Systems and methods for computer digital certificate management and analysis
First Claim
1. A computer-implemented method for testing security settings for a computing device comprising:
- receiving at least one digital certificate from the computing device, the at least one digital certificate including a certificate chain that includes a first certificate preceding a second certificate, each certificate in the certificate chain having an expiration date;
identifying whether the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date;
determining that the at least one digital certificate is invalid when the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date;
determining whether the first certificate contains an Authority Information Access (AIA) entry with a URL that can be utilized to retrieve a third certificate;
when the first certificate contains such a URL;
using the URL in the first certificate'"'"'s AIA to retrieve the third certificate, andcomparing the third certificate to the second certificate; and
determining that the at least one digital certificate is invalid when the second certificate is not identical to the third certificate.
2 Assignments
0 Petitions
Accused Products
Abstract
Described herein are methods and systems for updating digital certificates on a computer and testing to confirm that the update was performed correctly. The testing may involve confirming that a server'"'"'s common name (CN) and/or a server'"'"'s subject alternative name (SAN) matches the domain name server (DNS) name utilized to access the server, confirming that, for all the certificates sent in chain, each certificate'"'"'s expiration date is less than or equal to the expiration date of that certificate'"'"'s parent certificate, confirming that the certificates'"'"' authority key identifier (AKI), subject key identifier (SKI), and/or authority information access (AIA) are in compliance, and comparing available cipher suites to a list of pre-approved cipher suites.
-
Citations
16 Claims
-
1. A computer-implemented method for testing security settings for a computing device comprising:
-
receiving at least one digital certificate from the computing device, the at least one digital certificate including a certificate chain that includes a first certificate preceding a second certificate, each certificate in the certificate chain having an expiration date; identifying whether the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining that the at least one digital certificate is invalid when the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining whether the first certificate contains an Authority Information Access (AIA) entry with a URL that can be utilized to retrieve a third certificate; when the first certificate contains such a URL; using the URL in the first certificate'"'"'s AIA to retrieve the third certificate, and comparing the third certificate to the second certificate; and determining that the at least one digital certificate is invalid when the second certificate is not identical to the third certificate. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A device comprising:
-
a processor; and a memory coupled to the processor, the memory comprising instructions that, when executed by the processor, cause the processor to effectuate operations comprising; receiving, at a computing device with the processor, at least one digital certificate from the server, the at least one digital certificate including a certificate chain that includes a first certificate preceding a second certificate, each certificate in the certificate chain having an expiration date; identifying whether the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining that the at least one digital certificate is invalid when the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining that the at least one digital certificate is invalid when the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining whether the first certificate contains an Authority Information Access (AIA) entry with a URL that can be utilized to retrieve a third certificate; when the first certificate contains such a URL; using the URL in the first certificate'"'"'s AIA to retrieve the third certificate, and comparing the third certificate to the second certificate; and determining that the at least one digital certificate is invalid when the second certificate is not identical to the third certificate. - View Dependent Claims (9, 10, 11, 14, 15, 16)
-
-
12. A computer-implemented method for testing security settings for a server comprising:
-
receiving, at a computing device with a processor, at least one digital certificate from the server; and determining, via the computing device'"'"'s processor, whether the at least one digital certificate is valid, wherein the step of determining whether the at least one digital certificate is valid comprises; receive one or more domain name server (DNS) names utilized, by the computing device, to contact the server; identify one or more subject alternative names (SAN) in the at least one digital certificate; determining that the at least one digital certificate is invalid when at least one of the one or more DNS names does not have a corresponding entry in the one or more SAN entries; and determining that the at least one digital certificate is not invalid when each of the one or more DNS names does have a corresponding entry in the one or more SAN entries, wherein the at least one digital certificate comprises a certificate chain that includes a first certificate and a second certificate, each certificate in the certificate chain having an expiration date, wherein the first certificate precedes the second certificate in the certificate chain, and wherein the step of determining whether the at least one digital certificate is valid further comprises; identifying whether the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; and determining that the at least one digital certificate is invalid when the first certificate'"'"'s expiration date is later than the second certificate'"'"'s expiration date; determining that the one or more subject alternative names (SAN) in the at least one digital certificate does not have the one or more DNS names; determining that the at least one digital certificate is invalid when there are two or more of the one or more DNS names used to access the server; and determining that the at least one digital certificate is not invalid when there is only one of the one or more DNS names and when a common name received from the server matches the one DNS name. - View Dependent Claims (13)
-
Specification