US20050081029A1 - Remote management of client installed digital certificates - Google Patents

Remote management of client installed digital certificates Download PDF

Info

Publication number
US20050081029A1
US20050081029A1 US10/917,964 US91796404A US2005081029A1 US 20050081029 A1 US20050081029 A1 US 20050081029A1 US 91796404 A US91796404 A US 91796404A US 2005081029 A1 US2005081029 A1 US 2005081029A1
Authority
US
United States
Prior art keywords
certificate
certificates
server
retrieved
network
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US10/917,964
Inventor
Russell Thornton
Benjamin Hodson
Jayson Seegmiller
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Venafi Inc
Imcentric Inc
Original Assignee
Imcentric Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Imcentric Inc filed Critical Imcentric Inc
Priority to US10/917,964 priority Critical patent/US20050081029A1/en
Assigned to IMCENTRIC, INC. reassignment IMCENTRIC, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: HODSON, BENJAMIN, SEEGMILLER, JAYSON, THORNTON, RUSSELL S.
Publication of US20050081029A1 publication Critical patent/US20050081029A1/en
Assigned to IMCENTRIC, INC reassignment IMCENTRIC, INC ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: HODSON, BENJAMIN, SEEGMILLER, JAYSON, THORNTON, RUSSELL S.
Assigned to VENAFI, INC. reassignment VENAFI, INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: HODSON, BENJAMIN, HOLLOBON, TIMOTHY, SEEGMILLER, JAYSON, THORNTON, RUSSELL S.
Assigned to SILICON VALLEY BANK reassignment SILICON VALLEY BANK SECURITY AGREEMENT Assignors: VENAFI, INCORPORATED
Assigned to SILICON VALLEY BANK reassignment SILICON VALLEY BANK SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: VENAFI, INC.
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823Network architectures or network communication protocols for network security for authentication of entities using certificates
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/04Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/20Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3271Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/34Encoding or coding, e.g. Huffman coding or error correction
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/56Financial cryptography, e.g. electronic payment or e-cash
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/76Proxy, i.e. using intermediary entity to perform cryptographic operations
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105Multiple levels of security

