Method to automate the renewal of digital certificates

• US 7,653,810 B2
• Filed: 08/13/2004
• Issued: 01/26/2010
• Est. Priority Date: 08/15/2003
• Status: Active Grant

• Current Assignee: Venafi,Inc.
• Original Assignee: Venafi,Inc.
• Inventors: Hollobon, Timothy, Thornton, Russell S., Seegmiller, Jayson, Hodson, Benjamin
• Primary Examiner(s): Barron, Jr.; Gilberto
• Assistant Examiner(s): ARMOUCHE, HADI S
• Application Number:
  US10/917,863
• Publication Number:
  US 20050081028A1
• Time in Patent Office: 1,992 Days
• Field of Search: 713155-156, 713/158, 713/175, 713/180, 713/201, 380/30, 380/277, 715/741, 709/207, 726 5- 7
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/34 Encoding or coding, e.g. Huffman coding or error correction
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

The disclosure relates to the management of PKI digital certificates, including certificate discovery, installation, verification and replacement for endpoints over an insecure network. A database of certificates may be maintained through discovery, replacement and other activities. Certificate discovery identifies certificates and associated information including network locations, methods of access, applications of use and non-use, and may produce logs and reports. Automated requests to certificate authorities for new certificates, renewals or certificate signing requests may precede the installation of issued certificates to servers using installation scripts directed to a particular application or product, which may provide notification or require approval or intervention. An administrator may be notified of expiring certificates, using a database or scanning or server agents. Interaction with certificate authorities may be by an abstractor providing a common intefface for issuing signing requests to disparate certificate authorities. Digital certificate management may also be applied to network-connecting client devices.

Claims

1. A method for automatically renewing digital certificates in a managed network using a certificate authority abstractor, said method comprising the steps of:

receiving notifications regarding a managed digital certificate;

identifying a managed server corresponding to a digital certificate referred to in a received notification from a certificate authority;

communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;

communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;

receiving the selection of a certificate authority;

transmitting a generated and received certificate signing request to a certificate authority, said transmitting being accomplished through the execution of a script corresponding to the selected certificate authority, the script being one of a set of scripts;

receiving a certificate signed by a certificate authority generated from a certificate signing request;

identifying a destination managed server corresponding to a received certificate signed by a certificate authority;

installing a received certificate signed by a certificate authority to an identified destination managed server; and

configuring an identified destination managed server to use a private key corresponding to an installed certificate.

2. A method according to claim 1 further comprising the steps of:

generating a new asymmetric key pair,

and installing a generated private key of a new asymmetric key pair to an identified destination managed server; and

wherein a generated certificate signing request includes a generated public key of a new asymmetric key pair.

3. A method according to claim 1, further comprising the step of installing a received certificate signed by a certificate authority by a network interface provided by a web interface of a web server installed to an identified destination managed server.

4. A method according to claim 1, further comprising the step of installing a received certificate signed by a certificate authority by a shell interface to an identified destination managed server.

5. A method according to claim 1, further comprising the step of installing a received certificate signed by a certificate authority by an agent program installed to an identified destination managed server.

6. A method according to claim 1, further comprising the step of restarting a destination server program.

7. A method according to claim 1, further comprising the step of restarting a destination server computer.

8. A method according to claim 1, further comprising the step of notifying an administrator to restart a destination server program or destination server computer.

9. A method according to claim 1, further comprising the step of confirming the installation of a received certificate to a destination server following the performance of a set of installation steps.

10. A method according to claim 9, further comprising the step of generating an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.

11. A method according to claim 1, further comprising the steps of:

informing an administrator of a certificate for which a notification has been received from a certificate authority;

prior to said transmitting, requesting approval to renew a certificate for which a notification has been received from a certificate authority; and

receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed.

12. A method according to claim 1, further comprising the steps of:

following said receiving a certificate signed by a certificate authority, informing an administrator of that renewed certificate;

prior to said installing, requesting approval to install a renewed certificate received from a certificate authority; and

receiving, in response to a request for approval, an indication from an administrator that a renewed certificate is to be installed.

