Systems and methods for selectively requesting certificates during initiation of secure communication sessions
View Patent ↗An exemplary method involves an SSL server receiving an SSL session request from an SSL client. It is determined whether the SSL client is going to use certificate-based authentication. This may involve identifying a port at which the SSL session request was received. Alternatively, this may involve identifying an IP address at which the SSL session request was received. Alternatively still, this may involve examining authentication information in the SSL session request. If the SSL client is going to use certificate-based authentication, a certificate is requested from the SSL client. If the SSL client is not going to use certificate-based authentication, the certificate is not requested from the SSL client.
1. In a computer system, a method for selectively requesting certificates during initiation of secure communication sessions, the method comprising:
receiving from a client a request to initiate a secure communication session, wherein the secure communication session is a secure sockets layer session;
determining whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by identifying a location where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein the at least two possible locations comprise a port, wherein determining whether the client is going to use certificate-based authentication comprises identifying the port at which the request was received, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, requesting a certificate from the client; and
if the client is not going to use certificate-based authentication, attempting to authenticate using another authentication mechanism besides certificate-based authentication, not requesting the certificate from the client, and also preventing a dialog box from being displayed that indicates that the certificate should be selected, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism.
2. In a computer system, a method for selectively requesting certificates during initiation of secure communication sessions, the method comprising:
receiving from a client a request to initiate a secure communication session, wherein the secure communication session is a secure sockets layer session;
determining whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by identifying a location where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein the at least two possible locations comprise an IP address, wherein determining whether the client is going to use certificate-based authentication comprises identifying the IP address at which the request was received, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, requesting a certificate from the client;
if the client is not going to use certificate-based authentication, not requesting the certificate from the client, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism; and
wherein determining whether the client is going to use certificate-based authentication comprises determining whether the request was received at a certificate IP address or a non-certificate IP address.
3. The method of claim 1 , wherein the computer system is a managed node in a computer network.
4. The method of claim 1 , wherein the computer system is connected to a computer network, and wherein the client is located on an administrative system for the computer network.
5. The method of claim 4 , wherein the client is included in a management application on the administrative system.
6. The method of claim 1 , wherein the computer system is connected to a computer network, and wherein the client is located on a console system that is also connected to the computer network.
7. The method of claim 6 , wherein the client is included in a browser on the console system.
8. A computer system that is configured to selectively request certificates during initiation of secure communication sessions, the computer system comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
receive from a client a request to initiate a secure communication session;
determine whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by identifying a location where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, request a certificate from the client;
if the client is not going to use certificate-based authentication, attempt to authenticate using another authentication mechanism besides certificate-based authentication, not request the certificate from the client, and also prevent a dialog box from being displayed that indicates that the certificate should be selected, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism;
wherein the at least two possible locations comprise at least one certificate port that is designated to receive secure communication session requests from clients that will use certificate-based authentication; and
wherein the at least two possible locations comprise at least one non-certificate port that is designated to receive secure communication session requests from clients that will not use certificate-based authentication.
9. The computer system of claim 8 , wherein the instructions are executable to determine whether the client is going to use certificate-based authentication comprises determining whether the request was received at a certificate port or a non-certificate port.
10. A computer system that is configured to selectively request certificates during initiation of secure communication sessions, the computer system comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
receive from a client a request to initiate a secure communication session;
determine whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by identifying a location where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, request a certificate from the client;
if the client is not going to use certificate-based authentication, not request the certificate from the client, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism;
wherein the at least two possible locations comprise at least one certificate IP address that is designated to receive secure communication session requests from clients that will use certificate-based authentication;
wherein the at least two possible locations further comprise at least one non-certificate IP address that is designated to receive secure communication session requests from clients that will not use certificate-based authentication; and
wherein the instructions are executable to determine whether the client is going to use certificate-based authentication comprises determining whether the request was received at a certificate IP address or a non-certificate IP address.
11. A non-transitory computer-readable medium comprising executable instructions for selectively requesting certificates during initiation of secure communication sessions, the instructions being executable to:
receive from a client a request to initiate a secure communication session;
determine whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by examining where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, request a certificate from the client; and
if the client is not going to use certificate-based authentication, attempt to authenticate using another authentication mechanism besides certificate-based authentication, not request the certificate from the client, and also prevent a dialog box from being displayed that indicates that the certificate should be selected, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism;
wherein the at least two possible locations comprise a port, wherein determining whether the client is going to use certificate-based authentication comprises identifying the port at which the request was received.
12. A non-transitory computer-readable medium comprising executable instructions for selectively requesting certificates during initiation of secure communication sessions, the instructions being executable to:
receive from a client a request to initiate a secure communication session;
determine whether the client is going to use certificate-based authentication before any certificate is requested from the client, wherein the determination is made by examining where the request to initiate the secure communication session was received, wherein the identified location is one of at least two possible locations, wherein a first location of the at least two possible locations receives requests to initiate the secure communication session via certificate-based authentication, and wherein a second location of the at least two possible locations receives requests to initiate the secure communication session via another authentication mechanism;
if the client is going to use certificate-based authentication, request a certificate from the client;
if the client is not going to use certificate-based authentication, not request the certificate from the client, wherein the other authentication mechanism comprises an operating system-specific authentication mechanism; and
wherein the at least two possible locations comprise an IP address, wherein determining whether the client is going to use certificate-based authentication comprises identifying the IP address at which the request was received, wherein determining whether the client is going to use certificate-based authentication comprises determining whether the request was received at a certificate IP address or a non-certificate IP address.
13. The method of claim 1 , further comprising:
if the client presents the certificate during certificate-based authentication but is not successfully authenticated, attempting to authenticate the client via the operating system-specific authentication mechanism; and
if the client is not successfully authenticated via the operating system-specific authentication mechanism, determining whether the client is allowed to proceed without authentication.
14. The method of claim 1 , wherein the request to initiate a secure communication session includes authentication information indicating whether the client is going to authenticate by using certificate-based authentication or whether the client is going to authenticate via another authentication mechanism.