Definitions

  • the claimed inventions relate generally to management of public key infrastructure server networks, and more particularly to systems that can automate the installation, renewal, detection or management of public key infrastructure digital certificates in a secure network system.
  • FIG. 1 depicts conceptual elements of asymmetric cryptography.
  • FIG. 2 shows conceptual elements of a process useful to secure data against unauthorized access.
  • FIG. 3 shows conceptual elements of a process useful to digitally sign data.
  • FIGS. 4A, 4B , 4 C and 4 D depict a method of establishing secure communications between a client and a server over a network.
  • FIG. 5 depicts components of a certificate management system providing certificate management functions.
  • FIG. 6 shows components of an integrated certificate management system.
  • FIG. 7 depicts a certificate management system whereby certificate management is conducted from an external network location from an enterprise
  • FIG. 8 shows a simplified method of automatically receiving and installing signed certificates from certificate authorities.
  • FIG. 9 depicts a simplified certificate renewal process.
  • FIG. 10 shows an automated simplified method of monitoring and renewing certificates.
  • FIG. 11 shows conceptual elements of a certificate authority abstractor.
  • FIG. 12 illustrates a procedure for discovering network certificates.
  • FIG. 13 shows an exemplary process permitting a server device to authenticate a client component associated with a user, account, or other association.
  • FIG. 14 shows a system useful for managing client certificates and providing network services.
  • FIG. 15 shows a representative home page for an exemplary certificate manager.
  • FIG. 16 depicts a representation of a manage certificates screen for an exemplary certificate manager.
  • FIG. 17 shows a representation of a manage servers screen for an exemplary certificate manager.
  • FIG. 18 shows a sample screen for managing groups in an exemplary certificate manager.
  • FIG. 19 shows a representative screen for the management of registered users in the exemplary certificate management system.
  • FIG. 20 shows a representative screen of an exemplary certificate manager whereby network settings may be input.
  • FIG. 21 depicts a representative screen containing entries for custom fields for managed certificates in an exemplary certificate manager interface.
  • FIG. 22 depicts a representative screen by which the certificate database settings may be maintained in an exemplary certificate manager interface.
  • FIG. 23 shows a representative screen by which default certificate information may be configured in an exemplary certificate manager.
  • FIG. 24 shows an exemplary screen in which replicator settings may optionally be configured in an exemplary certificate manager.
  • FIG. 25 shows a screen for entering network discovery settings in an exemplary certificate manager.
  • FIG. 26 shows a screen for entering configuration of the intermediate root certificate authority settings of an exemplary certificate manager.
  • FIG. 27 depicts a screen whereby the log archival settings may be set in an exemplary certificate manager.
  • FIG. 28 depicts a representative screen permitting the management of certificates discovered but not yet completed in an exemplary certificate manager.
  • FIG. 29 depicts a screen for completing or removing discovered server records to or from an exemplary certificate manager database.
  • FIG. 30 shows a screen whereby a report may be selected from a list of available reports, generated and printed in an exemplary certificate manager interface.
  • FIG. 31 shows a historical report of intermediate root certificate authority scans as generated by an exemplary certificate manager.
  • FIG. 32 depicts a view of an error log generated by an exemplary certificate manager.
  • FIG. 33 depicts a view of an alert log generated by an exemplary certificate manager.
  • FIG. 34 depicts a view of a user log generated by an exemplary certificate manager.
  • FIG. 35 shows a view reporting all managed certificates in an exemplary certificate manager interface.
  • FIG. 36 shows a view reporting all managed servers in an exemplary certificate manager interface.
  • FIG. 37 shows a representative login screen for an exemplary certificate manager.
  • FIG. 38 shows a representative screen for viewing the entries of particular users registered in an exemplary certificate manager.
  • FIG. 39 shows a representative screen for editing user entries in an exemplary certificate manager.
  • FIG. 40 shows a representative screen of a view of certificate information for an exemplary certificate manager.
  • FIG. 41 depicts a screen in which an existing certificate record may be edited for an exemplary certificate manager.
  • FIG. 42 depicts a screen for editing a group in an exemplary certificate manager.
  • FIG. 43 shows a report of user actions generated by an exemplary certificate manager.
  • FIG. 44 shows a report of changes to a certificate database generated by an exemplary certificate manager.
  • FIG. 45 shows a report of changes to a server database generated by an exemplary certificate manager.
  • FIG. 46 shows a manage servers screen in an exemplary certificate manager.
  • FIG. 47 shows a screen whereby an administrator may enter information about a new certificate for an exemplary certificate manager.
  • FIG. 48 shows a screen for adding users to a group in an exemplary certificate manager.
  • FIGS. 49, 50 , 51 , 52 and 53 depict exemplary screens generated in a secure client agent installation.
  • FIGS. 54 and 55 show login screens to an exemplary secure client service.
  • FIG. 56 shows a screen of an exemplary secure client service indicating the absence of a certificate on the client.
  • FIGS. 57 and 58 depict screens generated through the process of registering a client device with an exemplary secure client service.
  • FIG. 59 shows a screen for specifying authorized actions for a client device in an exemplary secure client service.
  • FIG. 60 shows a client device configuration selection screen of an exemplary secure client service.
  • FIG. 61 shows a transaction report of an exemplary secure client service.
  • FIG. 62 shows a screen for specifying authorized actions for a client device and a provider in an exemplary secure client service.
  • FIG. 63 shows a screen for entering user information in an exemplary secure client service.
  • PKI Public key infrastructure
  • Data encryption generally is of one of two types, which are symmetric and asymmetric cryptography.
  • a single key is shared by the encryptor and the decryptor, i.e. the encryption key can be used to decrypt data encrypted with that key.
  • FIG. 1 the basic concepts of asymmetric cryptography are depicted.
  • a key generation process 10 is used to generate a pair of related keys, which are an encryption key 11 and a decryption key 12 .
  • the cryptographic algorithms are selected such that if either one of the encryption key 11 or decryption key 12 is known, the other key is difficult to discover.
  • the selection of appropriate algorithms and keys is well known in the art, and will not be expounded upon further here. Further in FIG.
  • Data 13 is to be sent to a receiver in a secure fashion.
  • Encryption key 11 is applied to data 13 , producing encrypted data 14 , perhaps in a single message or a group of packets.
  • the encrypted data is sent to the receiver through the insecure network, thereby preventing access to the original data 13 by undesirable parties.
  • a receiver applies decryption key 12 to the encrypted data 14 , producing the original and decrypted data 15 . Because the keys needed to encrypt and decrypt are different, this type of cryptography is called asymmetric.
  • one of the keys may be made public, which may serve to either to secure data from unauthorized access or digitally sign transmitted data. By digitally signing data, the receiver may verify that the received data comes from a particular sender and that the data has arrived unmodified.
  • FIG. 2 concepts of a process useful to secure data against unauthorized access are depicted.
  • an asymmetric key pair is generated beforehand, which include encryption key 21 and decryption key 25 .
  • Encryption key 21 is made public, i.e. it is provided to others wishing to send encrypted data to a receiving party holding decryption key 25 , which is held private by that receiving party.
  • a sending party uses the public key 21 to encrypt secret data 20 , producing encrypted data 22 .
  • Encrypted data is sent to the receiving party by way of a network link 23 , which might be insecure and/or subject to interception.
  • the received encrypted data 24 is then applied to the private decryption key 25 , producing decrypted data 26 identical to the original secret data 20 .
  • the security of the data relies on the difficulty of producing the decryption key 25 from the public encryption key 21 and the inaccessibility of private key 35 .
  • Data 30 is to be provided to a receiving party over in insecure network link 37 , i.e. the sending and/or receiving parties do not control the link sufficiently to prevent a third party sending data to the receiver masquerading as the sending party.
  • Data 30 is first encrypted with a privately held encryption key 31 , producing an encrypted form 32 of the original data.
  • the encrypted data 32 is then sent to the receiving party 33 over an untrusted network link, which might be the same or a different link as the one used for transmission 37 .
  • the received encrypted data 34 is then decrypted with the public decryption key 35 , producing decrypted data 36 .
  • the decrypted data may then be compared to the unencrypted data provided through transmission 37 , which may be considered to be from the sending party if the two data sets are identical.
  • this procedure relies on the difficult of producing the private encryption key from the public decryption key, making unlikely the prospect that the private key could ever be discovered and used by a malicious party.
  • public key 35 is transferred through a controlled process that permits the receiving party to know the original source party of that key.
  • an additional step produces a hash value of the data to be signed 30 .
  • the hash function may be chosen to produce a substantially unique value for variations of input data, i.e. the hash value will change for any change to the input data, even minute changes.
  • the hash function may also be chosen to be substantially non-reversible, making extremely difficult the task of finding a changed data set that produces the same hash value without exaustively iterating through an extremely large number of possible changed data sets.
  • the hash value may be encrypted rather than the original data, and the verification includes the step of comparing the decrypted hash value against a hash value calculated from the received data to be verified.
  • the sender and receiver must apply the same hash function.
  • PKI Public key infrastructure
  • PKI may include a sender computer and a receiver computer, with software for encrypting and decrypting messages, such as email messages.
  • PKI provides a facility for the retrieval of a public key from the data sender or the intended recipient, permitting encrypted communication without the need of physical public key transfers.
  • public keys are provided by way of certificates.
  • a PKI certificate is a data structure that provides a public key to others. PKI certificates may be made available by way of network servers to others with access to that network, thus providing an efficient way of distributing public keys.
  • certificates also include a signature to verify the source of the certificate.
  • PKI keys are provided in pairs, one being held private and the other distributed publicly.
  • the recipient of a public key may communicate with the holder of the corresponding public key in a secure fashion, but if the recipient obtained the public key over a network he may not know what the source of that public key is. It is therefore possible, in that circumstance, for a third party to trick or “spoof” the recipient party into holding communications with him, if he can provide a substitute certificate to the recipient party and if the third party's communications are sufficiently authentic to complete the deception.
  • a third party may form an encrypted communications link with a destination server, provide a substitute certificate to a recipient, and masquerade as the destination server by passing data between the recipient party and the destination server. The third party may then view all traffic between the recipient and the destination server unencrypted.
  • This technique is often referred to as a “man in the middle attack”, and can be a serious problem for many entities, such as banks or on-line stores, wishing to correspond with customers, employees and others over public and/or uncontrolled networks.
  • CAs Certificate Authoritys
  • Verisign and Entrust have created services for authenticating certificates. These entities hold themselves out as entities of trust, providing certificate signing services for certificate verification.
  • the operation of a CA is generally as follows. First, a CA produces a set of asymmetric key pairs, and therefrom a set of root certificates. The private keys are secretly held by the CA, while the root certificates containing public keys are provided to others through controlled distribution. These root certificates are made widely available to the public, for example in the distribution of web browsers, operating systems or other software. Next, a CA receives unsigned certificates in Certificate Signing Requests (CSRs), which contain sufficient information to produce a signed certificate and optionally to verify the source of the individual CSRs.
  • CSRs Certificate Signing Requests
  • the CA may attempt to validate the CSR as coming from a known party, for example through the use of a password or other confidential information from the customer.
  • Signed certificates are produced by choosing a root certificate, signing the certificate with the private key of the chosen root certificate, including identification of the root certificate with the signed certificate and returning the signed certificate to the requesting party.
  • a standard certificate specification referred to as X509 has been established to provide a common readable certificate format for publicly accessible utilities.
  • This format will be recognized by those of ordinary skill in the art, and will be only briefly commented herein.
  • the X509 format provides an example of a usable certificate format, noteworthy format items being a version number (the version of the X509 standard being used), a public key, a signature value, a denotation of the signature algorithm used, a period of validity, and an issuer identification among other format items.
  • this format has seen recent widespread use, especially in https and secure shell technologies, other formats may be used with equally good results.
  • a client receiving a certificate from a server may verify a signed certificate by doing the following. First the client may review the certificate to see what certificate was used for signing (i.e. a parent certificate). If the parent certificate is recorded at the client's location, it may locate it and extract the public key. If the parent certificate is not known to the client, the client may request the parent certificate from an accessible server. Upon receipt of the parent certificate, the client may extract the public key. Having the public key, the client may then verify the signing of the child certificate. If the parent certificate was obtained remotely, the client may continue by verifying the signing of the parent certificate. That procedure may continue through a chain of certificates until reaching a known certificate, or reaching an unsigned or unavailable certificate. Should the process end without reaching a known certificate, the client may consider the child certificate (and other certificates in the chain) to be untrustworthy, and may provide a warning to a user.
  • a parent certificate If the parent certificate is recorded at the client's location, it may locate it and extract the public key. If the parent certificate is not known to
  • FIGS. 4A through 4D a method of establishing secure communications between a client and a server over a network is depicted.
  • a negotiation takes place between the client and the server. This involves client 40 sending a request to server 41 to initiate negotiation. If multiple communication modes are available, i.e. if more than one cryptographic algorithm is available for use, one of client 40 or server 41 will chose a mode.
  • sever 41 transmits a certificate to client 40 containing a public key, as shown in FIG. 4B .
  • the client may verify the server's certificate, if desired.
  • client 40 chooses a secret key to be shared with server 41 .
  • the choosing of secret key may be performed so as to avoid use of keys previously used, and may also be chosen to avoid predictability, for example by choosing a key from a random number generator.
  • Client 40 using the server's public key, then encodes the secret key in a message subsequently sent to server 40 , as in FIG. 4C .
  • Secure communication may then be conducted using a symmetric encryption technique using the shared secret key between client 40 and server 41 , as in FIG. 4D .
  • a certificate is normally used for a limited amount of time for a number of reasons. Certificates are priced according to the length of the validity period. This pricing is not merely for profit making, as there is an expense associated with maintaining the certificate authority infrastructure, i.e. maintaining servers that can validate issued certificates. A service provider may therefore not wish to purchase a certificate lasting a lengthy period of time, particularly if the certificate is to be used in a test or uncertain venture. Additionally, the longer a certificate is in existence and/or service, the more likely the private key will be discovered.
  • An attack on a PKI key pair is thought to best be performed by an exhaustive search for a private key that decrypts intercepted encrypted data. Test searches are known to have been successfully conducted using supercomputer clusters in a period of months against keys of typical size.
  • a longer period of use means that, first, an attacker will have more time to perform the search and, second, an attacker may have more intercepted data to validate the resulting possible private keys that are found. Additionally, certificate validity periods may be especially important when considering insiders, administrators and other internal employees having access to SSL servers may have additional opportunity to compromise private keys through their administrative access.
  • the causes of certificate renewal are many in number, a few of which are noted here.
  • An entity may fail to note the expiration of a certificate.
  • the certificate authority may send a reminder by postal or e-mail, with some chance of mis-delivery.
  • the certificate authority may have a postal or e-mail address that has changed due to the entity moving or changing its domain name. If the entity is located overseas, there is also an increased opportunity for the notification to suffer delay. If the entity maintains a manual certificate database, there is a chance for an erroneous or missing entry.
  • a notification may be missed by an administrator, which individual may be busy, on vacation, incompetent or terminated. For larger organizations, there may be several administrators multiplying that problem. Additionally, the process of renewing certificates has been a manual process, and subject to typos and other technical errors.
  • a database is maintained containing records relating to inventoried certificates. Each record identifies a certificate and a server to which the certificate resides or is installed. For each certificate, an expiration date or time may also be noted, by which the expiring of certificates may be noticed. Likewise, an expiration period may also be noted. Notation may also be made in certificate records for an issuing certificate authority. Other items of data relating to certificates may also be tracked, for example the common name, organization, an identification of a responsible individual, the strength of the encryption keys, etc. Expired certificates may also be tracked in a database, if desired.
  • Such a certificate database may be maintained using common file formats, for example CSV or dBase formats without becoming unwieldy, as the number of certificates tracked in a typical organization will be relatively small.
  • a certificate database might also be maintained in a relational database server, which may provide additional search, remote access, encryption and other helpful database functions. Access to a certificate database may be controlled. In the exemplary system access to the database is provided only to authenticated persons and/or applications.
  • a certificate database may take many other forms as desired, the details of which are not particularly important.
  • Entries and modifications to the certificate database may be performed manually, or applications may be provided for managing certificate entries in the database through the use of graphical user interfaces, web interfaces, or many other techniques. Entries may also be made by a certificate scanner, which will be described shortly.
  • a database of related servers i.e. servers on which certificates reside or servers within a defined network, may also be kept. Such a server database may be kept separately from a certificate database, or may be integrated in the same database, file or data structures.
  • a certificate database may be maintained to provide information regarding the state of certificates in a network at given times. This may be used, in one example, by an administrator to identify certificates due to expire, or certificates that have expired. In another use, certificates may be related to servers to identify unused or duplicate certificates. In yet another use, a survey may be conducted using the database to identify certificate authorities being used, a schedule of certificate renewals, encryption strengths, certificates on a particular domain, or other reviews useful to manage a secure network system.
  • a certificate inventorying system may additionally include a certificate discovery tool for locating certificates in a chosen network.
  • the discovery tool may receive as input a network address range, which in one example includes an IP address and subnet mask for an IP protocol network. In another example, a list of IP address ranges are given. For other network types, a network name, SSID name or other identifier may be used in accordance with the network's addressing standards.
  • a procedure for discovering network certificates is described.
  • a network address range is input and received by the discovering system.
  • an empty database is created in step 1204 for holding the resulting certificate information.
  • the procedure iterates through the address range in step 1206 , which includes a process illustrated in further detail in steps 1212 through 1222 .
  • a search function is available which may report devices registered on the network. In that case, the procedure may iterate over the registered devices.
  • the resulting database may be stored, or alternatively it may be merged with an existing database, particularly if the results of a prior scan are available.
  • an existing certificate database might be directly modified, adding newly discovered certificates and optionally removing certificates no longer in existence.
  • steps 1212 through 1222 are executed in a subroutine.
  • an attempt to connect with the device at the currently iterated device is made over the network, as in step 1212 . If the attempt is unsuccessful, the subroutine may exit, as in step 1214 . Should a successful connection be made, an attempt to retrieve a certificate will be made, as in step 1216 . If a certificate is not available, decision 1218 causes an exit of the subroutine, as there is no certificate information to record. Otherwise, the subroutine parses a received certificate for items of interest, as in step 1220 .
  • the items of interest may be any information related to the received certificate, but might be a certificate identifier, an expiration date, in one example.
  • the parsed information may then be recorded to an entry in the scan database, as in step 1222 , optionally with other related information such as the current network address, server type, or other information.
  • the procedure shown in FIG. 12 shows a single attempt to connect with a network device.
  • This attempt might be, for example, an attempt to establish an SSL handshake over IP port 443 , which is the port commonly used for the HTTPS secure connection service.
  • IP port 443 is the port commonly used for the HTTPS secure connection service.
  • the SSL certificate is provided to the connector, which is one way it may be retrieved.
  • Other ports or methods may be used to attempt the connection and retrieval of certificates.
  • an attempt may be made to mount a device's file system (or a portion thereof) through an NFS or SMB connection. Following establishment of a connection, a search may be conducted through the exported file system to locate probable certificates, which can be verified by attempting a parsing of the suspected file.
  • a similar and further alternate method attempts to establish a secure shell or telnet connection using a set of commonly used usemames and passwords.
  • an attempt may be made to access an administrator interface provided by a web server or other application providing access to certificates.
  • Other methods of obtaining certificates may be available, depending on the devices attached to the network, which may be incorporated to provide improved scanning coverage.
  • a discovery system may provide for log production of the discovery process.
  • the log might show any of items such as: addresses scanned, ports scanned, failed and/or successful connection attempts, addresses with no response, certificate identifiers and other certificate information, server software types and version numbers, modifications to an existing certificate database, and many other items as desired.
  • a discovery system may additionally combine the results of scans conducted at different times, which may be useful to catch servers which may have been inoperative at a particular time. Although the procedure of FIG. 12 attempts only a single connection, the procedure may be modified to perform two or more connection/retrieval techniques. In that case, the log may additionally reflect the techniques used as well as technique-specific information.
  • the result of a discovery process may be a database providing an audit of certificate conditions on a network, which may be utilized by administrators in certificate maintenance activities.
  • a discovery process may be conducted manually, by software, by a network appliance, or any other object of execution as desired.
  • a discovery process is conducted by a software application installed to a host computer on a network.
  • the software may be provided on a disk or other medium, and may be packaged with other software and instructional items as a stand-alone software product.
  • the discovery process may be conducted by a dedicated network appliance, which may provide a user interface through the HTTP or HTTPS protocols, or by other user interface type.
  • the database may reside on the appliance, or may be created or deposited to another computing device, which might be an RDBMS or NAS device.
  • a database or log might also be sent in an e-mail message, or might be sent to a printing device for a hardcopy by the appliance.
  • the appliance includes other functions related to certificate management, including software for renewing and installing certificates. Many other variations are possible and may be fashioned in accordance with the desires and preferences of the implementer.
  • a certificate discovery system may detect certificates that are not used, and may report those unused certificates to an administrator. Discovered certificates may also be archived, avoiding the need to provisioning of new certificates should a server crash or otherwise become inoperable. If private keys are also discovered, those can also be archived if desired. Other systems as disclosed below may also report unused certificates or archive certificates as desired, managed or otherwise.
  • an automated system receives a notification from a certificate authority, as in step 81 .
  • a notification may take place by email, as described below, through polling on a web interface, or other notification facilities.
  • an alarm or timeout may initiate the process rather than a notification, which may be set prior to or about the time of expiration, or alternately may be set to according to a predefined period after certificate issuance.
  • other events may trigger the notification of a certificate due to be renewed, for example according to risk profiles or reports from other systems, such as an intrusion detection system, that a server has been compromised.
  • the system tests whether the notification concerns a new certificate, as in step 82 . If a new certificate is referred to or included in the notification message, the certificate is extracted in step 83 from wherever it is located. It may not be apparent which server is to be the target of the new certificate installation, and therefore a destination server is identified in step 84 . The certificate may then be installed to the destination server, as in step 85 . The process may repeat with the reception of additional notifications and may be executed as frequently as needed.
  • the installation of newly issued certificates may proceed as follows. First, it may be necessary to request and receive a certificate from a certificate authority, if it is not desired to use an internally-generated certificate.
  • a common method of certificate receipt is by e-mail received at the same computer from which a certificate signing request was submitted.
  • For a signed certificate received from a certificate authority it may be necessary to determine a destination server for the certificate upon receipt. For example, if the certificate is a renewed certificate for a certificate about to expire, it may be desirable to install the certificate to the server storing the expiring certificate. Alternatively, a certificate may under some circumstances be held prior to installation. In one situation, it may be desirable to request renewed certificates well in advance of the expiration of old certificates.
  • the old certificate is, in that situation, allowed to age before installing the renewal certificate.
  • a collection of servers may serve the same network address, through network address translation or other techniques.
  • a collection of renewal certificates may, in that situation, be maintained in a store until needed, at which time the oldest renewal certificate may be installed to servers having certificates about to expire.
  • a fresh or renewal certificate is associated to a destination network server at the time it is signed.
  • a destination network server is therefore identified as corresponding to the received signed certificate.
  • the server type is determined, in order to choose the proper method of installation. For example, if the server is serving web pages over the HTTPS protocol, there are a number of possible web server products that might be installed.
  • the Apache web server might dictate that certificates be installed through a file placement to a specified directory, a modification of particular configuration files (especially for non-renewed certificates), and restarting of the web server daemons.
  • an iPlanet web server might provide a web administrator interface.
  • the text of the certificate might be cut and pasted from an email into a text entry field, following which the web administrator installs the certificate text in the correct location. It may also be necessary to restart the PKI application and/or computer to flush the old certificates out of memory. Installation scripts might be written to support a number of PKI platforms, for example iPlanet, Apache, IIS, Netscape, Websphere in a multiplicity of versions.
  • an authentication step will be required to access the certificate store on the destination device. This may involve offering an administrator username and password, a passphrase, a certificate or other authorization object.
  • An authorization object may be stored within or accessible to the installation system prior to the installation activities.
  • the installation system has access to installation instructions which constitute a set of installation steps for installing certificates to particular server types.
  • These installation instructions may take many forms, the content of which will depend on the type of interface used to perform the installation steps.
  • the installation instructions define a set of shell commands.
  • An exemplary set of shell commands for installing a certificate to an apache server might be: (1) log onto the destination server using an SSH connection and using a pre-stored username and password, (2) use the “cd” command to change the current directory to the certificate directory store, i.e. “cd/etc/ssl/apache”, (3) remove the old certificate, i.e. “rm-f./server.crt”, (4) install the new certificate, i.e. “echo MIIDBTCCA . . . >server.crt”, (5) install the new private key, i.e. “echo MIICXQ . . .
  • the directories given above may vary between operating system distributions and even between installations if an administrator has changed the directory configuration from the default. If it is desired to support an expanded range of server configurations, it may be desirable to examine the server configuration files.
  • the location of the ssl certificate and key can be found using the commands “grep SSLCertificateFile /etc/httpd/conf.d/41_mod_ssl.default-vhost.conf” and “grep SSLCertificateKeyFile /etc/httpd/conf.d/ 41 _mod_ssl.default-vhost.conf”, assuming that root access is available. Similar installation instructions may be fashioned through a study of other server products to be supported.
  • a second installation instructional example utilizes file transfer protocols to deposit the certificate and key to a destination server.
  • This example includes the steps of (1) using the scp protocol to transfer the certificate to the server, i.e. “scp -B server.crt /etc/ssl'server.crt”, (2) use the scp protocol to transfer the private key to the server, i.e. “scp -B server.key /etc/ssl/server.crt”, and (3) notify the administrator that the server needs to be restarted, for example by an e-mail message.
  • Other file transfer protocols can be used, such as FTP or NFS, however it should be kept in mind that using insecure protocols over public networks may comprimise the security of the destination server.
  • a third example utilizes a web interface provided with the server application.
  • a web interface is sometimes provided with a web server or other server application, by which control of the operation of the server may be commanded through a web browser.
  • the web interface if enabled, is accessible typically at a default relative URL, which might be at a special IP port, directory, CGI or other executable web script or program.
  • the instructions are configured for a program that acts as a web browser, sending input back to the server's web interface as if the input came from a person operating a browser.
  • This exemplary set of instructions includes (1) a command to go to the login URL of the web interface, (2) submit a form to the web interface containing an administrator usemame and password, (3) receiving the resulting web page, (4) a command to go to the certificate entry URL of the web interface, (5) submitting a second form to the web interface containing the new certificate and key, (6) confirming the submission of a new certificate and key in a third form, (7) a command to go to the web interface page including a “restart server” button, and (8) sending a fourth form containing a selection of the “restart server” button.
  • the third example might be implemented in any number of ways.
  • a PERL script to perform the steps might be written utilizing an http protocol library.
  • a web scripting language is utilized to provide a shortenend and simplified interaction script.
  • any number of scripting or programming languages may be used to provide controlled interaction with a server's web interface.
  • an agent may be pre-installed to the destination server.
  • the agent monitors some communication channel for instructions to install certificates and keys.
  • That communication channel might take several forms, such as a TCP/IP connection, an SMTP receiver, an RPC interface, or the agent might periodically review a configuration file located on the destination server or at another location.
  • XML web service interfaces, web interfaces, and other secure and non-secure layers or custom protocols might also be used.
  • That agent would include support for the server type such that incoming certificates are properly deposited in the correct location.
  • Such an agent may also include authentication measures to prevent unauthorized agent activity.
  • the agent may optionally also cause a restart of the server application or a reboot of the server itself.
  • information is first retrieved to effect contacting and install the certificate to the destination web server, accelerator or other device, that information including at least some of the platform type, the operating system, a detault protocol such as telnet, SSH, HTTP, HTTPS, etc., the certificate text, the destination server's IP address or hostname, a user name and password to log onto the destination, a password for the certificate store, the certificate common name, and a port number to initiate contact with the destination.
  • the certificate text is formatted to be in X.506 base 64 encoded format.
  • the destination is then connected to using the port number, IP address and protocol specified.
  • server applications such as the Apache web server, an IBM web server, an IPlanet server or accelerator, the OpenSSL service is started.
  • the command “find / -name ssl.conf”, or a similar command is executed to locate the SSL configuration file.
  • the command “find / -name httpd.conf”, or a similar command, is also executed to locate the server configuration file.
  • the certificate and key name are extracted from the configuration file using “grep ⁇ SSLCertificateFile/” or a similar command.
  • a new configuration file is then generated either including or referencing the new certificate, and written to the destination server. If needed, the “make” command may be executed to roll out the updated certificate information to all server files. The connection is then terminated and the server restarted.
  • a new private key is installed for every new certificate.
  • the use of several keys over a period of time tends to increase the difficulty of discovering the keys, or at least may prevent an attacker from discovering a key while it is in use.
  • the use of new keys is not strictly required, however, and an installation procedure may install a new signed certificate containing an old public key, if desired.
  • the received certificate may be held pending approval by the administrator.
  • the installation system may provide an approval interface, for example accessible by a web browser, by which an administrator may authenticate himself to the system and select certificates approved to be installed.
  • the interface may additionally provide for bulk approvals, i.e. presentation and approval of a group of certificates in a single approval step.
  • the interface may additionally present certificates sorted in order of expiration date or priority, providing for ease of administrator selection.
  • certificates may also be presented in order of risk according to certificate risk profiles.
  • the certificates may be installed to the appropriate servers, for example using automated processes as suggested above.
  • An installation and renewal system may also include provisions for monitoring expiring certificates.
  • certificates may be enrolled in a certificate watch program. On a periodic basis, for example daily, weekly or monthly, a certificate database is reviewed for certificates expiring within a future period.
  • Finding certificates in need of renewal a notification may be sent to an administrator, which for example might be by e-mail or by a display upon login at an administrator interface. The administrator may then select certificates to be renewed, upon which a process of certificate renewal may be initiated as described below.
  • the renewal system may be configured to initiate certificate renewal without approval, to prevent late certificate renewal should an administrator be unavailable to approve. If more than one administrator is configured, the renewal system may contact other administrators if first administrators do not timely respond to requests for approval.
  • a renewal system may scan the servers of a network periodically, as in the discovery processes discussed above, to detect certificates due to expire within a future period. In that system certificates might not be enrolled, but rather servers might be enrolled in a server watch list.
  • agents are installed to the servers being monitored. Each agent periodically reviews the certificates for expiration, and may notify an administrator or a central system of any certificates about to expire, for example by email.
  • a manual certificate renewal process is typically initiated at the server to which the certificate will be installed.
  • the process begins first by the generation of a public/private key pair. Now the key pair might be generated externally to the server, but that method introduces some risk of compromise in that the private key could be discovered in the process of moving it to the server.
  • a certificate signing request is generated, which is basically a partially completed certificate in that it contains the public key and server identification, but is not otherwise associated to a certificate authority or a root certificate. Having a certificate signing request, it may either be sent to a certificate authority or it may be signed in-house.
  • a certificate is to be used externally, it should either be signed by a certificate authority or by using an intermediate root certificate itself signed by a certificate authority. Certificates to be used for internal use only may be signed by an internally generated root certificate, because those certificates maintained by an organization may be considered to be trusted.
  • the signing process generates and attaches a signature to the certificate, which signature is generally an encrypted hash value generated from an unsigned certificate generated from the CSR information and from other information, such as the location of the root certificate and the validity period, which is encoded by the private key corresponding to a public key of a root certificate.
  • the signed certificate is then ready for installation to the server.
  • the following method may be useful to generate a certificate signing request remotely using shell commands through an SSH, Telnet or other shell connection.
  • the information needed as input to generate the certificate signing request is provided, including at least some of the protocol to be used, an email address, an IP address, the locality of the certificate including the country, state and city, the organization name, a certificate store password, and a port number to initiate a connection with the remote platform.
  • the remote shell is opened to the remote platform, utilizing known usernames and passwords or other authentication means.
  • a command is then executed to set the remote platform to configure mode, followed by a command to enter an SSL configuration utility.
  • the certificate store is then remotely opened and the default SSL certificate selected.
  • the current private key is removed from the certificate store.
  • a new private key for example a 1024 bit DES key, is generated and placed in the certificate store.
  • a new PEM file or PKCS file is then created using the newly created private key.
  • a further command is then sent to exit the SSL configuration utility.
  • the “gencsr key” command is then used to create a new certificate signing request file with the city, state, country, organization name/unit, common name and email address provided in the earlier input or obtained from default set values.
  • the output of the CSR text between the string identifiers “ - - - BEGIN CERTIFICATE REQUEST - - - ” and “ - - - END CERTIFICATE REQUEST - - - ” may then be captured and optionally placed in a database for storage until needed. Housekeeping activities and disconnection may follow the capture of the certificate signing request.
  • a simplified certificate renewal process is depicted in FIG. 9 , which may be operated by a certificate renewing system.
  • a search is made to detect expiring and/or expired certificates in a managed server group.
  • a loop is started in step 92 , which ends when there are no more expiring/expired certificates that remain unprocessed.
  • steps 93 through 97 are performed.
  • the appropriate server (the server holding the expiring/expired certificate) is commanded to generate a new CSR and optionally a new key pair, as described above.
  • the renewal system receives the generated CSR, as in step 95 , and sends the CSR to a selected certificate authority 96 for signing.
  • Optional step 97 may be performed to maintain a record of what certificates have been processed for renewal.
  • an alarm is set in step 98 to pause the execution for a period of time to avoid unnecessary processing.
  • a certificate installation process may be conducted apart from this method and system in any way desired.
  • the public/private key pair may be generated off the destination server, particularly if the server does not include software to generate the key pair (many operating systems include a well-known product called openssl). If that is done, it may be desirable to ensure the network between the generating computer and the destination is secure to avoid private key discovery.
  • the submitting a certificate signing request to a certificate authority is typically performed through a network connection over the Internet.
  • the certificate authority presents an interface, for example in a web browser, in which an administrator may enter the CSR and other information related to the request, such as the requesting entity's identification, account number or a challenge phrase. If desired, the CA may permit the use of default values, in which case it may be possible to initiate a request by submitting only a CSR and identification of the requester.
  • the CA may take steps to verify the identity of the requester so as to avoid others from impersonating a proper requester and receiving valid and/or trusted certificates. After a period of time, usually at least several hours but typically not more than a few days, the CA issues the signed certificate.
  • the issuing typically takes the form of sending the issued certificate to the administrator in an e-mail message, although other transference methods might be used equally well.
  • XML Key Management Specification XKMS
  • Web interfaces suitable for human access may also be used through http automation tools. Screen scraping, data manipulation, key stroke automation, mouse click simulation and other forms of automation can be used to interact with such a web interface. Direct socket communication might also be used.
  • a certificate renewal system may include facilities for automating certificate signing, as will be presently described.
  • certificate signing requests may be subject to approval.
  • expiring certificates may be presented to an administrator for renewal. If it is desired to continue use of particular certificates or servers, an administrator may select those for certificate renewal.
  • Approved certificates may be reviewed and parsed for informational items to be recycled, for example the server identity and the owning entity identity.
  • a new certificate signing request is generated, either locally or remotely, for example at the server to receive the certificate. If a CSR is generated locally, the generation uses the identity of the destination server. If desired, the CSR may then be sent to a CSR for signing. Alternatively, if a root or intermediate root certificate is to be used and is available locally, the renewal system may sign and issue the certificate.
  • the system may monitor the incoming email messages. If desired, the system may include a specialized SMTP module to receive emails, in the event that an SMTP client isn't provided by the hosting operating system. Alternatively, an email filter may be applied to an existing SMH system to route messages from CAs to a renewal program. Regardless, the renewal system reviews the incoming email messages for issued certificates, and extracts them from the emails as needed. Alternatively, a CA may issue certificate by download. In that event, the renewal system may periodically access the CA's website. Of course, if a certificate is issued locally, for example if a management system is configured to act as a CA, it is immediately available for installation. Once a certificate is received or otherwise available, it may be held pending approval or immediately installed as in the examples above.
  • the CA may have policy regarding the issuance of certificates, for example declaring how an issued certificate may be used.
  • a certificate renewal system may be fashioned to be not only compatible with the protocol requirements of CAs, but also with any policy requirements set forth.
  • challenge phrases used in the submission of CSRs to CAs are stored in the renewal system privately, and may also be encrypted if further security is desired. If a CA requires the submission of an administrator certificate or other object to accompany the submission of a CSR, those objects may be stored at the renewal system and made accessible for transmission to the CA in accordance with existing protocol. Internal CAs may also be used, i.e. certificate authorities controlled internally by a certificate using entity, for example if public validation of certificates with trusted CAs is not required.
  • CSRs may also include custom fields, such as accounting codes, group identifiers, usage notations, and other information associated with a particular issuing certificate.
  • custom fields are included providing accounting codes that may be used to track operational expenses.
  • usage notations are included in CSRs to provide, encoded in the issuing certificates, instructions where to install the certificates. Many other uses of custom fields may be used as desired, and may be facilitated by a renewal system.
  • a renewal system may also include access control for users and groups of users.
  • the system may maintain a record of users authorized to view, change, renew and otherwise manage certificates. Authentication may be made through the use of passwords, certificates or other identifying objects. Certificates may be assigned to be managed by a single user or several users. Likewise, user groups may be configured to permit individuals within the user group to manage certificates.
  • a log may be maintained by the system.
  • the log may track activity at any level of detail desired, which might be in one example programmable. Entries might include logins, logouts, certificates approved for renewal, certificates approved for installation, which certificate authority was used to renew particular certificates, which server a certificate was installed to, which version of automation scripts were used and many other possible events.
  • an examination of available intermediate root certificates may be performed to ensure the period of validity of the end certificate is within the period of validity of a selected intermediate root certificate. Should an intermediate root certificate expire before the desired end certificate period of validity, or the root certificate become valid after the start of the period of validity of the end certificate, an administrator may be notified of a problem. The administrator may choose to renew the intermediate root certificate, obtain a new intermediate root certificate with an appropriate validity period, defer the renewal of an end certificate, or choose to have a certificate to be renewed signed by a publicly available root certificate.
  • an installation or renewal system may also handle the installation and renewal of intermediate root certificates.
  • it may be desirable to provide backup for intermediate root certificates and private keys from which those certificates have been generated, so as to prevent the loss of private keys necessitating the obtaining of new intermediate root certificates for issuing new end certificates.
  • a database may also be maintained including information about the relationship of intermediate root certificates and end certificates issued from those root certificates. Other information may be stored in such a database, such as the attributes of intermediate root certificates, which devices contain those certificates, what certificate authorities issued those certificates, a history of end certificates issued from intermediate root certificates, and other related information.
  • a certificate renewal system or a certificate signing requesting system may make use of a certificate authority abstractor, which permits certificate related interaction with two or more certificate authorities using a common schema of operation.
  • a number of certificate authorities presently make their services available, however each presents a different interface and procedures to administrators who wish to submit certificate signing requests. Thus an administrator may be required to learn the various web pages and/or software interfaces, functions, administrations, reporting and delivery systems of several certificate authorities.
  • a certificate authority abstractor 115 receives a number of input items.
  • a set of scripts 114 a and 114 b are accessibly provided to abstractor 115 , those scripts containing programs or instructions sufficient to submit CSRs to a particular certificate authority.
  • Those scripts may operate through web interfaces, specialized protocols such as XKMS, or other communications protocols according to the requirements of the certificate authority for which the script is to interact.
  • certificate authority records, 113 a and 113 b may be maintained to provide default values for the scripts.
  • certificate authority A may always request the organization name and account number in the course of submitting a CSR, which may be conveniently set in a record specially prepared for that certificate authority.
  • Information sufficient to identify the requesting entity to all supported certificate authorities may also be stored, in this example in certificate authority records 1 13 a and 113 b as an organization name, domain name and account number.
  • CA abstractor 115 also presents a uniform interface 119 for receiving information pertaining to the submission of an individual certificate signing request 112 .
  • Interface 119 provides a uniform set of entries for at least the informational items required in a certificate signing request generally. These entries may provide for such items as a common certificate name, a period of validity, a locality identification, a public key, user defined fields or other fields in many combinations.
  • the certificate request information contains only a certificate signing request generated externally, for example at the server destined to receive a signed certificate.
  • the certificate request information contains information sufficient to complete a certificate signing request by the CA abstractor using a transferred public key.
  • Many other data transference schemas can be implemented as desired with attention to the details of any larger certificate automation system.
  • Abstractor 115 further receives a selection of a certificate authority 116 , which may occur one time through a default setting, or a CA choice may be presented each time a certificate request information record 112 is submitted.
