Certificate registration after issuance for secure communication
Techniques for registering certificates after the issuance of the certificates are provided. A service provider securely registers a client's identity and its certificate without depending on or using an existing basis of trust, such as that provided by domain-joined clients or a security directory (e.g., MICROSOFT's ACTIVE DIRECTORY). The service provider provides services, such as, by way of example and not a limitation, email services, web application services, application services, etc., based on identifiers (e.g., service IDs) issued to registered clients. The service provider subsequently uses the issued identifier to authenticate a client requesting a service or services, and to authorize the client to receive the requested service or services.
1. A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising:
receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate; and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate, wherein registering the certificate comprises:
determining whether a service ID is included in the certificate registration request;
when it is determined that a service ID is included in the request, determining whether the service ID is associated with a registration record for a less trusted certificate;
when it is determined that the service ID is associated with a registration record for a less trusted certificate, updating the registration record associated with the service ID, wherein the updating the registration record includes indicating that the registration record is for the certificate included in the certificate registration request; and
sending a successful registration response to the client; and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client.
2. The method of claim 1 , wherein determining whether the certificate is a valid certificate comprises determining whether the certificate is issued by a trusted authority.
3. The method of claim 1 , wherein determining whether the certificate is a valid certificate comprises determining that the certificate has not expired.
4. The method of claim 1 , wherein determining whether the certificate is a valid certificate comprises determining whether the certificate can be used for client authentication.
5. The method of claim 1 , wherein the certificate registration request is encrypted.
6. The method of claim 1 , wherein renewing the registration comprises:
determining whether a service ID is included in the certificate registration request; and
when it is determined that a service ID is not included in the request, sending a service ID associated with a registration record that is associated with the unique token associated with the registered certificate to the client.
7. A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising
receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate; and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate; and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client, wherein renewing the registration comprises:
determining whether a service ID that is included in the certificate registration request matches a service ID that is associated with a registration record that is associated with the unique token associated with the registered certificate; and
when it is determined that the service ID that is included in the request does not match the service ID that is associated with the registration record, sending the service ID that is associated with the registration record that is associated with the unique token associated with the registered certificate to the client.
8. The method of claim 7 , wherein registering the certificate comprises:
determining that a service ID is passed with the certificate registration request;
determining that the service ID is not associated with a registration record for a registered certificate;
associating the service ID with a unique token associated with the certificate; and
sending a successful registration response to the client.
9. A method in a computer system with a processor and memory for registering a certificate after issuance of the certificate, the method comprising
receiving a certificate registration request from a client to register the certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a unique token;
determining by the computer system whether the certificate is a valid certificate;
determining by the computer system whether the client is an authentic client based on the signature of the certificate registration request;
determining by the computer system whether the unique token is already associated with a registered certificate; and
when it is determined that the certificate is valid and the client is authentic,
registering the certificate when the unique token is not already associated with a registered certificate; and
renewing the registration of the certificate when the unique token is already associated with a registered certificate for the authentic client, wherein renewing the registration comprises:
determining whether a service ID that is included in the certificate registration request matches a service ID that is associated with a registration record that is associated with the unique token associated with the registered certificate;
when it is determined that the service ID that is included in the request matches the service ID that is associated with the registration record, replacing a current certificate associated with the registration record with the certificate included in the certificate registration request; and
sending a successful registration response to the client.
10. The method of claim 9 , wherein determining whether the client is an authentic client based on the signature comprises:
hashing the received certificate registration request;
signing the hash using a public key included in the certificate; and
comparing the hash signed with the public key with the signature of the certificate registration request.
11. The method of claim 9 , wherein registering the certificate comprises:
generating a service ID;
associating the generated service ID with the unique token included in the certificate; and
sending a successful registration response to the client, the successful registration response including the service ID.
12. A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:
receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration request;
when it is determined that a service ID is included in the certificate registration request,
determining whether the service ID included in the certificate registration request is associated with a registration record for a non-issued certificate; and
when it is determined that the service ID included in the certificate registration request is associated with a registration record for a registered certificate,
updating the registration record associated with the service ID included in the certificate registration request, wherein the updating the registration record includes indicating that the registration record is for the certificate included in the certificate registration request; and
sending a successful registration response to the client; and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate; and
sending a successful registration response to the client, the successful registration response including the service ID.
13. The computer-readable storage medium of claim 12 wherein the method further comprises:
when it is determined that the subject name included in the certificate is associated with a registration record for a registered certificate,
determining whether a service ID is included in the certificate registration request; and
when it is determined that a service ID is not included in the certificate registration request, sending a service ID associated with the registration record to the client.
14. A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:
receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is associated with a registration record for a registered certificate,
determining whether a service ID included in the certificate registration request matches a service ID associated with the registration record; and
when it is determined that the service ID included in the certificate registration request does not match the service ID associated with the registration record, sending the service ID associated with the registration record to the client;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration reguest; and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate; and
sending a successful registration response to the client, the successful registration response including the service ID.
15. The computer-readable storage medium of claim 14 wherein the method further comprises:
when it is determined that a service ID is included in the certificate registration request,
determining whether the service ID included in the certificate registration request is associated with a registration record for a registered certificate; and
when it is determined that the service ID included in the certificate registration request is not associated with a registration record for a registered certificate,
associating the service ID included in the certificate registration request with the subject name included in the certificate; and
sending a successful registration response to the client.
16. A computer-readable storage medium containing computer-executable instructions that when executed by a server register certificates after issuance of the certificates, by a method comprising:
receiving a certificate registration request from a client to register a certificate that has already been issued and that is to be registered, wherein the certificate registration request comprises the certificate and a signature, and wherein the certificate includes a subject name;
determining whether the certificate is a valid certificate;
determining whether the client is an authentic client based on the signature of the certificate registration request;
determining whether the subject name included in the certificate is associated with a registration record for a registered certificate;
when it is determined that the subject name included in the certificate is associated with a registration record for a registered certificate;
determining whether a service ID included in the certificate registration request matches a service ID associated with the registration record;
when it is determined that the service ID included in the certificate registration request matches the service ID associated with the registration record,
replacing a current certificate associated with the registration record with the certificate passed with the certificate registration request; and
sending a successful registration response to the client;
when it is determined that the subject name included in the certificate is not associated with a registration record for a registered certificate, determining whether a service ID is included in the certificate registration request; and
when it is determined that a service ID is not included in the certificate registration request,
generating a service ID;
associating the generated service ID with the subject name included in the certificate;
registering the certificate; and
sending a successful registration response to the client, the successful registration response including the service ID.