instructions are further executable to achieve the functions of:

operating an SMTP service;

receiving an e-mail message by the SMTP service, the e-mail message containing a certificate signed by a certificate authority;

parsing an e-mail message containing a certificate signed by a certificate authority to extract that certificate for installation.

11. A set of computer readable media according to claim 9, wherein said instructions are further executable to achieve the functions of:

upon receiving a certificate signed by a certificate authority, and optionally after identifying a destination network server, notifying a person that the received certificate is ready to be installed; and

prior to performing the set of installation steps, receiving an approval indication from a person indicating that a certificate is to be installed.

12. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for automated controlling of a network interface provided by a web server.

13. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for automated controlling of a shell interface.

14. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for transmission and installation of a certificate through a server agent program.

15. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for restarting a destination server program.

16. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for restarting a destination server computer.

17. A set of computer readable media according to claim 9, wherein said performing a set of installation steps includes steps for notifying an administrator to restart a destination server program or destination server computer.

18. A set of computer readable media according to claim 9, wherein said instructions are further executable to confirm the installation of a received certificate to a destination server following the performance of a set of installation steps.

19. A set of computer readable media according to claim 18, wherein said instructions are further executable to generate an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.