  • the selection of certificate authority determines which script will be executed and which certificate authority record will be executed.
  • the abstractor will interact with one of certificate authorities 118 a or 118 b by way of an external network 117 , which may be the Internet. Alternatively, if a locally maintained certificate authority is available, external network 117 may be replaced with an internal network or other communicative objects.
  • certificate request records may be submitted to the abstractor, whereby the all required items by the selected certificate authority may be provided. The interaction by the script 114 may then communicate a request that in its totality constitutes a certificate signing request associated with the requesting entity.
  • the abstractor acts as a proxy application to the true certificate authorities.
  • An administrator or system for example a certificate renewal system, may interact with the abstractor as if it were a true certificate authority, passing the same informational types using similar interfaces, as desired.
  • interaction with two certificate authorities is shown, the concepts disclosed above may be extended to support operation with any number of certificate authorities.
  • a certificate installation or renewal system may also perform a verification operation to verify that a newly requested certificate has been installed correctly and is available for use.
  • the system may act as a client for the particular service for which the certificate is being used. For example, if a new certificate is for a web server supporting HTTPS, the installation/renewal system may attempt a secure HTTPS connection with the destination server. The verification may include checking for use of the new certificate and general operation of the secure use.
  • Notifications may be sent to an administrator on success or failure, which may be after a timeout period if verification does not immediately follow certificate installation.
  • alerts may be sent to more than one administrator, the system contacting further administrators if administrators previously notified haven't resolved a problem. That system may also submit periodic messages, such as what certificates are due for renewal in the near future, for example a period of 14 days.
  • a default certificate authority may be selected. That selected CA may then be used to renew certificates, by transferring information from the old certificates into CSRs to the new selected CA. If desired, a renewal system might also be commanded to replace all or a part of a set of managed certificates, swapping out certificates one or more several undesirable certificate authorities with a selected certificate authority.
  • a “migrate” function is provided permitting automatic transfer of certificates managed by unsupported certificate authorities to a default certificate authority for which certificate requests are supported.
  • a more complete system for managing certificates in an enterprise will include facilities not only for monitoring certificates, but also for requesting renewed certificates and installing those certificates to the enterprise.
  • Another simplified method depicted in FIG. 10 suggests the operation of that system type.
  • notifications are sent from certificate authorities, which are received by the system in step 101 .
  • a determination is made as to whether the notice concerns a newly issued certificate, as in step 102 . If the notice concerns or includes a newly issued certificate, a process similar to that described for FIG. 8 is performed in steps 106 - 108 to extract the certificate and install it to an identified destination server.
  • Another determination may be made in step 103 as to whether the certificate authority is warning of an expiring certificate.
  • steps 109 - 111 are performed as in the method described for FIG. 9 , by which a new certificate signing request is generated and sent to the appropriate certificate authority.
  • FIG. 5 depicts components of a certificate management system providing functions as described above for a single enterprise entity.
  • the enterprise includes a number of servers 53 a , 53 b , 53 c and 53 d for providing services. Some of servers 53 a - d may provide services to clients 50 over an external network 51 by way of a gateway or router 52 . Others of servers 53 a - d may provide services to clients 59 local to the enterprise entity.
  • two accelerators 54 a and 54 b are provided to assist in encrypted communications with clients 50 or 59 .
  • At least one certificate authority (CA) is accessed to provide new and renewed certificates, which in this example are an internal CA 60 and an external CA 61 .
  • CA certificate authority
  • Internal CA 60 is managed by the enterprise entity and may be used to provide self-signed certificates, which may be useful for internal secure communications.
  • Internal CA 60 may also include an intermediate root certificate upon which individual server certificates may be signed and issued, the intermediate certificate being made available for verification to parties encountering the issued certificates, for example over the external network 51 .
  • An external CA 61 may also be utilized to issue digital certificates for secure communications between client 50 and servers 53 a - d.
  • a scanner 57 may be provided to scan the network for certificates to be managed, which in this case would scan any or all of servers 53 a - d, accelerators 54 a and 54 b, and internal CA 60 if provided. Upon finding servers and certificates installed thereon, scanner 57 may provide resulting information to a database 58 containing information identifying certificates, expiration dates, and issuing CAs for the certificates. An installer 56 may also be provided to automate the installation of new certificates on servers 53 a - d or accelerators 54 a and 54 b. Installer 56 may further automate the installation of intermediate root certificates to internal CA 60 , if desired.
  • a renewer 55 may be provided to monitor the expiration of certificates of which information is stored in database 58 and may provide functions related to the renewal of expiring certificates.
  • One function is to notify an administrator of an expiring certificate.
  • Another function is to initiate the renewal of a certificate through the automated generation of a certificate signing request, optionally after administrative approval.
  • Another renewal function is the delivery and/or installation of renewed certificates to servers.
  • the system of FIG. 5 may be expanded to include other functions related to certificate management, for example reporting services and provisions for access through an electronic interface.
  • FIG. 6 a similar system to that shown in FIG. 5 is depicted, including a client 50 , an external network 51 , a gateway device 52 , servers 53 a - d, an internal client 59 , and an external certificate authority 61 .
  • the functions of renewer 55 , installer 56 , scanner 57 , database server 58 , and optionally internal CA 60 are combined in a single computing system called a certificate manager 62 .
  • the certificate manager 62 may be “dropped in” to the enterprise system as a single piece of hardware connected to the enterprise's internal network, providing rapid certificate management in the enterprise without unduly consuming space or computing resources.
  • FIG. 7 a system is depicted whereby certificate management is conducted from an external network location from an enterprise.
  • the enterprise includes servers 53 a and 53 b , either or both of which may include digital certificates for secure transactions with a client 50 .
  • certificate manager 70 is located outside of the enterprise network including servers 53 a and 53 b .
  • certificate manager 70 communicates electronically over the external network 51 .
  • the use of secure protocols for those communications may be desirable, particularly if private keys are passed over the potentially insecure external network 51 .
  • An administrative client 71 b may access local certificate manager 70 to perform administrative functions, for example configuring certificate manager to service servers 53 a and 53 b .
  • Certificate manager 70 may also be made accessible to non-local administrative clients 71 a, particularly if secure protocols are utilized in that access.
  • An external certificate authority 61 may be accessed to provide trusted certificates to servers 53 a and 53 b , and also to certificate manager 70 for secure administrative access.
  • the configuration of FIG. 7 may provide a service to enterprises whereby additional hardware is not required to be installed locally to the enterprise.
  • enterprises may subscribe to a service and further provide any necessary usemames and passwords for administrator access to the enterprise servers, to be stored accessible to the certificate manager.
  • Servers 53 a and 53 b may have installed thereon agents for access by the certificate manager 70 , or services already installed may be utilized to provide the necessary access by certificate manager 70 , for example the SSH service.
  • the certificate manager may also include root certificates, whereby the certificate manager becomes a certificate authority that not only can issue and verify end certificates, but can also maintain those end certificates automatically for customers.
  • the certificate manager may also include intermediate root certificates, if the operator does is not or does not wish to operate as a trusted authority.
  • An exemplary certificate management computer system is packaged in a rack-mountable form-factor and includes a Pentium 4 processor operating at 1.7 GHz or higher, 512 MB of 400 MHz SD-RAM, a RAID system including two 40 GB hard drives in a data mirroring configuration, redundant power supplies, two redundant 10/100 Base TX network ports, two 9-pin serial ports, one parallel port, four USB ports, and a graphics port supporting VGA video modes and higher.
  • Other computer systems may be utilized in various circumstances, for example if a relatively small number of certificates are to be managed or if network access is provided through a non-Ethernet connection.
  • the computer system may have other software installed thereon, provided that sufficient processing power and network resources are provided to handle the total operating loads on the system.
  • the exemplary certificate manager includes a user interface accessible through the HTTPS protocol, of which FIGS. 15 to 48 are representative. That user interface will now be described.
  • an administrator is provided access to the exemplary certificate manager by way of a web browser optionally located to a client computer.
  • the user Upon first accessing the manager, the user is first directed to enter a username and password, or present a certificate or other token.
  • the web session of access is attributed to a user with optionally assigned access privileges.
  • An authenticated user may be first directed to a home page or a screen containing alerts directed to the user or the user's group.
  • FIG. 15 is representative of a home page providing a number of links to other screens of various functions available through the exemplary certificate manager.
  • the user is presented with status information concerning the number of certificates in process and critical alerts important for the user to view, appearing in a prominent location. Certificates in process and critical alerts to which a user is not privileged to manage need not be indicated.
  • the exemplary home page provides activity groupings which include managing certificates, network discovery, reports and logs.
  • the available management activities shown include managing certificates, managing servers, managing groups, managing users, and system configuration.
  • Network discovery activities include the discovery of servers and certificates in the network. Activities related to reports include the generation and viewing of reports and reports concerning the history of intermediate root certificates managed by the exemplary certificate manager.
  • Logs concerning general errors, critical alerts, and user activity are also made viewable by links in the home page. Also displayed on the home page may be statistics concerning the number of certificates and servers being managed, which may be indicative of the certificates and servers managed by the particular user or the certificate manager generally. In this screen, as well as others, shortcuts may also be provided to direct the user to frequented activities, for example manage certificates and manage servers.
  • FIG. 16 depicts a representation of a manage certificates screen, as might be displayed by transversal through the home page. That screen includes a list element through with the list of managed certificates may be displayed, the certificates managed by a certificate identification including a numeric certificate ID and a common name. For each certificate selectable objects are provided to view, edit, remove and show the history of each individual certificate. The list is further filterable by a textual or numeric criteria, bypassing extensive page-after-page displays of certificates if the number of managed certificates is large. Also in that screen an “add certificate” button is provided to add a certificate to the managed certificate database.
  • FIG. 40 shows a representative screen of a view of certificate information
  • FIG. 47 shows a screen whereby an administrator may enter information about a new certificate
  • FIG. 42 depicts a screen in which an existing certificate record may be edited.
  • an administrator may be presented with various elements of particular certificates tracked in a certificate database, which in the exemplary certificate manager are: Field name Contents Common Name: Specifies the fully qualified hostname used in DNS lookups (for example, www.imcentric.com). This is the hostname in the URL that a browser uses to connect to the server on which the certificate is located. It is important that these two names are the same. Otherwise, a client may notice that the certificate name does not match the site name, which often makes users doubt the authenticity of the certificate.
  • Organization Name Specifies the official, legal name of the company, educational institution, or other organization owning the certificate.
  • Organization Unit Specifies a description of an organizational unit within the organization.
  • Certificate Strength Specifies the bit strength of the keys of the certificate.
  • Renewing Certificate Authority Specifies the CA through which the certificate is to be renewed.
  • FIG. 17 shows a representation of a manage servers screen, again as might be displayed from the home page. That screen includes a list of managed servers listed by a server ID, a hostname and an IP address. For each server shown in the list selectable objects are provided to view, edit, remove and show the history of each server. This list is also filterable, the filter operating by textual or numeric fragments of the server ID, hostname, or IP address. An “add server” button is also provided to add server information for a new server to be managed.
  • a screen similar to that of FIG. 46 appears.
  • the server column data of the particular record appears, which columns may include: Field name Contents Host Name Specifies the hostname of the server. IP Address IP Address of the server. Description Description of server. Port Port used to access the server, some common ports are ssh(22), telnet(23), or web(8888). Username Username used to access server. Is SSL Enabled Specifies if the admin pages are accessed via SSL. (Note: only used on Netscape 3.6 and Iplanet.)
  • FIG. 18 shows a sample screen for managing groups in the exemplary certificate manager.
  • the recorded groups appear in a list from which a group may be viewed, edited, removed or historically viewed. Groups appear in the list as a group ID and a group name. Groups may be added by selecting the “add group” button.
  • Depicted in FIG. 42 is a screen for editing a group. In that screen the group name appears in a textbox, which may be modifiable therein to rename the group.
  • the member users of the group appear in a list including sufficient identification to discriminate users, in this example the user ID, first and last name, email address, and role assignment for the user. User members may be added to a group by clicking the “add member” button, which brings up a separate screen depicted in FIG. 48 whereby registered users may be selected for inclusion in a group.
  • FIG. 19 a representative screen is depicted for the management of registered users in the exemplary certificate management system.
  • the registered users are presented in a list, with selectable objects for viewing or editing user information, removing a user, and reviewing a history of user actions.
  • Each user is referenced by a first and last name, and email address, and a username.
  • a button is provided for adding a new user to be added to the registered user list.
  • FIG. 38 Depicted in FIG. 38 is a representative screen for viewing the entries of a particular user registered in the system.
  • FIG. 39 shows a similar screen for editing the entries of a user.
  • a default set of fields are included in the user database, which are outlined in the following table: Field name Contents First Name First name of the user. Last Name Last name of the user. Title Position Title for the user. Company Company with which the user is employed. Department The user's department in the company. Address Street address (home or office) for user. City City in which the address is located. Zip Postal code for the city. Email Email address for user. Work Phone Work phone number for user. State State in which the city is located. Country Country in which the state is located. Fax Number Fax number for user. Username The identifier index of the user. Password The password of the user (may be hashed).
  • an active directory input facility by which an administrator may import user information by providing an import path and the usemame and password of access for the directory service.
  • FIG. 20 depicts a representative screen of the exemplary certificate manager whereby network settings may be input.
  • the network settings include the IP address, subnet, and gateway of the manager.
  • DHCP may alternately be enabled by checking the appropriate checkbox, which overrides the IP address, subnet and gateway settings.
  • the exemplary manager may be configured to require a specified client certificate be present at clients accessing the administrator user interface, which function may be enabled by selecting the appropriate checkbox.
  • the manager device may also provide for issuance or renewal of certificates by HTTP scripts controlling provided certificate authority user interfaces, as described above.
  • the manager device includes configuration for use of an optional proxy server, including address, port, usemame and password, which may be useful if the manager device is located behind a firewall restricting default HTTP traffic.
  • the screen of FIG. 20 further includes a location to enter an email address for transmitting critical alerts to a selected email box, if desired.
  • FIG. 21 a representative screen is depicted containing entries for custom fields for managed certificates.
  • the exemplary certificate management system may track with certificates other information, such as accounting codes, use notations or other custom information that may not be required or suggested by a certificate standard or a certificate authority.
  • certificates other information such as accounting codes, use notations or other custom information that may not be required or suggested by a certificate standard or a certificate authority.
  • By checking the “required” checkbox for the field selected fields may be made to be required, by which the manager will force the entry of a user to the field at the time a certificate is created by the system.
  • By checking the “X.509” field for the field that field will be included in the content of the certificate, otherwise the system will track the information of the field separately.
  • FIG. 22 depicts a representative screen by which the certificate database settings may be maintained.
  • the certificate database may be backed up to a file on a network drive, which directory may be specified in the “path to network share” entry. If a usemame and password are required to access that drive, it may be entered in this screen.
  • the administrator may also specify a backup interval, in this example of 7 days between backups.
  • the exemplary certificate manager creates backups of managed certificate and server information, users, groups, and may also include copies of the managed certificates in the backups as well.
  • FIG. 23 shows a representative screen by which default certificate information may be configured to the exemplary manager.
  • the screen of FIG. 23 is for a Windows 2003 Certificate Authority, which CA is useful for generating internal root and end certificates.
  • Other screens are provided by the exemplary certificate manager for configuring the server to operate with other certificate authorities, for example Versign or Entrust, in various modes of operation.
  • the exemplary manager may also include facilities for retrieval of connection information from a CA over the Internet, if identification is provided in the configuration screen for that CA.
  • the certificate authority screen shown includes entries for a network path to the certificate authority, a usemame and password, domains managed. The value of the organization name field is incorporated into all certificate signing requests sent to the particular certificate authority, unless overridden elsewhere.
  • the CA setup screens may be modifiable by program updates from the seller, manufacturer or licensor to adapt to changes in the operation of the certificate authorities made available for use.
  • Those program updates may also include updates to the scripts (or other programmable elements) used to interact with the certificate authorities intended to be usable to the administrator.
  • a second exemplary certificate manager may be set up as a replicator for a first manager, providing failover functionality. Shown in FIG. 24 is an exemplary screen in which replicator settings may optionally be configured.
  • the exemplary certificate manager may perform discovery on a network to locate servers and certificates that may need to be managed.
  • the discovery settings include one or more IP address ranges to scan, and a number of IP ports to scan.
  • the manager may be configured to perform discovery periodically to automatically detect newly installed servers and certificates.
  • the automatic discovery interval may be set in the “scan interval” checkbox, and the time of day to perform the scan may be entered into the “beginning scan time” pulldowns. Discovery may also be disabled by checking the “disable scan” checkbox.
  • the exemplary certificate manager may also manage intermediate root certificate authorities and intermediate certificate authorities, such as might be the case with a Windows 2003 CA above.
  • the configuration of the intermediate root certificate authority settings for the manager may be controlled in a screen similar to that shown in FIG. 26 . That manager may permit the maintenance, storage and access of intermediate root certificates by the manager, or may permit maintenance at a different server device.
  • an intermediate certificate to be managed may be entered in the textbox, followed by the administrator clicking on “import”. The new intermediate certificate may then be included in the maintained intermediate root certificates being managed, and displayed in a list with others as desired.
  • the exemplary certificate manager may also scan for intermediate certificates on the discovery network.
  • the manager may discriminate an end certificate from an intermediate root certificate by a review of certificate contents, or the manager may examine the chain of authority for certificates for parents located on the discovery network.
  • FIG. 27 depicts a screen whereby the log archival settings may be set in the exemplary certificate manager.
  • logs may be archived remotely to prevent accumulation on the manager itself.
  • This screen permits the setting of a network location, time, interval, username and password for the error log and the history recorded by the manager.
  • FIG. 28 depicts a representative screen permitting the management of certificates discovered but not yet completed in the exemplary manager.
  • a list of certificates is presented, with a discovery-assigned certificate id and the common name recorded in each certificate. For each certificate, a complete and remove selection are provided. If an administrator desires to complete the entry of a discovered certificate into the database, he may click on complete. Likewise, if an administrator decides that a discovered certificate need not be managed, he may click on remove (the removal is only for the manager database—the certificate is not removed from a server).
  • FIG. 29 depicts a similar screen permitting the completion or removal of discovered server records to or from the database.
  • the exemplary certificate manager additionally permits the generation of various reports.
  • Depicted in FIG. 30 is a screen whereby a report may be selected from a list of available reports, generated and printed.
  • Depicted in FIG. 35 is an exemplary view reporting all managed certificates, detailing the name, status, validity dates, and other certificate information.
  • a similar report is depicted in FIG. 36 , by which all managed servers are listed including details such as the hostname, IP address, port a certificate was accessible, the server software platform, the operating system, the protocol used for connecting to the server, as well as other related information.
  • FIG. 31 Depicted in FIG. 31 is a historical report of intermediate root certificate authority scans, including updates to the current database entries. Shown in FIG. 43 is a report of user actions within the manager, each user action including a date, time, action, user and value among other potential action informational items.
  • FIG. 44 shows another history view, this one of changes to the certificate database, each change record including the date and time of change, the column changes, the new value, and the user making the change.
  • FIG. 45 shows a historical view of changes to the server database, each record including the date, time, column, new value of the change and the user making the change.
  • FIG. 32 depicts a view of the error log, including a description of each error and the time of occurrence. A list of error codes and meanings appears in Appendix A for the exemplary certificate manager.
  • FIG. 33 depicts a view of the alerts log, which in this view is empty. If, for example, renewal of a certificate was unsuccessful, that event might appear in this log view. Attempts to notify administrators may also appear in the alerts log.
  • FIG. 34 depicts a view of the user log, which includes a list of user actions to the database as well as other actions.
  • exemplary manager may additionally act as a firewall to the management software, permitting communication only to selected ports in the network protocol. For example, a manager might enable port 443 for HTTPS administrative user interface access and port 25 for receiving email in a TCP/IP protocol supporting manager. Providing firewall functionality may prevent attacks from worms, buffer overflow attacks or other attacks, and make make a manager suitable to be connected directly to a public network such as the Internet.
  • the certificate database of the exemplary certificate manager may additionally be encrypted.
  • the manager may generate a self-signed certificate initially to encrypt the database.
  • the self-signed certificate may be protected from user access by user privileges, by encryption with a fixed key, encoding in a non-readable or specialized format, or other method.
  • Private keys used to generate CSRs are not stored on the exemplary manager, but are stored on the destination servers (where they may have been generated by the creation of a CSR).
  • the exemplary manager may further include an updating tool.
  • the updating tool checks for security or bug fix updates to the system periodically, and downloads and installs any updates automatically.
  • the manager may further include one or more fail-safe mechanisms that run system diagnostics on a periodic basis to gauge the health of the system and attempt error recovery. Administrators may be notified by email if error recovery is unsuccessful.
  • the manager may further include a database backup feature functional to restore and archive the state of the system.
  • FIG. 13 an exemplary process is depicted permitting a server device to authenticate a client component associated with a user, account, or other association.
  • the client component might be, in several examples, a personal computer, a cell phone, a personal data assistant, or virtually any other client device operable by a person providing access to a service provider over a communications network.
  • This procedure begins in step 1302 by a request for connection, in this example by a client.
  • the request for connection might also be initiated by a server, in some circumstances.
  • the server requests an appropriate digital certificate from the client for authentication purposes.
  • the client may present a certificate to the server if it is available.
  • a client may, if desired, be configured to fetch a certificate from a CA if a proper certificate is not available.
  • the server may proceed to validate the certificate as in step 1308 .
  • the server may also test for certificate revocation, for example by comparing the certificate against a list of revoked certificates. If the certificate has been revoked, or if the certificate is not valid for the authentication purposes, tested in step 1310 , the server may proceed to issue a new certificate to the client. Proceeding from one of steps 1306 or 1310 to step 1312 , the user is authenticated using an alternate procedure, as a valid certificate was not presented.
  • the alternate procedure may take many forms, such as the entry of a known usemame and password, a passphrase, an account number and PIN number, or any other procedure which may identify the user of the device to the satisfaction of the service provider. Alternatively, if it is merely needed to identify the client device upon subsequent accesses, the user authentication need not be performed.
  • a new certificate is delivered to the client.
  • a new certificate may be created about the time of delivery, which might be created by in internal or external certificate authority entity.
  • step 1308 If in step 1308 , the client certificate delivered to the server is found to be valid and not revoked, a check for an expired certificate may be performed in step 1316 . If the certificate is not expired, authenticated transactions may proceed in step 1320 . Otherwise, a process of renewing a certificate may commence, in step 1318 . In that step, the old certificate is renewed with the appropriate certificate authority, which might be internal or external, and the renewed certificate delivered to the client. The renewal of a certificate might occur at the time of the connection attempt by the client, however a small delay may be introduced, especially if an external certificate authority is used. Alternatively, a process may periodically run on the service side, checking issued certificates for expiration. Certificates may be renewed prior to a request for connection for services from a client, avoiding the small delay, provided that the client certificates are stored in the service system.
  • agents may be fashioned for particular client devices.
  • an installed agent may act to communicate with the service provider to receive certificates therefrom.
  • An agent may also, if desired, provide an interface for presenting certificates to the service provider.
  • An agent may also provide for management of client certificates in a local store, if local client facilities are not provided or not used otherwise.
  • An agent may, if desired, remove managed certificates from a client device at the time the agent is uninstalled.
  • the agent might also be fashioned to be more comprehensive in function, and may manage a session or transactions with the service provider.
  • Agents may be fashioned for several kinds of client devices.
  • an agent might be fashioned as a background executable process or daemon communicating with a service provider on a selected TCP port, executables being provided for a number of operating system types such as WinCE, PalmOS, PocketPC, Windows XP, MacOS, Linux, etc.
  • an agent might be downloaded from the service provider about the time the request for connection for services is made. That agent might be written in a platform-independent interpretive language, such as Java, or might be an executable program provided by a server based on the perceived client type. In that example, the agent might only reside on the client for a fixed period, although the client certificates may reside at the client locally.
  • the agent might be a browser plugin, which may be automatically downloaded from a predefined location at the time a user first attempts to access a service provider.
  • an operating system may provide access services sufficient to perform the agent functions, in which case the operating system may be equivalent to a certificate agent.
  • a client may be identified in several different ways.
  • a client certificate contains an encrypted identifier assigned by the service provider, the encryption performed with a secret key known to the service provider but not by others generally.
  • the identifier may be associated with an individual's service, for example a bank account number or a user identifier for an information subscription service.
  • the encrypted identifier might include a user identifier and a passphrase, for example a usemame and password or an account number and PIN number.
  • the identification data may not necessarily be kept secret.
  • a service provider is in the business of providing access to databases and literature for a fee, the impact of discovery or monitoring the activities of the user might be negligible, although it may be desirable for the service provider to ensure that the user is subscribed.
  • a certificate might contain a subscription number digitally signed by a key maintained by the provider.
  • the service provider may identify the individual or group using the service using a presumption that other individuals will not be permitted access to the client device. For example, if the client device is a personal data assistant (PDA), it may be presumed that that device is for a particular individual only, which individual will retain control of to prevent unauthorized use of the service provider's services. If that assumption is made, a service provider may authenticate using a certificate on a client device alone, and need not require the entry of passwords or other user authenticating items.
  • PDA personal data assistant
  • the service provider may also wish to prevent the transfer of a certificate from one client device to another.
  • the certificate may include information unique to the client device, for example a MAC address, a fixed IP address, a serial number or a processor ID.
  • the signature of the certificate may further be obtained by encoding the unique information, causing a signature mismatch should the certificate be moved.
  • an agent may provide the unique information to the service provider so as to avoid an unauthorized user masquerading a different client device for the original device.
  • a client 1400 is connectable to an external network 1404 permitting connections with a service provider device 1408 , in this example through a router/gateway device 1406 .
  • Service provider 1408 provides access to services through a standardized protocol, for example HTTPS.
  • Client 1400 likewise includes software for communicating with service provider 1408 and for interacting with the operator of client 1400 , which might be a web browser supporting SSL if the service provider 1408 uses HTTPS.
  • a certificate store 1410 may be provided to store certificates issued or deposited to clients, and may also store new and unissued certificates.
  • Certificate store 1410 might be a shared certificate store, such as a Microsoft Windows Certificate Store or Java Key Store, or in another example might be a private certificate store managed by an agent.
  • a repository of revoked certificates 1412 may be consulted by service provider 1408 to verify a client certificate presented by a client has not been revoked.
  • An agent server 1414 may also be provided to assist with the download and installation of agents to clients.
  • An internal certificate authority 1416 may be provided to produce encryption/decryption keys or facilities for digitally signing certificates.
  • internal certificate authority 1416 is in communicative proximity to service provider 1408 so as to avoid substantial delays in data processing.
  • an external certificate authority 1418 may be used, which may be operated independently of the entity operating the service provider 1408 . If an external certificate authority is used, a certificate may be used to sign user transactions which are afterward publicly verifiable.
  • a certificate store 1402 is provided at client 1400 to store certificates issued by the service provider, making them available in later accesses between client 1400 and service provider 1408 .
  • service provider 1408 , optional certificate store 1410 , revoked certificate database 1412 , agent server 1414 and internal certificate authority 1416 might be completely separate computing systems connected by a network. Alternatively, elements of those may be combined as desired on shared computing resources.
  • each of service provider 1408 , certificate store 1410 , revoked certificate database, agent server 1414 are elements residing on a single server or distributed servers, with internal certificate authority 1416 being optionally included thereon.
  • FIGS. 49 through 63 The operation of a system according to the principles set forth above is illustrated in FIGS. 49 through 63 , and will be presently described.
  • a user has accessed a service provider's download area via a web browser on a client device, and is presented with an information screen about an agent system to be downloaded, activated by a “download now” link. Following activation, the user is presented with a screen shown in FIG. 50 , which presents further information concerning the “secure client” software. Clicking on the “next” button, the user continues to a step 2 screen shown in FIG. 51 , which presents a license which the user may assent to. The user may then be directed to a step 3 screen as shown in FIG. 52 , which provides a download button to start the agent download process. The installation of the agent to the client device immediately follows the download, and the user is presented with the step 4 screen shown in FIG. 53 . The user is then ready to use the “secure client” product.
  • the user accesses a server providing the secure client service, and is presented a screen containing entry fields for identifying information, in this example an email address and a passphrase.
  • identifying information in this example an email address and a passphrase.
  • the user may click the login button to proceed to the screen shown in FIG. 55 .
  • FIG. 55 the user is presented with a screen indicating that authentication is in progress.
  • FIG. 56 shows a screen which would be presented to a user if the user had not registered the client device being used with the service. This may be discovered by the service by the absence of an appropriate digital certificate accessible to the agent downloaded and installed to the device as in FIGS. 49 through 53 .
  • the user is presented with a button (or other input) to add the present device to the list of trusted devices. If the user does so, the user is presented with a screen as shown in FIG. 57 .
  • the user is presented with a entry field for a mnemonic identifier for the device (“device name”), which is in this example “office computer.” Also in the screen of FIG.
  • a list of registered devices is shown, which in this example indicates the user has registered his work PC, a PDA and a laptop. Following entry of the device identifier, the user may click the next button. If the user does this, a screen similar to that in FIG. 58 may be shown, indicating that processing is proceeding to register the device with the service.
  • the processing registering the device might include generating a new certificate, or selecting a pre-generated certificate, and installing the certificate to the client device.
  • the process may also include associating the entered device identifier with the certificate, and otherwise maintaining the user's profile.
  • each client device may be assigned trust levels, the selection of which is shown in FIG. 59 .
  • Trust levels permit the user to select activities which are authorized for clients which have been registered. In this example, those activities include viewing a bank account balance, browsing a public web site, applying for a credit line, completing a load application, making a transfer to savings, making a transfer to checking, closing an account, and transferring funds over a certain amount. Following a user's selections, the finish button may be pressed to commit those selections.
  • the trust level selections are not stored on client devices. Those selections are stored in a database managed by the service, though alternatively the selections might be maintained in a secure third-party system as well.
  • FIG. 60 Depicted in FIG. 60 is a screen which is representative of a user's home screen in the exemplary service. Displayed on that screen is the user's profile, a list of registered device, and a number of links for performing several management actions including edit the profile information, change the passphrase and a viewing of transaction reports. For each registered device, selections are provided for changing the trust levels associated with that device and a selection for removal of the device.
  • FIG. 61 is a screen representative of a transaction report. In the exemplary service, for each transaction a record is created including the date of the transaction, the provider involved in the transaction, the certificate authority providing the certificate used to sign the transaction, and various details of the particular transaction types.
  • FIG. 62 Depicted in FIG. 62 is a screen representative of a screen provided in the exemplary service for selecting trust levels, in this case of the “home pc” client device.
  • this screen not only may the user select the trust levels for the client device, but the user may also select trust levels for particular providers.
  • a pull-down list is provided in this example to enter a user selection of a provider, the particular trust levels for that provider and device being shown and selectable below.
  • a done button may commit the selections for storage to the service provider.
  • FIG. 63 Depicted in FIG. 63 is a screen provided by the exemplary service for the editing of user information, that information including a first, middle, and last name, an address, a home and work telephone number, and credit card information.
  • the information is subdivided into ratings sections, which are labeled bronze, silver and gold.
  • ratings sections which are labeled bronze, silver and gold.
  • a user is not required to enter information beyond the “bronze” level, which constitutes a minimal identification criteria for the service provider.
  • the user may be assigned to higher ratings categories, and become eligible for enhanced benefits from the system. For example, a user may provide credit card information to authorize purchases from merchants through the system. The user may also be further made eligible for sweepstakes, prizes, discounts or rebates at higher ratings.
  • the exemplary client authorization system above may provide for authentication of a user under the requirements that (1) the user is using a device made trusted earlier and (2) for transactions considered highly sensitive, that a usemame and password or other higher form of authentication be used.
  • a global certificate may be provided by the system to various service providers to sign online transactions, or several certificates may be created and stored at the client for signing transactions for several service providers.
  • the exemplary system may also require confirmation by return email to add or remove a client device from the registration list.
  • an intruder must not only obtain a usemame and password to create a fraudulent transaction, but must also perform his actions from one of the registered client devices. This makes fraudulent activity much more difficult to accomplish than with present systems that rely only on a usemame and password for user identification.
  • servers utilizing SSL or TLS protocols may be modified as will be understood by those skilled in the art to encompass other protocols, such as message queuing systems, VPN systems, S/MIME systems, IPsec systems, code signatures, 802.11x EAP devices, encrypting file systems (EFS), and client web authenticators, as well as other server types and protocols.
  • the above examples have referenced web servers utilizing digital certificate.
  • Those examples may also be modified to include other server types such as application servers, databases, SSL offloading devices, SSL accelerators, or any other type of server or device having the ability to utilize an SSL certificate to communicate securely over a network connection.
  • the above examples have also made use of SSL certificates.
  • Other types of certificates of varying formats and protocols may also be used in the above disclosed systems with minor modification to operate with virtually any conceivable public key infrastructure.
  • IPlanet Install Certificate (m_bIsFinished was already true) 6613 IPlanet Install Certificate: could not find the Add Server Certificate Button 6614 IPlanet Install Certificate: Alias value not found in select box 6615 IPlanet Install Certificate: Navigation to admin page failed. Possible heavy internet traffic or no network connection. 6616 IPlanet Install Certificate: Navigation to install certificate page failed. Possible heavy internet traffic or no network connection. 6617 IPlanet Install Certificate: Server user name blank 6618 IPlanet Install Certificate: Server password blank 6619 IPlanet Install Certificate: IP address blank 6620 IPlanet Install Certificate: Secure server name blank 6621 IPlanet Install Certificate: Key pair password blank 6622 IPlanet Install Certificate: Certificate text blank 6623 IPlanet Install Certificate: Navigation to confirmation page failed.
  • IPlanet Install Certificate Replace certificate confirmation window not found 6625 IPlanet Install Certificate: Add certificate confirmation window not found 6626 IPlanet Install Certificate: Alias blank 6090 Verisign Retrieve Organization: Navigation to main page failed. Possible heavy internet traffic or no network connection.
  • Verisign Post CSR could not find text field for CSR text 6119 Verisign Post CSR: could not find text field for First Name 6120 Verisign Post CSR: maybe not find text field for Last Name 6121 Verisign Post CSR: could not find text field for Email address 6122 Verisign Post CSR: could not find text field for Challenge Phrase 6123 Verisign Post CSR: could not find text field for Challenge Phrase confirm 6124 Verisign Post CSR: could not find drop down box for Application Server Type 6125 Verisign Post CSR: Your challenge phrase and reconfirmation do not match. 6126 Verisign Post CSR: Please enter a valid IP Address.
  • Verisign Post CSR Error finding additional fields 6128 Verisign Post CSR: Navigation to CSR Result page failed. Possible heavy internet traffic or no network connection. 6129 Verisign Post CSR: Can not find additional fields 6130 Verisign Post CSR: One or more additional fields has invalid data. The information entered should contain only alphabetical or numerical characters... 6131 Verisign Post CSR: Unable to start up and connect a browser instance. 6132 Verisign Post CSR: Unable to Navigate the browser. 6133 Verisign Post CSR: An error occurred while checking for ‘First Name’ error message. 6134 Verisign Post CSR: An error occurred while checking for ‘Last Name’ error message.
  • Verisign Post CSR An error occurred while checking for an invalid email format error message.
  • Verisign Post CSR An error occurred while checking for the Challenge Phrase error message.
  • Verisign Post CSR An error occurred while checking for the company name error message.
  • Verisign Post CSR An error occurred while checking for an invalid Organization Name error message.
  • Verisign Post CSR An error occurred while checking for Invalid CSR Text error message.
  • Verisign Post CSR An error occurred while checking for duplicate cert error message.
  • Verisign Post CSR An error occurred while checking to see if the Enrollment of the CSR Text was complete.
  • Verisign Post CSR An unknown error occurred while posting the CSR Text.
  • Entrust retrieve Domains The User Id passed to Entrust retrieve Domains was blank 6660 Entrust retrieve Domains: The Password passed to Entrust retrieve Domains was blank 6661 Entrust retrieve Domains: Can not complete navigation to Logon page 6662 Entrust retrieve Domains: could not complete navigation to Management page 6663 Entrust retrieve Domains: Can not complete navigation to Contract Information page 6675 Entrust Retrieve Organization Names: The automation did not occur or was not completed successfully.
  • IPlanet Create CSR Document Complete never Fired 6701 IPlanet Create CSR: could not find the CA Email Address field on the main HTML page 6702 IPlanet Create CSR: could not find the Key Pair database field on the main HTML page 6703 IPlanet Create CSR: could not find the Requestor Name field on the main HTML page 6704 IPlanet Create CSR: could not find the Telephone Number field on the main HTML page 6705 IPlanet Create CSR: Can not find the Common Name field on the main HTML page 6706 IPlanet Create CSR:
  • IPlanet Create CSR Invalid Country Code.
  • IPlanet Create CSR Invalid Country Code.
  • IPlanet Create CSR Alias value not found in select box 6727 IPlanet Create CSR: Trust database has not been initialized 6728 IPlanet Create CSR: User name blank 6729 IPlanet Create CSR: Password blank 6730 IPlanet Create CSR: IP Address blank 6731 IPlanet Create CSR: Secure server name blank 6732 IPlanet Create CSR: Common name blank 6733 IPlanet Create CSR: Organization name blank 6734 IPlanet Create CSR: Organization unit blank 6735 IPlanet Create CSR: City blank 6736 IPlanet Create CSR: State blank 6737 IPlanet Create CSR: Country blank 6738 IPlanet Create CSR: Contact email blank 6739 IPlanet Create CSR: Contact first name blank 6740 IPlanet Create CSR: Contact last name blank 6741 IPlanet Create CSR: Contact work phone number blank 6742 IPlanet Create CSR:
  • IPlanet Create CSR Invalid secure server name 6745 IPlanet Create CSR: Navigation to create CSR page failed. Possible heavy internet traffic or no network connection. 6746 IPlanet Create CSR: Navigation to CSR page failed. Possible heavy internet traffic or no network connection. 6747 IPlanet Create CSR: Error retrieving CSR 6748 IPlanet Create CSR: Invalid length for the common name 6749 IPlanet Create CSR: Alias blank 6750 IPlanet Create CSR: could not find alias field 6751 IPlanet Create CSR: Can not find alias value 6760 Entrust Verify Login: The automation did not occur or was not completed successfully.
  • Verisign Approve Common name was not found 6780 Verisign Approve: Approve link was not found 6781 Verisign Approve: Can not complete navigation to main MPKI page. Possible heavy internet traffic or no network connection. 6782 Verisign Approve: could not complete navigation to Process Requests (approval) page. Possible heavy internet traffic or no network connection. 6783 Verisign Approve: could not complete navigation to approval result page. Possible heavy internet traffic or no network connection. 6784 Verisign Approve: could not complete navigation to next approval page. Possible heavy internet traffic or no network connection.
  • Verisign retrieve Organization Names could not find the organization names ‘Org:’ label
  • Verisign retrieve Organization Names Document complete did not fire
  • Verisign retrieve Organization Names Error occurred during retrieval of names from elements on page
  • Verisign retrieve Organization Names could not complete navigation to Verisign's main MPKI page. Possible heavy internet traffic or no network connection.
  • Verisign retrieve organization names Unable to start up and connect a browser instance.
  • Verisign retrieve organization names: Unable to Navigate the browser.
  • Verisign retrieve organization names An error occurred while searching for the OrgName label. 6800 Autocert Utilities Service: Verisign certificate is neither a standard nor global certificate.
  • 6808 Autocert Utilities Service Failed to establish session with web site.
  • 6809 Autocert Utilities Service Failed to create Http request handle.
  • 6810 Autocert Utilities Service Failed to retrieve certificate from store. Verify certificate is installed.
  • 6811 Autocert Utilities Service Failed to attach certificate to http request.
  • 6812 Autocert Utilities Service SPC system store failed to open.
  • 6813 Autocert Utilities Service Failed to send request to server.
  • 6814 Autocert Utilities Service Global certificate file not uploaded. Upload certificate before retrieving information.
  • 6815 Autocert Utilities Service Standard server certificate file not uploaded. Upload certificate before retrieving information.
  • Entrust Post CSR The Password passed to Entrust Post Csr was blank 6820
  • Entrust Post CSR The Certificate Id passed to Entrust Post Csr was blank 6821
  • Entrust Post CSR The Organization name passed to Entrust Post Csr was blank 6822
  • Entrust Post CSR The Csr passed to Entrust Post Csr was blank 6823
  • Entrust Post CSR The UserID edit box on the login page could not be found.
  • 6824 Entrust Post CSR The Password edit box on the login page could not be found.
  • 6825 Entrust Post CSR The Log in button on the login page could not be found.
  • 6826 Entrust Post CSR: The Create/Renew button on the status page could not be found.
  • 6827 Entrust Post CSR The Organization Name select box could not be found on the Create/Renue page.
  • 6828 Entrust Post CSR The Certificate Type select box could not be found on the Create/Renue page.
  • 6831 Entrust Post CSR The Certificate signing request text area could not be found on the Create/Renew page.
  • 6832 Entrust Post CSR The Tracking information edit box could not be found on the Create/Renew page.
  • 6833 Entrust Post CSR The Confirm button was not found on the confirmation page.
  • 6863 Entrust Post CSR Unable to start up and connect a browser instance.
  • 6875 Entrust Post CSR An error occurred while checking the CSR for five dashes 6876
  • Entrust Post CSR An error occurred while checking if all the SSL Server Certs have been used for the login account.
  • Verisign retrieve Domains could not complete navigation to Verisign's MPKI main page 9776 Verisign Retrieve Domains: Error occurred during building of user services url 9777 Verisign retrieve Domains: could not complete navigation to user services page 9778 Verisign retrieve Domains: could not complete navigation to domains page 9779 Verisign Retrieve Domains: Error occurred during retrieving of domain names from page 9801 A timeout occurred while posting the csr, this may be due to network traffic or the server may be down 9802 A timeout occurred while approving the csr, this may be due to network traffic or the server may be down 9803 A timeout occurred while retrieving the certificate, this may be due to network traffic or the server may be down 9804 Unable to start the Windows2003Ca Process this could be due to a misconfiguration in the Windows 2003 Certificate Authority setup, please check the settings to make sure they are correct ⁇ 1 ERROR UNKNOWN

