Granted Patent B2

US 8,364,954 · App. 12/639,771 · Granted Jan 29, 2013

Abstract

Claims (68)

1. A computer-implemented method of provisioning a first digital certificate and a second digital certificate based on an existing digital certificate, the method comprising:

receiving, at a data processor, information related to the existing digital certificate, wherein the existing digital certificate includes a public key, a first name listed in a Subject field, and a second name listed in a SubjectAltName extension;

receiving, at the data processor, an indication from a user to split the existing digital certificate;

extracting, at the data processor, the first name from the Subject field of the existing digital certificate;

extracting, at the data processor, the second name from the SubjectAltName extension of the existing digital certificate;

extracting, at the data processor, the public key from the existing digital certificate;

provisioning, at the data processor, the first digital certificate with the first name, listed in a Subject field of the first digital certificate, and the public key; and

provisioning, at the data processor, the second digital certificate with the second name, listed in a Subject field of the second digital certificate, and the public key.

2. The method of claim 1 wherein the existing digital certificate complies with RFC 5280.

3. The method of claim 1 wherein the existing digital certificate further includes a third name listed in the SubjectAltName extension, the method further comprising:

extracting the third name from the SubjectAltName extension of the existing digital certificate; and

provisioning the third certificate with the third name, listed in a Subject field of the third digital certificate, and the public key.

4. The method of claim 1 further comprising extracting validity period information for the first digital certificate and the second digital certificate from the existing digital certificate.

5. The method of claim 1 wherein provisioning the first digital certificate and the second digital certificate comprises digitally signing the first digital certificate and the second digital certificate with a private key of a certificate authority.

6. A certificate provisioning system comprising:

a data processor;

a communications module coupled to the data processor; and

a computer readable medium coupled to the data processor and storing a plurality of instructions for controlling the data processor to provision a first digital certificate and a second digital certificate based on an existing digital certificate, the plurality of instructions comprising:

instructions that cause the data processor to receive information related to the existing digital certificate, wherein the existing digital certificate includes a public key, a first name listed in a Subject field, and a second name listed in a SubjectAltName extension;

instructions that cause the data processor to receive an indication from a user to split the existing digital certificate;

instructions that cause the data processor to extract the first name from the Subject field of the existing digital certificate;

instructions that cause the data processor to extract the second name from the SubjectAltName extension of the existing digital certificate;

instructions that cause the data processor to extract the public key from the existing digital certificate;

instructions that cause the data processor to provision the first digital certificate with the first name, listed in a Subject field of the first digital certificate, and the public key; and

instructions that cause the data processor to provision the second digital certificate with the second name, listed in a Subject field of the second digital certificate, and the public key.

7. The system of claim 6 wherein the existing digital certificate complies with RFC 5280.

8. The system of claim 6 wherein the existing digital certificate further includes a third name listed in the SubjectAltName extension, the plurality of instructions further comprising:

instructions that cause the data processor to extract the third name from the SubjectAltName extension of the existing digital certificate; and

instructions that cause the data processor to provision the third certificate with the third name, listed in a Subject field of the third digital certificate, and the public key.

9. The system of claim 6 wherein the plurality of instructions further comprise instructions that cause the data processor to extract validity period information for the first digital certificate and the second digital certificate from the existing digital certificate.

10. The system of claim 6 wherein the plurality of instructions further comprise instructions that cause the data processor to digitally sign the first digital certificate and the second digital certificate with a private key of a certificate authority.

11. A computer-implemented method of provisioning a first digital certificate and a second digital certificate based on an existing digital certificate, the method comprising:

receiving, at a data processor, an indication to split the existing digital certificate, wherein the existing digital certificate includes an existing public key, a first name listed in a Subject field, and a second name listed in a SubjectAltName extension;

receiving, at the data processor, a first certificate signing request (CSR including a first new public key different from the existing public key;

extracting, at the data processor, the first name from the Subject field of the existing digital certificate;

provisioning, at the data processor, the first digital certificate with the first name, listed in a Subject field of the first digital certificate, and the first new public key;

determining, at the data processor, that the second name is listed in the SubjectAltName extension of the existing digital certificate;

receiving, at the data processor, a second CSR including a second new public key different from the existing public key;

extracting, at the data processor, the second name from the SubjectAltName extension of the existing digital certificate; and

provisioning, at the data processor, the second digital certificate with the second name, listed in a Subject field of the second digital certificate, and the second new public key.

12. The method of claim 11 wherein the existing digital certificate complies with RFC 5280.

13. The method of claim 11 wherein the existing digital certificate further includes a third name listed in the SubjectAltName extension, the method further comprising:

receiving a third CSR including a third new public key different from the existing public key;

extracting the third name from the SubjectAltName extension of the existing digital certificate; and

provisioning the third certificate with the third name, listed in a Subject field of the third digital certificate, and the third new public key.

14. The method of claim 11 further comprising extracting validity period information for the first digital certificate and the second digital certificate from the existing digital certificate.

15. The method of claim 11 further comprising receiving contact information and validity period information for at least one of the first digital certificate or the second digital certificate from a user.

16. The method of claim 11 wherein provisioning the first digital certificate and the second digital certificate comprises digitally signing the first digital certificate and the second digital certificate with a private key of a certificate authority.

17. A certificate provisioning system comprising:

a data processor;

a communications module coupled to the data processor; and

a computer readable medium coupled to the data processor and storing a plurality of instructions for controlling the data processor to provision a first digital certificate and a second digital certificate based on an existing digital certificate, the plurality of instructions comprising:

instructions that cause the data processor to receive an indication to split the existing digital certificate, wherein the existing digital certificate includes an existing public key, a first name listed in a Subject field, and a second name listed in a SubjectAltName extension;

instructions that cause the data processor to receive a first certificate signing request (CSR including a first new public key different from the existing public key;

instructions that cause the data processor to extract the first name from the Subject field of the existing digital certificate;

instructions that cause the data processor to provision the first digital certificate with the first name, listed in a Subject field of the first digital certificate, and the first new public key;

instructions that cause the data processor to determine that the second name is listed in the SubjectAltName extension of the existing digital certificate;

instructions that cause the data processor to receive a second CSR including a second new public key different from the existing public key;

instructions that cause the data processor to extract the second name from the SubjectAltName extension of the existing digital certificate; and

instructions that cause the data processor to provision the second digital certificate with the second name, listed in a Subject field of the second digital certificate, and the second new public key.

18. The system of claim 17 wherein the existing digital certificate complies with RFC 5280.

19. The system of claim 17 wherein the existing digital certificate further includes a third name listed in the SubjectAltName extension, the plurality of instructions further comprising:

instructions that cause the data processor to receive a third CSR including a third new public key different from the existing public key;

instructions that cause the data processor to extract the third name from the SubjectAltName extension of the existing digital certificate; and

instructions that cause the data processor to provision the third certificate with the third name, listed in a Subject field of the third digital certificate, and the third new public key.

20. The system of claim 17 wherein the plurality of instructions further comprise instructions that cause the data processor to extract validity period information for the first digital certificate and the second digital certificate from the existing digital certificate.

21. The system of claim 17 wherein the plurality of instructions further comprise instructions that cause the data processor to receive contact information and validity period information for at least one of the first digital certificate or the second digital certificate from a user.

22. The system of claim 17 wherein the plurality of instructions further comprise instructions that cause the data processor to digitally sign the first digital certificate and the second digital certificate with a private key of a certificate authority.

Assignments (12)