System for domain control validation

• US 9,521,138 B2
• Filed: 06/14/2013
• Issued: 12/13/2016
• Est. Priority Date: 06/14/2013
• Status: Active Grant

• Current Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Original Assignee: Go Daddy Operating Company LLC (GoDaddy, Inc.)
• Inventors: Thayer, Wayne, Plains, Jacob
• Primary Examiner(s): NGUYEN, TU T
• Application Number:
  US13/918,716
• Publication Number:
  US 20140373097A1
• Time in Patent Office: 1,278 Days
• Field of Search: 726/4
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method for domain control validation is presented. At a certificate authority a request is received. The request includes a certificate signing request and a first Internet protocol address. The certificate signing request identifies a domain and a certificate. A second Internet protocol address for the domain is retrieved from a domain name system. When the first Internet protocol address is the same as the second Internet protocol address, the certificate is signed, and the signed certificate is transmitted to a requester of the request. When the first Internet protocol address is not the same as the second Internet protocol address, the certificate signing request is rejected.

Claims

1. A system, comprising:

at least one server computer having a processor and being configured to;

receive a request including a certificate signing request and a first Internet protocol address, the certificate signing request identifying a domain and a certificate;

retrieve a second Internet protocol address for the domain from a domain name system;

when the first Internet protocol address is the same as the second Internet protocol address;

sign the certificate, and

transmit the signed certificate to a requester of the request; and

when the first Internet protocol address is not the same as the second Internet protocol address, reject the certificate signing request.

2. The system of claim 1, wherein the request is received from a web hosting provider.

3. The system of claim 2, wherein rejecting the certificate signing request includes transmitting a notification to the web hosting provider.

4. The system of claim 2, wherein the at least one server computer is hosted by a certificate authority and the certificate authority and the web hosting provider have a pre-established trusted relationship.

5. The system of claim 4, wherein the certificate authority and the web hosting provider are the same entity.

6. The system of claim 4, wherein the certificate authority and the web hosting provider are different entities.

7. The system of claim 1, wherein the at least one server computer is configured to:

determine whether the request includes a first plurality of Internet protocol addresses; and

when the request includes the first plurality of Internet protocol addresses, retrieve a second plurality of Internet protocol addresses for the domain from a domain name system server.

8. The system of claim 7, wherein the first Internet protocol address is selected from the first plurality of Internet protocol addresses and the second Internet protocol address is selected from the second plurality of Internet protocol addresses.

9. The system of claim 1, wherein, when the first Internet protocol address is not the same as the second Internet protocol address, the at least one server computer is configured to initiate an alternative method for performing domain control validation for the domain.

10. A system, comprising:

at least one server computer having a processor and being configured to;

receive a request from a second server computer, the second server computer operating an administration account for a domain, the request including a certificate signing request and a first Internet protocol address of a third server computer hosting a website for the domain, the certificate signing request identifying the domain and a certificate;

retrieve a second Internet protocol address for the domain from a domain name system;

when the first Internet protocol address is the same as the second Internet protocol address;

sign the certificate, and

transmit the signed certificate to a requester of the request; and

when the first Internet protocol address is not the same as the second Internet protocol address, reject the certificate signing request.