Abstract

Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.

Description

    CROSS-REFERENCE TO RELATED APPLICATIONS
  • This application claims the benefit of U.S. Provisional Application No. 60/495,864 filed Aug. 15, 2003 and U.S. Provisional Application No. 60/586,429 filed Jul. 8, 2004, both of which are hereby incorporated by reference in their entirety.
  • BACKGROUND
  • The claimed inventions relate generally to management of public key infrastructure server networks, and more particularly to systems that can automate the installation, renewal, detection or management of public key infrastructure digital certificates in a secure network system.
  • BRIEF SUMMARY
  • Disclosed herein are several digital certificate discovery and management systems. Detailed information on various example embodiments of the inventions are provided in the Detailed Description below, and the inventions are defined by the appended claims.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • FIG. 1 depicts conceptual elements of asymmetric cryptography.
  • FIG. 2 shows conceptual elements of a process useful to secure data against unauthorized access.
  • FIG. 3 shows conceptual elements of a process useful to digitally sign data.
  • FIGS. 4A, 4B, 4C and 4D depict a method of establishing secure communications between a client and a server over a network.
  • FIG. 5 depicts components of a certificate management system providing certificate management functions.
  • FIG. 6 shows components of an integrated certificate management system.
  • FIG. 7 depicts a certificate management system whereby certificate management is conducted from an external network location from an enterprise
  • FIG. 8 shows a simplified method of automatically receiving and installing signed certificates from certificate authorities.
  • FIG. 9 depicts a simplified certificate renewal process.
  • FIG. 10 shows an automated simplified method of monitoring and renewing certificates.
  • FIG. 11 shows conceptual elements of a certificate authority abstractor.
  • FIG. 12 illustrates a procedure for discovering network certificates.
  • FIG. 13 shows an exemplary process permitting a server device to authenticate a client component associated with a user, account, or other association.
  • FIG. 14 shows a system useful for managing client certificates and providing network services.
  • FIG. 15 shows a representative home page for an exemplary certificate manager.
  • FIG. 16 depicts a representation of a manage certificates screen for an exemplary certificate manager.
  • FIG. 17 shows a representation of a manage servers screen for an exemplary certificate manager.
  • FIG. 18 shows a sample screen for managing groups in an exemplary certificate manager.
  • FIG. 19 shows a representative screen for the management of registered users in the exemplary certificate management system.
  • FIG. 20 shows a representative screen of an exemplary certificate manager whereby network settings may be input.
  • FIG. 21 depicts a representative screen containing entries for custom fields for managed certificates in an exemplary certificate manager interface.
  • FIG. 22 depicts a representative screen by which the certificate database settings may be maintained in an exemplary certificate manager interface.
  • FIG. 23 shows a representative screen by which default certificate information may be configured in an exemplary certificate manager.
  • FIG. 24 shows an exemplary screen in which replicator settings may optionally be configured in an exemplary certificate manager.
  • FIG. 25 shows a screen for entering network discovery settings in an exemplary certificate manager.
  • FIG. 26 shows a screen for entering configuration of the intermediate root certificate authority settings of an exemplary certificate manager.
  • FIG. 27 depicts a screen whereby the log archival settings may be set in an exemplary certificate manager.
  • FIG. 28 depicts a representative screen permitting the management of certificates discovered but not yet completed in an exemplary certificate manager.
  • FIG. 29 depicts a screen for completing or removing discovered server records to or from an exemplary certificate manager database.
  • FIG. 30 shows a screen whereby a report may be selected from a list of available reports, generated and printed in an exemplary certificate manager interface.
  • FIG. 31 shows a historical report of intermediate root certificate authority scans as generated by an exemplary certificate manager.
  • FIG. 32 depicts a view of an error log generated by an exemplary certificate manager.
  • FIG. 33 depicts a view of an alert log generated by an exemplary certificate manager.
  • FIG. 34 depicts a view of a user log generated by an exemplary certificate manager.
  • FIG. 35 shows a view reporting all managed certificates in an exemplary certificate manager interface.
  • FIG. 36 shows a view reporting all managed servers in an exemplary certificate manager interface.
  • FIG. 37 shows a representative login screen for an exemplary certificate manager.
  • FIG. 38 shows a representative screen for viewing the entries of particular users registered in an exemplary certificate manager.
  • FIG. 39 shows a representative screen for editing user entries in an exemplary certificate manager.
  • FIG. 40 shows a representative screen of a view of certificate information for an exemplary certificate manager.
  • FIG. 41 depicts a screen in which an existing certificate record may be edited for an exemplary certificate manager.
  • FIG. 42 depicts a screen for editing a group in an exemplary certificate manager.
  • FIG. 43 shows a report of user actions generated by an exemplary certificate manager.
  • FIG. 44 shows a report of changes to a certificate database generated by an exemplary certificate manager.
  • FIG. 45 shows a report of changes to a server database generated by an exemplary certificate manager.
  • FIG. 46 shows a manage servers screen in an exemplary certificate manager.
  • FIG. 47 shows a screen whereby an administrator may enter information about a new certificate for an exemplary certificate manager.
  • FIG. 48 shows a screen for adding users to a group in an exemplary certificate manager.
  • FIGS. 49, 50, 51, 52 and 53 depict exemplary screens generated in a secure client agent installation.
  • FIGS. 54 and 55 show login screens to an exemplary secure client service.
  • FIG. 56 shows a screen of an exemplary secure client service indicating the absence of a certificate on the client.
  • FIGS. 57 and 58 depict screens generated through the process of registering a client device with an exemplary secure client service.
  • FIG. 59 shows a screen for specifying authorized actions for a client device in an exemplary secure client service.
  • FIG. 60 shows a client device configuration selection screen of an exemplary secure client service.
  • FIG. 61 shows a transaction report of an exemplary secure client service.
  • FIG. 62 shows a screen for specifying authorized actions for a client device and a provider in an exemplary secure client service.
  • FIG. 63 shows a screen for entering user information in an exemplary secure client service.
  • Reference will now be made in detail to systems and methods for discovering and managing digital certificates which may include some more specific embodiments of the claimed inventions, examples of which are illustrated in the accompanying drawings.
  • DETAILED DESCRIPTION
  • Public key infrastructure (PKI) has recently become widespread in use, particularly with the availability of public networks that provide access to confidential sources or sinks of information, for example e-commerce over the Internet. PKI is utilized in many network systems to encrypt data transacted between a user on a client device and a server, and also to verify that the client is linked to an authentic server device, particularly when the data transactions pass through an uncontrolled or insecure network portion.
  • Data encryption generally is of one of two types, which are symmetric and asymmetric cryptography. Speaking at a basic level, in symmetric cryptography a single key is shared by the encryptor and the decryptor, i.e. the encryption key can be used to decrypt data encrypted with that key. In FIG. 1, the basic concepts of asymmetric cryptography are depicted. A key generation process 10 is used to generate a pair of related keys, which are an encryption key 11 and a decryption key 12. The cryptographic algorithms are selected such that if either one of the encryption key 11 or decryption key 12 is known, the other key is difficult to discover. The selection of appropriate algorithms and keys is well known in the art, and will not be expounded upon further here. Further in FIG. 1, the process of cryptography is shown. Data 13 is to be sent to a receiver in a secure fashion. Encryption key 11 is applied to data 13, producing encrypted data 14, perhaps in a single message or a group of packets. The encrypted data is sent to the receiver through the insecure network, thereby preventing access to the original data 13 by undesirable parties. A receiver applies decryption key 12 to the encrypted data 14, producing the original and decrypted data 15. Because the keys needed to encrypt and decrypt are different, this type of cryptography is called asymmetric.
  • In public key cryptography one of the keys may be made public, which may serve to either to secure data from unauthorized access or digitally sign transmitted data. By digitally signing data, the receiver may verify that the received data comes from a particular sender and that the data has arrived unmodified. Referring now to FIG. 2, concepts of a process useful to secure data against unauthorized access are depicted. In the process of FIG. 2, an asymmetric key pair is generated beforehand, which include encryption key 21 and decryption key 25. Encryption key 21 is made public, i.e. it is provided to others wishing to send encrypted data to a receiving party holding decryption key 25, which is held private by that receiving party. A sending party uses the public key 21 to encrypt secret data 20, producing encrypted data 22. Encrypted data is sent to the receiving party by way of a network link 23, which might be insecure and/or subject to interception. The received encrypted data 24 is then applied to the private decryption key 25, producing decrypted data 26 identical to the original secret data 20. In this process, the security of the data relies on the difficulty of producing the decryption key 25 from the public encryption key 21 and the inaccessibility of private key 35.
  • Referring now to FIG. 3, concepts of a process useful to digitally sign data are depicted. Data 30 is to be provided to a receiving party over in insecure network link 37, i.e. the sending and/or receiving parties do not control the link sufficiently to prevent a third party sending data to the receiver masquerading as the sending party. Data 30 is first encrypted with a privately held encryption key 31, producing an encrypted form 32 of the original data. The encrypted data 32 is then sent to the receiving party 33 over an untrusted network link, which might be the same or a different link as the one used for transmission 37. The received encrypted data 34 is then decrypted with the public decryption key 35, producing decrypted data 36. The decrypted data may then be compared to the unencrypted data provided through transmission 37, which may be considered to be from the sending party if the two data sets are identical. As in the procedure depicted in FIG. 2, this procedure relies on the difficult of producing the private encryption key from the public decryption key, making unlikely the prospect that the private key could ever be discovered and used by a malicious party. Also in this procedure, public key 35 is transferred through a controlled process that permits the receiving party to know the original source party of that key.
  • In a variation of the procedure of FIG. 3, an additional step produces a hash value of the data to be signed 30. The hash function may be chosen to produce a substantially unique value for variations of input data, i.e. the hash value will change for any change to the input data, even minute changes. The hash function may also be chosen to be substantially non-reversible, making extremely difficult the task of finding a changed data set that produces the same hash value without exaustively iterating through an extremely large number of possible changed data sets. In that variation, the hash value may be encrypted rather than the original data, and the verification includes the step of comparing the decrypted hash value against a hash value calculated from the received data to be verified. Of course, the sender and receiver must apply the same hash function.
  • Public key infrastructure (PKI) is the equipment and software required to practice public key cryptography for real-world applications, and may take any number of forms. In one form, PKI may include a sender computer and a receiver computer, with software for encrypting and decrypting messages, such as email messages. Often, PKI provides a facility for the retrieval of a public key from the data sender or the intended recipient, permitting encrypted communication without the need of physical public key transfers. In another PKI form, public keys are provided by way of certificates. A PKI certificate is a data structure that provides a public key to others. PKI certificates may be made available by way of network servers to others with access to that network, thus providing an efficient way of distributing public keys.
  • In a commonly used PKI, certificates also include a signature to verify the source of the certificate. Again, PKI keys are provided in pairs, one being held private and the other distributed publicly. The recipient of a public key may communicate with the holder of the corresponding public key in a secure fashion, but if the recipient obtained the public key over a network he may not know what the source of that public key is. It is therefore possible, in that circumstance, for a third party to trick or “spoof” the recipient party into holding communications with him, if he can provide a substitute certificate to the recipient party and if the third party's communications are sufficiently authentic to complete the deception. In a related technique of interception, a third party may form an encrypted communications link with a destination server, provide a substitute certificate to a recipient, and masquerade as the destination server by passing data between the recipient party and the destination server. The third party may then view all traffic between the recipient and the destination server unencrypted. This technique is often referred to as a “man in the middle attack”, and can be a serious problem for many entities, such as banks or on-line stores, wishing to correspond with customers, employees and others over public and/or uncontrolled networks.
  • To solve this problem a number of Certificate Authorities (CAs), for example Verisign and Entrust, have created services for authenticating certificates. These entities hold themselves out as entities of trust, providing certificate signing services for certificate verification. The operation of a CA is generally as follows. First, a CA produces a set of asymmetric key pairs, and therefrom a set of root certificates. The private keys are secretly held by the CA, while the root certificates containing public keys are provided to others through controlled distribution. These root certificates are made widely available to the public, for example in the distribution of web browsers, operating systems or other software. Next, a CA receives unsigned certificates in Certificate Signing Requests (CSRs), which contain sufficient information to produce a signed certificate and optionally to verify the source of the individual CSRs. For individual CSRs, the CA may attempt to validate the CSR as coming from a known party, for example through the use of a password or other confidential information from the customer. Signed certificates are produced by choosing a root certificate, signing the certificate with the private key of the chosen root certificate, including identification of the root certificate with the signed certificate and returning the signed certificate to the requesting party.
  • A standard certificate specification, referred to as X509 has been established to provide a common readable certificate format for publicly accessible utilities. This format will be recognized by those of ordinary skill in the art, and will be only briefly commented herein. The X509 format provides an example of a usable certificate format, noteworthy format items being a version number (the version of the X509 standard being used), a public key, a signature value, a denotation of the signature algorithm used, a period of validity, and an issuer identification among other format items. Although this format has seen recent widespread use, especially in https and secure shell technologies, other formats may be used with equally good results.
  • A client receiving a certificate from a server may verify a signed certificate by doing the following. First the client may review the certificate to see what certificate was used for signing (i.e. a parent certificate). If the parent certificate is recorded at the client's location, it may locate it and extract the public key. If the parent certificate is not known to the client, the client may request the parent certificate from an accessible server. Upon receipt of the parent certificate, the client may extract the public key. Having the public key, the client may then verify the signing of the child certificate. If the parent certificate was obtained remotely, the client may continue by verifying the signing of the parent certificate. That procedure may continue through a chain of certificates until reaching a known certificate, or reaching an unsigned or unavailable certificate. Should the process end without reaching a known certificate, the client may consider the child certificate (and other certificates in the chain) to be untrustworthy, and may provide a warning to a user.
  • Referring now to FIGS. 4A through 4D, a method of establishing secure communications between a client and a server over a network is depicted. In FIG. 4A, a negotiation takes place between the client and the server. This involves client 40 sending a request to server 41 to initiate negotiation. If multiple communication modes are available, i.e. if more than one cryptographic algorithm is available for use, one of client 40 or server 41 will chose a mode. Following negotiation, sever 41 transmits a certificate to client 40 containing a public key, as shown in FIG. 4B. The client may verify the server's certificate, if desired. In response, client 40 chooses a secret key to be shared with server 41. The choosing of secret key may be performed so as to avoid use of keys previously used, and may also be chosen to avoid predictability, for example by choosing a key from a random number generator. Client 40, using the server's public key, then encodes the secret key in a message subsequently sent to server 40, as in FIG. 4C. Secure communication may then be conducted using a symmetric encryption technique using the shared secret key between client 40 and server 41, as in FIG. 4D.
  • Certificate Life Cycle
  • A certificate is normally used for a limited amount of time for a number of reasons. Certificates are priced according to the length of the validity period. This pricing is not merely for profit making, as there is an expense associated with maintaining the certificate authority infrastructure, i.e. maintaining servers that can validate issued certificates. A service provider may therefore not wish to purchase a certificate lasting a lengthy period of time, particularly if the certificate is to be used in a test or uncertain venture. Additionally, the longer a certificate is in existence and/or service, the more likely the private key will be discovered. An attack on a PKI key pair is thought to best be performed by an exhaustive search for a private key that decrypts intercepted encrypted data. Test searches are known to have been successfully conducted using supercomputer clusters in a period of months against keys of typical size. A longer period of use means that, first, an attacker will have more time to perform the search and, second, an attacker may have more intercepted data to validate the resulting possible private keys that are found. Additionally, certificate validity periods may be especially important when considering insiders, administrators and other internal employees having access to SSL servers may have additional opportunity to compromise private keys through their administrative access.
  • Having a limited service life of certificates requires intervention and/or certificate renewal upon the expiration of the validity of those certificates. Recent experience with PKI enterprises has shown that certificates are too often not properly renewed before expiring. Should a certificate expire unnoticed, the associated service may become unavailable. Should the PKI continue to operate, users are likely to experience warning messages, which may cause those users to avoid using the service. The service may further be subjected to an increased probability of a compromise, with devastating consequences. Should a certificate renewal failure occur for a large enterprise, for example a large Internet seller or lender, significant revenues may be lost.
  • The causes of certificate renewal are many in number, a few of which are noted here. An entity may fail to note the expiration of a certificate. The certificate authority may send a reminder by postal or e-mail, with some chance of mis-delivery. For example, the certificate authority may have a postal or e-mail address that has changed due to the entity moving or changing its domain name. If the entity is located overseas, there is also an increased opportunity for the notification to suffer delay. If the entity maintains a manual certificate database, there is a chance for an erroneous or missing entry. Furthermore, a notification may be missed by an administrator, which individual may be busy, on vacation, incompetent or terminated. For larger organizations, there may be several administrators multiplying that problem. Additionally, the process of renewing certificates has been a manual process, and subject to typos and other technical errors.
  • Service entities have operated for months and years ignorant of the dangers of expiring certificates. When the problem is discovered, it may be too late to recover without downtime of the enterprise. Should an entity face such a crisis, there are presently no tools for surveying the certificates in service. The administrators may then find themselves visiting every server of the enterprise, creating a compilation of the certificates installed and the relevant expiration dates. As certificates are renewed, the administrators may update the compilation to get a handle on the schedule of certificate renewals. Again, this is a manual process and subject to human errors, which process puts an entity at risk of downtime and loss of income or services to clients or customers. For very large enterprises having thousands of certificates, the certificate renewal workload may require the attention of several administrators, which increases the expense of the operation.
  • Disclosed below are a number of systems and methods useful in environments of certificate management. Some of the disclosed systems serve a single function related to certificates. Others combine several of those functions into more comprehensive systems. Of the many potential combinations most, if not all, are useful, and therefore combinations may be chosen for particular circumstances of certificate management.
  • Individual disclosures herein may take the form of computer systems performing functions by software, software executable by a computing system, or a group of functions performable by a computing or software system to achieve various functions, or other forms. The reader should recognize that wherever disclosure is made of one of these types below, the others will also be made apparent.
  • Certificate Inventorying Systems
  • Certain of the systems disclosed herein relate to discovering and inventorying certificates installed to a set of network servers. In a first exemplary system, a database is maintained containing records relating to inventoried certificates. Each record identifies a certificate and a server to which the certificate resides or is installed. For each certificate, an expiration date or time may also be noted, by which the expiring of certificates may be noticed. Likewise, an expiration period may also be noted. Notation may also be made in certificate records for an issuing certificate authority. Other items of data relating to certificates may also be tracked, for example the common name, organization, an identification of a responsible individual, the strength of the encryption keys, etc. Expired certificates may also be tracked in a database, if desired.
  • Such a certificate database may be maintained using common file formats, for example CSV or dBase formats without becoming unwieldy, as the number of certificates tracked in a typical organization will be relatively small. A certificate database might also be maintained in a relational database server, which may provide additional search, remote access, encryption and other helpful database functions. Access to a certificate database may be controlled. In the exemplary system access to the database is provided only to authenticated persons and/or applications. A certificate database may take many other forms as desired, the details of which are not particularly important.
  • Entries and modifications to the certificate database may be performed manually, or applications may be provided for managing certificate entries in the database through the use of graphical user interfaces, web interfaces, or many other techniques. Entries may also be made by a certificate scanner, which will be described shortly. A database of related servers, i.e. servers on which certificates reside or servers within a defined network, may also be kept. Such a server database may be kept separately from a certificate database, or may be integrated in the same database, file or data structures.
  • A certificate database may be maintained to provide information regarding the state of certificates in a network at given times. This may be used, in one example, by an administrator to identify certificates due to expire, or certificates that have expired. In another use, certificates may be related to servers to identify unused or duplicate certificates. In yet another use, a survey may be conducted using the database to identify certificate authorities being used, a schedule of certificate renewals, encryption strengths, certificates on a particular domain, or other reviews useful to manage a secure network system.
  • A certificate inventorying system may additionally include a certificate discovery tool for locating certificates in a chosen network. The discovery tool may receive as input a network address range, which in one example includes an IP address and subnet mask for an IP protocol network. In another example, a list of IP address ranges are given. For other network types, a network name, SSID name or other identifier may be used in accordance with the network's addressing standards.
  • Referring now to FIG. 12, a procedure for discovering network certificates is described. First, in step 1202, a network address range is input and received by the discovering system. In this example, an empty database is created in step 1204 for holding the resulting certificate information. The procedure iterates through the address range in step 1206, which includes a process illustrated in further detail in steps 1212 through 1222. Alternatively, in some network protocols a search function is available which may report devices registered on the network. In that case, the procedure may iterate over the registered devices. In step 1208, once the address range has been scanned, the resulting database may be stored, or alternatively it may be merged with an existing database, particularly if the results of a prior scan are available. Alternatively, an existing certificate database might be directly modified, adding newly discovered certificates and optionally removing certificates no longer in existence.
  • At each address iterated through, steps 1212 through 1222 are executed in a subroutine. First, an attempt to connect with the device at the currently iterated device is made over the network, as in step 1212. If the attempt is unsuccessful, the subroutine may exit, as in step 1214. Should a successful connection be made, an attempt to retrieve a certificate will be made, as in step 1216. If a certificate is not available, decision 1218 causes an exit of the subroutine, as there is no certificate information to record. Otherwise, the subroutine parses a received certificate for items of interest, as in step 1220. The items of interest may be any information related to the received certificate, but might be a certificate identifier, an expiration date, in one example. The parsed information may then be recorded to an entry in the scan database, as in step 1222, optionally with other related information such as the current network address, server type, or other information.
  • The procedure shown in FIG. 12 shows a single attempt to connect with a network device. This attempt might be, for example, an attempt to establish an SSL handshake over IP port 443, which is the port commonly used for the HTTPS secure connection service. Through the course of the handshake, the SSL certificate is provided to the connector, which is one way it may be retrieved. Other ports or methods may be used to attempt the connection and retrieval of certificates. In an alternate method, an attempt may be made to mount a device's file system (or a portion thereof) through an NFS or SMB connection. Following establishment of a connection, a search may be conducted through the exported file system to locate probable certificates, which can be verified by attempting a parsing of the suspected file. The location a certificate is found provides clues as to what application is using it, if any. A similar and further alternate method attempts to establish a secure shell or telnet connection using a set of commonly used usemames and passwords. In yet another alternate method, an attempt may be made to access an administrator interface provided by a web server or other application providing access to certificates. Other methods of obtaining certificates may be available, depending on the devices attached to the network, which may be incorporated to provide improved scanning coverage.
  • A discovery system may provide for log production of the discovery process. The log might show any of items such as: addresses scanned, ports scanned, failed and/or successful connection attempts, addresses with no response, certificate identifiers and other certificate information, server software types and version numbers, modifications to an existing certificate database, and many other items as desired. A discovery system may additionally combine the results of scans conducted at different times, which may be useful to catch servers which may have been inoperative at a particular time. Although the procedure of FIG. 12 attempts only a single connection, the procedure may be modified to perform two or more connection/retrieval techniques. In that case, the log may additionally reflect the techniques used as well as technique-specific information. [0091] The result of a discovery process may be a database providing an audit of certificate conditions on a network, which may be utilized by administrators in certificate maintenance activities. A discovery process may be conducted manually, by software, by a network appliance, or any other object of execution as desired. In one example, a discovery process is conducted by a software application installed to a host computer on a network. In that example, the software may be provided on a disk or other medium, and may be packaged with other software and instructional items as a stand-alone software product. In another example, the discovery process may be conducted by a dedicated network appliance, which may provide a user interface through the HTTP or HTTPS protocols, or by other user interface type. In that example, the database may reside on the appliance, or may be created or deposited to another computing device, which might be an RDBMS or NAS device. A database or log might also be sent in an e-mail message, or might be sent to a printing device for a hardcopy by the appliance. In a further example, described below, the appliance includes other functions related to certificate management, including software for renewing and installing certificates. Many other variations are possible and may be fashioned in accordance with the desires and preferences of the implementer.
  • A certificate discovery system may detect certificates that are not used, and may report those unused certificates to an administrator. Discovered certificates may also be archived, avoiding the need to provisioning of new certificates should a server crash or otherwise become inoperable. If private keys are also discovered, those can also be archived if desired. Other systems as disclosed below may also report unused certificates or archive certificates as desired, managed or otherwise.
  • Certificate Installation/Renewal Systems
  • Other systems may be fashioned to assist with the installation and renewal of PKI certificates. Those systems may assist with the issuance of a certificate and may perform steps to install certificates to appropriate server destinations and other PKI devices.
  • Referring now to FIG. 8, a simplified method of automatically receiving and installing signed certificates from certificate authorities is depicted. First, an automated system receives a notification from a certificate authority, as in step 81. This may take place by email, as described below, through polling on a web interface, or other notification facilities. Alternatively, an alarm or timeout may initiate the process rather than a notification, which may be set prior to or about the time of expiration, or alternately may be set to according to a predefined period after certificate issuance. Optionally, other events may trigger the notification of a certificate due to be renewed, for example according to risk profiles or reports from other systems, such as an intrusion detection system, that a server has been compromised. Upon reception of a notification, the system tests whether the notification concerns a new certificate, as in step 82. If a new certificate is referred to or included in the notification message, the certificate is extracted in step 83 from wherever it is located. It may not be apparent which server is to be the target of the new certificate installation, and therefore a destination server is identified in step 84. The certificate may then be installed to the destination server, as in step 85. The process may repeat with the reception of additional notifications and may be executed as frequently as needed.
  • The installation of newly issued certificates may proceed as follows. First, it may be necessary to request and receive a certificate from a certificate authority, if it is not desired to use an internally-generated certificate. A common method of certificate receipt is by e-mail received at the same computer from which a certificate signing request was submitted. For a signed certificate received from a certificate authority, it may be necessary to determine a destination server for the certificate upon receipt. For example, if the certificate is a renewed certificate for a certificate about to expire, it may be desirable to install the certificate to the server storing the expiring certificate. Alternatively, a certificate may under some circumstances be held prior to installation. In one situation, it may be desirable to request renewed certificates well in advance of the expiration of old certificates. The old certificate is, in that situation, allowed to age before installing the renewal certificate. In another situation, a collection of servers may serve the same network address, through network address translation or other techniques. A collection of renewal certificates may, in that situation, be maintained in a store until needed, at which time the oldest renewal certificate may be installed to servers having certificates about to expire.
  • Regardless of the situation, a fresh or renewal certificate is associated to a destination network server at the time it is signed. A destination network server is therefore identified as corresponding to the received signed certificate. After a server is identified the server type is determined, in order to choose the proper method of installation. For example, if the server is serving web pages over the HTTPS protocol, there are a number of possible web server products that might be installed. For example, the Apache web server might dictate that certificates be installed through a file placement to a specified directory, a modification of particular configuration files (especially for non-renewed certificates), and restarting of the web server daemons. In another example, an iPlanet web server might provide a web administrator interface. In that circumstance the text of the certificate might be cut and pasted from an email into a text entry field, following which the web administrator installs the certificate text in the correct location. It may also be necessary to restart the PKI application and/or computer to flush the old certificates out of memory. Installation scripts might be written to support a number of PKI platforms, for example iPlanet, Apache, IIS, Netscape, Websphere in a multiplicity of versions.
  • In many if not most installation procedures, an authentication step will be required to access the certificate store on the destination device. This may involve offering an administrator username and password, a passphrase, a certificate or other authorization object. An authorization object may be stored within or accessible to the installation system prior to the installation activities.
  • The installation system has access to installation instructions which constitute a set of installation steps for installing certificates to particular server types. These installation instructions may take many forms, the content of which will depend on the type of interface used to perform the installation steps.
  • In a first example, the installation instructions define a set of shell commands. An exemplary set of shell commands for installing a certificate to an apache server might be: (1) log onto the destination server using an SSH connection and using a pre-stored username and password, (2) use the “cd” command to change the current directory to the certificate directory store, i.e. “cd/etc/ssl/apache”, (3) remove the old certificate, i.e. “rm-f./server.crt”, (4) install the new certificate, i.e. “echo MIIDBTCCA . . . >server.crt”, (5) install the new private key, i.e. “echo MIICXQ . . . >server.key”, (6) restart the web server, i.e. “apachectl restart”, and (7) terminate the SSH connection. Now, the directories given above may vary between operating system distributions and even between installations if an administrator has changed the directory configuration from the default. If it is desired to support an expanded range of server configurations, it may be desirable to examine the server configuration files. In the above example, which assumes a default Apache 2.0.47 server installed to a Linux Mandrake 9.1 operating system, the location of the ssl certificate and key can be found using the commands “grep SSLCertificateFile /etc/httpd/conf.d/41_mod_ssl.default-vhost.conf” and “grep SSLCertificateKeyFile /etc/httpd/conf.d/41_mod_ssl.default-vhost.conf”, assuming that root access is available. Similar installation instructions may be fashioned through a study of other server products to be supported.
  • A second installation instructional example utilizes file transfer protocols to deposit the certificate and key to a destination server. This example includes the steps of (1) using the scp protocol to transfer the certificate to the server, i.e. “scp -B server.crt /etc/ssl'server.crt”, (2) use the scp protocol to transfer the private key to the server, i.e. “scp -B server.key /etc/ssl/server.crt”, and (3) notify the administrator that the server needs to be restarted, for example by an e-mail message. Other file transfer protocols can be used, such as FTP or NFS, however it should be kept in mind that using insecure protocols over public networks may comprimise the security of the destination server.
  • A third example utilizes a web interface provided with the server application. A web interface is sometimes provided with a web server or other server application, by which control of the operation of the server may be commanded through a web browser. The web interface, if enabled, is accessible typically at a default relative URL, which might be at a special IP port, directory, CGI or other executable web script or program. In this example, the instructions are configured for a program that acts as a web browser, sending input back to the server's web interface as if the input came from a person operating a browser. This exemplary set of instructions includes (1) a command to go to the login URL of the web interface, (2) submit a form to the web interface containing an administrator usemame and password, (3) receiving the resulting web page, (4) a command to go to the certificate entry URL of the web interface, (5) submitting a second form to the web interface containing the new certificate and key, (6) confirming the submission of a new certificate and key in a third form, (7) a command to go to the web interface page including a “restart server” button, and (8) sending a fourth form containing a selection of the “restart server” button.
  • The third example might be implemented in any number of ways. For example, a PERL script to perform the steps might be written utilizing an http protocol library. In another example, a web scripting language is utilized to provide a shortenend and simplified interaction script. Likewise, any number of scripting or programming languages may be used to provide controlled interaction with a server's web interface.
  • In a fourth example, an agent may be pre-installed to the destination server. In that example the agent monitors some communication channel for instructions to install certificates and keys. That communication channel might take several forms, such as a TCP/IP connection, an SMTP receiver, an RPC interface, or the agent might periodically review a configuration file located on the destination server or at another location. Likewise XML web service interfaces, web interfaces, and other secure and non-secure layers or custom protocols might also be used. That agent would include support for the server type such that incoming certificates are properly deposited in the correct location. Such an agent may also include authentication measures to prevent unauthorized agent activity. The agent may optionally also cause a restart of the server application or a reboot of the server itself.
  • A certificate installation system might utilize one or several methods of certificate installation. Such a system might incorporate a table selecting an installation method and/or script to execute depending on the server type, i.e. the server's operating system and server applications installed thereon.
  • In a fifth related installation, information is first retrieved to effect contacting and install the certificate to the destination web server, accelerator or other device, that information including at least some of the platform type, the operating system, a detault protocol such as telnet, SSH, HTTP, HTTPS, etc., the certificate text, the destination server's IP address or hostname, a user name and password to log onto the destination, a password for the certificate store, the certificate common name, and a port number to initiate contact with the destination. Next, the certificate text is formatted to be in X.506 base 64 encoded format. The destination is then connected to using the port number, IP address and protocol specified. For certain server applications such as the Apache web server, an IBM web server, an IPlanet server or accelerator, the OpenSSL service is started. Next, the command “find / -name ssl.conf”, or a similar command, is executed to locate the SSL configuration file. The command “find / -name httpd.conf”, or a similar command, is also executed to locate the server configuration file. Next the certificate and key name are extracted from the configuration file using “grep \SSLCertificateFile/” or a similar command. A new configuration file is then generated either including or referencing the new certificate, and written to the destination server. If needed, the “make” command may be executed to roll out the updated certificate information to all server files. The connection is then terminated and the server restarted.
  • Now in the above examples, a new private key is installed for every new certificate. The use of several keys over a period of time tends to increase the difficulty of discovering the keys, or at least may prevent an attacker from discovering a key while it is in use. The use of new keys is not strictly required, however, and an installation procedure may install a new signed certificate containing an old public key, if desired.
  • Also in the above examples, no provision is made to reconfigure a server application to support PKI operation. Any of the above examples may be expanded to configure PKI supporting applications, for example by modifying files or accessing a web interface. By reconfiguring a server automatically, a laborious process of configuring servers for SSL or HTTPS support may be avoided.
  • Provision may also be provided in the certificate installation system for approvals. Upon receipt of a certificate signed by a certificate authority an administrator may be notified, for example by email. The received certificate may be held pending approval by the administrator. The installation system may provide an approval interface, for example accessible by a web browser, by which an administrator may authenticate himself to the system and select certificates approved to be installed. The interface may additionally provide for bulk approvals, i.e. presentation and approval of a group of certificates in a single approval step. The interface may additionally present certificates sorted in order of expiration date or priority, providing for ease of administrator selection. Optionally, certificates may also be presented in order of risk according to certificate risk profiles. Following approval, the certificates may be installed to the appropriate servers, for example using automated processes as suggested above.
  • An installation and renewal system may also include provisions for monitoring expiring certificates. In such a system, certificates may be enrolled in a certificate watch program. On a periodic basis, for example daily, weekly or monthly, a certificate database is reviewed for certificates expiring within a future period. Finding certificates in need of renewal, a notification may be sent to an administrator, which for example might be by e-mail or by a display upon login at an administrator interface. The administrator may then select certificates to be renewed, upon which a process of certificate renewal may be initiated as described below. Alternatively, the renewal system may be configured to initiate certificate renewal without approval, to prevent late certificate renewal should an administrator be unavailable to approve. If more than one administrator is configured, the renewal system may contact other administrators if first administrators do not timely respond to requests for approval.
  • In an alternate mode, a renewal system may scan the servers of a network periodically, as in the discovery processes discussed above, to detect certificates due to expire within a future period. In that system certificates might not be enrolled, but rather servers might be enrolled in a server watch list. In another alternate mode, agents are installed to the servers being monitored. Each agent periodically reviews the certificates for expiration, and may notify an administrator or a central system of any certificates about to expire, for example by email.
  • A manual certificate renewal process is typically initiated at the server to which the certificate will be installed. The process begins first by the generation of a public/private key pair. Now the key pair might be generated externally to the server, but that method introduces some risk of compromise in that the private key could be discovered in the process of moving it to the server. Following the generation of the key pair, a certificate signing request (CSR) is generated, which is basically a partially completed certificate in that it contains the public key and server identification, but is not otherwise associated to a certificate authority or a root certificate. Having a certificate signing request, it may either be sent to a certificate authority or it may be signed in-house. If a certificate is to be used externally, it should either be signed by a certificate authority or by using an intermediate root certificate itself signed by a certificate authority. Certificates to be used for internal use only may be signed by an internally generated root certificate, because those certificates maintained by an organization may be considered to be trusted. The signing process generates and attaches a signature to the certificate, which signature is generally an encrypted hash value generated from an unsigned certificate generated from the CSR information and from other information, such as the location of the root certificate and the validity period, which is encoded by the private key corresponding to a public key of a root certificate. The signed certificate is then ready for installation to the server.
  • The following method may be useful to generate a certificate signing request remotely using shell commands through an SSH, Telnet or other shell connection. First, the information needed as input to generate the certificate signing request is provided, including at least some of the protocol to be used, an email address, an IP address, the locality of the certificate including the country, state and city, the organization name, a certificate store password, and a port number to initiate a connection with the remote platform. Next, the remote shell is opened to the remote platform, utilizing known usernames and passwords or other authentication means. A command is then executed to set the remote platform to configure mode, followed by a command to enter an SSL configuration utility. The certificate store is then remotely opened and the default SSL certificate selected. Next, the current private key is removed from the certificate store. A new private key, for example a 1024 bit DES key, is generated and placed in the certificate store. A new PEM file or PKCS file is then created using the newly created private key. A further command is then sent to exit the SSL configuration utility. The “gencsr key” command is then used to create a new certificate signing request file with the city, state, country, organization name/unit, common name and email address provided in the earlier input or obtained from default set values. The output of the CSR text between the string identifiers “ - - - BEGIN CERTIFICATE REQUEST - - - ” and “ - - - END CERTIFICATE REQUEST - - - ” may then be captured and optionally placed in a database for storage until needed. Housekeeping activities and disconnection may follow the capture of the certificate signing request.
  • A simplified certificate renewal process is depicted in FIG. 9, which may be operated by a certificate renewing system. First, in step 91, a search is made to detect expiring and/or expired certificates in a managed server group. Following detection of expiring/expired certificates, a loop is started in step 92, which ends when there are no more expiring/expired certificates that remain unprocessed. For each detected expiring/expired certificate steps 93 through 97 are performed. In step 94, the appropriate server (the server holding the expiring/expired certificate) is commanded to generate a new CSR and optionally a new key pair, as described above. The renewal system receives the generated CSR, as in step 95, and sends the CSR to a selected certificate authority 96 for signing. Optional step 97 may be performed to maintain a record of what certificates have been processed for renewal. Upon exit of the loop starting at step 92, an alarm is set in step 98 to pause the execution for a period of time to avoid unnecessary processing. A certificate installation process may be conducted apart from this method and system in any way desired.
  • The public/private key pair may be generated off the destination server, particularly if the server does not include software to generate the key pair (many operating systems include a well-known product called openssl). If that is done, it may be desirable to ensure the network between the generating computer and the destination is secure to avoid private key discovery.
  • The submitting a certificate signing request to a certificate authority is typically performed through a network connection over the Internet. The certificate authority (CA) presents an interface, for example in a web browser, in which an administrator may enter the CSR and other information related to the request, such as the requesting entity's identification, account number or a challenge phrase. If desired, the CA may permit the use of default values, in which case it may be possible to initiate a request by submitting only a CSR and identification of the requester. Upon receiving the CSR, the CA may take steps to verify the identity of the requester so as to avoid others from impersonating a proper requester and receiving valid and/or trusted certificates. After a period of time, usually at least several hours but typically not more than a few days, the CA issues the signed certificate. The issuing typically takes the form of sending the issued certificate to the administrator in an e-mail message, although other transference methods might be used equally well.
  • In other communications with certificate authorities, specialized protocols may be used. One exemplary protocol called the XML Key Management Specification (XKMS), the specification of and description of which is available from the World Wide Web Consortium, may be used as a starting point for a certificate signing request transmission protocol. Web interfaces suitable for human access may also be used through http automation tools. Screen scraping, data manipulation, key stroke automation, mouse click simulation and other forms of automation can be used to interact with such a web interface. Direct socket communication might also be used.
  • A certificate renewal system may include facilities for automating certificate signing, as will be presently described. As with certificate installation, certificate signing requests may be subject to approval. As expiring certificates are identified, they may be presented to an administrator for renewal. If it is desired to continue use of particular certificates or servers, an administrator may select those for certificate renewal. Approved certificates may be reviewed and parsed for informational items to be recycled, for example the server identity and the owning entity identity. A new certificate signing request is generated, either locally or remotely, for example at the server to receive the certificate. If a CSR is generated locally, the generation uses the identity of the destination server. If desired, the CSR may then be sent to a CSR for signing. Alternatively, if a root or intermediate root certificate is to be used and is available locally, the renewal system may sign and issue the certificate.
  • If a CSR is submitted to a CA, a period of time will elapse before issuance of the corresponding signed certificate. It may therefore be desirable to suspend the renewal process until the certificate arrives. For interacting with CAs that issue certificates by email, the system may monitor the incoming email messages. If desired, the system may include a specialized SMTP module to receive emails, in the event that an SMTP client isn't provided by the hosting operating system. Alternatively, an email filter may be applied to an existing SMH system to route messages from CAs to a renewal program. Regardless, the renewal system reviews the incoming email messages for issued certificates, and extracts them from the emails as needed. Alternatively, a CA may issue certificate by download. In that event, the renewal system may periodically access the CA's website. Of course, if a certificate is issued locally, for example if a management system is configured to act as a CA, it is immediately available for installation. Once a certificate is received or otherwise available, it may be held pending approval or immediately installed as in the examples above.
  • The CA may have policy regarding the issuance of certificates, for example declaring how an issued certificate may be used. A certificate renewal system may be fashioned to be not only compatible with the protocol requirements of CAs, but also with any policy requirements set forth.
  • In an exemplary certificate renewal method, challenge phrases used in the submission of CSRs to CAs are stored in the renewal system privately, and may also be encrypted if further security is desired. If a CA requires the submission of an administrator certificate or other object to accompany the submission of a CSR, those objects may be stored at the renewal system and made accessible for transmission to the CA in accordance with existing protocol. Internal CAs may also be used, i.e. certificate authorities controlled internally by a certificate using entity, for example if public validation of certificates with trusted CAs is not required.
  • CSRs may also include custom fields, such as accounting codes, group identifiers, usage notations, and other information associated with a particular issuing certificate. In one example, custom fields are included providing accounting codes that may be used to track operational expenses. In another example, usage notations are included in CSRs to provide, encoded in the issuing certificates, instructions where to install the certificates. Many other uses of custom fields may be used as desired, and may be facilitated by a renewal system.
  • A renewal system may also include access control for users and groups of users. The system may maintain a record of users authorized to view, change, renew and otherwise manage certificates. Authentication may be made through the use of passwords, certificates or other identifying objects. Certificates may be assigned to be managed by a single user or several users. Likewise, user groups may be configured to permit individuals within the user group to manage certificates.
  • Throughout the renewal and/or installation progress a log may be maintained by the system. The log may track activity at any level of detail desired, which might be in one example programmable. Entries might include logins, logouts, certificates approved for renewal, certificates approved for installation, which certificate authority was used to renew particular certificates, which server a certificate was installed to, which version of automation scripts were used and many other possible events.
  • If it is desired to use intermediate root certificates to sign end certificates, before creating a CSR an examination of available intermediate root certificates may be performed to ensure the period of validity of the end certificate is within the period of validity of a selected intermediate root certificate. Should an intermediate root certificate expire before the desired end certificate period of validity, or the root certificate become valid after the start of the period of validity of the end certificate, an administrator may be notified of a problem. The administrator may choose to renew the intermediate root certificate, obtain a new intermediate root certificate with an appropriate validity period, defer the renewal of an end certificate, or choose to have a certificate to be renewed signed by a publicly available root certificate.
  • Likewise, an installation or renewal system may also handle the installation and renewal of intermediate root certificates. In that system, it may be desirable to provide backup for intermediate root certificates and private keys from which those certificates have been generated, so as to prevent the loss of private keys necessitating the obtaining of new intermediate root certificates for issuing new end certificates. A database may also be maintained including information about the relationship of intermediate root certificates and end certificates issued from those root certificates. Other information may be stored in such a database, such as the attributes of intermediate root certificates, which devices contain those certificates, what certificate authorities issued those certificates, a history of end certificates issued from intermediate root certificates, and other related information.
  • Certificate Request Systems Supporting Multiple Certificate Authorities
  • A certificate renewal system or a certificate signing requesting system may make use of a certificate authority abstractor, which permits certificate related interaction with two or more certificate authorities using a common schema of operation. A number of certificate authorities presently make their services available, however each presents a different interface and procedures to administrators who wish to submit certificate signing requests. Thus an administrator may be required to learn the various web pages and/or software interfaces, functions, administrations, reporting and delivery systems of several certificate authorities.
  • The conceptual elements of a certificate authority abstractor are depicted in FIG. 11, which will now be disclosed. A certificate authority abstractor 115 receives a number of input items. First of all, a set of scripts 114 a and 114 b are accessibly provided to abstractor 115, those scripts containing programs or instructions sufficient to submit CSRs to a particular certificate authority. Those scripts may operate through web interfaces, specialized protocols such as XKMS, or other communications protocols according to the requirements of the certificate authority for which the script is to interact. Additionally certificate authority records, 113 a and 113 b, may be maintained to provide default values for the scripts. For example, certificate authority A may always request the organization name and account number in the course of submitting a CSR, which may be conveniently set in a record specially prepared for that certificate authority. Information sufficient to identify the requesting entity to all supported certificate authorities may also be stored, in this example in certificate authority records 1 13 a and 113 b as an organization name, domain name and account number.
  • CA abstractor 115 also presents a uniform interface 119 for receiving information pertaining to the submission of an individual certificate signing request 112. Interface 119 provides a uniform set of entries for at least the informational items required in a certificate signing request generally. These entries may provide for such items as a common certificate name, a period of validity, a locality identification, a public key, user defined fields or other fields in many combinations.
  • In a first exemplary abstractor, the certificate request information contains only a certificate signing request generated externally, for example at the server destined to receive a signed certificate. In a second exemplary abstractor, the certificate request information contains information sufficient to complete a certificate signing request by the CA abstractor using a transferred public key. Many other data transference schemas can be implemented as desired with attention to the details of any larger certificate automation system.
  • Abstractor 115 further receives a selection of a certificate authority 116, which may occur one time through a default setting, or a CA choice may be presented each time a certificate request information record 112 is submitted. The selection of certificate authority determines which script will be executed and which certificate authority record will be executed. In some circumstances and as shown, the abstractor will interact with one of certificate authorities 118 a or 118 b by way of an external network 117, which may be the Internet. Alternatively, if a locally maintained certificate authority is available, external network 117 may be replaced with an internal network or other communicative objects. Once certificate authority records are received, certificate request records may be submitted to the abstractor, whereby the all required items by the selected certificate authority may be provided. The interaction by the script 114 may then communicate a request that in its totality constitutes a certificate signing request associated with the requesting entity.
  • In an alternative abstractor the abstractor acts as a proxy application to the true certificate authorities. An administrator or system, for example a certificate renewal system, may interact with the abstractor as if it were a true certificate authority, passing the same informational types using similar interfaces, as desired. Additionally, although interaction with two certificate authorities is shown, the concepts disclosed above may be extended to support operation with any number of certificate authorities.
  • A certificate installation or renewal system may also perform a verification operation to verify that a newly requested certificate has been installed correctly and is available for use. In an exemplary method, the system may act as a client for the particular service for which the certificate is being used. For example, if a new certificate is for a web server supporting HTTPS, the installation/renewal system may attempt a secure HTTPS connection with the destination server. The verification may include checking for use of the new certificate and general operation of the secure use. Notifications may be sent to an administrator on success or failure, which may be after a timeout period if verification does not immediately follow certificate installation. In an exemplary system, alerts may be sent to more than one administrator, the system contacting further administrators if administrators previously notified haven't resolved a problem. That system may also submit periodic messages, such as what certificates are due for renewal in the near future, for example a period of 14 days.
  • Presently, it is difficult for enterprises to switch between certificate authorities, as the certificates under use may be expiring at different times and the enterprise may wish to continue to use existing certificate services paid for through the end of that term. In a manual system, as certificates expire an administrator is required to track certificates individually, renewing each certificate with the new authority. This activity can be relatively expensive and is susceptible to error.
  • In a certificate renewal system, a default certificate authority may be selected. That selected CA may then be used to renew certificates, by transferring information from the old certificates into CSRs to the new selected CA. If desired, a renewal system might also be commanded to replace all or a part of a set of managed certificates, swapping out certificates one or more several undesirable certificate authorities with a selected certificate authority. In an exemplary renewal system a “migrate” function is provided permitting automatic transfer of certificates managed by unsupported certificate authorities to a default certificate authority for which certificate requests are supported.
  • Systems for Managing Certificates in an Enterprise
  • A more complete system for managing certificates in an enterprise will include facilities not only for monitoring certificates, but also for requesting renewed certificates and installing those certificates to the enterprise. Another simplified method depicted in FIG. 10 suggests the operation of that system type. In that system, notifications are sent from certificate authorities, which are received by the system in step 101. For each notification, a determination is made as to whether the notice concerns a newly issued certificate, as in step 102. If the notice concerns or includes a newly issued certificate, a process similar to that described for FIG. 8 is performed in steps 106-108 to extract the certificate and install it to an identified destination server. Another determination may be made in step 103 as to whether the certificate authority is warning of an expiring certificate. If it is, an attempt to identify an enrolled server and/or certificate corresponding to the notice is made in step 104. If the corresponding certificate/server is enrolled, steps 109-111 are performed as in the method described for FIG. 9, by which a new certificate signing request is generated and sent to the appropriate certificate authority.
  • FIG. 5 depicts components of a certificate management system providing functions as described above for a single enterprise entity. The enterprise includes a number of servers 53 a, 53 b, 53 c and 53 d for providing services. Some of servers 53 a-d may provide services to clients 50 over an external network 51 by way of a gateway or router 52. Others of servers 53 a-d may provide services to clients 59 local to the enterprise entity. In the exemplary enterprise two accelerators 54 a and 54 b are provided to assist in encrypted communications with clients 50 or 59. At least one certificate authority (CA) is accessed to provide new and renewed certificates, which in this example are an internal CA 60 and an external CA 61. Internal CA 60 is managed by the enterprise entity and may be used to provide self-signed certificates, which may be useful for internal secure communications. Internal CA 60 may also include an intermediate root certificate upon which individual server certificates may be signed and issued, the intermediate certificate being made available for verification to parties encountering the issued certificates, for example over the external network 51. An external CA 61 may also be utilized to issue digital certificates for secure communications between client 50 and servers 53 a-d.
  • A scanner 57 may be provided to scan the network for certificates to be managed, which in this case would scan any or all of servers 53 a-d, accelerators 54 a and 54 b, and internal CA 60 if provided. Upon finding servers and certificates installed thereon, scanner 57 may provide resulting information to a database 58 containing information identifying certificates, expiration dates, and issuing CAs for the certificates. An installer 56 may also be provided to automate the installation of new certificates on servers 53 a-d or accelerators 54 a and 54 b. Installer 56 may further automate the installation of intermediate root certificates to internal CA 60, if desired. A renewer 55 may be provided to monitor the expiration of certificates of which information is stored in database 58 and may provide functions related to the renewal of expiring certificates. One function is to notify an administrator of an expiring certificate. Another function is to initiate the renewal of a certificate through the automated generation of a certificate signing request, optionally after administrative approval. Another renewal function is the delivery and/or installation of renewed certificates to servers. The system of FIG. 5 may be expanded to include other functions related to certificate management, for example reporting services and provisions for access through an electronic interface.
  • Referring now to FIG. 6, a similar system to that shown in FIG. 5 is depicted, including a client 50, an external network 51, a gateway device 52, servers 53 a-d, an internal client 59, and an external certificate authority 61. In the system of FIG. 6, the functions of renewer 55, installer 56, scanner 57, database server 58, and optionally internal CA 60 are combined in a single computing system called a certificate manager 62. In this example, the certificate manager 62 may be “dropped in” to the enterprise system as a single piece of hardware connected to the enterprise's internal network, providing rapid certificate management in the enterprise without unduly consuming space or computing resources.
  • In FIG. 7 a system is depicted whereby certificate management is conducted from an external network location from an enterprise. In this example the enterprise includes servers 53 a and 53 b, either or both of which may include digital certificates for secure transactions with a client 50. In this example certificate manager 70 is located outside of the enterprise network including servers 53 a and 53 b. To perform certificate management on servers 53 a and 53 b, certificate manager 70 communicates electronically over the external network 51. The use of secure protocols for those communications may be desirable, particularly if private keys are passed over the potentially insecure external network 51. An administrative client 71 b may access local certificate manager 70 to perform administrative functions, for example configuring certificate manager to service servers 53 a and 53 b. Certificate manager 70 may also be made accessible to non-local administrative clients 71 a, particularly if secure protocols are utilized in that access. An external certificate authority 61 may be accessed to provide trusted certificates to servers 53 a and 53 b, and also to certificate manager 70 for secure administrative access.
  • The configuration of FIG. 7 may provide a service to enterprises whereby additional hardware is not required to be installed locally to the enterprise. In that example enterprises may subscribe to a service and further provide any necessary usemames and passwords for administrator access to the enterprise servers, to be stored accessible to the certificate manager. Servers 53 a and 53 b may have installed thereon agents for access by the certificate manager 70, or services already installed may be utilized to provide the necessary access by certificate manager 70, for example the SSH service. The certificate manager may also include root certificates, whereby the certificate manager becomes a certificate authority that not only can issue and verify end certificates, but can also maintain those end certificates automatically for customers. The certificate manager may also include intermediate root certificates, if the operator does is not or does not wish to operate as a trusted authority.
  • An exemplary certificate management computer system is packaged in a rack-mountable form-factor and includes a Pentium 4 processor operating at 1.7 GHz or higher, 512 MB of 400 MHz SD-RAM, a RAID system including two 40 GB hard drives in a data mirroring configuration, redundant power supplies, two redundant 10/100 Base TX network ports, two 9-pin serial ports, one parallel port, four USB ports, and a graphics port supporting VGA video modes and higher. Other computer systems may be utilized in various circumstances, for example if a relatively small number of certificates are to be managed or if network access is provided through a non-Ethernet connection. Likewise, the computer system may have other software installed thereon, provided that sufficient processing power and network resources are provided to handle the total operating loads on the system.
  • The exemplary certificate manager includes a user interface accessible through the HTTPS protocol, of which FIGS. 15 to 48 are representative. That user interface will now be described.
  • Referring first to FIG. 37, an administrator is provided access to the exemplary certificate manager by way of a web browser optionally located to a client computer. Upon first accessing the manager, the user is first directed to enter a username and password, or present a certificate or other token. Upon authentication by the manager, the web session of access is attributed to a user with optionally assigned access privileges. An authenticated user may be first directed to a home page or a screen containing alerts directed to the user or the user's group.
  • FIG. 15 is representative of a home page providing a number of links to other screens of various functions available through the exemplary certificate manager. In that page, as well as others, the user is presented with status information concerning the number of certificates in process and critical alerts important for the user to view, appearing in a prominent location. Certificates in process and critical alerts to which a user is not privileged to manage need not be indicated. The exemplary home page provides activity groupings which include managing certificates, network discovery, reports and logs. The available management activities shown include managing certificates, managing servers, managing groups, managing users, and system configuration. Network discovery activities include the discovery of servers and certificates in the network. Activities related to reports include the generation and viewing of reports and reports concerning the history of intermediate root certificates managed by the exemplary certificate manager. Logs concerning general errors, critical alerts, and user activity are also made viewable by links in the home page. Also displayed on the home page may be statistics concerning the number of certificates and servers being managed, which may be indicative of the certificates and servers managed by the particular user or the certificate manager generally. In this screen, as well as others, shortcuts may also be provided to direct the user to frequented activities, for example manage certificates and manage servers.
