Secure certificate installation on IP clients
View Patent ↗According to one embodiment of the invention, a method is deployed for loading a user CA certificate into the trusted certificate storage of a network device. The method comprises a number of operations. A first operation involves a downloading of addressing information. Thereafter, a communication session is established using the addressing information for retrieval of a bootstrapping digital certificate that can be digitally verified by the network device using its factory settings. Keying information is extracted from the bootstrapping digital certificate and the keying information can be used to verify that the communication session is between the network device and a certificate server being different than a source for the addressing information. Upon verification that the network device is in communication with the certificate server, the user CA certificate is downloaded from the certificate server using a secure channel that is established based on the bootstrapping digital certificate.
1. A method for loading a user CA certificate into a network device, comprising:
downloading addressing information of a certificate server, wherein the addressing information is one of a domain name and an Internet Protocol (IP) address of the certificate server, wherein downloading addressing information of a certificate server includes:
identifying the certificate server based on a network provider associated with an existing certificate embedded in the network device, wherein the existing certificate is pre-stored in the network device;
retrieving a bootstrapping digital certificate from the certificate server upon establishing a communication session with the certificate server based on the addressing information;
verifying the bootstrapping digital certificate using the existing certificate embedded in the network device, wherein the verifying of the bootstrapping digital certificate includes recovering a public key of the certificate server from the bootstrapping digital certificate and engaging in a challenge/response communication session to verify that the certificate server has access to a private key of the certificate server;
establishing a secure channel with the certificate server using the bootstrapping digital certificate; and
downloading the user CA certificate from the certificate server.
2. The method of claim 1 wherein the network device is an Internet Protocol (IP) based device.
3. The method of claim 1 , wherein the user CA certificate includes at least a public key associated with a user that is digitally signed with a private key of a certificate authority.
4. The method of claim 1 , wherein the downloading of the addressing information includes retrieving an Internet Protocol (IP) address from a configuration server.
5. The method of claim 4 further comprising: discontinuing the communication session upon determining that the configuration server and the certificate server are in the same subnet.
6. The method of claim 1 , wherein the downloading of the addressing information includes retrieving a domain name from a configuration server and using the domain name to retrieve an Internet Protocol (IP) address of the certificate server from a Domain Name Service (DNS) server.
7. The method of claim 6 further comprising: discontinuing the communication session upon determining that the DNS server and the configuration server are in the same subnet; and
after a user CA certificate is downloaded into the network device, manually verifying at least one from a group consisting of: a certificate thumbprint or a public key fingerprint.
8. The method of claim 1 further comprising: verifying the user CA certificate downloaded into the network device with either a certificate thumbprint or public key fingerprint.
9. A system comprising:
a configuration server to download addressing information of the certificate server to a network device, wherein the configuration server identifies the certificate server based on a network provider associated with a pre-stored certificate embedded in the network device, wherein the addressing information is one of a domain name and an Internet Protocol (IP) address of the certificate server, wherein the network device establishes a communication session with the certificate server based on the addressing information and to retrieve a bootstrapping digital certificate;
wherein the network device includes the pre-stored embedded certificate to be used to verify the bootstrapping digital certificate by using a public key of the certificate server, wherein the public key is included in the bootstrapping digital certificate;
wherein the network device engages in a challenge/response communication session to verify that the certificate server has access to a private key of the certificate server;
wherein the network device establishes a secure channel with the certificate server using the bootstrapping digital certificate; and
wherein the network device downloads the user CA certificate from the certificate server.
10. A method comprising:
receiving addressing information from a first network device by a second network device, wherein receiving the addressing information includes: identifying a third network device based on a network provider associated with an existing certificate embedded pre-stored in the network device, wherein the addressing information is an Internet Protocol (IP) address of the third network device, wherein the first network device is a Dynamic Host Configuration Protocol (DHCP) server;
establishing a communication session between the second network device and a third network device to retrieve a bootstrapping digital certificate from the third network device, the third network device being different from the first network device;
continuing the communication session upon a determination that the first network device is in a different subnet as the third network device by verifying the bootstrapping digital certificate using an existing digital certificate embedded and pre-stored in the second network device,
establishing a secure channel, between the second network device and the third network device, using the bootstrapping digital certificate; and
downloading a user CA certificate from the third network device for storage within a trusted certificate list stored within the second network device, wherein the user CA certificate includes at least a public key associated with a user of the second network device digitally signed with a private key of a certificate authority.
11. The method of claim 10 wherein the second network device supports Internet Protocol (IP) telephony.
12. The method of claim 10 , wherein after receiving the addressing information from the first network device and the addressing information being a domain name of the third network device, the method further comprises fetching an Internet Protocol (IP) address of the third network device from a Domain Name Service (DNS) server based on the domain name and establishing the communication session with the third network device using the IP address.
13. The method of claim 12 further comprising: discontinuing the communication session upon determining that the DNS server and the first network device are in the same subnet.