AUTOMATICALLY GENERATING A CERTIFICATE OPERATION REQUEST

• US 20110213966A1
• Filed: 02/26/2010
• Published: 09/01/2011
• Est. Priority Date: 02/26/2010
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Fu, Christina, Wnuk, Andrew
• Granted Patent: US 8,898,457 B2
• Time in Patent Office: Days
• US Class Current: 713/158
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 61/4505 using standardised directories; using standardised directory access protocols
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

A method and system for automatically generating a certificate operation request is described.

Claims

1. A method, implemented by a computing system programmed to perform operations, comprising:

establishing a secure connection with a server computing system using an authentication protocol that uses symmetric-key cryptography;

automatically generating, by a client agent of the computing system, a request to perform a certificate operation associated with a certificate; and

sending, by the client agent, the request over the secure connection to an identity management system of the server computing system, wherein the client agent is capable of automatically generating and sending the certificate operation without user intervention at the computing system.

2. The method of claim 1, wherein the authentication protocol is the Kerberos authentication protocol.

3. The method of claim 1, wherein the computing system is a service provider that provides a service to one or more clients over a network.

4. The method of claim 1, wherein the certificate operation is at least one of requesting the certificate, renewing the certificate, checking a request status of the certificate, retrieving the certificate, putting the certificate on hold, removing the certificate from being on hold, and revoking the certificate.

5. The method of claim 1, wherein the certificate operation is requesting the certificate, wherein said automatically generating the request comprises automatically generating a certificate signing request (CSR) by the client agent, wherein the CSR contains information identifying an owner of the certificate and a public key.

6. The method of claim 5, wherein said automatically generating the CSR comprises:

generating a message to include the information identifying the owner of the certificate and the public key; and

digitally signing the message using a private key corresponding to the public key, wherein the digitally signed message is the CSR.

7. The method of claim 6, wherein said automatically generating the CSR comprises generating a key pair including the private key and the public key.

8. The method of claim 1, wherein said automatically generating the request comprises:

periodically determining if any certificate operation needs to be performed;

automatically generating the request when the certificate operation needs to be performed; and

sending the request to the identity management system over the secure connection after said automatically generating the request.

9. The method of claim 1, wherein the certificate operation is retrieving the certificate, wherein the request identifies the certificate to be retrieved, and wherein the method further comprises:

when the certificate operation is approved by the identity management system, receiving the certificate from the identity management system over the secure connection without user intervention at the computing system; and

storing the certificate at a designated storage location.

10. A computing system, comprising

a client agent, comprising:

a Kerberos client to establish a secure connection with a server computing system using an authentication protocol that uses symmetric-key cryptography; and

a certificate utility to automatically generate a request to perform a certificate operation associated with a certificate and to send the request over the secure connection to an identity management system of the server computing system, wherein the client agent is capable of automatically generating and sending the certificate operation without user intervention at the computing system.

11. The computing system of claim 10, wherein the client agent comprises a systems security services daemon (SSSD) that includes the certificate utility.

12. The computing system of claim 10, wherein the certificate utility comprises a certificate signing request (CSR) generator to automatically generate a CSR for the certificate, wherein the CSR contains information identifying an owner of the certificate and a public key.

13. The computing system of claim 10, wherein the Kerberos client interacts with a key distribution center (KDC) of the server computing system to establish the secure connection.

14. The computing system of claim 10, wherein the certificate utility interacts with a registration authority (RA) of the server computing system over the secure connection to request the certificate operation, wherein the RA is configured to determine whether to approve the request from the client agent and to send the request to a certificate authority (CA) to perform the certificate operation when approved, wherein the RA is a trusted manager of the CA.

15. The computing system of claim 10, wherein the certificate utility comprises an XML-RPC client that is an event-based daemon, wherein the XML-RPC client periodically determines if any certificate operation needs to be performed, automatically generates the request when the certificate operation needs to be performed, and sends the request to the identity management system over the secure connection.

16. A machine-readable storage medium having instructions, which when executed, cause a computing device to perform a method comprising:

establishing a secure connection with a server computing system using an authentication protocol that uses symmetric-key cryptography;

automatically generating, by a client agent of the computing system, a request to perform a certificate operation associated with a certificate; and

sending, by the client agent, the request over the secure connection to an identity management system of the server computing system, wherein the client agent is capable of automatically generating and sending the certificate operation without user intervention at the computing system.

17. The machine-readable storage medium of claim 16, wherein the authentication protocol is the Kerberos authentication protocol.

18. The machine-readable storage medium of claim 16, wherein the certificate operation is at least one of requesting the certificate, renewing the certificate, checking a request status of the certificate, retrieving the certificate, putting the certificate on hold, removing the certificate from being on hold, and revoking the certificate.

19. The machine-readable storage medium of claim 16, wherein the certificate operation is requesting the certificate, wherein said automatically generating the request comprises automatically generating a certificate signing request (CSR) by the client agent, wherein the CSR contains information identifying an owner of the certificate and a public key.

20. The machine-readable storage medium of claim 19, wherein said automatically generating the CSR comprises:

generating a message to include the information identifying the owner of the certificate and the public key; and

digitally signing the message using a private key corresponding to the public key, wherein the digitally signed message is the CSR.