  • FIG. 16 depicts a representation of a manage certificates screen, as might be displayed by transversal through the home page. That screen includes a list element through with the list of managed certificates may be displayed, the certificates managed by a certificate identification including a numeric certificate ID and a common name. For each certificate selectable objects are provided to view, edit, remove and show the history of each individual certificate. The list is further filterable by a textual or numeric criteria, bypassing extensive page-after-page displays of certificates if the number of managed certificates is large. Also in that screen an “add certificate” button is provided to add a certificate to the managed certificate database.
  • FIG. 40 shows a representative screen of a view of certificate information, FIG. 47 shows a screen whereby an administrator may enter information about a new certificate, while FIG. 42 depicts a screen in which an existing certificate record may be edited. In those views an administrator may be presented with various elements of particular certificates tracked in a certificate database, which in the exemplary certificate manager are:
    Field name Contents
    Common Name: Specifies the fully qualified hostname used in DNS lookups (for
    example, www.imcentric.com). This is the hostname in the URL that
    a browser uses to connect to the server on which the certificate is
    located. It is important that these two names are the same. Otherwise,
    a client may notice that the certificate name does not match the site
    name, which often makes users doubt the authenticity of the
    certificate.
    Organization Name: Specifies the official, legal name of the company, educational
    institution, or other organization owning the certificate.
    Organization Unit: Specifies a description of an organizational unit within the
    organization.
    Contact: Specifies an individual who is responsible for this certificate.
    City: Specifies a description of the city, principality, or country for the
    organization.
    State: Specifies the state or province in which the business is located.
    Country: Specifies the two-character abbreviation of the country name (in ISO
    format) of the business location.
    Valid From: Specifies the effective date of the certificate.
    Valid To: Specifies the expiration date of the certificate.
    Certificate Strength: Specifies the bit strength of the keys of the certificate.
    Renewing Certificate Authority: Specifies the CA through which the certificate is to be renewed.
    Server: Specifies the server on which the certificate is or will be installed.
    Secure Server Name: Specifies the instance or name of the web server where the certificate
    is or will be used.
  • FIG. 17 shows a representation of a manage servers screen, again as might be displayed from the home page. That screen includes a list of managed servers listed by a server ID, a hostname and an IP address. For each server shown in the list selectable objects are provided to view, edit, remove and show the history of each server. This list is also filterable, the filter operating by textual or numeric fragments of the server ID, hostname, or IP address. An “add server” button is also provided to add server information for a new server to be managed.
  • If an administrator selects to view or edit a server record, a screen similar to that of FIG. 46 appears. In that screen, the server column data of the particular record appears, which columns may include:
    Field name Contents
    Host Name Specifies the hostname of the server.
    IP Address IP Address of the server.
    Description Description of server.
    Port Port used to access the server,
    some common ports are ssh(22),
    telnet(23), or web(8888).
    Username Username used to access server.
    Is SSL Enabled Specifies if the admin pages are accessed
    via SSL. (Note: only used
    on Netscape 3.6 and Iplanet.)
  • In the exemplary certificate manager users may be grouped together to ease the administration of user privileges. FIG. 18 shows a sample screen for managing groups in the exemplary certificate manager. As with managed certificates and servers, the recorded groups appear in a list from which a group may be viewed, edited, removed or historically viewed. Groups appear in the list as a group ID and a group name. Groups may be added by selecting the “add group” button. Depicted in FIG. 42 is a screen for editing a group. In that screen the group name appears in a textbox, which may be modifiable therein to rename the group. The member users of the group appear in a list including sufficient identification to discriminate users, in this example the user ID, first and last name, email address, and role assignment for the user. User members may be added to a group by clicking the “add member” button, which brings up a separate screen depicted in FIG. 48 whereby registered users may be selected for inclusion in a group.
  • In FIG. 19 a representative screen is depicted for the management of registered users in the exemplary certificate management system. The registered users are presented in a list, with selectable objects for viewing or editing user information, removing a user, and reviewing a history of user actions. Each user is referenced by a first and last name, and email address, and a username. A button is provided for adding a new user to be added to the registered user list.
  • Depicted in FIG. 38 is a representative screen for viewing the entries of a particular user registered in the system. FIG. 39 shows a similar screen for editing the entries of a user. In the exemplary certificate manager a default set of fields are included in the user database, which are outlined in the following table:
    Field name Contents
    First Name First name of the user.
    Last Name Last name of the user.
    Title Position Title for the user.
    Company Company with which the user is employed.
    Department The user's department in the company.
    Address Street address (home or office) for user.
    City City in which the address is located.
    Zip Postal code for the city.
    Email Email address for user.
    Work Phone Work phone number for user.
    State State in which the city is located.
    Country Country in which the state is located.
    Fax Number Fax number for user.
    Username The identifier index of the user.
    Password The password of the user (may be hashed).
  • Additionally included in the screens shown in FIGS. 38 and 39 is an active directory input facility, by which an administrator may import user information by providing an import path and the usemame and password of access for the directory service.
  • FIG. 20 depicts a representative screen of the exemplary certificate manager whereby network settings may be input. The network settings include the IP address, subnet, and gateway of the manager. DHCP may alternately be enabled by checking the appropriate checkbox, which overrides the IP address, subnet and gateway settings. The exemplary manager may be configured to require a specified client certificate be present at clients accessing the administrator user interface, which function may be enabled by selecting the appropriate checkbox. Now the manager device may also provide for issuance or renewal of certificates by HTTP scripts controlling provided certificate authority user interfaces, as described above. The manager device includes configuration for use of an optional proxy server, including address, port, usemame and password, which may be useful if the manager device is located behind a firewall restricting default HTTP traffic. The screen of FIG. 20 further includes a location to enter an email address for transmitting critical alerts to a selected email box, if desired.
  • In FIG. 21 a representative screen is depicted containing entries for custom fields for managed certificates. The exemplary certificate management system may track with certificates other information, such as accounting codes, use notations or other custom information that may not be required or suggested by a certificate standard or a certificate authority. By checking the “required” checkbox for the field, selected fields may be made to be required, by which the manager will force the entry of a user to the field at the time a certificate is created by the system. By checking the “X.509” field for the field, that field will be included in the content of the certificate, otherwise the system will track the information of the field separately.
  • FIG. 22 depicts a representative screen by which the certificate database settings may be maintained. In the exemplary system, the certificate database may be backed up to a file on a network drive, which directory may be specified in the “path to network share” entry. If a usemame and password are required to access that drive, it may be entered in this screen. The administrator may also specify a backup interval, in this example of 7 days between backups. The exemplary certificate manager creates backups of managed certificate and server information, users, groups, and may also include copies of the managed certificates in the backups as well.
  • FIG. 23 shows a representative screen by which default certificate information may be configured to the exemplary manager. The screen of FIG. 23 is for a Windows 2003 Certificate Authority, which CA is useful for generating internal root and end certificates. Other screens are provided by the exemplary certificate manager for configuring the server to operate with other certificate authorities, for example Versign or Entrust, in various modes of operation. The exemplary manager may also include facilities for retrieval of connection information from a CA over the Internet, if identification is provided in the configuration screen for that CA. The certificate authority screen shown includes entries for a network path to the certificate authority, a usemame and password, domains managed. The value of the organization name field is incorporated into all certificate signing requests sent to the particular certificate authority, unless overridden elsewhere.
  • The CA setup screens may be modifiable by program updates from the seller, manufacturer or licensor to adapt to changes in the operation of the certificate authorities made available for use. Those program updates may also include updates to the scripts (or other programmable elements) used to interact with the certificate authorities intended to be usable to the administrator.
  • A second exemplary certificate manager may be set up as a replicator for a first manager, providing failover functionality. Shown in FIG. 24 is an exemplary screen in which replicator settings may optionally be configured.
  • Depicted in FIG. 25 is a screen for entering network discovery settings. The exemplary certificate manager may perform discovery on a network to locate servers and certificates that may need to be managed. The discovery settings include one or more IP address ranges to scan, and a number of IP ports to scan. The manager may be configured to perform discovery periodically to automatically detect newly installed servers and certificates. The automatic discovery interval may be set in the “scan interval” checkbox, and the time of day to perform the scan may be entered into the “beginning scan time” pulldowns. Discovery may also be disabled by checking the “disable scan” checkbox.
  • The exemplary certificate manager may also manage intermediate root certificate authorities and intermediate certificate authorities, such as might be the case with a Windows 2003 CA above. The configuration of the intermediate root certificate authority settings for the manager may be controlled in a screen similar to that shown in FIG. 26. That manager may permit the maintenance, storage and access of intermediate root certificates by the manager, or may permit maintenance at a different server device. In the screen shown in FIG. 26 an intermediate certificate to be managed may be entered in the textbox, followed by the administrator clicking on “import”. The new intermediate certificate may then be included in the maintained intermediate root certificates being managed, and displayed in a list with others as desired.
  • The exemplary certificate manager may also scan for intermediate certificates on the discovery network. The manager may discriminate an end certificate from an intermediate root certificate by a review of certificate contents, or the manager may examine the chain of authority for certificates for parents located on the discovery network.
  • FIG. 27 depicts a screen whereby the log archival settings may be set in the exemplary certificate manager. In that manager, logs may be archived remotely to prevent accumulation on the manager itself. This screen permits the setting of a network location, time, interval, username and password for the error log and the history recorded by the manager.
  • FIG. 28 depicts a representative screen permitting the management of certificates discovered but not yet completed in the exemplary manager. A list of certificates is presented, with a discovery-assigned certificate id and the common name recorded in each certificate. For each certificate, a complete and remove selection are provided. If an administrator desires to complete the entry of a discovered certificate into the database, he may click on complete. Likewise, if an administrator decides that a discovered certificate need not be managed, he may click on remove (the removal is only for the manager database—the certificate is not removed from a server). FIG. 29 depicts a similar screen permitting the completion or removal of discovered server records to or from the database.
  • The exemplary certificate manager additionally permits the generation of various reports. Depicted in FIG. 30 is a screen whereby a report may be selected from a list of available reports, generated and printed. Depicted in FIG. 35 is an exemplary view reporting all managed certificates, detailing the name, status, validity dates, and other certificate information. A similar report is depicted in FIG. 36, by which all managed servers are listed including details such as the hostname, IP address, port a certificate was accessible, the server software platform, the operating system, the protocol used for connecting to the server, as well as other related information. An additional report, not shown, lists the users registered with the exemplary manager.
  • Of the reports available, several historical reports may be generated by the exemplary manager. Depicted in FIG. 31 is a historical report of intermediate root certificate authority scans, including updates to the current database entries. Shown in FIG. 43 is a report of user actions within the manager, each user action including a date, time, action, user and value among other potential action informational items. FIG. 44 shows another history view, this one of changes to the certificate database, each change record including the date and time of change, the column changes, the new value, and the user making the change. FIG. 45 shows a historical view of changes to the server database, each record including the date, time, column, new value of the change and the user making the change.
  • The logs generated by the exemplary manager are also viewable. FIG. 32 depicts a view of the error log, including a description of each error and the time of occurrence. A list of error codes and meanings appears in Appendix A for the exemplary certificate manager. FIG. 33 depicts a view of the alerts log, which in this view is empty. If, for example, renewal of a certificate was unsuccessful, that event might appear in this log view. Attempts to notify administrators may also appear in the alerts log. FIG. 34 depicts a view of the user log, which includes a list of user actions to the database as well as other actions.
  • Further in the exemplary manager, user roles may be assigned to users. A user may thereby be given authorization to perform various administrative actions, for example authorizing the request of new certificates or merely viewing the certificate database. The exemplary manager may additionally act as a firewall to the management software, permitting communication only to selected ports in the network protocol. For example, a manager might enable port 443 for HTTPS administrative user interface access and port 25 for receiving email in a TCP/IP protocol supporting manager. Providing firewall functionality may prevent attacks from worms, buffer overflow attacks or other attacks, and make make a manager suitable to be connected directly to a public network such as the Internet.
  • The certificate database of the exemplary certificate manager may additionally be encrypted. Optionally, the manager may generate a self-signed certificate initially to encrypt the database. The self-signed certificate may be protected from user access by user privileges, by encryption with a fixed key, encoding in a non-readable or specialized format, or other method. Private keys used to generate CSRs are not stored on the exemplary manager, but are stored on the destination servers (where they may have been generated by the creation of a CSR).
  • The exemplary manager may further include an updating tool. The updating tool checks for security or bug fix updates to the system periodically, and downloads and installs any updates automatically. The manager may further include one or more fail-safe mechanisms that run system diagnostics on a periodic basis to gauge the health of the system and attempt error recovery. Administrators may be notified by email if error recovery is unsuccessful. The manager may further include a database backup feature functional to restore and archive the state of the system.
  • Systems for Managing Digital Certificates to Client Devices
  • Systems described above permit the automatic maintenance of certificates on server devices of various types. Systems may also be constructed to install and maintain certificates on client devices as well. Referring now to FIG. 13, an exemplary process is depicted permitting a server device to authenticate a client component associated with a user, account, or other association. The client component might be, in several examples, a personal computer, a cell phone, a personal data assistant, or virtually any other client device operable by a person providing access to a service provider over a communications network. This procedure begins in step 1302 by a request for connection, in this example by a client. The request for connection might also be initiated by a server, in some circumstances. The server then requests an appropriate digital certificate from the client for authentication purposes. The client may present a certificate to the server if it is available. A client may, if desired, be configured to fetch a certificate from a CA if a proper certificate is not available.
  • If the client presents a certificate for authentication, tested in step 1306, the server may proceed to validate the certificate as in step 1308. The server may also test for certificate revocation, for example by comparing the certificate against a list of revoked certificates. If the certificate has been revoked, or if the certificate is not valid for the authentication purposes, tested in step 1310, the server may proceed to issue a new certificate to the client. Proceeding from one of steps 1306 or 1310 to step 1312, the user is authenticated using an alternate procedure, as a valid certificate was not presented. The alternate procedure may take many forms, such as the entry of a known usemame and password, a passphrase, an account number and PIN number, or any other procedure which may identify the user of the device to the satisfaction of the service provider. Alternatively, if it is merely needed to identify the client device upon subsequent accesses, the user authentication need not be performed.
  • Upon successful alternate authentication, a new certificate is delivered to the client. Under some circumstances it may be desirable to maintain a store of new certificates, to avoid delays in a service due to the time required to issue a new certificate. Alternatively, a new certificate may be created about the time of delivery, which might be created by in internal or external certificate authority entity. Once a new certificate is delivered to a client, transactions may proceed with the client device under an assurance of authentication, as in step 1320.
  • If in step 1308, the client certificate delivered to the server is found to be valid and not revoked, a check for an expired certificate may be performed in step 1316. If the certificate is not expired, authenticated transactions may proceed in step 1320. Otherwise, a process of renewing a certificate may commence, in step 1318. In that step, the old certificate is renewed with the appropriate certificate authority, which might be internal or external, and the renewed certificate delivered to the client. The renewal of a certificate might occur at the time of the connection attempt by the client, however a small delay may be introduced, especially if an external certificate authority is used. Alternatively, a process may periodically run on the service side, checking issued certificates for expiration. Certificates may be renewed prior to a request for connection for services from a client, avoiding the small delay, provided that the client certificates are stored in the service system.
  • In the exemplary method described above, agents may be fashioned for particular client devices. Through the method, an installed agent may act to communicate with the service provider to receive certificates therefrom. An agent may also, if desired, provide an interface for presenting certificates to the service provider. An agent may also provide for management of client certificates in a local store, if local client facilities are not provided or not used otherwise. An agent may, if desired, remove managed certificates from a client device at the time the agent is uninstalled. The agent might also be fashioned to be more comprehensive in function, and may manage a session or transactions with the service provider.
  • Agents may be fashioned for several kinds of client devices. For example, an agent might be fashioned as a background executable process or daemon communicating with a service provider on a selected TCP port, executables being provided for a number of operating system types such as WinCE, PalmOS, PocketPC, Windows XP, MacOS, Linux, etc. In another example, an agent might be downloaded from the service provider about the time the request for connection for services is made. That agent might be written in a platform-independent interpretive language, such as Java, or might be an executable program provided by a server based on the perceived client type. In that example, the agent might only reside on the client for a fixed period, although the client certificates may reside at the client locally. In another example, the agent might be a browser plugin, which may be automatically downloaded from a predefined location at the time a user first attempts to access a service provider. In yet a further example, an operating system may provide access services sufficient to perform the agent functions, in which case the operating system may be equivalent to a certificate agent.
  • As to a client certificate, a client may be identified in several different ways. In a first example, a client certificate contains an encrypted identifier assigned by the service provider, the encryption performed with a secret key known to the service provider but not by others generally. The identifier may be associated with an individual's service, for example a bank account number or a user identifier for an information subscription service. The encrypted identifier might include a user identifier and a passphrase, for example a usemame and password or an account number and PIN number.
  • The identification data may not necessarily be kept secret. For example, if a service provider is in the business of providing access to databases and literature for a fee, the impact of discovery or monitoring the activities of the user might be negligible, although it may be desirable for the service provider to ensure that the user is subscribed. In that example, a certificate might contain a subscription number digitally signed by a key maintained by the provider.
  • Now in the above client certificate management methods the service provider may identify the individual or group using the service using a presumption that other individuals will not be permitted access to the client device. For example, if the client device is a personal data assistant (PDA), it may be presumed that that device is for a particular individual only, which individual will retain control of to prevent unauthorized use of the service provider's services. If that assumption is made, a service provider may authenticate using a certificate on a client device alone, and need not require the entry of passwords or other user authenticating items.
  • The service provider may also wish to prevent the transfer of a certificate from one client device to another. In that case, the certificate may include information unique to the client device, for example a MAC address, a fixed IP address, a serial number or a processor ID. The signature of the certificate may further be obtained by encoding the unique information, causing a signature mismatch should the certificate be moved. In an alternative system, an agent may provide the unique information to the service provider so as to avoid an unauthorized user masquerading a different client device for the original device.
  • Referring now to FIG. 14, a system useful for managing client certificates and providing network services is depicted. A client 1400 is connectable to an external network 1404 permitting connections with a service provider device 1408, in this example through a router/gateway device 1406. Service provider 1408 provides access to services through a standardized protocol, for example HTTPS. Client 1400 likewise includes software for communicating with service provider 1408 and for interacting with the operator of client 1400, which might be a web browser supporting SSL if the service provider 1408 uses HTTPS. A certificate store 1410 may be provided to store certificates issued or deposited to clients, and may also store new and unissued certificates. Certificate store 1410 might be a shared certificate store, such as a Microsoft Windows Certificate Store or Java Key Store, or in another example might be a private certificate store managed by an agent. A repository of revoked certificates 1412 may be consulted by service provider 1408 to verify a client certificate presented by a client has not been revoked.
  • An agent server 1414 may also be provided to assist with the download and installation of agents to clients. An internal certificate authority 1416 may be provided to produce encryption/decryption keys or facilities for digitally signing certificates. In one example, internal certificate authority 1416 is in communicative proximity to service provider 1408 so as to avoid substantial delays in data processing. Optionally, an external certificate authority 1418 may be used, which may be operated independently of the entity operating the service provider 1408. If an external certificate authority is used, a certificate may be used to sign user transactions which are afterward publicly verifiable. A certificate store 1402 is provided at client 1400 to store certificates issued by the service provider, making them available in later accesses between client 1400 and service provider 1408.
  • Now it is to be understood that service provider 1408, optional certificate store 1410, revoked certificate database 1412, agent server 1414 and internal certificate authority 1416 might be completely separate computing systems connected by a network. Alternatively, elements of those may be combined as desired on shared computing resources. In another example, not shown, each of service provider 1408, certificate store 1410, revoked certificate database, agent server 1414 are elements residing on a single server or distributed servers, with internal certificate authority 1416 being optionally included thereon. The operation of a system according to the principles set forth above is illustrated in FIGS. 49 through 63, and will be presently described.
  • In FIG. 49, a user has accessed a service provider's download area via a web browser on a client device, and is presented with an information screen about an agent system to be downloaded, activated by a “download now” link. Following activation, the user is presented with a screen shown in FIG. 50, which presents further information concerning the “secure client” software. Clicking on the “next” button, the user continues to a step 2 screen shown in FIG. 51, which presents a license which the user may assent to. The user may then be directed to a step 3 screen as shown in FIG. 52, which provides a download button to start the agent download process. The installation of the agent to the client device immediately follows the download, and the user is presented with the step 4 screen shown in FIG. 53. The user is then ready to use the “secure client” product.
  • Referring now to FIG. 54, the user accesses a server providing the secure client service, and is presented a screen containing entry fields for identifying information, in this example an email address and a passphrase. Now it is to be understood that other kinds of identifying information might be more suitable for other circumstances, and the particular entry fields shown are merely for explanation. Following entry of the identifying information the user may click the login button to proceed to the screen shown in FIG. 55. In FIG. 55 the user is presented with a screen indicating that authentication is in progress.
  • FIG. 56 shows a screen which would be presented to a user if the user had not registered the client device being used with the service. This may be discovered by the service by the absence of an appropriate digital certificate accessible to the agent downloaded and installed to the device as in FIGS. 49 through 53. In this case, the user is presented with a button (or other input) to add the present device to the list of trusted devices. If the user does so, the user is presented with a screen as shown in FIG. 57. The user is presented with a entry field for a mnemonic identifier for the device (“device name”), which is in this example “office computer.” Also in the screen of FIG. 57, a list of registered devices is shown, which in this example indicates the user has registered his work PC, a PDA and a laptop. Following entry of the device identifier, the user may click the next button. If the user does this, a screen similar to that in FIG. 58 may be shown, indicating that processing is proceeding to register the device with the service. The processing registering the device might include generating a new certificate, or selecting a pre-generated certificate, and installing the certificate to the client device. The process may also include associating the entered device identifier with the certificate, and otherwise maintaining the user's profile.
  • In the exemplary service, each client device may be assigned trust levels, the selection of which is shown in FIG. 59. Trust levels permit the user to select activities which are authorized for clients which have been registered. In this example, those activities include viewing a bank account balance, browsing a public web site, applying for a credit line, completing a load application, making a transfer to savings, making a transfer to checking, closing an account, and transferring funds over a certain amount. Following a user's selections, the finish button may be pressed to commit those selections. Also in the exemplary service, the trust level selections are not stored on client devices. Those selections are stored in a database managed by the service, though alternatively the selections might be maintained in a secure third-party system as well.
  • Depicted in FIG. 60 is a screen which is representative of a user's home screen in the exemplary service. Displayed on that screen is the user's profile, a list of registered device, and a number of links for performing several management actions including edit the profile information, change the passphrase and a viewing of transaction reports. For each registered device, selections are provided for changing the trust levels associated with that device and a selection for removal of the device. Depicted in FIG. 61 is a screen representative of a transaction report. In the exemplary service, for each transaction a record is created including the date of the transaction, the provider involved in the transaction, the certificate authority providing the certificate used to sign the transaction, and various details of the particular transaction types.
  • Depicted in FIG. 62 is a screen representative of a screen provided in the exemplary service for selecting trust levels, in this case of the “home pc” client device. In this screen, not only may the user select the trust levels for the client device, but the user may also select trust levels for particular providers. A pull-down list is provided in this example to enter a user selection of a provider, the particular trust levels for that provider and device being shown and selectable below. A done button, not shown, may commit the selections for storage to the service provider.
  • Depicted in FIG. 63 is a screen provided by the exemplary service for the editing of user information, that information including a first, middle, and last name, an address, a home and work telephone number, and credit card information. In the example the information is subdivided into ratings sections, which are labeled bronze, silver and gold. Now a user is not required to enter information beyond the “bronze” level, which constitutes a minimal identification criteria for the service provider. As a user provides more information, the user may be assigned to higher ratings categories, and become eligible for enhanced benefits from the system. For example, a user may provide credit card information to authorize purchases from merchants through the system. The user may also be further made eligible for sweepstakes, prizes, discounts or rebates at higher ratings.
  • In the exemplary client authorization system above may provide for authentication of a user under the requirements that (1) the user is using a device made trusted earlier and (2) for transactions considered highly sensitive, that a usemame and password or other higher form of authentication be used. In the exemplary system above, it may not be necessary for a user to manage digital certificates, enrollments or digital signing dialogs, although the client system may provide for such activities for advanced use. Also in that system, a global certificate may be provided by the system to various service providers to sign online transactions, or several certificates may be created and stored at the client for signing transactions for several service providers. The exemplary system may also require confirmation by return email to add or remove a client device from the registration list. Additionally, an intruder must not only obtain a usemame and password to create a fraudulent transaction, but must also perform his actions from one of the registered client devices. This makes fraudulent activity much more difficult to accomplish than with present systems that rely only on a usemame and password for user identification.
  • Now although examples above may have included servers utilizing SSL or TLS protocols, the examples above may be modified as will be understood by those skilled in the art to encompass other protocols, such as message queuing systems, VPN systems, S/MIME systems, IPsec systems, code signatures, 802.11x EAP devices, encrypting file systems (EFS), and client web authenticators, as well as other server types and protocols. Likewise, the above examples have referenced web servers utilizing digital certificate. Those examples may also be modified to include other server types such as application servers, databases, SSL offloading devices, SSL accelerators, or any other type of server or device having the ability to utilize an SSL certificate to communicate securely over a network connection. The above examples have also made use of SSL certificates. Other types of certificates of varying formats and protocols may also be used in the above disclosed systems with minor modification to operate with virtually any conceivable public key infrastructure.
  • While a number of digital certificate discovery and management systems have been described and illustrated in conjunction with a number of specific configurations and methods, those skilled in the art will appreciate that variations and modifications may be made without departing from the principles herein illustrated, described, and claimed. The present invention, as defined by the appended claims, may be embodied in other specific forms without departing from its spirit or essential characteristics. The configurations described herein are to be considered in all respects as only illustrative, and not restrictive. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
  • Appendix A
  • The following is a list of possible error codes, descriptions, and suggested resolutions.
    ERROR CODE DESCRIPTION
    0 Success
    100 No results found for the given query
    101 Could not insert row into table
    102 Could not update the information in the table
    103 The database query has failed
    1200 Specified service was not found
    1201 User is not authorized for this service
    1202 Service file was not found
    1203 Service is not active
    3000 Failed to retrieve certificates
    3001 Failed to process certificate
    3002 Failed to post a CSR to the web site
    3003 Failed approving certificate renewal on web site
    4000 Could not find the first search string of the common name
    4001 Could not find the second search string of the common name
    4002 Could not find the first search string of the certificate
    4003 Could not find the second search string of the certificate
    4004 Could not find the common name
    4005 Could not find the certificate
    4006 Certificate extraction failed
    4007 Could not save certificate. Check ID and common name
    4008 Could not find \“C:\\Inetpub\\mailroot\\Drop\” folder
    5000 Could not establish a connection with the telnet server
    6000 Could not create the CSR for this platform
    6001 Could not install the Certification on the platform
    6500 Exception in Create Csr
    6501 Invalid initial login password
    6502 Invalid password config
    6503 Could not find the config-ssl prompt
    6504 Sonicwall already in use elsewhere - could not connect to configure ssl interface
    6505 Could not find the config-ssl-server prompt
    6527 Exception in Install Certificate
    6528 Invalid initial login password
    6529 Invalid password config
    6530 Could not find the config-ssl prompt
    6531 Sonicwall already in use elsewhere - could not connect to configure ssl interface
    6600 IPlanet Install Certificate: Document Complete Never Fired
    6601 IPlanet Install Certificate: Invalid username or password
    6602 IPlanet Install Certificate: Invalid certificate text
    6603 IPlanet Install Certificate: Missing certificate text (the text was empty)
    6604 IPlanet Install Certificate: Missing the key pair database password (the password
    was empty)
    6605 IPlanet Install Certificate: Invalid key pair database password
    6606 IPlanet Install Certificate: Could not find the Key Pair Password field on the
    HTML page
    6607 IPlanet Install Certificate: Could not find the MessageText radio button on the
    HTML page
    6608 IPlanet Install Certificate: Could not find the MessageText text area box on the
    HTML page
    6609 IPlanet Install Certificate: Could not find the OK button to install the certificate
    on the HTML page
    6610 IPlanet Install Certificate: Could not find the Replace button to confirm the install
    on the HTML page
    6611 IPlanet Install Certificate: Could not find the Server On button to restart the
    server
    6612 IPlanet Install Certificate: The automation did not occur or was not completed
    successfully. (m_bIsFinished was already true)
    6613 IPlanet Install Certificate: Could not find the Add Server Certificate Button
    6614 IPlanet Install Certificate: Alias value not found in select box
    6615 IPlanet Install Certificate: Navigation to admin page failed. Possible heavy
    internet traffic or no network connection.
    6616 IPlanet Install Certificate: Navigation to install certificate page failed. Possible
    heavy internet traffic or no network connection.
    6617 IPlanet Install Certificate: Server user name blank
    6618 IPlanet Install Certificate: Server password blank
    6619 IPlanet Install Certificate: IP address blank
    6620 IPlanet Install Certificate: Secure server name blank
    6621 IPlanet Install Certificate: Key pair password blank
    6622 IPlanet Install Certificate: Certificate text blank
    6623 IPlanet Install Certificate: Navigation to confirmation page failed. Possible heavy
    internet traffic or no network connection.
    6624 IPlanet Install Certificate: Replace certificate confirmation window not found
    6625 IPlanet Install Certificate: Add certificate confirmation window not found
    6626 IPlanet Install Certificate: Alias blank
    6090 Verisign Retrieve Organization: Navigation to main page failed. Possible heavy
    internet traffic or no network connection.
    6091 Verisign Retrieve Organization: Error retrieving data collection of organization
    information
    6100 Verisign Post CSR: Document Complete never fired
    6101 Verisign Post CSR: Automation did not complete (m_bIsFinished == true)
    6102 Verisign Post CSR: Missing the First Name parameter
    6103 Verisign Post CSR: A duplicate CSR was posted to Verisign's site which cannot
    be issued
    6104 Verisign Post CSR: Missing the Last name parameter
    6105 Verisign Post CSR: Invalid email format, must be in format user@mail.com
    6106 Verisign Post CSR: Missing Challenge Phrase
    6107 Verisign Post CSR: Missing the Organization Name
    6108 Verisign Post CSR: Invalid Organization Name
    6109 Verisign Post CSR: Invalid CSR Text or missing CSR Text Fields
    6110 Verisign Post CSR: Verisign MPKI URL blank
    6111 Verisign Post CSR: First Name blank
    6112 Verisign Post CSR: Last Name blank
    6113 Verisign Post CSR: Contact email blank
    6114 Verisign Post CSR: Challenge phrase blank
    6115 Verisign Post CSR: Missing CSR text
    6116 Verisign Post CSR: Additional Fields data table NULL
    6117 Verisign Post CSR: Navigation to post CSR page has failed. Possible heavy
    internet traffic or no network connection.
    6118 Verisign Post CSR: Could not find text field for CSR text
    6119 Verisign Post CSR: Could not find text field for First Name
    6120 Verisign Post CSR: Could not find text field for Last Name
    6121 Verisign Post CSR: Could not find text field for Email address
    6122 Verisign Post CSR: Could not find text field for Challenge Phrase
    6123 Verisign Post CSR: Could not find text field for Challenge Phrase confirm
    6124 Verisign Post CSR: Could not find drop down box for Application Server Type
    6125 Verisign Post CSR: Your challenge phrase and reconfirmation do not match.
    6126 Verisign Post CSR: Please enter a valid IP Address.
    6127 Verisign Post CSR: Error finding additional fields
    6128 Verisign Post CSR: Navigation to CSR Result page failed. Possible heavy
    internet traffic or no network connection.
    6129 Verisign Post CSR: Could not find additional fields
    6130 Verisign Post CSR: One or more additional fields has invalid data. The
    information entered should contain only alphabetical or numerical characters...
    6131 Verisign Post CSR: Unable to start up and connect a browser instance.
    6132 Verisign Post CSR: Unable to Navigate the browser.
    6133 Verisign Post CSR: An error occurred while checking for ‘First Name’ error
    message.
    6134 Verisign Post CSR: An error occurred while checking for ‘Last Name’ error
    message.
    6135 Verisign Post CSR: An error occurred while checking for an invalid email format
    error message.
    6136 Verisign Post CSR: An error occurred while checking for the Challenge Phrase
    error message.
    6137 Verisign Post CSR: An error occurred while checking for the company name
    error message.
    6138 Verisign Post CSR: An error occurred while checking for an invalid Organization
    Name error message.
    6139 Verisign Post CSR: An error occurred while checking for Invalid CSR Text error
    message.
    6140 Verisign Post CSR: An error occurred while checking for duplicate cert error
    message.
    6141 Verisign Post CSR: An error occurred while checking to see if the Enrollment of
    the CSR Text was complete.
    6142 Verisign Post CSR: An unknown error occurred while posting the CSR Text.
    Unable to confirm if Enrollment was complete.
    6143 Verisign Post CSR: Invalid CA type passed to Postcard
    6650 Entrust Retrieve Domains: The automation did not occur or was not completed
    successfully.
    6651 Entrust Retrieve Domains: Document Complete Never Fired
    6652 Entrust Retrieve Domains: Username/ID box not found on login page
    6653 Entrust Retrieve Domains: Password field not found on login page
    6654 Entrust Retrieve Domains: Login button not found on login page
    6655 Entrust Retrieve Domains: Username or password not valid
    6656 Entrust Retrieve Domains: Less than two select boxes were found on contract
    information page.
    6657 Entrust Retrieve Domains: More than two select boxes were found on contract
    information page.
    6658 Entrust Retrieve Domains: Could not find the Domain Information select box.
    6659 Entrust Retrieve Domains: The User Id passed to Entrust Retrieve Domains was
    blank
    6660 Entrust Retrieve Domains: The Password passed to Entrust Retrieve Domains
    was blank
    6661 Entrust Retrieve Domains: Could not complete navigation to Logon page
    6662 Entrust Retrieve Domains: Could not complete navigation to Management page
    6663 Entrust Retrieve Domains: Could not complete navigation to Contract
    Information page
    6675 Entrust Retrieve Organization Names: The automation did not occur or was not
    completed successfully.
    6676 Entrust Retrieve Organization Names: Document Complete Never Fired
    6677 Entrust Retrieve Organization Names: Username/ID box not found on login page
    6678 Entrust Retrieve Organization Names: Password field not found on login page
    6679 Entrust Retrieve Organization Names: Login button not found on login page
    6680 Entrust Retrieve Organization Names: Username or password not valid
    6681 Entrust Retrieve Organization Names: Less than two select boxes were found on
    contract information page.
    6682 Entrust Retrieve Organization Names: More than two select boxes were found on
    contract information page.
    6683 Entrust Retrieve Organization Names: Could not find the Organization Name
    select box
    6684 Entrust Retrieve Organization Names: The User Id passed to Entrust Retrieve
    Organization Names was blank
    6685 Entrust Retrieve Organization Names: The Password passed to Entrust Retrieve
    Organization Names was blank
    6686 Entrust Retrieve Organization Names: Could not complete navigation to Logon
    page
    6689 Entrust Retrieve Organization Names: Could not complete navigation to
    Management page
    6690 Entrust Retrieve Organization Names: Could not complete navigation to Contract
    Information page
    6700 IPlanet Create CSR: Document Complete Never Fired
    6701 IPlanet Create CSR: Could not find the CA Email Address field on the main
    HTML page
    6702 IPlanet Create CSR: Could not find the Key Pair database field on the main
    HTML page
    6703 IPlanet Create CSR: Could not find the Requestor Name field on the main HTML
    page
    6704 IPlanet Create CSR: Could not find the Telephone Number field on the main
    HTML page
    6705 IPlanet Create CSR: Could not find the Common Name field on the main HTML
    page
    6706 IPlanet Create CSR: Could not find the Email Address field on the main HTML
    page
    6707 IPlanet Create CSR: Could not find the Organization field on the main HTML
    page
    6708 IPlanet Create CSR: Could not find the Organization Unit field on the main
    HTML page
    6709 IPlanet Create CSR: Could not find the Locality field on the main HTML page
    6710 IPlanet Create CSR: Could not find the State or Province field on the main
    HTML page
    6711 IPlanet Create CSR: Could not find the Country field on the main HTML page
    6712 IPlanet Create CSR: Could not find the OK button on the main HTML page
    6713 IPlanet Create CSR: Invalid UserName or Password
    6714 IPlanet Create CSR: Missing the CA Email Address (the text was empty)
    6715 IPlanet Create CSR: Missing the Key Pair Database Password (the text was
    empty)
    6716 IPlanet Create CSR: Invalid Key Pair Database Password
    6717 IPlanet Create CSR: Missing the Requestor Name (the text was empty)
    6718 IPlanet Create CSR: Missing the Telephone Number (the text was empty)
    6719 IPlanet Create CSR: Missing the Common name (the text was empty)
    6720 IPlanet Create CSR: Missing the Email Address (the text was empty)
    6721 IPlanet Create CSR: Missing the Organization Name (the text was empty)
    6722 IPlanet Create CSR: Missing the Country (the text was empty)
    6723 IPlanet Create CSR: Invalid Country (only a single letter was entered —must be
    two letters)
    6724 IPlanet Create CSR: The automation did not occur or was not completed
    successfully. (m_bIsFinished was already true)
    6725 IPlanet Create CSR: Invalid Country Code.
    6726 IPlanet Create CSR: Alias value not found in select box
    6727 IPlanet Create CSR: Trust database has not been initialized
    6728 IPlanet Create CSR: User name blank
    6729 IPlanet Create CSR: Password blank
    6730 IPlanet Create CSR: IP Address blank
    6731 IPlanet Create CSR: Secure server name blank
    6732 IPlanet Create CSR: Common name blank
    6733 IPlanet Create CSR: Organization name blank
    6734 IPlanet Create CSR: Organization unit blank
    6735 IPlanet Create CSR: City blank
    6736 IPlanet Create CSR: State blank
    6737 IPlanet Create CSR: Country blank
    6738 IPlanet Create CSR: Contact email blank
    6739 IPlanet Create CSR: Contact first name blank
    6740 IPlanet Create CSR: Contact last name blank
    6741 IPlanet Create CSR: Contact work phone number blank
    6742 IPlanet Create CSR: Key pair password blank
    6743 IPlanet Create CSR: Navigation to admin page failed. Possible heavy internet
    traffic or no network connection.
    6744 IPlanet Create CSR: Invalid secure server name
    6745 IPlanet Create CSR: Navigation to create CSR page failed. Possible heavy
    internet traffic or no network connection.
    6746 IPlanet Create CSR: Navigation to CSR page failed. Possible heavy internet
    traffic or no network connection.
    6747 IPlanet Create CSR: Error retrieving CSR
    6748 IPlanet Create CSR: Invalid length for the common name
    6749 IPlanet Create CSR: Alias blank
    6750 IPlanet Create CSR: Could not find alias field
    6751 IPlanet Create CSR: Could not find alias value
    6760 Entrust Verify Login: The automation did not occur or was not completed
    successfully. (m_bIsFinished was already true)
    6761 Entrust Verify Login: Document Complete Never Fired
    6762 Entrust Verify Login: Username/ID box not found on login page
    6763 Entrust Verify Login: Password field not found on login page
    6764 Entrust Verify Login: Login button not found on login page
    6765 Entrust Verify Login: Username or password not valid
    6766 Entrust Verify Login: The User Id passed to Entrust Verify Login was blank
    6767 Entrust Verify Login: The Password passed to Entrust Verify Login was blank
    6768 Entrust Verify Login: Could not complete navigation to Logon page
    6769 Entrust Verify Login: Could not complete navigation to Management page
    6775 Verisign Approve: Document Complete Never Fired
    6776 Verisign Approve: Could not find the Process Requests link on the main HTML
    page
    6777 Verisign Approve: Could not find the Continue button on the HTML page
    6778 Verisign Approve: The automation did not occur or was not completed
    successfully. (m_bIsFinished was already true)
    6779 Verisign Approve: Common name was not found
    6780 Verisign Approve: Approve link was not found
    6781 Verisign Approve: Could not complete navigation to main MPKI page. Possible
    heavy internet traffic or no network connection.
    6782 Verisign Approve: Could not complete navigation to Process Requests (approval)
    page. Possible heavy internet traffic or no network connection.
    6783 Verisign Approve: Could not complete navigation to approval result page.
    Possible heavy internet traffic or no network connection.
    6784 Verisign Approve: Could not complete navigation to next approval page. Possible
    heavy internet traffic or no network connection.
    6785 Verisign Retrieve Organization Names: Could not find the organization names
    ‘Org:’ label
    6786 Verisign Retrieve Organization Names: Document complete did not fire
    6787 Verisign Retrieve Organization Names: Error occurred during retrieval of names
    from elements on page
    6788 Verisign Retrieve Organization Names: Could not complete navigation to
    Verisign's main MPKI page. Possible heavy internet traffic or no network
    connection.
    6790 Verisign retrieve organization names: Unable to start up and connect a browser
    instance.
    6791 Verisign retrieve organization names: Unable to Navigate the browser.
    6792 Verisign retrieve organization names: An error occurred while searching for the
    OrgName label.
    6800 Autocert Utilities Service: Verisign certificate is neither a standard nor global
    certificate.
    6801 Autocert Utilities Service: Unable to update the standard mpki url to the
    Certificate Authority table.
    6802 Autocert Utilities Service: Unable to update the global mpki url to the Certificate
    Authority table.
    6803 Autocert Utilities Service: Unable to delete the domain name from the domain
    verification table.
    6804 Autocert Utilities Service: Unable to insert the domain name to the domain
    verification table.
    6805 Autocert Utilities Service: Unable to delete the organization name from the
    organization verification table.
    6806 Autocert Utilities Service: Unable to insert the organization name to the
    organization verification table.
    6807 Autocert Utilities Service: Initialization of WinINet functions failed.
    6808 Autocert Utilities Service: Failed to establish session with web site.
    6809 Autocert Utilities Service: Failed to create Http request handle.
    6810 Autocert Utilities Service: Failed to retrieve certificate from store. Verify
    certificate is installed.
    6811 Autocert Utilities Service: Failed to attach certificate to http request.
    6812 Autocert Utilities Service: SPC system store failed to open.
    6813 Autocert Utilities Service: Failed to send request to server.
    6814 Autocert Utilities Service: Global certificate file not uploaded. Upload certificate
    before retrieving information.
    6815 Autocert Utilities Service: Standard server certificate file not uploaded. Upload
    certificate before retrieving information.
    6816 Autocert Utilities Service: Could not find Verisign standard account information.
    Verify correct certificate was uploaded.
    6817 Autocert Utilities Service: Could not find Verisign global account information.
    Verify correct certificate was uploaded.
    6818 Entrust Post CSR: The User Id passed to Entrust Post Csr was blank.
    6819 Entrust Post CSR: The Password passed to Entrust Post Csr was blank
    6820 Entrust Post CSR: The Certificate Id passed to Entrust Post Csr was blank
    6821 Entrust Post CSR: The Organization name passed to Entrust Post Csr was blank
    6822 Entrust Post CSR: The Csr passed to Entrust Post Csr was blank
    6823 Entrust Post CSR: The UserID edit box on the login page could not be found.
    6824 Entrust Post CSR: The Password edit box on the login page could not be found.
    6825 Entrust Post CSR: The Log in button on the login page could not be found.
    6826 Entrust Post CSR: The Create/Renew button on the status page could not be
    found.
    6827 Entrust Post CSR: The Organization Name select box could not be found on the
    Create/Renue page.
    6828 Entrust Post CSR: The Certificate Type select box could not be found on the
    Create/Renue page.
    6829 Entrust Post CSR: The Standard option could not be found as a selection in the
    Certificate Type select box on the Crate/Renue page.
    6830 Entrust Post CSR: The Create Certificate button could not be found on the
    Create/Renew page.
    6831 Entrust Post CSR: The Certificate signing request text area could not be found on
    the Create/Renew page.
    6832 Entrust Post CSR: The Tracking information edit box could not be found on the
    Create/Renew page.
    6833 Entrust Post CSR: The Confirm button was not found on the confirmation page.
    6834 Entrust Post CSR: The CSR provided has already been posted, duplicate csr.
    6835 Entrust Post CSR: The CSR does not begin with -----BEGIN (five dashes and
    BEGIN) which is required by Entrust.
    6836 Entrust Post CSR: The CSR if for an invalid domain.
    6837 Entrust Post CSR: The CSR has an invalid country code.
    6838 Entrust Post CSR: The company is using all of its SSL Server Certificates.
    6850 Entrust Post CSR: Document Complete did not fire
    6851 Entrust Post CSR: could not complete automation.
    6852 Entrust Post CSR: An invalid UserId or Password was used.
    6853 Entrust Post CSR: Could not complete navigation to Logon page
    6854 Entrust Post CSR: Could not complete navigation to certificate management page
    6855 Entrust Post CSR: Could not complete navigation to post CSR page
    6856 Entrust Post CSR: Could not complete navigation to post CSR confirmation page
    6857 Entrust Post CSR: Could not complete navigation to post CSR finished page
    6858 Entrust Post CSR: Confirmation page not found
    6859 Entrust Post CSR: Unable to navigate to Login Page
    6861 Entrust Post CSR: Unable to Locate the Username Element in any of the Frames
    of the Web Browser Document.
    6862 Entrust Post CSR: Unable to authenticate the login. The username and/or
    password are incorrect or refused by Entrust.
    6863 Entrust Post CSR: Unable to start up and connect a browser instance.
    6864 Entrust Post CSR: An error occurred while searching for the CSR header sting in
    the Html text from the WebBrowser document.
    6865 Entrust Post CSR: An error occurred while searching for the Tracking label string
    in the Html text from the WebBrowser document.
    6866 Entrust Post CSR: An error occurred while checking if the CSR is a duplicate.
    6875 Entrust Post CSR: An error occurred while checking the CSR for five dashes
    6876 Entrust Post CSR: An error occurred while checking if all the SSL Server Certs
    have been used for the login account.
    6877 Entrust Approve Certificate: Document Complete Never Fired
    6878 Entrust Approve Certificate: The automation did not occur or was not completed
    successfully. (m_bIsFinished was already true)
    6879 Entrust Approve Certificate: Username/ID box not found on login page
    6880 Entrust Approve Certificate: Password field not found on login page
    6881 Entrust Approve Certificate: Login button not found on login page
    6882 Entrust Approve Certificate: Username or password not valid
    6883 Entrust Approve Certificate: Certificate was not found
    6884 Entrust Approve Certificate: The User Id passed to Entrust Approve Certificate
    was blank
    6885 Entrust Approve Certificate: The Password passed to Entrust Approve Certificate
    was blank
    6886 Entrust Approve Certificate: The Certificate Id passed to Entrust Approve
    Certificate was blank
    6887 Entrust Approve Certificate: Could not complete navigation to Logon page
    6888 Entrust Approve Certificate: Could not complete navigation to certificate
    management page
    6889 Entrust Approve Certificate: Could not find ‘Ready’ text in the TR tag
    6890 Entrust Approve Certificate: Could not find Entrust generated tracking id
    6891 Entrust Approve Certificate: Could not find Ready link with Entrust generated
    tracking id
    6892 Entrust Approve Certificate: Could not complete navigation to Csr Posting
    Finished page
    6900 Entrust Retrieve Certificate: Document Complete did not fire
    6901 Entrust Retrieve Certificate: Automation did not complete
    6902 Entrust Retrieve Certificate: Could not find the Unique Id field on the Entrust
    Login frame
    6903 Entrust Retrieve Certificate: Could not find the Password field on the Entrust
    Login frame
    7000 Entrust Retrieve Certificate: Could not find the Log in button
    7001 Entrust Retrieve Certificate: Invalid Entrust Username or Password
    7002 Entrust Retrieve Certificate: Certificate id was not found
    8000 Entrust Retrieve Certificate: Could not find the BEGIN CERTIFICATE or END
    CERTIFICATE identifiers
    8001 Entrust Retrieve Certificate: Could not find the Certificate page section identifier
    8002 Entrust Retrieve Certificate: The User Id passed to Entrust Retrieve Certificate
    was blank
    8010 Entrust Retrieve Certificate: The Password passed to Entrust Retrieve Certificate
    was blank
    9003 Entrust Retrieve Certificate: The Certificate Id passed to Entrust Retrieve
    Certificate was blank
    9011 Entrust Retrieve Certificate: Could not complete navigation to Logon page
    9012 Entrust Retrieve Certificate: Could not complete navigation to Management page
    9013 Entrust Retrieve Certificate: Could not find active text
    9014 Entrust Retrieve Certificate: Could not find tracking ID
    9015 Entrust Retrieve Certificate: Could not find active link
    9016 Entrust Retrieve Certificate: Could not complete navigation to Finish page
    9017 IIS 6.0: Could not create the private key
    9018 IIS 6.0: Could not create the CSR
    9019 IIS 6.0: Could not create the PFX
    9020 IIS 6.0: Could not install the PFX
    9021 AutocertMonitor: An exception occurred while calling the auto-update web
    service
    9022 AutocertMonitor: Error loading local xml manifest document
    9023 AutocertMonitor: Error occurred during LoadManifest call
    9024 SMImport: Error connecting to csv file. Check file location.
    9025 SMImport: Data type(s) incorrect in csv file. Check numerical data.
    9026 SMImport: Data format incorrect in csv file. Verify that data in each field is
    correctly formatted.
    9027 SMCertificate: Unable to update the Valid From and To dates in the Database
    9028 ACLog: Could not get log configuration
    9029 SMCertificate: Could not get certificate
    9030 SMCertificate: Could not get certificates by status code
    9031 SMCertificate: Could not get and sort certificates by status code
    9032 SMCertificate: Could not get certificates in renewal window
    9033 SMCertificate: Could not get all certificates
    9034 SMCertificate: Could not get and sort all certificates
    9035 SMCertificate: Could not get all certificates over max attempt number
    9036 SMCertificate: Could not get and sort all certificates over max attempt number
    9041 SMCertificate: Could not get generated CSR data
    9042 SMCertificate: Could not insert certificate
    9043 SMCertificate: Could not update certificate
    9044 SMCertificate: Could not update certificate edited by the user
    9045 SMCertificate: Could not update the certificate csr text
    9046 SMCertificate: Could not update the certificate active flag
    9047 SMCertificate: Could not update the certificate status code
    9048 SMCertificate: Could not update the certificate attempt count
    9049 SMCertificate: Could not update the certificate text
    9050 SMCertificate: Could not update certificate private key text
    9051 SMCertificate: Could not update certificate valid from/to date
    9052 SMCertificate: Could not get certificate ID by common name
    9053 SMCertificate: No certificate given to split
    9054 SMCertificate: Unable to retrieve all custom field titles
    9055 SMCertificate: Unable to get all custom fields
    9056 SMCertificate: Unable to read valid dates from certificate text
    9061 SMCertificate: Could not update the certificate CA tracking value
    9062 SMCertificate: Count not get certificates in process
    9063 SMCertificateAuthority: Could not get all certificate authorities
    9064 SMCertificateAuthority: Could not get certificate authority
    9065 EXCEPTION_SMCERTIFICATEAUTHORITY_
    GETCERTIFICATEAUTHORITYSETUPCOMPLETESORT
    9066 SMCertificateAuthority: Could not update certificate authority setup complete
    9067 SMCertificateAuthority: Could not update certificate authority username and
    password
    9068 SMCertificateAuthority: Could not update certificate authority post csr url
    9069 SMCertificateAuthority: Could not get any certificate authority setup complete
    9071 SMCertificateAuthority: Could not get domain verifications by CA
    9072 SMCertificateAuthority: Could not insert domain verification
    9073 SMCertificateAuthority: Could not delete domain verification
    9081 SMCertificateAuthority: Could not get organization verifications by CA
    9091 SMCertificateAuthority: Could not insert organization verification
    9092 SMCertificateAuthority: Could not delete organization verification
    9093 SMCertificateAuthority: Could not get Entrust domain organization verification
    9094 SMCertificateAuthority: Could not get semaphore error code
    9095 SMCertificateAuthority: Could not update semaphore error code
    9096 SMContact: Could not update contact
    9097 SMContact: Could not update contact active flag
    9098 SMContact: Could not insert contact
    9099 SMContact: Could not get all contacts
    9101 SMContact: Could not get and sort all contacts
    9102 SMContact: Could not get contact
    9103 SMContact: Could not get contact by certificate serial number
    9104 SMContact: Could not get contact certificate serial number
    9105 SMContact: Could not verify user rights
    9106 SMDatabase: Could not backup database
    9107 SMDatabase: Could not restore database
    9108 SMDatabase: Unable to get all status codes
    9112 SMMailParse: Could not process mail
    9113 SMServer: Could not get all servers
    9114 SMServer: Could not get all server type codes
    9115 SMServer: Could not get and sort all servers
    9116 SMServer: Could not get server
    9117 SMServer: Could not insert server
    9118 SMServer: Could not update the server active flag
    9121 SMServer: Could not update server
    9122 SMServer: Could not get server type code by certificate ID
    9123 SMServer: Could not get server type code
    9124 SMSettings: Could not get all settings
    9125 SMSettings: Could not get settings
    9126 SMSettings: Could not update settings critical error email
    9127 SMSettings: Could not update settings database backup path
    9128 SMSettings: Could not update settings database last backup date
    9129 SMSettings: Could not update settings database last backup path
    9130 SMSettings: Could not update settings database backup interval
    9131 SMSettings: Could not update settings proxy server address
    9132 SMSettings: Could not get settings critical error email
    9133 SMSettings: Could not get settings database backup path
    9134 SMSettings: Could not get settings max attempt number
    9135 SMSettings: Could not get settings automation interval
    9136 SMSettings: Could not get settings server email
    9137 SMSettings: Could not get settings database backup interval
    9231 SMSettings: Could not get settings proxy server address
    9232 ACCryptography: Could not install verisign admin certificate
    9233 ACCryptography: Could not remove verisign admin certificate
    9234 ACCryptography: Exception occurred while reading pfx file
    9235 ACCryptography: Not a valid pfx file
    9141 ACCryptography: Incorrect password
    9142 ACCryptography: Opening of pfx file failed
    9143 ACCryptography: ‘MY’ system store failed to open in
    InstallVerisignAdminCertificate
    9144 ACCryptography: Import of certificate to ‘MY’ store failed
    9145 ACCryptography: Empty parameter for file path passed to
    InstallVerisignAdminCertificate
    9146 ACCryptography: Empty parameter for password passed to
    InstallVerisignAdminCertificate
    9147 ACCryptography: ‘MY’ system store failed to open in
    RemoveVerisignAdminCertificate
    9148 ACCryptography: Failed to remove certificates from ‘MY’ store
    9149 ACCryptography: Exception occurred while reading pfx file
    9150 ACCryptography: Not a valid pfx file
    9151 ACCryptography: Incorrect password
    9152 ACCryptography: Empty parameter for file path passed to VerifyPfxFile
    9160 ACCryptography: Empty parameter for password passed to VerifyPfxFile
    9161 ACTelnet: Could not receive from server
    9162 ACTelnet: Could not send to server
    9163 ACTelnet: Could not process options
    9164 ACTelnet: Could not respond to options
    9165 ACTelnet: Could not arrange reply
    9166 AutoCertService: Exception in Main()
    9167 AutoCertService: Unable to get expiring certificates
    9171 AutoCertService: Unable to generate CSR
    9172 AutoCertService: Unable to post CSR
    9173 AutoCertService: Manual bulk approval failed
    9174 AutoCertService: Unable to approve certificates
    9200 AutoCertService: Unable to retrieve certificates
    9201 AutoCertService: Unable to split certificates
    9202 AutoCertService: Unable to install certificates
    9203 AutoCertService: Unable to verify certificates
    9204 AutoCertService: Unable to set proxy settings
    9205 AutoCertService: Unable to set proxy settings
    9206 Unable to connect to server while creating csr
    9207 Exiting create csr
    9208 Unable to connect to server while installing certificate
    9209 Installation of certificate failed
    9210 Unable to connect to server while creating csr
    9211 Exiting create csr
    9212 Unable to connect to server while installing certificate
    9213 Installation of certificate failed
    9214 Access denied, Please check the username and password (for the Certificate
    Authority) and try again
    9215 Unable to retrieve the certificate
    9216 Unable to approve the certificate
    9217 Unable to post the CSR
    9450 Common name exceeded maximum length
    9451 Domain name must be at the end of the common name
    9501 ServerID not found
    9502 ContactID not found
    9503 Server email not found
    9511 SMCertificateAuthority: Domain Name already exists in the database
    9512 SMCertificateAuthority: Organization Name already exists in the database
    9521 SMCertificate: No certificate given to split
    9522 SMCertificate: Server certificate not found
    9600 Verisign Global Setup: Error occurred while stopping service.
    9601 Verisign Global Setup: Error occurred while starting service.
    9602 Verisign Standard Setup: Error occurred while stopping service.
    9603 Verisign Standard Setup: Error occurred while starting service.
    9604 Command prompt not received after terminal type input
    9605 Command ‘genconf’ common name prompt not received
    9606 Command ‘genconf’ country name prompt not received
    9607 Command ‘genconf’ state prompt not received
    9608 Command ‘genconf’ city prompt not received
    9609 Command ‘genconf’ organization name prompt not received
    9610 Command ‘genconf’ organizational unit prompt not received
    9611 Command ‘genconf’ Are these correct? prompt not received
    9612 Command ‘genconf’ command prompt not received
    9613 Command ‘genkey’ key file already exists
    9614 Command ‘genkey’ Are these correct? prompt not received
    9615 Command ‘genkey’ country name prompt not received
    9616 Command ‘genkey’ state prompt not received
    9617 Command ‘genkey’ city prompt not received
    9618 Command ‘genkey’ organization name prompt not received
    9619 Command ‘genkey’ organizational unit prompt not received
    9620 Command ‘genkey’ common name prompt not received
    9621 Command ‘genkey’ second country name prompt not received
    9622 Command ‘genkey’ second state prompt not received
    9623 Command ‘genkey’ second city prompt not received
    9624 Command ‘genkey’ second organization name prompt not received
    9625 Command ‘genkey’ second organizational unit prompt not received
    9626 Command ‘genkey’ second common name prompt not received
    9627 Command ‘genkey’ second hit return prompt not received
    9628 Command ‘genkey’ encrypt prompt not received
    9629 Command ‘genkey’ passphrase prompt not received
    9630 Command ‘genkey’ verify passphrase prompt not received
    9631 Command ‘genkey’ command prompt not received after verify passphrase
    9632 Command ‘cat’ command prompt not received
    9633 Command prompt not received after echo
    9634 Command ‘genkey’ key file already exists
    9635 Command ‘genkey’ Hit return prompt not received
    9636 Command ‘genkey’ command prompt not received
    9637 Command ‘genkey’ remove key prompt not received
    9638 Command ‘genkey’ command prompt not received after key removed
    9639 Command ‘genkey’ remove csr prompt not received
    9640 Command ‘genkey’ command prompt not received after csr remove
    9641 Command ‘genkey’ remove crt prompt not received
    9642 Command ‘genkey’ command prompt not received after crt remove
    9643 Command prompt not received after terminal type input
    9644 Command ‘genconf’ common name prompt not received
    9645 Command ‘genconf’ country name prompt not received
    9646 Command ‘genconf’ state prompt not received
    9647 Command ‘genconf’ city prompt not received
    9648 Command ‘genconf’ organization name prompt not received
    9649 Command ‘genconf’ organizational unit prompt not received
    9650 Command ‘genconf’ Are these correct? prompt not received
    9651 Command ‘genconf’ command prompt not received
    9652 Command ‘genkey’ Hit return prompt not received
    9653 Command ‘genkey’ command prompt not received
    9654 Command ‘genkey’ remove key prompt not received
    9655 Command ‘genkey’ command prompt not received after key removed
    9656 Command ‘genkey’ remove csr prompt not received
    9657 Command ‘genkey’ command prompt not received after csr remove
    9658 Command ‘genkey’ remove crt prompt not received
    9659 Command ‘genkey’ command prompt not received after crt remove
    9660 Command ‘genkey’ key file already exists
    9661 Command ‘genkey’ Are these correct? prompt not received
    9662 Command ‘genkey’ country name prompt not received
    9663 Command ‘genkey’ state prompt not received
    9664 Command ‘genkey’ city prompt not received
    9665 Command ‘genkey’ organization name prompt not received
    9666 Command ‘genkey’ organizational unit prompt not received
    9667 Command ‘genkey’ common name prompt not received
    9668 Command ‘genkey’ second country name prompt not received
    9669 Command ‘genkey’ second state prompt not received
    9670 Command ‘genkey’ second city prompt not received
    9671 Command ‘genkey’ second organization name prompt not received
    9672 Command ‘genkey’ second organizational unit prompt not received
    9673 Command ‘genkey’ second common name prompt not received
    9674 Command ‘genkey’ second hit return prompt not received
    9675 Command ‘genkey’ encrypt prompt not received
    9676 Command ‘genkey’ passphrase prompt not received
    9700 Command ‘genkey’ verify passphrase prompt not received
    9701 Command ‘genkey’ command prompt not received after verify passphrase
    9702 Command ‘cat’ command prompt not received
    9703 Command prompt not received after echo
    9704 Verisign Retrieve Domains: Unable to start up and connect a browser instance.
    9705 Verisign Retrieve Domains: Could not complete navigation to Verisign's MPKI
    main page
    9776 Verisign Retrieve Domains: Error occurred during building of user services url
    9777 Verisign Retrieve Domains: Could not complete navigation to user services page
    9778 Verisign Retrieve Domains: Could not complete navigation to domains page
    9779 Verisign Retrieve Domains: Error occurred during retrieving of domain names
    from page
    9801 A timeout occurred while posting the csr, this may be due to network traffic or
    the server may be down
    9802 A timeout occurred while approving the csr, this may be due to network traffic or
    the server may be down
    9803 A timeout occurred while retrieving the certificate, this may be due to network
    traffic or the server may be down
    9804 Unable to start the Windows2003Ca Process this could be due to a
    misconfiguration in the Windows 2003 Certificate Authority setup, please check
    the settings to make sure they are correct
    −1 ERROR UNKNOWN

