Assisted certificate enrollment
View Patent ↗A certificate enrollment assistant module may be provided to inject a challenge password into a certificate signing request to be sent, to a Certificate Authority, from a computing device. The certificate enrollment assistant module, thereby, acts as a trusted proxy to assist the computing device in building a valid certificate signing request without the computing device having access to the challenge password.
1. A method of requesting a certificate, said method comprising:
transmitting a certificate signing request to a certificate enrollment assistant module;
receiving, from said certificate enrollment assistant module, a hash of an altered version of said certificate signing request, said altered version of said certificate signing request including a challenge password;
signing said hash to produce a signature for said altered version of said certificate signing request;
transmitting said signature for said altered version of said certificate signing request to said certificate enrollment assistant module;
receiving an enveloped version of said altered version of said certificate signing request;
determining a signature for said enveloped version of said altered version of said certificate signing request; and
transmitting said enveloped version of said altered version of said certificate signing request and said signature for said enveloped version of said altered version of said certificate signing request to a certificate authority.
2. The method of claim 1 further comprising receiving, from said certificate authority, a certificate.
3. The method of claim 2 wherein said receiving said certificate comprises receiving said certificate via another device.
4. The method of claim 1 wherein said certificate signing request complies with Public Key Cryptography Standard 10.
5. The method of claim 1 , further comprising, before said transmitting said certificate signing request to said certificate:
generating a public key and a corresponding private key; and
based on said public key, creating said certificate signing request.
6. The method of claim 5 , wherein said signing said hash uses said private cryptographic key.
7. The method of claim 5 , wherein said determining said signature further comprises:
obtaining a hash of said enveloped version of said altered version of said certificate signing request; and
signing, using said private key, said hash of said enveloped version of said altered version of said certificate signing request.
8. The method of claim 1 further comprising transmitting said certificate signing request to said certificate enrollment assistant module with said signature for said altered version of said certificate signing request.
9. The method of claim 1 further comprising transmitting a Registration Authority certificate to said certificate enrollment assistant module with said signature for said altered version of said certificate signing request.
10. The method of claim 1 wherein said enveloped version of said altered version of said certificate signing request comprises an encrypted version of said altered version of said certificate signing request.
11. The method of claim 10 wherein said enveloped version of said altered version of said certificate signing request complies with Public Key Cryptography Standard 7.
12. The method of claim 1 wherein said transmitting said enveloped version of said altered version of said certificate signing request and said signature for said enveloped version of said altered version of said certificate signing request to a certificate authority comprises transmitting said enveloped version via another device.
13. A computing device comprising:
a communication subsystem operated to:
transmit a certificate signing request to a certificate enrolment assistant module;
receive, from said certificate enrolment assistant module, a hash of an altered version of said certificate signing request, said altered version of said certificate signing request including a challenge password;
transmit a signature for said altered version of said certificate signing request to said certificate enrolment assistant module;
receive an enveloped version of said altered version of said certificate signing request;
transmit said enveloped version of said altered version of said certificate signing request and a signature for said enveloped version of said altered version of said certificate signing request to a certificate authority; and
a processor operated to:
sign said hash to produce said signature; and
determine said signature for said enveloped version of said altered version of said certificate signing request.
14. A non-transitory computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause said processor to:
transmit a certificate signing request to a certificate enrolment assistant module;
receive, from said certificate enrolment assistant module, a hash of an altered version of said certificate signing request, said altered version of said certificate signing request including a challenge password;
sign said hash to produce a signature for said altered version of said certificate signing request;
transmit said signature to said certificate enrolment assistant module;
receive an enveloped version of said altered version of said certificate signing request;
determine a signature for said enveloped version of said altered version of said certificate signing request; and
transmit said enveloped version of said altered version of said certificate signing request and said signature for said enveloped version of said altered version of said certificate signing request to a certificate authority.