13. A method according to claim 1, further comprising the step of storing a received certificate signed by a certificate authority to a backup storage device.

14. A method for automatically renewing digital certificates in a managed network using a certificate authority abstractor, said method comprising the steps of:

receiving notifications from a certificate authority regarding a managed digital certificate;

identifying a managed server corresponding to a digital certificate referred to in a received notification from a certificate authority;

communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;

receiving the selection of a certificate authority;

transmitting a generated and received certificate signing request to a certificate authority, said transmitting being accomplished through the execution of a script corresponding to the selected certificate authority, the script being one of a set of scripts;

receiving a certificate signed by a certificate authority generated from a certificate signing request;

identifying a destination managed server corresponding to a received certificate signed by a certificate authority;

installing a received certificate signed by a certificate authority to an identified destination managed server;

configuring an identified destination managed server to use a private key corresponding to an installed certificate; and

performing a restart action selected from the group of commanding an identified destination managed server to perform a restart, commanding an identified destination managed server to restart and notifying an administrator to restart a destination server program or destination server computer.

15. A method according to claim 14, further comprising the steps of:

generating a new asymmetric key pair; and

installing a generated private key of a new asymmetric key pair to an identified destination managed server.

16. A method according to claim 14, further comprising the step of installing a received certificate signed by a certificate authority by a network interface provided by a web interface of a web server installed to an identified destination managed server.

17. A method according to claim 14, further comprising the step of installing a received certificate signed by a certificate authority by a shell interface to an identified destination managed server.

18. A method according to claim 14, further comprising the step of installing a received certificate signed by a certificate authority by an agent program installed to an identified destination managed server.

19. A method according to claim 14, further comprising the step of confirming the installation of a received certificate to a destination server following the performance of a set of installation steps.

20. A method according to claim 19, further comprising the step of generating an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.

21. A method according to claim 14, further comprising the steps of:

informing an administrator of a certificate for which a notification has been received from a certificate authority;

prior to said transmitting, requesting approval to renew a certificate for which a notification has been received from a certificate authority; and

receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed.

22. A method according to claim 14, further comprising the steps of:

following said receiving a certificate signed by a certificate authority, informing an administrator of that renewed certificate;

prior to said installing, requesting approval to install a renewed certificate received from a certificate authority; and

receiving, in response to a request for approval, an indication from an administrator that a renewed certificate is to be installed.

23. A method for automatically renewing digital certificates in a managed network using a certificate authority abstractor, said method comprising the steps of:

receiving notifications from a certificate authority regarding a managed digital certificate;

receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed or installed;

identifying a managed server corresponding to a digital certificate referred to in a received notification from a certificate authority;

communicating with the managed server, the communicating causing the managed server to generate a new asymmetric key pair, the communicating further causing the managed server to generate a certificate signing request and return the request to the managing device;

receiving the selection of a certificate authority;

transmitting a generated and received certificate signing request to a certificate authority, said transmitting being accomplished through the execution of a script corresponding to the selected certificate authority, the script being one of a set of scripts;

receiving a certificate signed by a certificate authority generated from a certificate signing request;

identifying a destination managed server corresponding to a received certificate signed by a certificate authority;

installing a received certificate signed by a certificate authority to an identified destination managed server, the installing being performed by accessing the identified destination managed server using a corresponding object of said authentication objects, the installing utilizing a protocol selected from the group of a shell interface, an agent interface and a network interface provided by a web interface of a web server;

configuring an identified destination managed server to use a private key corresponding to an installed certificate; and

performing a restart action selected from the group of commanding an identified destination managed server to perform a restart, commanding an identified destination managed server to restart and notifying an administrator to restart a destination server program or destination server computer.

24. A method according to claim 23, further comprising the step of confirming the installation of a received certificate to a destination server following the performance of a set of installation steps.

25. A method according to claim 24, further comprising the step of generating an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.