Claims (23)

1. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:
receiving requests for connections from clients,
attempting to retrieve a digital certificate from the client device by way of the network facilities and a client executable component,
if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,
if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,
if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,
if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,
following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device, and
authenticating the client device for data transfer.
2. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a financial transaction.
3. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a contractual transaction.
4. A method according to claim 1, wherein said authenticating indicates authentication of an individual for a loan application.
5. A method according to claim 1, further comprising the step of providing access to resources within an organization based on an authenticated individual's access rights.
6. A method according to claim 1, further comprising the step of providing access to email messages for authenticated individuals.
7. A method according to claim 1, further comprising the step of providing access to applications on the client device for authenticated individuals.
8. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:
receiving requests for connections from clients,
attempting to retrieve a digital certificate from the client device by way of the network facilities and said client executable component,
if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,
if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,
if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,
if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,
following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device, and
authenticating the client device for data transfer.
9. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a financial transaction.
10. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a contractual transaction.
11. A method according to claim 8, wherein said authenticating indicates authentication of an individual for a loan application.
12. A method according to claim 8, further comprising the step of providing access to resources within an organization based on an authenticated individual's access rights.
13. A method according to claim 8, further comprising the step of providing access to email messages for authenticated individuals.
14. A method according to claim 8, further comprising the step of providing access to applications on the client device for authenticated individuals.
15. A method according to claim 8, further comprising the step of providing an access rights configuration interface operable from the client device upon authentication.
16. A method for automatically managing placement of digital certificates to client devices from a certificate management system, the certificate management system including network facilities for communication over an electronic communication network, the method comprising the steps of:
receiving requests for connections from clients,
attempting to retrieve a digital certificate from the client device by way of the network facilities and said client executable component,
if in said attempting a digital certificate is retrieved, checking for expiration of the retrieved digital certificate,
if in said attempting a digital certificate is retrieved, querying a revocation server by way of said network facilities for revocation of the retrieved digital certificate,
if the retrieved digital certificate is expired or revoked, retrieving a newly issued certificate from a network certificate server,
if in said attempting a digital certificate is not retrieved, accessing a certificate store to retrieve an authentication certificate,
following said accessing a network certificate server to retrieve an authentication certificate, placing the retrieved authentication certificate in the certificate store of said client device,
authenticating the client device for data transfer, said authenticating identifying the client device to the certificate management system, said authenticating further identifying a user to the certificate management system;
providing access to services conditioned on the enablement of the services for the identified client device and user.
17. A method according to claim 16, further comprising the step of providing an access rights configuration interface operable from the client device upon authentication.
18. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a financial transaction.
19. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a contractual transaction.
20. A method according to claim 16, wherein said authenticating indicates authentication of an individual for a loan application.
21. A method according to claim 16, further comprising the step of providing access to resources within an organization based on an authenticated individual's access rights.
22. A method according to claim 16, further comprising the step of providing access to email messages for authenticated individuals.
23. A method according to claim 16, further comprising the step of providing access to applications on the client device for authenticated individuals.
US10/917,964 2003-08-15 2004-08-13 Remote management of client installed digital certificates Abandoned US20050081029A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US10/917,964 US20050081029A1 (en) 2003-08-15 2004-08-13 Remote management of client installed digital certificates

Applications Claiming Priority (3)

Application Number Priority Date Filing Date Title
US49586403P 2003-08-15 2003-08-15
US58642904P 2004-07-08 2004-07-08
US10/917,964 US20050081029A1 (en) 2003-08-15 2004-08-13 Remote management of client installed digital certificates

Publications (1)

Publication Number Publication Date
US20050081029A1 true US20050081029A1 (en) 2005-04-14

Family

ID=34397004

Family Applications (19)

Application Number Title Priority Date Filing Date
US10/917,861 Active 2027-01-20 US7650496B2 (en) 2003-08-15 2004-08-13 Renewal product for digital certificates
US10/918,710 Abandoned US20050076204A1 (en) 2003-08-15 2004-08-13 Apparatuses for authenticating client devices with client certificate management
US10/918,667 Abandoned US20050074124A1 (en) 2003-08-15 2004-08-13 Management of SSL/TLS certificates
US10/917,961 Abandoned US20050076200A1 (en) 2003-08-15 2004-08-13 Method for discovering digital certificates in a network
US10/918,325 Abandoned US20050071630A1 (en) 2003-08-15 2004-08-13 Processing apparatus for monitoring and renewing digital certificates
US10/917,958 Abandoned US20050076199A1 (en) 2003-08-15 2004-08-13 Automated SSL certificate installers
US10/918,707 Abandoned US20050076203A1 (en) 2003-08-15 2004-08-13 Product for managing and monitoring digital certificates
US10/918,831 Active 2027-03-02 US7568095B2 (en) 2003-08-15 2004-08-13 Method of aggregating multiple certificate authority services
US10/917,965 Abandoned US20050078830A1 (en) 2003-08-15 2004-08-13 Method for automated installation of digital certificates to network servers
US10/918,665 Active 2027-01-16 US7650497B2 (en) 2003-08-15 2004-08-13 Automated digital certificate renewer
US10/917,963 Abandoned US20050076202A1 (en) 2003-08-15 2004-08-13 Program product for discovering enterprise certificates
US10/917,845 Abandoned US20050081026A1 (en) 2003-08-15 2004-08-13 Software product for installing SSL certificates to SSL-enablable devices
US10/917,960 Abandoned US20060015716A1 (en) 2003-08-15 2004-08-13 Program product for maintaining certificate on client network devices1
US10/917,964 Abandoned US20050081029A1 (en) 2003-08-15 2004-08-13 Remote management of client installed digital certificates
US10/918,755 Active 2028-01-26 US7698549B2 (en) 2003-08-15 2004-08-13 Program product for unified certificate requests from certificate authorities
US10/917,862 Active - Reinstated 2026-02-20 US7418597B2 (en) 2003-08-15 2004-08-13 Apparatus for accepting certificate requests and submission to multiple certificate authorities
US10/917,962 Abandoned US20050076201A1 (en) 2003-08-15 2004-08-13 System for discovering SSL-enabled network devices and certificates
US10/917,863 Active 2026-03-10 US7653810B2 (en) 2003-08-15 2004-08-13 Method to automate the renewal of digital certificates
US12/486,704 Active 2024-08-26 US7937583B2 (en) 2003-08-15 2009-06-17 Method of aggregating multiple certificate authority services

Family Applications Before (13)

Application Number Title Priority Date Filing Date
US10/917,861 Active 2027-01-20 US7650496B2 (en) 2003-08-15 2004-08-13 Renewal product for digital certificates
US10/918,710 Abandoned US20050076204A1 (en) 2003-08-15 2004-08-13 Apparatuses for authenticating client devices with client certificate management
US10/918,667 Abandoned US20050074124A1 (en) 2003-08-15 2004-08-13 Management of SSL/TLS certificates
US10/917,961 Abandoned US20050076200A1 (en) 2003-08-15 2004-08-13 Method for discovering digital certificates in a network
US10/918,325 Abandoned US20050071630A1 (en) 2003-08-15 2004-08-13 Processing apparatus for monitoring and renewing digital certificates
US10/917,958 Abandoned US20050076199A1 (en) 2003-08-15 2004-08-13 Automated SSL certificate installers
US10/918,707 Abandoned US20050076203A1 (en) 2003-08-15 2004-08-13 Product for managing and monitoring digital certificates
US10/918,831 Active 2027-03-02 US7568095B2 (en) 2003-08-15 2004-08-13 Method of aggregating multiple certificate authority services
US10/917,965 Abandoned US20050078830A1 (en) 2003-08-15 2004-08-13 Method for automated installation of digital certificates to network servers
US10/918,665 Active 2027-01-16 US7650497B2 (en) 2003-08-15 2004-08-13 Automated digital certificate renewer
US10/917,963 Abandoned US20050076202A1 (en) 2003-08-15 2004-08-13 Program product for discovering enterprise certificates
US10/917,845 Abandoned US20050081026A1 (en) 2003-08-15 2004-08-13 Software product for installing SSL certificates to SSL-enablable devices
US10/917,960 Abandoned US20060015716A1 (en) 2003-08-15 2004-08-13 Program product for maintaining certificate on client network devices1

Family Applications After (5)

Application Number Title Priority Date Filing Date
US10/918,755 Active 2028-01-26 US7698549B2 (en) 2003-08-15 2004-08-13 Program product for unified certificate requests from certificate authorities
US10/917,862 Active - Reinstated 2026-02-20 US7418597B2 (en) 2003-08-15 2004-08-13 Apparatus for accepting certificate requests and submission to multiple certificate authorities
US10/917,962 Abandoned US20050076201A1 (en) 2003-08-15 2004-08-13 System for discovering SSL-enabled network devices and certificates
US10/917,863 Active 2026-03-10 US7653810B2 (en) 2003-08-15 2004-08-13 Method to automate the renewal of digital certificates
US12/486,704 Active 2024-08-26 US7937583B2 (en) 2003-08-15 2009-06-17 Method of aggregating multiple certificate authority services

Country Status (1)

Country Link
US (19) US7650496B2 (en)

Cited By (61)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030110397A1 (en) * 2001-12-12 2003-06-12 Pervasive Security Systems, Inc. Guaranteed delivery of changes to security policies in a distributed system
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols
US20070150727A1 (en) * 2005-12-28 2007-06-28 Brother Kogyo Kabushiki Kaisha Management Apparatus
US20080281907A1 (en) * 2007-05-07 2008-11-13 Hilary Vieira System and method for globally issuing and validating assets
US20090063849A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US20090060187A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US20090083538A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US20090083537A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Server configuration selection for ssl interception
US7681034B1 (en) 2001-12-12 2010-03-16 Chang-Ping Lee Method and apparatus for securing electronic data
US7703140B2 (en) 2003-09-30 2010-04-20 Guardian Data Storage, Llc Method and system for securing digital assets using process-driven security policies
US7707427B1 (en) 2004-07-19 2010-04-27 Michael Frederick Kenrich Multi-level file digests
US20100106965A1 (en) * 2008-10-28 2010-04-29 Dell Products L.P. Delivery of multiple third-party services to networked devices
WO2010045706A1 (en) * 2008-10-22 2010-04-29 Research In Motion Limited Pushing certificate chains to remote devices
US7729995B1 (en) 2001-12-12 2010-06-01 Rossmann Alain Managing secured files in designated locations
USRE41546E1 (en) 2001-12-12 2010-08-17 Klimenty Vainstein Method and system for managing security tiers
US7783765B2 (en) 2001-12-12 2010-08-24 Hildebrand Hal S System and method for providing distributed access control to secured documents
US20100228968A1 (en) * 2009-03-03 2010-09-09 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US7836310B1 (en) 2002-11-01 2010-11-16 Yevgeniy Gutnik Security system that uses indirect password-based encryption
US20100299525A1 (en) * 2005-08-10 2010-11-25 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US20100318665A1 (en) * 2003-04-14 2010-12-16 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US7890990B1 (en) 2002-12-20 2011-02-15 Klimenty Vainstein Security system with staging capabilities
US20110066848A1 (en) * 2005-06-29 2011-03-17 Microsoft Corporation Remote certificate management
US7921288B1 (en) 2001-12-12 2011-04-05 Hildebrand Hal S System and method for providing different levels of key security for controlling access to secured items
US7921284B1 (en) 2001-12-12 2011-04-05 Gary Mark Kinghorn Method and system for protecting electronic data in enterprise environment
US7921450B1 (en) 2001-12-12 2011-04-05 Klimenty Vainstein Security system using indirect key generation from access rules and methods therefor
US7930756B1 (en) 2001-12-12 2011-04-19 Crocker Steven Toye Multi-level cryptographic transformations for securing digital assets
US7950066B1 (en) 2001-12-21 2011-05-24 Guardian Data Storage, Llc Method and system for restricting use of a clipboard application
US20110145568A1 (en) * 2009-12-14 2011-06-16 International Business Machines Corporation Handling of the usage of software in a disconnected computing environment
US20110161662A1 (en) * 2009-12-30 2011-06-30 Hong Fu Jin Precision Industry (Shenzhen) Co., Ltd System and method for updating digital certificate automatically
US20110202759A1 (en) * 2010-02-12 2011-08-18 Microsoft Corporation Certificate remoting and recovery
US8006280B1 (en) 2001-12-12 2011-08-23 Hildebrand Hal S Security system for generating keys from access rules in a decentralized manner and methods therefor
US20110231923A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Local authentication in proxy ssl tunnels using a client-side proxy agent
US8065713B1 (en) 2001-12-12 2011-11-22 Klimenty Vainstein System and method for providing multi-location access management to secured items
US8127366B2 (en) * 2003-09-30 2012-02-28 Guardian Data Storage, Llc Method and apparatus for transitioning between states of security policies used to secure electronic documents
US8170931B2 (en) 2008-10-28 2012-05-01 Dell Products L.P. Configuring user-customized services for networked devices
US8176334B2 (en) 2002-09-30 2012-05-08 Guardian Data Storage, Llc Document security system that permits external users to gain access to secured files
US8266674B2 (en) 2001-12-12 2012-09-11 Guardian Data Storage, Llc Method and system for implementing changes to security policies in a distributed security system
US8307067B2 (en) 2002-09-11 2012-11-06 Guardian Data Storage, Llc Protecting encrypted files transmitted over a network
USRE43906E1 (en) 2001-12-12 2013-01-01 Guardian Data Storage Llc Method and apparatus for securing digital assets
WO2013093209A1 (en) * 2011-12-21 2013-06-27 Ssh Communications Security Oyj Automated access, key, certificate, and credential management
TWI410148B (en) * 2008-12-02 2013-09-21 Dell Products Lp Preconfiguration of wireless network access for portable devices
US8543827B2 (en) 2001-12-12 2013-09-24 Intellectual Ventures I Llc Methods and systems for providing access control to secured data
US20130276089A1 (en) * 2012-04-12 2013-10-17 Ariel Tseitlin Method and system for improving security and reliability in a networked application environment
US8606875B1 (en) * 2004-06-30 2013-12-10 Oracle America, Inc. Method and system for automatic distribution and installation of a client certificate in a secure manner
US8613102B2 (en) 2004-03-30 2013-12-17 Intellectual Ventures I Llc Method and system for providing document retention using cryptography
US8707034B1 (en) 2003-05-30 2014-04-22 Intellectual Ventures I Llc Method and system for using remote headers to secure electronic files
US8782393B1 (en) 2006-03-23 2014-07-15 F5 Networks, Inc. Accessing SSL connection data by a third-party
US20140237091A1 (en) * 2013-02-15 2014-08-21 Digicert, Inc. Method and System of Network Discovery
US20140281540A1 (en) * 2013-01-18 2014-09-18 Apple Inc. Keychain syncing
US9077759B2 (en) 2013-01-18 2015-07-07 Apple Inc. Conflict resolution for keychain syncing
US20170214530A1 (en) * 2016-01-27 2017-07-27 Blackberry Limited Trusted execution environment
US9722987B2 (en) 2015-03-13 2017-08-01 Ssh Communications Security Oyj Access relationships in a computer system
US10003458B2 (en) 2011-12-21 2018-06-19 Ssh Communications Security Corp. User key management for the secure shell (SSH)
US10009354B2 (en) 2013-07-08 2018-06-26 Ssh Communications Security Oyj Trust relationships in a computerized system
US10033700B2 (en) 2001-12-12 2018-07-24 Intellectual Ventures I Llc Dynamic evaluation of access rights
US10305871B2 (en) 2015-12-09 2019-05-28 Cloudflare, Inc. Dynamically serving digital certificates based on secure session properties
US10360545B2 (en) 2001-12-12 2019-07-23 Guardian Data Storage, Llc Method and apparatus for accessing secured electronic data off-line
US10599409B2 (en) 2016-02-02 2020-03-24 Blackberry Limited Application lifecycle operation queueing
US10771261B1 (en) * 2016-09-29 2020-09-08 EMC IP Holding Company LLC Extensible unified multi-service certificate and certificate revocation list management
US11095459B2 (en) * 2018-05-31 2021-08-17 Microsoft Technology Licensing, Llc Automatic generation of app-specific client certification
US11477011B1 (en) * 2005-03-30 2022-10-18 Wells Fargo Bank, N.A. Distributed cryptographic management for computer systems

