Central and implicit certificate management

• US 9,344,282 B2
• Filed: 03/22/2011
• Issued: 05/17/2016
• Est. Priority Date: 03/22/2011
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Yoo, Won, Mares, Carlos Aguilar, Hilmo, Wade
• Primary Examiner(s): ABYANEH, ALI S
• Application Number:
  US13/069,032
• Publication Number:
  US 20120246475A1
• Time in Patent Office: 1,883 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

Facilitating management of digital certificates is addressed. More specifically, digital certificates as well as public and private keys can be stored in a centrally accessible location and dynamically acquired from the location as needed. Additionally, binding of digital certificates and associated keys can be implicit and determined as a function of a host name provided during protocol negotiation, for example.

Claims

1. A method of facilitating certificate management, comprising:

employing at least one processor configured to execute computer-executable instructions stored in memory to perform the following acts;

receiving a request, including a host name, for secure communication from a client;

determining a digital certificate name based at least on the host name and a digital certificate naming convention;

confirming that a digital certificate exists on a network-accessible central store by comparing the digital certificate name with a set of one or more digital certificate names stored locally on a server;

acquiring the digital certificate from the network-accessible central store; and

returning the digital certificate to the client in response to the request.

2. The method of claim 1 further comprising acquiring the host name from a communication-channel negotiation protocol.

3. The method of claim 1 further comprising storing a local copy of the digital certificate on the server.

4. The method of claim 3 further comprising writing over the local copy of the digital certificate on the server with an updated digital certificate.

5. The method of claim 4, writing over the local copy in response to a change notification from the network-accessible central store.

6. The method of claim 1 further comprising binding a private key corresponding to the digital certificate to the server implicitly as a function of the host name.

7. The method of claim 6 further comprising acquiring the private key from the network-accessible central store.

8. The method of claim 1 further comprises:

receiving a message encrypted with a public key associated with the digital certificate;

decrypting the message with a private key associated with the digital certificate to reveal a number; and

generating a symmetric key from the number.

9. The method of claim 8 further comprises securely communicating with the client with symmetric encryption using the symmetric key.

10. A system configured to facilitate certificate management, comprising:

a processor coupled to a memory, the processor configured to execute the following computer-executable components stored in the memory;

a first component configured to determine a digital certificate name based on a host name received with a request for secure communication and a naming convention;

a second component configured to acquire a digital certificate from a network-accessible central store automatically after confirming the digital certificate exists on the network-accessible central store by comparison of the digital certificate name with a set of one or more names stored locally on a server; and

a third component configured to return the digital certificate in response to the request.

11. The system of claim 10, further comprises a fourth component configured to save the digital certificate in a local cache of the server.

12. The system of claim 11 further comprises a fifth component configured to initiate replacement of the digital certificate with a new version of the digital certificate.

13. The system of claim 10, the host is a web server.

14. A computer-readable storage device having instructions stored thereon that enables at least one processor to perform a method upon execution of the instructions, the method comprising:

identifying a file, including a digital certificate, for a web server as a function of a domain name for the web server and one or more file names stored locally on the web server indicative of one or more corresponding files stored on a network-accessible central store, the file names are based on names of domains for web servers to which the files are implicitly bound;

requesting the file from the network-accessible central store;

receiving the file from the network-accessible central store; and

saving the file to a local cache on the web server.

15. The computer-readable storage device of claim 14, the method further comprising replacing the file with an updated version of the file upon notification by the network-accessible central store.

16. The computer-readable storage device of claim 14, the method further comprises acquiring the domain name from a client during negotiation of a secure communication channel.

17. The computer-readable storage device of claim 16, the method further comprises sending the file to the client.

18. The computer-readable storage device of claim 17, the method further comprises:

receiving a message encrypted with a public key included in the file;

decrypting the message with a private key corresponding to the public key to reveal a number; and

generating a symmetric key from the number.

19. The computer-readable storage device of claim 18, the method further comprises communicating with the client with symmetric encryption employing the symmetric key.