Management of SSL/TLS certificates

1 . A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:

monitoring the expiration status of certificates stored to the plurality of servers;

detecting the expiration of a certificate stored to the plurality of servers within a specified period of time;

identifying a managed server corresponding to a detected expiring digital certificate;

communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;

transmitting a generated and received certificate signing request to a certificate authority;

receiving a certificate signed by a certificate authority generated from a certificate signing request;

identifying a destination managed server corresponding to a received certificate signed by a certificate authority;

installing a received certificate signed by a certificate authority to an identified destination managed server; and

configuring an identified destination managed server to use a private key corresponding to an installed certificate.

2 . A method according to claim 1 , wherein said instructions are further executable to revoke a certificate for which expiration was detected.

3 . A method according to claim 1 , wherein said instructions are further executable to achieve the functions of:

generating a new asymmetric key pair; and

installing a generated private key of a new asymmetric key pair to an identified destination managed server; and

wherein a generated certificate signing request includes a generated public key of a new asymmetric key pair.

4 . A method according to claim 1 , wherein said instructions are further executable to install a received certificate signed by a certificate authority by a network interface provided by a web interface of a web server installed to an identified destination managed server.

5 . A method according to claim 1 , wherein said instructions are further executable to install a received certificate signed by a certificate authority by a shell interface to an identified destination managed server.

6 . A method according to claim 1 , wherein said instructions are further executable to install a received certificate signed by a certificate authority by an agent program installed to an identified destination managed server.

7 . A method according to claim 1 , wherein said instructions are further executable to restart a destination server program.

8 . A method according to claim 1 , wherein said instructions are further executable to restart a destination server computer.

9 . A method according to claim 1 , wherein said instructions are further executable to notify an administrator to restart a destination server program or destination server computer.

10 . A method according to claim 1 , wherein said instructions are further executable to confirm the installation of a received certificate to a destination server following the performance of a set of installation steps.

11 . A method according to claim 10 , wherein said instructions are further executable to generate an alert to an administrator if the installation of a received certificate to a destination server is not confirmed.

12 . A method according to claim 1 , wherein said instructions are further executable to achieve the functions of:

informing an administrator of a certificate for which expiration has been detected;

prior to said transmitting, requesting approval to renew a certificate for which expiration has been detected; and

receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed.

13 . A method according to claim 1 , wherein said instructions are further executable to achieve the functions of:

following said receiving a certificate signed by a certificate authority, informing an administrator of that renewed certificate;

prior to said installing, requesting approval to install a renewed certificate received from a certificate authority; and

receiving, in response to a request for approval, an indication from an administrator that a renewed certificate is to be installed.

14 . A method according to claim 1 , wherein said instructions are further executable to store a received certificate signed by a certificate authority to a backup storage device.

15 . A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:

receiving an address range corresponding to a network or network portion to be scanned;

contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system;

for each contacted network device transmitting a digital certificate, receiving the digital certificate;

for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted;

storing created certificate records in a certificate database;

monitoring the expiration status of certificates stored to the plurality of servers;

detecting the expiration of a certificate stored to the plurality of servers within a specified period of time;

identifying a managed server corresponding to a detected expiring digital certificate;

communicating with the managed server, the communicating causing the managed server to generate a certificate signing request and return the request to the managing device;

transmitting a generated and received certificate signing request to a certificate authority;

receiving a certificate signed by a certificate authority generated from a certificate signing request;

identifying a destination managed server corresponding to a received certificate signed by a certificate authority;

installing a received certificate signed by a certificate authority to an identified destination managed server; and

configuring an identified destination managed server to use a private key corresponding to an installed certificate.

16 . A method for operating a certificate management and renewal system for automatically renewing digital certificates in a managed network, the management and renewal system including network facilities for electronic communication over a network, the management and renewal system being configured to communicate with a plurality of servers utilizing the network facilities, each of those servers including at least one digital certificate stored thereon and further configured to provide a service to client devices, the method comprising the steps of:

receiving an address range corresponding to a network or network portion to be scanned,

contacting network devices within the received address range, said contacting further intended to initiate the transmission of a digital certificate from each of the contacted network devices to said certificate discovery system,

for each contacted network device transmitting a digital certificate, receiving the digital certificate,

for each received digital certificate, creating a certificate record containing a certificate identification, wherein the certificate identification contains sufficient information to identify the received digital certificate and the network device from where it was transmitted,

storing created certificate records in a certificate database,

monitoring the expiration status of certificates stored to the plurality of servers,

detecting the expiration of a certificate stored to the plurality of servers within a specified period of time,

receiving, in response to a request for approval, an indication from an administrator that a certificate is to be renewed or installed,

identifying a managed server corresponding to a detected expiring digital certificate,

communicating with the managed server, the communicating causing the managed server to generate a new asymmetric key pair, the communicating further causing the managed server to generate a certificate signing request and return the request to the managing device,

transmitting a generated and received certificate signing request to a certificate authority,

receiving a certificate signed by a certificate authority generated from a certificate signing request,

identifying a destination managed server corresponding to a received certificate signed by a certificate authority,

installing a received certificate signed by a certificate authority to an identified destination managed server, the installing being performed by accessing the identified destination managed server using a corresponding object of said authentication objects, the installing utilizing a protocol selected from the group of a shell interface, an agent interface and a network interface provided by a web interface of a web server,

configuring an identified destination managed server to use a private key corresponding to an installed certificate,

performing a restart action selected from the group of commanding an identified destination managed server to perform a restart, commanding an identified destination managed server to restart and notifying an administrator to restart a destination server program or destination server computer.