Families Citing this family (494)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9219755B2 (en) 1996-11-08 2015-12-22 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US8079086B1 (en) 1997-11-06 2011-12-13 Finjan, Inc. Malicious mobile code runtime monitoring system and methods
US7058822B2 (en) 2000-03-30 2006-06-06 Finjan Software, Ltd. Malicious mobile code runtime monitoring system and methods
US7293087B2 (en) * 2000-01-21 2007-11-06 Scriptlogic Corporation Event-based application for performing configuration changes in a networked environment
DE10031741A1 (en) * 2000-06-29 2002-01-17 Sanguibio Tech Ag Externally applied oxygen carrier preparation for treating oxygen deficiency states of the skin, comprises active agent, specifically hemoglobin or its mixture with myoglobin, incorporated in a gel carrier
US20030233319A1 (en) * 2001-03-20 2003-12-18 David Lawrence Electronic fund transfer participant risk management clearing
US20030225687A1 (en) * 2001-03-20 2003-12-04 David Lawrence Travel related risk management clearinghouse
US20110131136A1 (en) * 2001-03-20 2011-06-02 David Lawrence Risk Management Customer Registry
US8121937B2 (en) * 2001-03-20 2012-02-21 Goldman Sachs & Co. Gaming industry risk management clearinghouse
US8140415B2 (en) * 2001-03-20 2012-03-20 Goldman Sachs & Co. Automated global risk management
US7899722B1 (en) * 2001-03-20 2011-03-01 Goldman Sachs & Co. Correspondent bank registry
US8209246B2 (en) 2001-03-20 2012-06-26 Goldman, Sachs & Co. Proprietary risk management clearinghouse
US20020143562A1 (en) * 2001-04-02 2002-10-03 David Lawrence Automated legal action risk management
EP1278333B1 (en) * 2001-04-19 2006-02-15 NTT DoCoMo, Inc. Terminal communication system
US20090216552A1 (en) * 2002-03-11 2009-08-27 Cert-A-Roof, Llc Systems and processes for maintaining roofs
US7885896B2 (en) 2002-07-09 2011-02-08 Avaya Inc. Method for authorizing a substitute software license server
US8041642B2 (en) 2002-07-10 2011-10-18 Avaya Inc. Predictive software license balancing
US7698225B2 (en) * 2002-08-30 2010-04-13 Avaya Inc. License modes in call processing
US7707116B2 (en) * 2002-08-30 2010-04-27 Avaya Inc. Flexible license file feature controls
US7681245B2 (en) 2002-08-30 2010-03-16 Avaya Inc. Remote feature activator feature extraction
US7966520B2 (en) * 2002-08-30 2011-06-21 Avaya Inc. Software licensing for spare processors
US7890997B2 (en) * 2002-12-26 2011-02-15 Avaya Inc. Remote feature activation authentication file system
US7260557B2 (en) * 2003-02-27 2007-08-21 Avaya Technology Corp. Method and apparatus for license distribution
DE602004002044T2 (en) * 2003-07-25 2007-04-12 Ricoh Co., Ltd. Authentication system and procedures using individualized and non-individualized certificates
US20050033855A1 (en) * 2003-08-05 2005-02-10 Ahmad Moradi Method and apparatus for generating and marketing video e-mail and an intelligent video streaming server
US8028236B2 (en) * 2003-10-17 2011-09-27 International Business Machines Corporation System services enhancement for displaying customized views
US8139770B2 (en) 2003-12-23 2012-03-20 Wells Fargo Bank, N.A. Cryptographic key backup and escrow system
US20050198545A1 (en) * 2004-02-12 2005-09-08 Sony Corporation Automatic user device presence registration system
AU2005239421B2 (en) 2004-04-26 2012-04-12 Google Inc. Methods and systems for dynamically composing distributed interactive applications from high-level programming languages
DE602005018038D1 (en) * 2004-04-30 2010-01-14 Research In Motion Ltd SYSTEM AND METHOD FOR TESTING DIGITAL CERTIFICATES
JP4717378B2 (en) * 2004-06-08 2011-07-06 キヤノン株式会社 Information processing device
WO2006002068A2 (en) * 2004-06-15 2006-01-05 Passmark Security, Inc. Method and apparatus for making accessible a set of services to users
US7546454B2 (en) * 2004-06-30 2009-06-09 At&T Intellectual Property I, L.P. Automated digital certificate discovery and management
US8442953B2 (en) 2004-07-02 2013-05-14 Goldman, Sachs & Co. Method, system, apparatus, program code and means for determining a redundancy of information
US8762191B2 (en) * 2004-07-02 2014-06-24 Goldman, Sachs & Co. Systems, methods, apparatus, and schema for storing, managing and retrieving information
US8510300B2 (en) 2004-07-02 2013-08-13 Goldman, Sachs & Co. Systems and methods for managing information associated with legal, compliance and regulatory risk
US8996481B2 (en) * 2004-07-02 2015-03-31 Goldman, Sach & Co. Method, system, apparatus, program code and means for identifying and extracting information
WO2006014504A2 (en) 2004-07-07 2006-02-09 Sciencelogic, Llc Self configuring network management system
US7617501B2 (en) 2004-07-09 2009-11-10 Quest Software, Inc. Apparatus, system, and method for managing policies on a computer having a foreign operating system
US7565577B2 (en) * 2004-07-22 2009-07-21 Research In Motion Limited Method and apparatus for providing intelligent error messaging
GB0418411D0 (en) * 2004-08-18 2004-09-22 King S College London A method of discovering contact means for network access devices
WO2006019143A1 (en) * 2004-08-19 2006-02-23 Nippon Telegraph And Telephone Corporation Event order certifying method
CN1993926A (en) * 2004-08-20 2007-07-04 三菱电机株式会社 Terminal apparatus
US8284942B2 (en) * 2004-08-24 2012-10-09 Microsoft Corporation Persisting private/public key pairs in password-encrypted files for transportation to local cryptographic store
US7681242B2 (en) * 2004-08-26 2010-03-16 Novell, Inc. Allocation of network resources
US20060047965A1 (en) * 2004-09-01 2006-03-02 Wayne Thayer Methods and systems for dynamic updates of digital certificates with hosting provider
US8615653B2 (en) * 2004-09-01 2013-12-24 Go Daddy Operating Company, LLC Methods and systems for dynamic updates of digital certificates via subscription
GB0419479D0 (en) * 2004-09-02 2004-10-06 Cryptomathic Ltd Data certification methods and apparatus
US7814216B2 (en) * 2004-09-07 2010-10-12 Route 1 Inc. System and method for accessing host computer via remote computer
US7707405B1 (en) 2004-09-21 2010-04-27 Avaya Inc. Secure installation activation
US7747851B1 (en) * 2004-09-30 2010-06-29 Avaya Inc. Certificate distribution via license files
US8229858B1 (en) 2004-09-30 2012-07-24 Avaya Inc. Generation of enterprise-wide licenses in a customer environment
US20060088026A1 (en) * 2004-10-27 2006-04-27 Microsoft Corporation Message based network configuration of domain name services
JP4532237B2 (en) * 2004-10-29 2010-08-25 株式会社日立製作所 Computer and access control method in computer
US7743093B2 (en) * 2004-11-10 2010-06-22 Microsoft Corporation Message based network configuration of domain name purchase
US8073971B2 (en) * 2004-12-10 2011-12-06 Microsoft Corporation Message based network configuration of dynamic domain name services
US20060129804A1 (en) * 2004-12-10 2006-06-15 Microsoft Corporation Message based network configuration of server certificate purchase
US20060129821A1 (en) * 2004-12-13 2006-06-15 Microsoft Corporation Believably trustworthy enforcement of privacy enhancing technologies in data processing
US20060174125A1 (en) * 2005-01-31 2006-08-03 Brookner George M Multiple cryptographic key security device
US20060179299A1 (en) * 2005-02-08 2006-08-10 Murata Kikai Kabushiki Kaisha E-mail communication device
JP4590282B2 (en) * 2005-02-24 2010-12-01 キヤノン株式会社 License management apparatus, control method, and program
US7661128B2 (en) * 2005-03-31 2010-02-09 Google Inc. Secure login credentials for substantially anonymous users
JP2006319702A (en) * 2005-05-13 2006-11-24 Murata Mach Ltd Electronic mail server apparatus
EP1732263A1 (en) * 2005-06-07 2006-12-13 Sony Ericsson Mobile Communications AB Method and apparatus for certificate roll-over
US8295492B2 (en) * 2005-06-27 2012-10-23 Wells Fargo Bank, N.A. Automated key management system
US7765398B2 (en) * 2005-07-07 2010-07-27 At&T Intellectual Property I, L.P. Method of promulgating a transaction tool to a recipient
JP4410166B2 (en) * 2005-07-14 2010-02-03 株式会社リコー Image forming apparatus, electronic signature generation method, electronic signature generation program, and recording medium
JP2007060473A (en) * 2005-08-26 2007-03-08 Fuji Xerox Co Ltd Electronic mail device
US7814023B1 (en) 2005-09-08 2010-10-12 Avaya Inc. Secure download manager
US7953971B2 (en) * 2005-10-27 2011-05-31 Research In Motion Limited Synchronizing certificates between a device and server
US7757270B2 (en) * 2005-11-17 2010-07-13 Iron Mountain Incorporated Systems and methods for exception handling
US7904949B2 (en) 2005-12-19 2011-03-08 Quest Software, Inc. Apparatus, systems and methods to provide authentication services to a legacy application
US7600123B2 (en) * 2005-12-22 2009-10-06 Microsoft Corporation Certificate registration after issuance for secure communication
US7788730B2 (en) * 2006-01-17 2010-08-31 International Business Machines Corporation Secure bytecode instrumentation facility
US7870383B2 (en) * 2006-02-09 2011-01-11 International Business Machines Corporation System, method and program to update certificates in a computer
US8700902B2 (en) 2006-02-13 2014-04-15 At&T Intellectual Property I, L.P. Methods and apparatus to certify digital signatures
US8087075B2 (en) * 2006-02-13 2011-12-27 Quest Software, Inc. Disconnected credential validation using pre-fetched service tickets
US7996895B2 (en) * 2006-03-27 2011-08-09 Avaya Inc. Method and apparatus for protecting networks from unauthorized applications
JP4449931B2 (en) 2006-03-30 2010-04-14 ブラザー工業株式会社 Management device and management system
JP4449933B2 (en) * 2006-03-31 2010-04-14 ブラザー工業株式会社 Electronic certificate issuing system, electronic certificate issuing device, communication device, and program
US7967682B2 (en) * 2006-04-12 2011-06-28 Bally Gaming, Inc. Wireless gaming environment
US20070245414A1 (en) * 2006-04-14 2007-10-18 Microsoft Corporation Proxy Authentication and Indirect Certificate Chaining
US7984479B2 (en) * 2006-04-17 2011-07-19 International Business Machines Corporation Policy-based security certificate filtering
US7552467B2 (en) * 2006-04-24 2009-06-23 Jeffrey Dean Lindsay Security systems for protecting an asset
US20070283143A1 (en) * 2006-06-06 2007-12-06 Kabushiki Kaisha Toshiba System and method for certificate-based client registration via a document processing device
US8429712B2 (en) 2006-06-08 2013-04-23 Quest Software, Inc. Centralized user authentication system apparatus and method
US8572751B2 (en) * 2006-06-12 2013-10-29 International Business Machines Corporation Method, system, and program product for preventing unauthorized changes to an electronic document
US8285636B2 (en) 2006-06-14 2012-10-09 Curry Edith L Methods of monitoring behavior/activity of an individual associated with an organization
US20080015977A1 (en) * 2006-06-14 2008-01-17 Curry Edith L Methods of deterring fraud and other improper behaviors within an organization
US8423762B2 (en) * 2006-07-25 2013-04-16 Northrop Grumman Systems Corporation Common access card heterogeneous (CACHET) system and method
US8327142B2 (en) * 2006-09-27 2012-12-04 Secureauth Corporation System and method for facilitating secure online transactions
US20080077791A1 (en) * 2006-09-27 2008-03-27 Craig Lund System and method for secured network access
US8458455B2 (en) * 2006-10-10 2013-06-04 International Business Machines Corporation Techniques for handling SSL certificate expiration and renewal
US8086710B2 (en) 2006-10-30 2011-12-27 Quest Software, Inc. Identity migration apparatus and method
US9101820B2 (en) * 2006-11-09 2015-08-11 Bally Gaming, Inc. System, method and apparatus to produce decks for and operate games played with playing cards
US20080153600A1 (en) * 2006-11-10 2008-06-26 Bally Gaming, Inc. Gaming system configuration change reporting
US8784212B2 (en) * 2006-11-10 2014-07-22 Bally Gaming, Inc. Networked gaming environment employing different classes of gaming machines
US8920233B2 (en) * 2006-11-10 2014-12-30 Bally Gaming, Inc. Assignment template and assignment bundle in a gaming configuration and download system
US9111078B2 (en) * 2006-11-10 2015-08-18 Bally Gaming, Inc. Package manager service in gaming system
US9275512B2 (en) * 2006-11-10 2016-03-01 Bally Gaming, Inc. Secure communications in gaming system
US8631501B2 (en) 2006-11-10 2014-01-14 Bally Gaming, Inc. Reporting function in gaming system environment
US8347280B2 (en) 2006-11-13 2013-01-01 Bally Gaming, Inc. System and method for validating download or configuration assignment for an EGM or EGM collection
US8930461B2 (en) 2006-11-13 2015-01-06 Bally Gaming, Inc. Download and configuration management engine for gaming system
US9082258B2 (en) 2006-11-13 2015-07-14 Bally Gaming, Inc. Method and system for providing download and configuration job progress tracking and display via host user interface
JP4227641B2 (en) * 2006-11-20 2009-02-18 キヤノン株式会社 Information processing apparatus and information processing apparatus control method
US8601555B2 (en) * 2006-12-04 2013-12-03 Samsung Electronics Co., Ltd. System and method of providing domain management for content protection and security
US7877600B2 (en) * 2006-12-27 2011-01-25 General Instrument Corporation Method and apparatus for distributing root certification
US20080161102A1 (en) * 2007-01-03 2008-07-03 Response Reward Systems L.C. Non-risk gaming
JP5130722B2 (en) * 2007-01-19 2013-01-30 セイコーエプソン株式会社 Authentication apparatus and method
US20080195862A1 (en) * 2007-02-12 2008-08-14 Research In Motion Limited Providing personal certificate warnings in a system and method for processing messages composed by a user
US20080229098A1 (en) * 2007-03-12 2008-09-18 Sips Inc. On-line transaction authentication system and method
KR101434569B1 (en) * 2007-04-06 2014-08-27 삼성전자 주식회사 Apparatus and method for providing security service in home network
US8195934B1 (en) * 2007-05-03 2012-06-05 United Services Automobile Association (Usaa) Systems and methods for managing certificates
US8473735B1 (en) * 2007-05-17 2013-06-25 Jpmorgan Chase Systems and methods for managing digital certificates
US8578152B2 (en) * 2007-06-20 2013-11-05 Red Hat, Inc. Methods, systems, and apparatus for staggered renewal periods
JP4128610B1 (en) * 2007-10-05 2008-07-30 グローバルサイン株式会社 Server certificate issuing system
CN101828358B (en) * 2007-06-27 2012-07-04 环球标志株式会社 Server certificate issuing system
US20090003603A1 (en) * 2007-06-29 2009-01-01 Metabeam Corporation Platform Independent Networked Communications
US8266678B2 (en) * 2007-07-02 2012-09-11 At&T Intellectual Property I, L.P. Deriving a username based on a digital certificate
KR101393012B1 (en) * 2007-07-03 2014-05-12 삼성전자주식회사 System and method for management of license
US8769291B2 (en) * 2007-07-23 2014-07-01 Red Hat, Inc. Certificate generation for a network appliance
US8374354B2 (en) * 2007-09-27 2013-02-12 Verizon Data Services Llc System and method to pass a private encryption key
US8196192B2 (en) * 2007-10-15 2012-06-05 Red Hat, Inc. Setting a preliminary time on a network appliance using a digital certificate
JP4936549B2 (en) * 2007-10-30 2012-05-23 キヤノン株式会社 Server device, management system, management method, storage medium, program
US20090118006A1 (en) 2007-11-02 2009-05-07 Bally Gaming, Inc. Game related systems, methods, and articles that combine virtual and physical elements
US20090126001A1 (en) * 2007-11-08 2009-05-14 Microsoft Corporation Techniques to manage security certificates
US8616958B2 (en) * 2007-11-12 2013-12-31 Bally Gaming, Inc. Discovery method and system for dynamically locating networked gaming components and resources
US8201229B2 (en) * 2007-11-12 2012-06-12 Bally Gaming, Inc. User authorization system and methods
US9563898B2 (en) 2008-04-30 2017-02-07 Bally Gaming, Inc. System and method for automated customer account creation and management
US8412806B2 (en) * 2007-11-14 2013-04-02 Red Hat, Inc. Setting a preliminary time on a network appliance using a message received from a server
US8621027B2 (en) 2007-11-16 2013-12-31 Red Hat, Inc. Automatically providing identity information for a network appliance
US8191122B2 (en) * 2007-11-27 2012-05-29 Red Hat, Inc. Provisioning a network appliance
US8191123B2 (en) * 2007-11-27 2012-05-29 Red Hat, Inc. Provisioning a network appliance
US8112535B2 (en) * 2007-11-30 2012-02-07 Microsoft Corporation Securing a server in a dynamic addressing environment
US9384488B2 (en) * 2007-12-17 2016-07-05 International Business Machines Corporation System and methods for credentialing on-line information providers
US9692602B2 (en) * 2007-12-18 2017-06-27 The Directv Group, Inc. Method and apparatus for mutually authenticating a user device of a primary service provider
CA2645990C (en) * 2007-12-20 2014-07-29 Bce Inc. Contact-less tag with signature, and applications thereof
US9281947B2 (en) * 2008-01-23 2016-03-08 Microsoft Technology Licensing, Llc Security mechanism within a local area network
US9183368B2 (en) * 2008-01-24 2015-11-10 Go Daddy Operating Company, LLC Validating control of domain zone
US8117439B2 (en) * 2008-01-24 2012-02-14 Go Daddy Operating Company, LLC Issuing secure certificate using domain zone control validation
US7653577B2 (en) 2008-02-19 2010-01-26 The Go Daddy Group, Inc. Validating e-commerce transactions
US7930732B2 (en) * 2008-02-22 2011-04-19 Novell, Inc. Techniques for secure transparent switching between modes of a virtual private network (VPN)
US9479339B2 (en) * 2008-02-29 2016-10-25 Blackberry Limited Methods and apparatus for use in obtaining a digital certificate for a mobile communication device
US10015158B2 (en) 2008-02-29 2018-07-03 Blackberry Limited Methods and apparatus for use in enabling a mobile communication device with a digital certificate
US8739292B2 (en) * 2008-03-04 2014-05-27 Apple Inc. Trust exception management
US8104091B2 (en) * 2008-03-07 2012-01-24 Samsung Electronics Co., Ltd. System and method for wireless communication network having proximity control based on authorization token
US8301877B2 (en) 2008-03-10 2012-10-30 Secureauth Corporation System and method for configuring a valid duration period for a digital certificate
US20090240936A1 (en) * 2008-03-20 2009-09-24 Mark Lambiase System and method for storing client-side certificate credentials
US20090275374A1 (en) * 2008-04-30 2009-11-05 Bally Gaming, Inc. Tournament play in a gaming property
US8856657B2 (en) * 2008-04-30 2014-10-07 Bally Gaming, Inc. User interface for managing network download and configuration tasks
US9483911B2 (en) * 2008-04-30 2016-11-01 Bally Gaming, Inc. Information distribution in gaming networks
US9005034B2 (en) * 2008-04-30 2015-04-14 Bally Gaming, Inc. Systems and methods for out-of-band gaming machine management
US8721431B2 (en) 2008-04-30 2014-05-13 Bally Gaming, Inc. Systems, methods, and devices for providing instances of a secondary game
US20090275401A1 (en) * 2008-04-30 2009-11-05 Bally Gaming, Inc. Method, system, apparatus, and article of manufacture for profile-driven configuration for electronic gaming machines (egms)
US8321662B2 (en) * 2008-05-08 2012-11-27 International Business Machines Corporation Certificate renewal using secure handshake
US8862874B2 (en) * 2008-05-09 2014-10-14 International Business Machines Corporation Certificate distribution using secure handshake
US8382584B2 (en) * 2008-05-24 2013-02-26 Bally Gaming, Inc. Networked gaming system with enterprise accounting methods and apparatus
WO2009155047A2 (en) * 2008-05-30 2009-12-23 Bally Gaming, Inc. Web pages for gaming devices
US8924714B2 (en) * 2008-06-27 2014-12-30 Microsoft Corporation Authentication with an untrusted root
US8412768B2 (en) * 2008-07-11 2013-04-02 Ball Gaming, Inc. Integration gateway
US8776238B2 (en) * 2008-07-16 2014-07-08 International Business Machines Corporation Verifying certificate use
US20100031028A1 (en) * 2008-07-31 2010-02-04 Research In Motion Limited Systems and methods for selecting a certificate for use with secure messages
US8862872B2 (en) * 2008-09-12 2014-10-14 Qualcomm Incorporated Ticket-based spectrum authorization and access control
US8548467B2 (en) 2008-09-12 2013-10-01 Qualcomm Incorporated Ticket-based configuration parameters validation
US8327422B1 (en) 2008-09-26 2012-12-04 Emc Corporation Authenticating a server device using dynamically generated representations
US9148335B2 (en) * 2008-09-30 2015-09-29 Qualcomm Incorporated Third party validation of internet protocol addresses
EP2180634B1 (en) 2008-10-22 2018-04-04 BlackBerry Limited Method of handling a certification request
US8296563B2 (en) 2008-10-22 2012-10-23 Research In Motion Limited Method of handling a certification request
US8266213B2 (en) 2008-11-14 2012-09-11 Bally Gaming, Inc. Apparatus, method, and system to provide a multiple processor architecture for server-based gaming
US8347303B2 (en) * 2008-11-14 2013-01-01 Bally Gaming, Inc. Apparatus, method, and system to provide a multi-core processor for an electronic gaming machine (EGM)
US8423790B2 (en) 2008-11-18 2013-04-16 Bally Gaming, Inc. Module validation
US8645696B2 (en) * 2008-11-26 2014-02-04 Red Hat, Inc. Notifying users of server changes via SSL
US20100138907A1 (en) * 2008-12-01 2010-06-03 Garret Grajek Method and system for generating digital certificates and certificate signing requests
KR20100066169A (en) * 2008-12-09 2010-06-17 한국전자통신연구원 System and method for private information management using anonymous authentication
WO2010069033A1 (en) 2008-12-18 2010-06-24 Bce Inc Validation method and system for use in securing nomadic electronic transactions
US20120102322A1 (en) 2008-12-18 2012-04-26 O'brien William G Processing of communication device signatures for use in securing nomadic electronic transactions
WO2010071888A2 (en) * 2008-12-19 2010-06-24 Watchguard Technologies, Inc. Cluster architecture and configuration for network security devices
US8145450B2 (en) 2008-12-23 2012-03-27 Novell, Inc. Techniques for distributed testing
US9860275B2 (en) * 2008-12-30 2018-01-02 Ebay Inc. Systems and methods to rotate security assets used for secure communications
US8682985B2 (en) * 2009-01-15 2014-03-25 Microsoft Corporation Message tracking between organizations
EP2230792B1 (en) * 2009-03-17 2016-10-19 BlackBerry Limited Validation of certificate issuance notification messages
US8255685B2 (en) 2009-03-17 2012-08-28 Research In Motion Limited System and method for validating certificate issuance notification messages
US9432356B1 (en) 2009-05-05 2016-08-30 Amazon Technologies, Inc. Host identity bootstrapping
US8560851B1 (en) * 2009-05-15 2013-10-15 Sprint Communications Company L.P. Managing digital certificates
US8289975B2 (en) * 2009-06-22 2012-10-16 Citrix Systems, Inc. Systems and methods for handling a multi-connection protocol between a client and server traversing a multi-core system
US8255984B1 (en) 2009-07-01 2012-08-28 Quest Software, Inc. Single sign-on system for shared resource environments
US20110029771A1 (en) * 2009-07-28 2011-02-03 Aruba Networks, Inc. Enrollment Agent for Automated Certificate Enrollment
EP2465228A4 (en) * 2009-08-12 2014-12-03 Motorola Mobility Llc Configurable online public key infrastructure (pki) management framework
US9077544B2 (en) * 2009-09-15 2015-07-07 Welch Allyn, Inc. Automatic provisioning of authentication credentials
US9262392B2 (en) 2009-09-29 2016-02-16 Paypal, Inc. User information population
US8555054B2 (en) * 2009-10-12 2013-10-08 Palo Alto Research Center Incorporated Apparatus and methods for protecting network resources
US8788571B2 (en) * 2009-11-03 2014-07-22 Language Line Services, Inc. Apparatus and method that provide data communication
US20110113240A1 (en) * 2009-11-10 2011-05-12 Christina Fu Certificate renewal using enrollment profile framework
US9130758B2 (en) * 2009-11-10 2015-09-08 Red Hat, Inc. Renewal of expired certificates
US8776192B2 (en) * 2009-11-17 2014-07-08 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for automatically verifying and populating digital certificates in an encryption keystore
US8738901B2 (en) * 2009-11-24 2014-05-27 Red Hat, Inc. Automatic certificate renewal
US8909916B2 (en) * 2009-11-30 2014-12-09 Red Hat, Inc. Using a PKCS module for opening multiple databases
US8327424B2 (en) * 2009-12-22 2012-12-04 Motorola Solutions, Inc. Method and apparatus for selecting a certificate authority
US9794248B2 (en) * 2009-12-23 2017-10-17 Symantec Corporation Alternative approach to deployment and payment for digital certificates
TWI482480B (en) * 2010-02-01 2015-04-21 Hon Hai Prec Ind Co Ltd System and method for updating digital certificates automatically
US8898457B2 (en) * 2010-02-26 2014-11-25 Red Hat, Inc. Automatically generating a certificate operation request
US9225525B2 (en) * 2010-02-26 2015-12-29 Red Hat, Inc. Identity management certificate operations
US10826885B2 (en) * 2010-03-02 2020-11-03 Liberty Plugins, Inc. Digital certificate and reservation
US9197630B2 (en) * 2010-03-08 2015-11-24 Microsoft Technology Licensing, Llc Automated certificate management
US20110258082A1 (en) * 2010-04-14 2011-10-20 Microsoft Corporation Application Store for Shared Resource Computing
CN102859929A (en) * 2010-04-15 2013-01-02 通用仪表公司 Online secure device provisioning with updated offline identity data generation and offline device binding
GB201008888D0 (en) * 2010-05-27 2010-07-14 Qinetiq Ltd Network security
JP5505160B2 (en) * 2010-07-22 2014-05-28 ブラザー工業株式会社 Information processing apparatus and computer program
US9225511B1 (en) 2010-08-17 2015-12-29 Go Daddy Operating Company, LLC Systems for determining website secure certificate status via partner browser plugin
US9225510B1 (en) * 2010-08-17 2015-12-29 Go Daddy Operating Company, LLC Website secure certificate status determination via partner browser plugin
US9111079B2 (en) * 2010-09-30 2015-08-18 Microsoft Technology Licensing, Llc Trustworthy device claims as a service
JP5669507B2 (en) * 2010-10-05 2015-02-12 キヤノン株式会社 Management apparatus, management apparatus control method, and computer program
EP2638665A4 (en) * 2010-11-09 2016-04-20 Zaplox Ab Method and system for remote operation of an installation
US8635447B1 (en) * 2010-12-23 2014-01-21 Emc Corporation Managing certificates between software environments
US20120166796A1 (en) * 2010-12-28 2012-06-28 Motorola Solutions, Inc. System and method of provisioning or managing device certificates in a communication network
US9083534B2 (en) 2011-01-07 2015-07-14 Mastercard International Incorporated Method and system for propagating a client identity
US8671385B2 (en) 2011-01-07 2014-03-11 Mastercard International Incorporated Methods and systems for throttling calls to a service application through an open API
US8707276B2 (en) 2011-01-07 2014-04-22 Mastercard International Incorporated Method and system for managing programmed applications in an open API environment
US8677308B2 (en) 2011-01-07 2014-03-18 Mastercard International Incorporated Method and system for generating an API request message
US9032204B2 (en) * 2011-01-07 2015-05-12 Mastercard International Incorporated Methods and systems for providing a signed digital certificate in real time
US9100190B1 (en) * 2011-02-07 2015-08-04 Symantec Corporation Previewing a digital certificate in a graphical user interface
US9401911B2 (en) 2011-02-10 2016-07-26 Microsoft Technology Licensing, Llc One-time password certificate renewal
US8701169B2 (en) * 2011-02-11 2014-04-15 Certicom Corp. Using a single certificate request to generate credentials with multiple ECQV certificates
EP3787218A1 (en) * 2011-02-11 2021-03-03 BlackBerry Limited Using a single certificate request to generate credentials with multiple ecqv certificates
US8984603B2 (en) * 2011-03-09 2015-03-17 Intel Mobile Communications GmbH Communication device, method for providing a data service, communication terminal, and method for requesting a data service
SI2697768T1 (en) 2011-04-12 2020-11-30 Applied Science, Inc. Method for managing blood donations
US9058716B2 (en) 2011-06-06 2015-06-16 Bally Gaming, Inc. Remote game play in a wireless gaming environment
US8850208B1 (en) * 2011-06-24 2014-09-30 Emc Corporation Certificate crosschecking by multiple certificate authorities
US20130036058A1 (en) * 2011-08-03 2013-02-07 American Express Travel Related Services Company, Inc. Systems and methods for securely processing transactions
US8898459B2 (en) * 2011-08-31 2014-11-25 At&T Intellectual Property I, L.P. Policy configuration for mobile device applications
US8918841B2 (en) 2011-08-31 2014-12-23 At&T Intellectual Property I, L.P. Hardware interface access control for mobile applications
US8782492B2 (en) * 2011-10-04 2014-07-15 Cleversafe, Inc. Updating data stored in a dispersed storage network
US8793485B2 (en) * 2011-12-15 2014-07-29 Texas Instruments Incorporated Combined digital certificate
US9641343B1 (en) 2011-12-20 2017-05-02 Google Inc. Efficient unified certificate revocation lists
JP6048089B2 (en) * 2011-12-26 2016-12-21 株式会社リコー Information processing apparatus and program
CN103188219A (en) * 2011-12-28 2013-07-03 北大方正集团有限公司 Method, equipment and system for digital right management
US8974305B2 (en) 2012-01-18 2015-03-10 Bally Gaming, Inc. Network gaming architecture, gaming systems, and related methods
US9120007B2 (en) 2012-01-18 2015-09-01 Bally Gaming, Inc. Network gaming architecture, gaming systems, and related methods
US9281948B2 (en) 2012-02-09 2016-03-08 Microsoft Technology Licensing, Llc Revocation information for revocable items
US10484355B1 (en) 2017-03-08 2019-11-19 Amazon Technologies, Inc. Detecting digital certificate expiration through request processing
US8856514B2 (en) * 2012-03-12 2014-10-07 International Business Machines Corporation Renewal processing of digital certificates in an asynchronous messaging environment
US8964973B2 (en) 2012-04-30 2015-02-24 General Electric Company Systems and methods for controlling file execution for industrial control systems
US8973124B2 (en) 2012-04-30 2015-03-03 General Electric Company Systems and methods for secure operation of an industrial controller
US9046886B2 (en) 2012-04-30 2015-06-02 General Electric Company System and method for logging security events for an industrial control system
US20130318353A1 (en) * 2012-05-24 2013-11-28 Digicert, Inc. Method for Creating and Installing a Digital Certificate
US9300643B1 (en) * 2012-06-27 2016-03-29 Amazon Technologies, Inc. Unique credentials verification
US9021255B1 (en) * 2012-06-29 2015-04-28 Emc Corporation Techniques for multiple independent verifications for digital certificates
WO2014018975A2 (en) * 2012-07-27 2014-01-30 Ingersoll-Rand Company System for account setup and/or device installation
US9122865B2 (en) * 2012-09-11 2015-09-01 Authenticade Llc System and method to establish and use credentials for a common lightweight identity through digital certificates
US20140089202A1 (en) * 2012-09-27 2014-03-27 Michael K. Bond CRM Security Core
US9172544B2 (en) * 2012-10-05 2015-10-27 General Electric Company Systems and methods for authentication between networked devices
US9087187B1 (en) 2012-10-08 2015-07-21 Amazon Technologies, Inc. Unique credentials verification
US8719908B1 (en) * 2012-12-21 2014-05-06 Disney Enterprises, Inc. Digital certificate management
CN103905390B (en) * 2012-12-26 2017-05-24 联想(北京)有限公司 Permission acquisition method, device, electronic equipment and system
US9819601B2 (en) 2012-12-27 2017-11-14 Vonage America Inc. Systems and methods of modifying data packets used in IP telephony communications
WO2014110828A1 (en) 2013-01-21 2014-07-24 华为技术有限公司 Method, device, and system for improving network security
FR3002398B1 (en) * 2013-02-18 2015-04-03 Oberthur Technologies METHOD OF CREATING A PROFILE IN A SECURITY DOMAIN OF A SECURE ELEMENT
US20140281497A1 (en) * 2013-03-13 2014-09-18 General Instrument Corporation Online personalization update system for externally acquired keys
US8966659B2 (en) * 2013-03-14 2015-02-24 Microsoft Technology Licensing, Llc Automatic fraudulent digital certificate detection
US9237021B2 (en) * 2013-03-15 2016-01-12 Hewlett Packard Enterprise Development Lp Certificate grant list at network device
CN103152366B (en) * 2013-04-10 2015-12-23 魅族科技(中国)有限公司 Obtain the method for terminal authorization, terminal and server
US9225714B2 (en) * 2013-06-04 2015-12-29 Gxm Consulting Llc Spatial and temporal verification of users and/or user devices
US9178888B2 (en) 2013-06-14 2015-11-03 Go Daddy Operating Company, LLC Method for domain control validation
US9521138B2 (en) 2013-06-14 2016-12-13 Go Daddy Operating Company, LLC System for domain control validation
US9055055B1 (en) * 2013-06-21 2015-06-09 Amazon Technologies, Inc. Provisioning account credentials via a trusted channel
US10587607B2 (en) * 2013-09-19 2020-03-10 Sony Corporation Information processing apparatus and information processing method for public key scheme based user authentication
US9961073B2 (en) 2013-09-30 2018-05-01 Digicert, Inc. Dynamic certificate generation on a certificate authority cloud
US11032265B2 (en) * 2013-11-22 2021-06-08 Digicert, Inc. System and method for automated customer verification
USD756372S1 (en) * 2013-12-02 2016-05-17 Symantec Corporation Display screen with graphical user interface
USD751571S1 (en) * 2013-12-19 2016-03-15 Asustek Computer Inc. Electronic device with graphical user interface
WO2015094326A1 (en) * 2013-12-20 2015-06-25 Intel Corporation Secure import and export of keying material
US9769151B2 (en) * 2013-12-23 2017-09-19 Symantec Corporation Multi-algorithm key generation and certificate install
CN105981326B (en) * 2014-02-26 2019-05-14 三菱电机株式会社 Certificate management device and certificate management method
US9830458B2 (en) * 2014-04-25 2017-11-28 Symantec Corporation Discovery and classification of enterprise assets via host characteristics
US9467442B2 (en) * 2014-05-23 2016-10-11 Symantec Corporation Automated step-up digital certificate installation process
AU2015266570B2 (en) 2014-05-30 2020-02-27 Applied Science, Inc. Systems and methods for managing blood donations
US20150358282A1 (en) * 2014-06-04 2015-12-10 Bank Of America Corporation Firewall Policy Browser
US9584492B2 (en) * 2014-06-23 2017-02-28 Vmware, Inc. Cryptographic proxy service
US9756078B2 (en) * 2014-07-24 2017-09-05 General Electric Company Proactive internet connectivity probe generator
US9300656B2 (en) * 2014-08-21 2016-03-29 International Business Machines Corporation Secure connection certificate verification
US10552827B2 (en) * 2014-09-02 2020-02-04 Google Llc Dynamic digital certificate updating
US9626271B2 (en) * 2014-09-26 2017-04-18 Oracle International Corporation Multivariate metadata based cloud deployment monitoring for lifecycle operations
US9614833B1 (en) * 2014-10-31 2017-04-04 Symantec Corporation Automated certificate management for a website associated with multiple certificates
GB2532926A (en) 2014-11-27 2016-06-08 Ibm Managing time-dependent electronic files
DE102014225418A1 (en) * 2014-12-10 2016-06-16 Siemens Aktiengesellschaft Method and device for monitoring a certification authority
GB2533338A (en) * 2014-12-17 2016-06-22 Vodafone Ip Licensing Ltd Utility gateway
US10439908B2 (en) * 2014-12-23 2019-10-08 Talari Networks Incorporated Methods and apparatus for providing adaptive private network centralized management system time correlated playback of network traffic
US10735208B2 (en) 2015-03-02 2020-08-04 Nokia Solutions And Networks Oy Future certificate revocation using CRL
EP3276874B1 (en) * 2015-03-25 2021-03-03 Mitsubishi Electric Corporation Server, certificate generation instruction method, and program
US9197673B1 (en) * 2015-05-18 2015-11-24 A2Zlogix, Inc. System and method for reception and transmission optimization of secured video, image, audio, and other media traffic via proxy
US10484172B2 (en) 2015-06-05 2019-11-19 Apple Inc. Secure circuit for encryption key generation
US10142113B2 (en) * 2015-06-18 2018-11-27 Bank Of America Corporation Identifying and maintaining secure communications
US10181036B2 (en) 2015-06-24 2019-01-15 Lenovo Enterprise Solutions (Singapore) Pte. Ltd. Automatic discovery and installation of secure boot certificates
US10791110B2 (en) * 2015-07-09 2020-09-29 Cloudflare, Inc. Certificate authority framework
CN105007277A (en) * 2015-07-30 2015-10-28 浪潮电子信息产业股份有限公司 Method for generating user certificate and web application
US9871662B2 (en) * 2015-09-25 2018-01-16 Netflix, Inc. Systems and methods for digital certificate and encryption key management
US10057190B2 (en) 2015-10-16 2018-08-21 International Business Machines Corporation Service access management
SE1551459A1 (en) * 2015-11-11 2017-05-12 Authentico Tech Ab Method and system for user authentication
US10666637B2 (en) * 2015-12-14 2020-05-26 Amazon Technologies, Inc. Certificate renewal and deployment
JP6854529B2 (en) * 2015-12-24 2021-04-07 ヘヴンテック プロプライエタリー リミテッドHaventec Pty Ltd Improved storage system
DE102016200382A1 (en) 2016-01-14 2017-07-20 Siemens Aktiengesellschaft A method of verifying a security rating of a first device using a digital certificate, first and second devices, and a certificate issuing device
US10020990B2 (en) * 2016-01-15 2018-07-10 Bank Of America Corporation Network stability reconnaisance tool
US10791109B2 (en) * 2016-02-10 2020-09-29 Red Hat, Inc. Certificate based expiration of file system objects
US10263789B1 (en) * 2016-03-28 2019-04-16 Amazon Technologies, Inc. Auto-generation of security certificate
US11244367B2 (en) 2016-04-01 2022-02-08 OneTrust, LLC Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design
US11004125B2 (en) 2016-04-01 2021-05-11 OneTrust, LLC Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design
US20220164840A1 (en) 2016-04-01 2022-05-26 OneTrust, LLC Data processing systems and methods for integrating privacy information management systems with data loss prevention tools or other tools for privacy design
US10706447B2 (en) 2016-04-01 2020-07-07 OneTrust, LLC Data processing systems and communication systems and methods for the efficient generation of privacy risk assessments
JP6227046B2 (en) * 2016-04-20 2017-11-08 三菱電機株式会社 Expiration notice device, certificate update system, expiry notice method, and expiry notice program
US10187375B1 (en) * 2016-04-22 2019-01-22 Walgreen Co. Cryptographic services engine
US10282700B2 (en) 2016-06-10 2019-05-07 OneTrust, LLC Data processing systems for generating and populating a data inventory
US10592648B2 (en) 2016-06-10 2020-03-17 OneTrust, LLC Consent receipt management systems and related methods
US11341447B2 (en) 2016-06-10 2022-05-24 OneTrust, LLC Privacy management systems and methods
US11157600B2 (en) 2016-06-10 2021-10-26 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US10740487B2 (en) 2016-06-10 2020-08-11 OneTrust, LLC Data processing systems and methods for populating and maintaining a centralized database of personal data
US10873606B2 (en) 2016-06-10 2020-12-22 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US11403377B2 (en) 2016-06-10 2022-08-02 OneTrust, LLC Privacy management systems and methods
US10944725B2 (en) 2016-06-10 2021-03-09 OneTrust, LLC Data processing systems and methods for using a data model to select a target data asset in a data migration
US11651106B2 (en) 2016-06-10 2023-05-16 OneTrust, LLC Data processing systems for fulfilling data subject access requests and related methods
US11651104B2 (en) 2016-06-10 2023-05-16 OneTrust, LLC Consent receipt management systems and related methods
US11146566B2 (en) 2016-06-10 2021-10-12 OneTrust, LLC Data processing systems for fulfilling data subject access requests and related methods
US11438386B2 (en) 2016-06-10 2022-09-06 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US11200341B2 (en) 2016-06-10 2021-12-14 OneTrust, LLC Consent receipt management systems and related methods
US10909265B2 (en) 2016-06-10 2021-02-02 OneTrust, LLC Application privacy scanning systems and related methods
US10796260B2 (en) 2016-06-10 2020-10-06 OneTrust, LLC Privacy management systems and methods
US11354434B2 (en) 2016-06-10 2022-06-07 OneTrust, LLC Data processing systems for verification of consent and notice processing and related methods
US11562097B2 (en) 2016-06-10 2023-01-24 OneTrust, LLC Data processing systems for central consent repository and related methods
US10997318B2 (en) 2016-06-10 2021-05-04 OneTrust, LLC Data processing systems for generating and populating a data inventory for processing data access requests
US10949565B2 (en) 2016-06-10 2021-03-16 OneTrust, LLC Data processing systems for generating and populating a data inventory
US11238390B2 (en) 2016-06-10 2022-02-01 OneTrust, LLC Privacy management systems and methods
US11354435B2 (en) 2016-06-10 2022-06-07 OneTrust, LLC Data processing systems for data testing to confirm data deletion and related methods
US10997315B2 (en) 2016-06-10 2021-05-04 OneTrust, LLC Data processing systems for fulfilling data subject access requests and related methods
US11144622B2 (en) 2016-06-10 2021-10-12 OneTrust, LLC Privacy management systems and methods
US10565236B1 (en) 2016-06-10 2020-02-18 OneTrust, LLC Data processing systems for generating and populating a data inventory
US10839102B2 (en) 2016-06-10 2020-11-17 OneTrust, LLC Data processing systems for identifying and modifying processes that are subject to data subject access requests
US11416798B2 (en) 2016-06-10 2022-08-16 OneTrust, LLC Data processing systems and methods for providing training in a vendor procurement process
US11301796B2 (en) 2016-06-10 2022-04-12 OneTrust, LLC Data processing systems and methods for customizing privacy training
US11625502B2 (en) 2016-06-10 2023-04-11 OneTrust, LLC Data processing systems for identifying and modifying processes that are subject to data subject access requests
US10585968B2 (en) 2016-06-10 2020-03-10 OneTrust, LLC Data processing systems for fulfilling data subject access requests and related methods
US11138299B2 (en) 2016-06-10 2021-10-05 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11074367B2 (en) 2016-06-10 2021-07-27 OneTrust, LLC Data processing systems for identity validation for consumer rights requests and related methods
US10678945B2 (en) 2016-06-10 2020-06-09 OneTrust, LLC Consent receipt management systems and related methods
US11294939B2 (en) 2016-06-10 2022-04-05 OneTrust, LLC Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software
US10846433B2 (en) 2016-06-10 2020-11-24 OneTrust, LLC Data processing consent management systems and related methods
US11392720B2 (en) 2016-06-10 2022-07-19 OneTrust, LLC Data processing systems for verification of consent and notice processing and related methods
US11222139B2 (en) 2016-06-10 2022-01-11 OneTrust, LLC Data processing systems and methods for automatic discovery and assessment of mobile software development kits
US10565161B2 (en) 2016-06-10 2020-02-18 OneTrust, LLC Data processing systems for processing data subject access requests
US11210420B2 (en) 2016-06-10 2021-12-28 OneTrust, LLC Data subject access request processing systems and related methods
US10318761B2 (en) 2016-06-10 2019-06-11 OneTrust, LLC Data processing systems and methods for auditing data request compliance
US11416109B2 (en) 2016-06-10 2022-08-16 OneTrust, LLC Automated data processing systems and methods for automatically processing data subject access requests using a chatbot
US11416590B2 (en) 2016-06-10 2022-08-16 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11100444B2 (en) 2016-06-10 2021-08-24 OneTrust, LLC Data processing systems and methods for providing training in a vendor procurement process
US11222309B2 (en) 2016-06-10 2022-01-11 OneTrust, LLC Data processing systems for generating and populating a data inventory
US11295316B2 (en) 2016-06-10 2022-04-05 OneTrust, LLC Data processing systems for identity validation for consumer rights requests and related methods
US10949170B2 (en) 2016-06-10 2021-03-16 OneTrust, LLC Data processing systems for integration of consumer feedback with data subject access requests and related methods
US11544667B2 (en) 2016-06-10 2023-01-03 OneTrust, LLC Data processing systems for generating and populating a data inventory
US11481710B2 (en) 2016-06-10 2022-10-25 OneTrust, LLC Privacy management systems and methods
US11586700B2 (en) 2016-06-10 2023-02-21 OneTrust, LLC Data processing systems and methods for automatically blocking the use of tracking tools
US11188862B2 (en) 2016-06-10 2021-11-30 OneTrust, LLC Privacy management systems and methods
US11416589B2 (en) 2016-06-10 2022-08-16 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11134086B2 (en) 2016-06-10 2021-09-28 OneTrust, LLC Consent conversion optimization systems and related methods
US10284604B2 (en) 2016-06-10 2019-05-07 OneTrust, LLC Data processing and scanning systems for generating and populating a data inventory
JP6674099B2 (en) * 2016-06-10 2020-04-01 富士通株式会社 Information management program, information management method, and information management device
US11227247B2 (en) 2016-06-10 2022-01-18 OneTrust, LLC Data processing systems and methods for bundled privacy policies
US10169609B1 (en) 2016-06-10 2019-01-01 OneTrust, LLC Data processing systems for fulfilling data subject access requests and related methods
US10467432B2 (en) 2016-06-10 2019-11-05 OneTrust, LLC Data processing systems for use in automatically generating, populating, and submitting data subject access requests
US10242228B2 (en) 2016-06-10 2019-03-26 OneTrust, LLC Data processing systems for measuring privacy maturity within an organization
US11343284B2 (en) 2016-06-10 2022-05-24 OneTrust, LLC Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance
US11475136B2 (en) 2016-06-10 2022-10-18 OneTrust, LLC Data processing systems for data transfer risk identification and related methods
US11038925B2 (en) 2016-06-10 2021-06-15 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US10592692B2 (en) 2016-06-10 2020-03-17 OneTrust, LLC Data processing systems for central consent repository and related methods
US11025675B2 (en) 2016-06-10 2021-06-01 OneTrust, LLC Data processing systems and methods for performing privacy assessments and monitoring of new versions of computer code for privacy compliance
US10607028B2 (en) 2016-06-10 2020-03-31 OneTrust, LLC Data processing systems for data testing to confirm data deletion and related methods
US10685140B2 (en) 2016-06-10 2020-06-16 OneTrust, LLC Consent receipt management systems and related methods
US11520928B2 (en) 2016-06-10 2022-12-06 OneTrust, LLC Data processing systems for generating personal data receipts and related methods
US11228620B2 (en) 2016-06-10 2022-01-18 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US11418492B2 (en) 2016-06-10 2022-08-16 OneTrust, LLC Data processing systems and methods for using a data model to select a target data asset in a data migration
US10896394B2 (en) 2016-06-10 2021-01-19 OneTrust, LLC Privacy management systems and methods
US10503926B2 (en) 2016-06-10 2019-12-10 OneTrust, LLC Consent receipt management systems and related methods
US10803200B2 (en) 2016-06-10 2020-10-13 OneTrust, LLC Data processing systems for processing and managing data subject access in a distributed environment
US11366786B2 (en) 2016-06-10 2022-06-21 OneTrust, LLC Data processing systems for processing data subject access requests
US11057356B2 (en) 2016-06-10 2021-07-06 OneTrust, LLC Automated data processing systems and methods for automatically processing data subject access requests using a chatbot
US10282559B2 (en) 2016-06-10 2019-05-07 OneTrust, LLC Data processing systems for identifying, assessing, and remediating data processing risks using data modeling techniques
US10606916B2 (en) 2016-06-10 2020-03-31 OneTrust, LLC Data processing user interface monitoring systems and related methods
US11366909B2 (en) 2016-06-10 2022-06-21 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11222142B2 (en) 2016-06-10 2022-01-11 OneTrust, LLC Data processing systems for validating authorization for personal data collection, storage, and processing
US10853501B2 (en) 2016-06-10 2020-12-01 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11087260B2 (en) 2016-06-10 2021-08-10 OneTrust, LLC Data processing systems and methods for customizing privacy training
US11727141B2 (en) 2016-06-10 2023-08-15 OneTrust, LLC Data processing systems and methods for synching privacy-related user consent across multiple computing devices
US11188615B2 (en) 2016-06-10 2021-11-30 OneTrust, LLC Data processing consent capture systems and related methods
US10848523B2 (en) 2016-06-10 2020-11-24 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US11151233B2 (en) 2016-06-10 2021-10-19 OneTrust, LLC Data processing and scanning systems for assessing vendor risk
US11328092B2 (en) 2016-06-10 2022-05-10 OneTrust, LLC Data processing systems for processing and managing data subject access in a distributed environment
US11023842B2 (en) 2016-06-10 2021-06-01 OneTrust, LLC Data processing systems and methods for bundled privacy policies
US11636171B2 (en) 2016-06-10 2023-04-25 OneTrust, LLC Data processing user interface monitoring systems and related methods
US10878127B2 (en) 2016-06-10 2020-12-29 OneTrust, LLC Data subject access request processing systems and related methods
US10783256B2 (en) 2016-06-10 2020-09-22 OneTrust, LLC Data processing systems for data transfer risk identification and related methods
US10909488B2 (en) 2016-06-10 2021-02-02 OneTrust, LLC Data processing systems for assessing readiness for responding to privacy-related incidents
US11277448B2 (en) 2016-06-10 2022-03-15 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US11461500B2 (en) 2016-06-10 2022-10-04 OneTrust, LLC Data processing systems for cookie compliance testing with website scanning and related methods
US11336697B2 (en) 2016-06-10 2022-05-17 OneTrust, LLC Data processing systems for data-transfer risk identification, cross-border visualization generation, and related methods
US10510031B2 (en) 2016-06-10 2019-12-17 OneTrust, LLC Data processing systems for identifying, assessing, and remediating data processing risks using data modeling techniques
US11138242B2 (en) 2016-06-10 2021-10-05 OneTrust, LLC Data processing systems and methods for automatically detecting and documenting privacy-related aspects of computer software
US11675929B2 (en) 2016-06-10 2023-06-13 OneTrust, LLC Data processing consent sharing systems and related methods
US10885485B2 (en) 2016-06-10 2021-01-05 OneTrust, LLC Privacy management systems and methods
US10084802B1 (en) * 2016-06-21 2018-09-25 Palantir Technologies Inc. Supervisory control and data acquisition
DE102016113110A1 (en) * 2016-07-15 2018-01-18 essendi it GmbH Method and system for installing certificates
JP6776689B2 (en) * 2016-07-22 2020-10-28 富士ゼロックス株式会社 Information processing equipment, security systems and programs
US20180034646A1 (en) * 2016-07-27 2018-02-01 Arris Enterprises Llc Method and apparatus for seamless remote renewal of offline generated digital identity certificates to field deployed hardware security modules
DE102016216115A1 (en) 2016-08-26 2018-03-01 Siemens Aktiengesellschaft Computer apparatus for transferring a certificate to a device in a system
US10320570B2 (en) 2016-08-30 2019-06-11 Microsoft Technology Licensing, Llc Digital security certificate selection and distribution
US10250587B2 (en) 2016-09-30 2019-04-02 Microsoft Technology Licensing, Llc Detecting malicious usage of certificates
CN109791591B (en) * 2016-10-06 2023-07-07 万事达卡国际公司 Method and system for identity and credential protection and verification via blockchain
US10153899B2 (en) 2016-11-18 2018-12-11 Airwatch, Llc System for retrieval of email certificates from remote certificate repository
US10873511B2 (en) * 2016-11-22 2020-12-22 Airwatch Llc Management service migration for managed devices
US10462263B2 (en) 2016-11-22 2019-10-29 Airwatch Llc Management service migration using web applications
US10924557B2 (en) * 2016-11-22 2021-02-16 Airwatch Llc Management service migration using managed devices
US10341327B2 (en) 2016-12-06 2019-07-02 Bank Of America Corporation Enabling secure connections by managing signer certificates
US10374810B2 (en) * 2017-01-05 2019-08-06 Bank Of America Corporation Middleware system validation tool
US10187377B2 (en) * 2017-02-08 2019-01-22 A10 Networks, Inc. Caching network generated security certificates
EP3593489B1 (en) * 2017-03-08 2023-06-14 Amazon Technologies, Inc. Digital certificate issuance and monitoring
US10516542B2 (en) 2017-03-08 2019-12-24 Amazon Technologies, Inc. Digital certificate issuance and monitoring
US10615987B2 (en) 2017-03-08 2020-04-07 Amazon Technologies, Inc. Digital certificate usage monitoring systems
US10511574B2 (en) * 2017-03-31 2019-12-17 Hyland Software, Inc. Methods and apparatuses for utilizing a gateway integration server to enhance application security
CN106982220B (en) * 2017-04-21 2020-07-31 国信电子票据平台信息服务有限公司 Digital certificate calling method and system
US10805091B2 (en) * 2017-04-28 2020-10-13 Sap Se Certificate tracking
EP3402152B1 (en) * 2017-05-08 2019-10-16 Siemens Aktiengesellschaft System-specific automated certificate management
US11190504B1 (en) * 2017-05-17 2021-11-30 Amazon Technologies, Inc. Certificate-based service authorization
US10013577B1 (en) 2017-06-16 2018-07-03 OneTrust, LLC Data processing systems for identifying whether cookies contain personally identifying information
US10492065B2 (en) 2017-06-23 2019-11-26 Bank Of America Corporation Encryption system and method
US11297050B2 (en) * 2017-07-17 2022-04-05 Thirdwayv, Inc. Secure communication for medical devices
US20190044950A1 (en) * 2017-08-02 2019-02-07 Qualcomm Incorporated Detection of Compromised Access Points
US10956551B2 (en) * 2017-08-07 2021-03-23 Clarius Mobile Health Corp. Systems and methods for securing operation of an ultrasound scanner
US10911433B1 (en) * 2017-09-27 2021-02-02 Amazon Technologies, Inc. Network traffic distribution using certificate scanning in agent-based architecture
CN107733882B (en) * 2017-09-30 2021-03-19 亚数信息科技(上海)有限公司 SSL certificate automatic deployment method and equipment
US10614240B2 (en) 2017-11-17 2020-04-07 International Business Machines Corporation Accessing an encrypted file system
CN109962781B (en) * 2017-12-26 2022-05-10 浙江宇视科技有限公司 Digital certificate distributing device
US11256818B2 (en) 2017-12-28 2022-02-22 Corlina, Inc. System and method for enabling and verifying the trustworthiness of a hardware system
US11032252B2 (en) * 2018-01-03 2021-06-08 Syccure, Inc. Distributed authentication between network nodes
WO2019152521A1 (en) * 2018-01-30 2019-08-08 Corlina, Inc. User and device onboarding
EP3530602B1 (en) * 2018-02-23 2020-06-17 Otis Elevator Company Safety circuit for an elevator system, device and method of updating such a safety circuit
US10812276B2 (en) * 2018-02-23 2020-10-20 International Business Machines Corporation Secure trust based distribution of digital certificates
US11563590B1 (en) 2018-04-03 2023-01-24 Amazon Technologies, Inc. Certificate generation method
US11323274B1 (en) * 2018-04-03 2022-05-03 Amazon Technologies, Inc. Certificate authority
US11888997B1 (en) 2018-04-03 2024-01-30 Amazon Technologies, Inc. Certificate manager
EP3562089A1 (en) * 2018-04-23 2019-10-30 Siemens Aktiengesellschaft Automated certificate management
KR102086739B1 (en) * 2018-06-27 2020-03-09 주식회사 수산아이앤티 Electronic re-signing method to support various digital signature algorithms in secure sockets layer decryption device
JP7262938B2 (en) * 2018-06-29 2023-04-24 キヤノン株式会社 Information processing device, control method for information processing device, and program
US10867321B1 (en) * 2018-07-16 2020-12-15 James D MacDonald-Korth Automatic login link for targeted users without previous account creation
CN110825400A (en) * 2018-08-14 2020-02-21 杭州萤石软件有限公司 Certificate updating method and system for application program client
US10803202B2 (en) 2018-09-07 2020-10-13 OneTrust, LLC Data processing systems for orphaned data identification and deletion and related methods
US11144675B2 (en) 2018-09-07 2021-10-12 OneTrust, LLC Data processing systems and methods for automatically protecting sensitive data within privacy management systems
US11544409B2 (en) 2018-09-07 2023-01-03 OneTrust, LLC Data processing systems and methods for automatically protecting sensitive data within privacy management systems
CN109257181B (en) * 2018-10-17 2019-10-29 西安邮电大学 Without the blind label decryption method of elliptic curve under certificate environment
US10439825B1 (en) * 2018-11-13 2019-10-08 INTEGRITY Security Services, Inc. Providing quality of service for certificate management systems
US20210044579A1 (en) * 2018-12-04 2021-02-11 Viakoo, Inc. Systems and Methods of Remotely Updating a Multitude of IP Connected Devices
GB201820853D0 (en) 2018-12-20 2019-02-06 Palantir Technologies Inc Detection of vulnerabilities in a computer network
US10931661B2 (en) 2019-03-05 2021-02-23 Centripetal Networks Methods and systems for certificate filtering
US11190364B2 (en) * 2019-03-12 2021-11-30 Vmware, Inc. Seamless certificate replacement for endpoints in hyperconverged infrastructure
CN114785523A (en) * 2019-04-28 2022-07-22 华为技术有限公司 Identity verification method and related device for network function service
CN110166252B (en) * 2019-05-20 2022-02-25 南京易联阳光信息技术股份有限公司 Digital certificate unified authentication gateway supporting multiple authentication modes
US20200412552A1 (en) * 2019-06-28 2020-12-31 Zebra Technologies Corporation Methods and Apparatus to Renew Digital Certificates
US11095460B2 (en) * 2019-07-05 2021-08-17 Advanced New Technologies Co., Ltd. Certificate application operations
US11283630B2 (en) 2019-11-05 2022-03-22 International Business Machines Corporation Server/server certificates exchange flow
US11362843B1 (en) * 2019-11-19 2022-06-14 Amazon Technologies, Inc. Certificate rotation on host
US11843706B1 (en) * 2019-11-19 2023-12-12 Amazon Technologies, Inc. Gradual certificate rotation
US11601289B2 (en) * 2020-01-07 2023-03-07 Microsoft Technology Licensing, Llc Securely rotating a server certificate
US11882110B2 (en) 2020-04-29 2024-01-23 Hewlett Packard Enterprise Development Lp Renewal of security certificates of supplicants
US11438179B2 (en) * 2020-05-18 2022-09-06 Kyndryl, Inc. Certificate renewal process outside application server environment
CN111786781B (en) * 2020-06-29 2021-03-26 友谊时光科技股份有限公司 SSL certificate monitoring method, system, device, equipment and storage medium
WO2022011142A1 (en) 2020-07-08 2022-01-13 OneTrust, LLC Systems and methods for targeted data discovery
EP4189569A1 (en) 2020-07-28 2023-06-07 OneTrust LLC Systems and methods for automatically blocking the use of tracking tools
US11475165B2 (en) 2020-08-06 2022-10-18 OneTrust, LLC Data processing systems and methods for automatically redacting unstructured data from a data subject access request
US11431675B2 (en) * 2020-08-17 2022-08-30 Arris Enterprises Llc Client device based solution for handling MAC randomization
US11436373B2 (en) 2020-09-15 2022-09-06 OneTrust, LLC Data processing systems and methods for detecting tools for the automatic blocking of consent requests
US11526624B2 (en) 2020-09-21 2022-12-13 OneTrust, LLC Data processing systems and methods for automatically detecting target data transfers and target data processing
US11778466B2 (en) * 2020-09-21 2023-10-03 Bank Of America Corporation System for secure resource allocation communication with a network
EP4241173A1 (en) 2020-11-06 2023-09-13 OneTrust LLC Systems and methods for identifying data processing activities based on data discovery results
US20220150241A1 (en) * 2020-11-11 2022-05-12 Hewlett Packard Enterprise Development Lp Permissions for backup-related operations
WO2022146571A1 (en) * 2020-12-28 2022-07-07 Keyfactor, Inc. Remote certificate authority management
CN112685795B (en) * 2020-12-31 2023-09-05 树根互联股份有限公司 Digital certificate creation method, digital certificate verification method and digital certificate system
US11687528B2 (en) 2021-01-25 2023-06-27 OneTrust, LLC Systems and methods for discovery, classification, and indexing of data in a native computing system
US11442906B2 (en) 2021-02-04 2022-09-13 OneTrust, LLC Managing custom attributes for domain objects defined within microservices
WO2022170254A1 (en) 2021-02-08 2022-08-11 OneTrust, LLC Data processing systems and methods for anonymizing data samples in classification analysis
US11601464B2 (en) 2021-02-10 2023-03-07 OneTrust, LLC Systems and methods for mitigating risks of third-party computing system functionality integration into a first-party computing system
US11775348B2 (en) 2021-02-17 2023-10-03 OneTrust, LLC Managing custom workflows for domain objects defined within microservices
US11546661B2 (en) 2021-02-18 2023-01-03 OneTrust, LLC Selective redaction of media content
WO2022192269A1 (en) 2021-03-08 2022-09-15 OneTrust, LLC Data transfer discovery and analysis systems and related methods
US11562078B2 (en) 2021-04-16 2023-01-24 OneTrust, LLC Assessing and managing computational risk involved with integrating third party computing functionality within a computing system
US11675917B2 (en) 2021-04-22 2023-06-13 Bank Of America Corporation Electronic system for dynamically permitting and restricting access to and modification of computer resources
US11804963B2 (en) 2021-04-29 2023-10-31 International Business Machines Corporation System and method for permissioned blockchain access into a computing network
US11502855B1 (en) 2021-08-26 2022-11-15 International Business Machines Corporation Certificate mirroring
US20230299978A1 (en) * 2022-03-18 2023-09-21 Target Brands, Inc. Digital certificate request system
US11620142B1 (en) 2022-06-03 2023-04-04 OneTrust, LLC Generating and customizing user interfaces for demonstrating functions of interactive user environments

Citations (34)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5903882A (en) * 1996-12-13 1999-05-11 Certco, Llc Reliance server for electronic transaction system
US6044462A (en) * 1997-04-02 2000-03-28 Arcanvs Method and apparatus for managing key revocation
US6134658A (en) * 1997-06-09 2000-10-17 Microsoft Corporation Multi-server location-independent authentication certificate management system
US6185678B1 (en) * 1997-10-02 2001-02-06 Trustees Of The University Of Pennsylvania Secure and reliable bootstrap architecture
US6269456B1 (en) * 1997-12-31 2001-07-31 Network Associates, Inc. Method and system for providing automated updating and upgrading of antivirus applications using a computer network
US6304974B1 (en) * 1998-11-06 2001-10-16 Oracle Corporation Method and apparatus for managing trusted certificates
US20020023037A1 (en) * 1997-08-22 2002-02-21 White Newton B. Exchange method and apparatus
US6367013B1 (en) * 1995-01-17 2002-04-02 Eoriginal Inc. System and method for electronic transmission, storage, and retrieval of authenticated electronic original documents
US20020071563A1 (en) * 2000-12-12 2002-06-13 Kurn David Michael Method and apparatus for cryptographic key rollover during operation
US20020087479A1 (en) * 2000-11-08 2002-07-04 Peter Malcolm Information management system
US6438690B1 (en) * 1998-06-04 2002-08-20 International Business Machines Corp. Vault controller based registration application serving web based registration authorities and end users for conducting electronic commerce in secure end-to-end distributed information system
US20020147746A1 (en) * 2000-12-22 2002-10-10 Lee Michele C. Delivering output XML with dynamically selectable processing
US20020152382A1 (en) * 1999-06-11 2002-10-17 Sihai Xiao Trust information delivery scheme for certificate validation
US20020184493A1 (en) * 2001-06-04 2002-12-05 Rees Robert Thomas Owen Digital certificate expiry notification
US20030037234A1 (en) * 2001-08-17 2003-02-20 Christina Fu Method and apparatus for centralizing a certificate revocation list in a certificate authority cluster
US20030035547A1 (en) * 2001-03-27 2003-02-20 John Newton Server with multiple encryption libraries
US20030110374A1 (en) * 2001-04-19 2003-06-12 Masaaki Yamamoto Terminal communication system
US20030126431A1 (en) * 2001-10-12 2003-07-03 Beattie Douglas D. Methods and systems for automated authentication, processing and issuance of digital certificates
US20030126433A1 (en) * 2001-12-27 2003-07-03 Waikwan Hui Method and system for performing on-line status checking of digital certificates
US20030131244A1 (en) * 2002-01-10 2003-07-10 Dream Team S.R.L. Method and system for identifying users and authenticating digital documents on data communications networks
US20030131233A1 (en) * 2002-01-04 2003-07-10 Avaya Technology Corp. Efficient packet encryption method
US6615347B1 (en) * 1998-06-30 2003-09-02 Verisign, Inc. Digital certificate cross-referencing
US6640301B1 (en) * 1999-07-08 2003-10-28 David Way Ng Third-party e-mail authentication service provider using checksum and unknown pad characters with removal of quotation indents
US6662217B1 (en) * 1999-01-19 2003-12-09 Microsoft Corporation Distributed and automated test administration system for administering automated tests on server computers over the internet
US20040030887A1 (en) * 2002-08-07 2004-02-12 Harrisville-Wolff Carol L. System and method for providing secure communications between clients and service providers
US20040080528A1 (en) * 2000-06-21 2004-04-29 Watchit.Com,Inc. Systems and methods for presenting interactive programs over the internet
US20040243805A1 (en) * 2003-03-19 2004-12-02 Tomoaki Enokida Digital certificate management system, digital certificate management apparatus, digital certificate management method, program and computer readable information recording medium
US20040268152A1 (en) * 2003-06-27 2004-12-30 Wrq, Inc. Computer-based dynamic secure non-cached delivery of security credentials such as digitally signed certificates or keys
US20050005097A1 (en) * 2003-06-12 2005-01-06 Minolta Co., Ltd. Communication system and method in public key infrastructure
US6853988B1 (en) * 1999-09-20 2005-02-08 Security First Corporation Cryptographic server with provisions for interoperability between cryptographic systems
US20050033957A1 (en) * 2003-06-25 2005-02-10 Tomoaki Enokida Digital certificate management system, digital certificate management apparatus, digital certificate management method, update procedure determination method and program
US7209479B2 (en) * 2001-01-18 2007-04-24 Science Application International Corp. Third party VPN certification
US7209563B1 (en) * 1998-12-15 2007-04-24 Bull, S.A. Process for creating and managing at least one cryptographic key, and system for its implementation
US7275155B1 (en) * 2000-09-01 2007-09-25 Northrop Grumman Corporation Chain of trust processing

Family Cites Families (19)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11255A (en) * 1854-07-11 Method of
US131244A (en) * 1872-09-10 Improvement in tubs for washing-machines
US87479A (en) * 1869-03-02 Improvement in the manufacture of iron and steel
US23037A (en) * 1859-02-22 Water-gage for steam-boilers
US5097A (en) * 1847-05-01 N peters photo lithogr peer wasringto d o
US30887A (en) * 1860-12-11 Improvement in machines for sowing fertilizers
US80528A (en) * 1868-07-28 Philadelphia
US131233A (en) * 1872-09-10 Smprovement in turbine water-wheels
US35547A (en) * 1862-06-10 C ri m pin g d e vic e
US6282712B1 (en) * 1995-03-10 2001-08-28 Microsoft Corporation Automatic software installation on heterogeneous networked computer systems
US5996076A (en) * 1997-02-19 1999-11-30 Verifone, Inc. System, method and article of manufacture for secure digital certification of electronic commerce
US6304013B1 (en) * 1999-06-30 2001-10-16 General Electric Company Line termination network assembly for an electric motor
US7213249B2 (en) * 2000-12-22 2007-05-01 Oracle International Corporation Blocking cache flush requests until completing current pending requests in a local server and remote server
US7085834B2 (en) * 2000-12-22 2006-08-01 Oracle International Corporation Determining a user's groups
US7171554B2 (en) * 2001-08-13 2007-01-30 Hewlett-Packard Company Method, computer program product and system for providing a switch user functionality in an information technological network
US20030123431A1 (en) * 2001-12-28 2003-07-03 Bertram Geck Methods and apparatus for providing internet messaging on the screen of a digital telephone
EP1488597B1 (en) * 2002-03-20 2013-01-23 Research In Motion Limited System and method for checking digital certificate status
US7448080B2 (en) * 2003-06-30 2008-11-04 Nokia, Inc. Method for implementing secure corporate communication
US7546454B2 (en) * 2004-06-30 2009-06-09 At&T Intellectual Property I, L.P. Automated digital certificate discovery and management

Patent Citations (38)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6367013B1 (en) * 1995-01-17 2002-04-02 Eoriginal Inc. System and method for electronic transmission, storage, and retrieval of authenticated electronic original documents
US5903882A (en) * 1996-12-13 1999-05-11 Certco, Llc Reliance server for electronic transaction system
US20010011255A1 (en) * 1996-12-13 2001-08-02 Alan Asay Reliance management for electronic transaction system
US20020062438A1 (en) * 1996-12-13 2002-05-23 Alan Asay Reliance server for electronic transaction system
US6044462A (en) * 1997-04-02 2000-03-28 Arcanvs Method and apparatus for managing key revocation
US6134658A (en) * 1997-06-09 2000-10-17 Microsoft Corporation Multi-server location-independent authentication certificate management system
US20020023037A1 (en) * 1997-08-22 2002-02-21 White Newton B. Exchange method and apparatus
US6185678B1 (en) * 1997-10-02 2001-02-06 Trustees Of The University Of Pennsylvania Secure and reliable bootstrap architecture
US6269456B1 (en) * 1997-12-31 2001-07-31 Network Associates, Inc. Method and system for providing automated updating and upgrading of antivirus applications using a computer network
US6438690B1 (en) * 1998-06-04 2002-08-20 International Business Machines Corp. Vault controller based registration application serving web based registration authorities and end users for conducting electronic commerce in secure end-to-end distributed information system
US6615347B1 (en) * 1998-06-30 2003-09-02 Verisign, Inc. Digital certificate cross-referencing
US6304974B1 (en) * 1998-11-06 2001-10-16 Oracle Corporation Method and apparatus for managing trusted certificates
US7209563B1 (en) * 1998-12-15 2007-04-24 Bull, S.A. Process for creating and managing at least one cryptographic key, and system for its implementation
US6662217B1 (en) * 1999-01-19 2003-12-09 Microsoft Corporation Distributed and automated test administration system for administering automated tests on server computers over the internet
US20020152382A1 (en) * 1999-06-11 2002-10-17 Sihai Xiao Trust information delivery scheme for certificate validation
US6640301B1 (en) * 1999-07-08 2003-10-28 David Way Ng Third-party e-mail authentication service provider using checksum and unknown pad characters with removal of quotation indents
US6853988B1 (en) * 1999-09-20 2005-02-08 Security First Corporation Cryptographic server with provisions for interoperability between cryptographic systems
US20040080528A1 (en) * 2000-06-21 2004-04-29 Watchit.Com,Inc. Systems and methods for presenting interactive programs over the internet
US7275155B1 (en) * 2000-09-01 2007-09-25 Northrop Grumman Corporation Chain of trust processing
US20020087479A1 (en) * 2000-11-08 2002-07-04 Peter Malcolm Information management system
US20020071563A1 (en) * 2000-12-12 2002-06-13 Kurn David Michael Method and apparatus for cryptographic key rollover during operation
US20020147746A1 (en) * 2000-12-22 2002-10-10 Lee Michele C. Delivering output XML with dynamically selectable processing
US7209479B2 (en) * 2001-01-18 2007-04-24 Science Application International Corp. Third party VPN certification
US20030035547A1 (en) * 2001-03-27 2003-02-20 John Newton Server with multiple encryption libraries
US20030110374A1 (en) * 2001-04-19 2003-06-12 Masaaki Yamamoto Terminal communication system
US20020184493A1 (en) * 2001-06-04 2002-12-05 Rees Robert Thomas Owen Digital certificate expiry notification
US20030037234A1 (en) * 2001-08-17 2003-02-20 Christina Fu Method and apparatus for centralizing a certificate revocation list in a certificate authority cluster
US7120929B2 (en) * 2001-10-12 2006-10-10 Geotrust, Inc. Methods and systems for automated authentication, processing and issuance of digital certificates
US20030126431A1 (en) * 2001-10-12 2003-07-03 Beattie Douglas D. Methods and systems for automated authentication, processing and issuance of digital certificates
US20030126433A1 (en) * 2001-12-27 2003-07-03 Waikwan Hui Method and system for performing on-line status checking of digital certificates
US20030131233A1 (en) * 2002-01-04 2003-07-10 Avaya Technology Corp. Efficient packet encryption method
US20030131244A1 (en) * 2002-01-10 2003-07-10 Dream Team S.R.L. Method and system for identifying users and authenticating digital documents on data communications networks
US20040030887A1 (en) * 2002-08-07 2004-02-12 Harrisville-Wolff Carol L. System and method for providing secure communications between clients and service providers
US20040243805A1 (en) * 2003-03-19 2004-12-02 Tomoaki Enokida Digital certificate management system, digital certificate management apparatus, digital certificate management method, program and computer readable information recording medium
US20050005097A1 (en) * 2003-06-12 2005-01-06 Minolta Co., Ltd. Communication system and method in public key infrastructure
US20060036850A1 (en) * 2003-06-25 2006-02-16 Tomoaki Enokida Digital certificate management system, digital certificate management apparatus, digital certificate management method, update procedure determination method and program
US20050033957A1 (en) * 2003-06-25 2005-02-10 Tomoaki Enokida Digital certificate management system, digital certificate management apparatus, digital certificate management method, update procedure determination method and program
US20040268152A1 (en) * 2003-06-27 2004-12-30 Wrq, Inc. Computer-based dynamic secure non-cached delivery of security credentials such as digitally signed certificates or keys

Cited By (131)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
USRE43906E1 (en) 2001-12-12 2013-01-01 Guardian Data Storage Llc Method and apparatus for securing digital assets
US7729995B1 (en) 2001-12-12 2010-06-01 Rossmann Alain Managing secured files in designated locations
US9542560B2 (en) 2001-12-12 2017-01-10 Intellectual Ventures I Llc Methods and systems for providing access control to secured data
US10769288B2 (en) 2001-12-12 2020-09-08 Intellectual Property Ventures I Llc Methods and systems for providing access control to secured data
US8918839B2 (en) 2001-12-12 2014-12-23 Intellectual Ventures I Llc System and method for providing multi-location access management to secured items
US8341407B2 (en) 2001-12-12 2012-12-25 Guardian Data Storage, Llc Method and system for protecting electronic data in enterprise environment
US8065713B1 (en) 2001-12-12 2011-11-22 Klimenty Vainstein System and method for providing multi-location access management to secured items
US10229279B2 (en) 2001-12-12 2019-03-12 Intellectual Ventures I Llc Methods and systems for providing access control to secured data
US7681034B1 (en) 2001-12-12 2010-03-16 Chang-Ping Lee Method and apparatus for securing electronic data
US20030110397A1 (en) * 2001-12-12 2003-06-12 Pervasive Security Systems, Inc. Guaranteed delivery of changes to security policies in a distributed system
US8543827B2 (en) 2001-12-12 2013-09-24 Intellectual Ventures I Llc Methods and systems for providing access control to secured data
US10360545B2 (en) 2001-12-12 2019-07-23 Guardian Data Storage, Llc Method and apparatus for accessing secured electronic data off-line
US8006280B1 (en) 2001-12-12 2011-08-23 Hildebrand Hal S Security system for generating keys from access rules in a decentralized manner and methods therefor
US7921450B1 (en) 2001-12-12 2011-04-05 Klimenty Vainstein Security system using indirect key generation from access rules and methods therefor
USRE41546E1 (en) 2001-12-12 2010-08-17 Klimenty Vainstein Method and system for managing security tiers
US7783765B2 (en) 2001-12-12 2010-08-24 Hildebrand Hal S System and method for providing distributed access control to secured documents
US9129120B2 (en) 2001-12-12 2015-09-08 Intellectual Ventures I Llc Methods and systems for providing access control to secured data
US8266674B2 (en) 2001-12-12 2012-09-11 Guardian Data Storage, Llc Method and system for implementing changes to security policies in a distributed security system
US10033700B2 (en) 2001-12-12 2018-07-24 Intellectual Ventures I Llc Dynamic evaluation of access rights
US7921284B1 (en) 2001-12-12 2011-04-05 Gary Mark Kinghorn Method and system for protecting electronic data in enterprise environment
US7930756B1 (en) 2001-12-12 2011-04-19 Crocker Steven Toye Multi-level cryptographic transformations for securing digital assets
US8341406B2 (en) 2001-12-12 2012-12-25 Guardian Data Storage, Llc System and method for providing different levels of key security for controlling access to secured items
US7913311B2 (en) 2001-12-12 2011-03-22 Rossmann Alain Methods and systems for providing access control to electronic data
US7921288B1 (en) 2001-12-12 2011-04-05 Hildebrand Hal S System and method for providing different levels of key security for controlling access to secured items
US7950066B1 (en) 2001-12-21 2011-05-24 Guardian Data Storage, Llc Method and system for restricting use of a clipboard application
US8943316B2 (en) 2002-02-12 2015-01-27 Intellectual Ventures I Llc Document security system that permits external users to gain access to secured files
US9286484B2 (en) 2002-04-22 2016-03-15 Intellectual Ventures I Llc Method and system for providing document retention using cryptography
US8307067B2 (en) 2002-09-11 2012-11-06 Guardian Data Storage, Llc Protecting encrypted files transmitted over a network
US8176334B2 (en) 2002-09-30 2012-05-08 Guardian Data Storage, Llc Document security system that permits external users to gain access to secured files
USRE47443E1 (en) 2002-09-30 2019-06-18 Intellectual Ventures I Llc Document security system that permits external users to gain access to secured files
US7836310B1 (en) 2002-11-01 2010-11-16 Yevgeniy Gutnik Security system that uses indirect password-based encryption
US7890990B1 (en) 2002-12-20 2011-02-15 Klimenty Vainstein Security system with staging capabilities
US20100318665A1 (en) * 2003-04-14 2010-12-16 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US8473620B2 (en) 2003-04-14 2013-06-25 Riverbed Technology, Inc. Interception of a cloud-based communication connection
US8707034B1 (en) 2003-05-30 2014-04-22 Intellectual Ventures I Llc Method and system for using remote headers to secure electronic files
US8127366B2 (en) * 2003-09-30 2012-02-28 Guardian Data Storage, Llc Method and apparatus for transitioning between states of security policies used to secure electronic documents
US8739302B2 (en) 2003-09-30 2014-05-27 Intellectual Ventures I Llc Method and apparatus for transitioning between states of security policies used to secure electronic documents
US8327138B2 (en) 2003-09-30 2012-12-04 Guardian Data Storage Llc Method and system for securing digital assets using process-driven security policies
US7703140B2 (en) 2003-09-30 2010-04-20 Guardian Data Storage, Llc Method and system for securing digital assets using process-driven security policies
US8613102B2 (en) 2004-03-30 2013-12-17 Intellectual Ventures I Llc Method and system for providing document retention using cryptography
US8606875B1 (en) * 2004-06-30 2013-12-10 Oracle America, Inc. Method and system for automatic distribution and installation of a client certificate in a secure manner
US7707427B1 (en) 2004-07-19 2010-04-27 Michael Frederick Kenrich Multi-level file digests
US8301896B2 (en) 2004-07-19 2012-10-30 Guardian Data Storage, Llc Multi-level file digests
US11477011B1 (en) * 2005-03-30 2022-10-18 Wells Fargo Bank, N.A. Distributed cryptographic management for computer systems
US8832430B2 (en) * 2005-06-29 2014-09-09 Microsoft Corporation Remote certificate management
US20110066848A1 (en) * 2005-06-29 2011-03-17 Microsoft Corporation Remote certificate management
US8613071B2 (en) 2005-08-10 2013-12-17 Riverbed Technology, Inc. Split termination for secure communication protocols
US20090083537A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Server configuration selection for ssl interception
US8438628B2 (en) 2005-08-10 2013-05-07 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US20090083538A1 (en) * 2005-08-10 2009-03-26 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US8478986B2 (en) 2005-08-10 2013-07-02 Riverbed Technology, Inc. Reducing latency of split-terminated secure communication protocol sessions
US20070038853A1 (en) * 2005-08-10 2007-02-15 Riverbed Technology, Inc. Split termination for secure communication protocols
US20100299525A1 (en) * 2005-08-10 2010-11-25 Riverbed Technology, Inc. Method and apparatus for split-terminating a secure network connection, with client authentication
US20070150727A1 (en) * 2005-12-28 2007-06-28 Brother Kogyo Kabushiki Kaisha Management Apparatus
US8108917B2 (en) * 2005-12-28 2012-01-31 Brother Kogyo Kabushiki Kaisha Management apparatus
US8782393B1 (en) 2006-03-23 2014-07-15 F5 Networks, Inc. Accessing SSL connection data by a third-party
US9742806B1 (en) 2006-03-23 2017-08-22 F5 Networks, Inc. Accessing SSL connection data by a third-party
US20080281907A1 (en) * 2007-05-07 2008-11-13 Hilary Vieira System and method for globally issuing and validating assets
US20090063849A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US9571484B2 (en) * 2007-08-31 2017-02-14 International Business Machines Corporation Device certificate based appliance configuration
US20090060187A1 (en) * 2007-08-31 2009-03-05 International Business Machines Corporation Device certificate based appliance configuration
US20150281220A1 (en) * 2007-08-31 2015-10-01 International Business Machines Corporation Device certificate based appliance configuration
US9055041B2 (en) * 2007-08-31 2015-06-09 International Business Machines Corporation Device certificate based appliance configuration
US9043896B2 (en) * 2007-08-31 2015-05-26 International Business Machines Corporation Device certificate based appliance configuration
WO2010045706A1 (en) * 2008-10-22 2010-04-29 Research In Motion Limited Pushing certificate chains to remote devices
US20100106965A1 (en) * 2008-10-28 2010-04-29 Dell Products L.P. Delivery of multiple third-party services to networked devices
US8170931B2 (en) 2008-10-28 2012-05-01 Dell Products L.P. Configuring user-customized services for networked devices
US8671274B2 (en) * 2008-10-28 2014-03-11 Dell Products L.P. Delivery of multiple third-party services to networked devices
TWI489404B (en) * 2008-10-28 2015-06-21 Dell Products Lp Configuring user-customized services for networked devices
US9009808B2 (en) 2008-10-28 2015-04-14 Dell Products L.P. Delivery of multiple third-party services to networked devices
TWI410148B (en) * 2008-12-02 2013-09-21 Dell Products Lp Preconfiguration of wireless network access for portable devices
US8707043B2 (en) 2009-03-03 2014-04-22 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US20100228968A1 (en) * 2009-03-03 2010-09-09 Riverbed Technology, Inc. Split termination of secure communication sessions with mutual certificate-based authentication
US8745375B2 (en) 2009-12-14 2014-06-03 International Business Machines Corporation Handling of the usage of software in a disconnected computing environment
US20110145568A1 (en) * 2009-12-14 2011-06-16 International Business Machines Corporation Handling of the usage of software in a disconnected computing environment
US20110161662A1 (en) * 2009-12-30 2011-06-30 Hong Fu Jin Precision Industry (Shenzhen) Co., Ltd System and method for updating digital certificate automatically
US20110202759A1 (en) * 2010-02-12 2011-08-18 Microsoft Corporation Certificate remoting and recovery
US8621205B2 (en) 2010-02-12 2013-12-31 Microsoft Corporation Certificate remoting and recovery
US20110231923A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Local authentication in proxy ssl tunnels using a client-side proxy agent
US9667601B2 (en) 2010-03-19 2017-05-30 F5 Networks, Inc. Proxy SSL handoff via mid-stream renegotiation
US20110231651A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Strong ssl proxy authentication with forced ssl renegotiation against a target server
US9166955B2 (en) 2010-03-19 2015-10-20 F5 Networks, Inc. Proxy SSL handoff via mid-stream renegotiation
US9172682B2 (en) 2010-03-19 2015-10-27 F5 Networks, Inc. Local authentication in proxy SSL tunnels using a client-side proxy agent
US9178706B1 (en) 2010-03-19 2015-11-03 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US8700892B2 (en) 2010-03-19 2014-04-15 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US9210131B2 (en) 2010-03-19 2015-12-08 F5 Networks, Inc. Aggressive rehandshakes on unknown session identifiers for split SSL
US20110231652A1 (en) * 2010-03-19 2011-09-22 F5 Networks, Inc. Proxy ssl authentication in split ssl for client-side proxy agent resources with content insertion
US9100370B2 (en) 2010-03-19 2015-08-04 F5 Networks, Inc. Strong SSL proxy authentication with forced SSL renegotiation against a target server
US9705852B2 (en) 2010-03-19 2017-07-11 F5 Networks, Inc. Proxy SSL authentication in split SSL for client-side proxy agent resources with content insertion
US9509663B2 (en) 2010-03-19 2016-11-29 F5 Networks, Inc. Secure distribution of session credentials from client-side to server-side traffic management devices
US10812530B2 (en) 2011-12-21 2020-10-20 Ssh Communications Security Oyj Extracting information in a computer system
US10693916B2 (en) 2011-12-21 2020-06-23 Ssh Communications Security Oyj Restrictions on use of a key
US10530814B2 (en) 2011-12-21 2020-01-07 Ssh Communications Security Oyj Managing authenticators in a computer system
US9515999B2 (en) 2011-12-21 2016-12-06 Ssh Communications Security Oyj Automated access, key, certificate, and credential management
WO2013093209A1 (en) * 2011-12-21 2013-06-27 Ssh Communications Security Oyj Automated access, key, certificate, and credential management
US10708307B2 (en) * 2011-12-21 2020-07-07 Ssh Communications Security Oyj Notifications in a computer system
US10277632B2 (en) 2011-12-21 2019-04-30 Ssh Communications Security Oyj Automated access, key, certificate, and credential management
US9998497B2 (en) 2011-12-21 2018-06-12 Ssh Communications Security Oyj Managing relationships in a computer system
US10187426B2 (en) * 2011-12-21 2019-01-22 Ssh Communications Security Oyj Provisioning systems for installing credentials
US10003458B2 (en) 2011-12-21 2018-06-19 Ssh Communications Security Corp. User key management for the secure shell (SSH)
US9832177B2 (en) 2011-12-21 2017-11-28 SSH Communication Security OYJ Managing credentials in a computer system
US10691814B2 (en) 2012-04-12 2020-06-23 Netflix, Inc. Method and system for improving security and reliability in a networked application environment
US20130276089A1 (en) * 2012-04-12 2013-10-17 Ariel Tseitlin Method and system for improving security and reliability in a networked application environment
US20150235035A1 (en) * 2012-04-12 2015-08-20 Netflix, Inc Method and system for improving security and reliability in a networked application environment
US9953173B2 (en) * 2012-04-12 2018-04-24 Netflix, Inc. Method and system for improving security and reliability in a networked application environment
US9027141B2 (en) * 2012-04-12 2015-05-05 Netflix, Inc. Method and system for improving security and reliability in a networked application environment
US10771545B2 (en) * 2013-01-18 2020-09-08 Apple Inc. Keychain syncing
US9077759B2 (en) 2013-01-18 2015-07-07 Apple Inc. Conflict resolution for keychain syncing
US20140281540A1 (en) * 2013-01-18 2014-09-18 Apple Inc. Keychain syncing
US9710673B2 (en) 2013-01-18 2017-07-18 Apple Inc. Conflict resolution for keychain syncing
US9197700B2 (en) * 2013-01-18 2015-11-24 Apple Inc. Keychain syncing
US20160065548A1 (en) * 2013-01-18 2016-03-03 Apple Inc. Keychain syncing
US9684801B2 (en) 2013-01-18 2017-06-20 Apple Inc. Data protection for keychain syncing
US20190273729A1 (en) * 2013-01-18 2019-09-05 Apple Inc. Keychain syncing
US9479583B2 (en) 2013-01-18 2016-10-25 Apple Inc. Conflict resolution for keychain syncing
US10218685B2 (en) * 2013-01-18 2019-02-26 Apple Inc. Keychain syncing
US9124637B2 (en) 2013-01-18 2015-09-01 Apple Inc. Data protection for keychain syncing
US20140237091A1 (en) * 2013-02-15 2014-08-21 Digicert, Inc. Method and System of Network Discovery
US10009354B2 (en) 2013-07-08 2018-06-26 Ssh Communications Security Oyj Trust relationships in a computerized system
US11277414B2 (en) 2013-07-08 2022-03-15 Ssh Communications Security Oyj Trust relationships in a computerized system
US10616237B2 (en) 2013-07-08 2020-04-07 Ssh Communications Security Oyj Trust relationships in a computerized system
US10880314B2 (en) 2013-07-08 2020-12-29 Ssh Communications Security Oyj Trust relationships in a computerized system
US10523674B2 (en) 2015-03-13 2019-12-31 Ssh Communications Security Oyj Access relationship in a computer system
US9722987B2 (en) 2015-03-13 2017-08-01 Ssh Communications Security Oyj Access relationships in a computer system
US10305871B2 (en) 2015-12-09 2019-05-28 Cloudflare, Inc. Dynamically serving digital certificates based on secure session properties
US10893031B2 (en) 2015-12-09 2021-01-12 Cloudflare, Inc. Dynamically serving digital certificates based on secure session properties
US11424931B2 (en) * 2016-01-27 2022-08-23 Blackberry Limited Trusted execution environment
US20170214530A1 (en) * 2016-01-27 2017-07-27 Blackberry Limited Trusted execution environment
US10599409B2 (en) 2016-02-02 2020-03-24 Blackberry Limited Application lifecycle operation queueing
US10771261B1 (en) * 2016-09-29 2020-09-08 EMC IP Holding Company LLC Extensible unified multi-service certificate and certificate revocation list management
US11095459B2 (en) * 2018-05-31 2021-08-17 Microsoft Technology Licensing, Llc Automatic generation of app-specific client certification

Also Published As

Publication number Publication date
US20050071630A1 (en) 2005-03-31
US20050076205A1 (en) 2005-04-07
US20050081028A1 (en) 2005-04-14
US20050076203A1 (en) 2005-04-07
US20050076204A1 (en) 2005-04-07
US20050074124A1 (en) 2005-04-07
US20050081027A1 (en) 2005-04-14
US20050091484A1 (en) 2005-04-28
US20090319783A1 (en) 2009-12-24
US7937583B2 (en) 2011-05-03
US20050076200A1 (en) 2005-04-07
US20050076199A1 (en) 2005-04-07
US20050078830A1 (en) 2005-04-14
US7653810B2 (en) 2010-01-26
US20050081025A1 (en) 2005-04-14
US20060015716A1 (en) 2006-01-19
US7418597B2 (en) 2008-08-26
US20050069136A1 (en) 2005-03-31
US7650496B2 (en) 2010-01-19
US20050076201A1 (en) 2005-04-07
US20050081026A1 (en) 2005-04-14
US7568095B2 (en) 2009-07-28
US7650497B2 (en) 2010-01-19
US20050076202A1 (en) 2005-04-07
US7698549B2 (en) 2010-04-13

Similar Documents

Publication Publication Date Title
US7698549B2 (en) Program product for unified certificate requests from certificate authorities
US11477011B1 (en) Distributed cryptographic management for computer systems
EP1751911B1 (en) A method of encrypting and transferring data between a sender and a receiver using a network
US20030069848A1 (en) A User interface for computer network management
US20030028495A1 (en) Trusted third party services system and method
US7320073B2 (en) Secure method for roaming keys and certificates
JP2006120148A (en) Authentication with expiring binding digital certificate
US9497172B2 (en) Method of encrypting and transferring data between a sender and a receiver using a network

Legal Events

Date Code Title Description
AS Assignment

Owner name: IMCENTRIC, INC., UTAH

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:THORNTON, RUSSELL S.;HODSON, BENJAMIN;SEEGMILLER, JAYSON;REEL/FRAME:016080/0355

Effective date: 20041115

AS Assignment

Owner name: IMCENTRIC, INC, UTAH

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:THORNTON, RUSSELL S.;HODSON, BENJAMIN;SEEGMILLER, JAYSON;REEL/FRAME:016566/0888

Effective date: 20041115

AS Assignment

Owner name: VENAFI, INC.,UTAH

Free format text: CHANGE OF NAME;ASSIGNORS:THORNTON, RUSSELL S.;HODSON, BENJAMIN;SEEGMILLER, JAYSON;AND OTHERS;REEL/FRAME:017111/0526

Effective date: 20050301

Owner name: VENAFI, INC., UTAH

Free format text: CHANGE OF NAME;ASSIGNORS:THORNTON, RUSSELL S.;HODSON, BENJAMIN;SEEGMILLER, JAYSON;AND OTHERS;REEL/FRAME:017111/0526

Effective date: 20050301

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION

AS Assignment

Owner name: SILICON VALLEY BANK, COLORADO

Free format text: SECURITY AGREEMENT;ASSIGNOR:VENAFI, INCORPORATED;REEL/FRAME:026597/0819

Effective date: 20110714

AS Assignment

Owner name: SILICON VALLEY BANK, CALIFORNIA

Free format text: SECURITY INTEREST;ASSIGNOR:VENAFI, INC.;REEL/FRAME:032875/0450

Effective date: 20140508