Granted Patent B1

US 8,707,027 · App. 13/539,867 · Granted Apr 22, 2014

Abstract

Claims (50)

1. A method comprising:

receiving, by a certificate management sensor executing on a processor of a first computing device, first instructions from a certificate management system (CMS) over a first network to analyze a second computing device on a second network to identify an application on the second computing device associated with cryptographic network traffic on the second computing device;

determining, by the certificate management sensor, an application identity of the application operating on the second computing device that uses a cryptographic certificate in response to the first instructions, wherein the application identity comprises an application name, an application version and an operating system identifier;

generating, by the certificate management sensor, an application fingerprint of the application, wherein generating the application fingerprint comprises determining a checksum of a file on disk that corresponds to the application using the cryptographic certificate, a size of the file, and a byte pattern from the file;

transmitting, by the certificate management sensor, the application fingerprint to the CMS in response to the first instructions;

receiving, by the certificate management sensor, second instructions from the CMS to generate a certificate signing request (CSR) for a new, renewed or replacement certificate for the application, wherein the second instructions are generated by the CMS based on the application fingerprint received from the certificate management sensor;

generating, by the certificate management sensor, the CSR for the new, renewed or replacement certificate for the application in response to the second instructions;

transmitting, by the certificate management sensor, the CSR to the CMS over the first network in response to the second instructions;

receiving, by the certificate management sensor, third instructions from the CMS to automatically install the new, renewed or replacement certificate on the second computing device in response to the CSR; and

initiating execution of the third instructions to automatically install the new, renewed or replacement certificate on the second computing system.

2. The method of claim 1 , wherein the cryptographic certificate comprises one of a Secure Socket Layer (SSL) server certificate or a Transport Layer Security (TLS) server certificate.

3. The method of claim 1 , wherein the initiating execution of the third instructions comprises:

accessing, by the certificate management sensor, the second computing system over the second network via a remote session; and

executing the third instructions to automatically install new, renewed or replacement certificate on the second computing device via the remote session.

4. The method of claim 1 , wherein the initiating execution of the third instructions comprises instructing an agent operating on the second computing device to install the cryptographic certificate according to the third instructions.

5. The method of claim 1 , wherein the byte pattern comprises a fixed number of bytes extracted from the file from at least one of a first 1 kB, a last 1 kB, or a middle 1 kB of the file.

6. The method of claim 1 , wherein the first instructions to analyze the second computing device further comprise directions to identify a configuration of the second computing device, the configuration comprising at least one of an operating system, an IP address, a port used by the cryptographic network traffic, an expiration date of the cryptographic certificate, a signature algorithm information, key length information, or certificate issuer information.

7. A computing system, comprising:

a memory; and

a processor coupled with the memory to execute a certificate management sensor configured to:

receive first instructions from a certificate management system (CMS) over a first network to analyze a second computing device on a second network to identify an application on the second computing device associated with cryptographic network traffic on the second computing device;

determine an application identity of an application operating on the second computing device that uses a cryptographic certificate in response to the first instructions, wherein the application identity comprises an application name, an application version and an operating system identifier;

generate an application fingerprint of the application, wherein certificate management sensor is to determine a checksum of a file on disk that corresponds to the application using the cryptographic certificate, a size of the file, and a byte pattern from the file;

transmit the application fingerprint to the CMS in response to the first instructions;

receive second instructions from the CMS to generate a certificate signing request (CSR) for a new, renewed or replacement certificate for the application, wherein the second instructions are generated by the CMS based on the application fingerprint received from the certificate management sensor;

generate the CSR for the new, renewed or replacement certificate for the application in response to the second instructions;

transmit the CSR to the CMS over the first network in response to the second instructions;

receive third instructions from the CMS to automatically install the new, renewed or replacement certificate on the second computing device in response to the CSR; and

initiate execution of the third instructions to automatically install the new, renewed or replacement certificate on the second computing system.

8. The computing system of claim 7 , wherein the cryptographic certificate comprises one of a Secure Socket Layer (SSL) server certificate or a Transport Layer Security (TLS) server certificate.

9. The computing system of claim 7 , wherein the certificate management sensor is further configured to access the second computing system over the second network via a remote session and execute the third instructions to automatically install the new, renewed or replacement certificate on the second computing device via the remote session.

10. The computing system of claim 7 , wherein the certificate management sensor is further configured to instruct an agent operating on the computing device to install the cryptographic certificate according to the third instructions.

11. The computing system of claim 7 , wherein the byte pattern comprises a fixed number of bytes extracted from the file from at least one of a first 1 kB, a last 1 kB, or a middle 1 kB of the file.

12. The computing system of claim 7 , wherein the first instructions to analyze the second computing device further comprise directions to identify a configuration of the second computing device, the configuration comprising at least one of an operating system, an IP address, a port used by the cryptographic network traffic, an expiration date of the cryptographic certificate, a signature algorithm information, key length information, or certificate issuer information.

13. A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform operations comprising:

receiving, from a certificate management sensor executing on a first computing device, first instructions from a certificate management system (CMS) over a first network to analyze a second computing device on a second network to identify an application on the second computing device associated with cryptographic network traffic on the second computing device;

determining, by the certificate management sensor, an application identity of an application operating on the second computing device that uses a cryptographic certificate in response to the first instructions, wherein the application identity comprises an application name, an application version and an operating system identifier;

generating, by the certificate management sensor, an application fingerprint of the application, wherein generating the application fingerprint comprises determining a checksum of a file on disk that corresponds to the application using the cryptographic certificate, a size of the file, and a byte pattern from the file;

transmitting, by the certificate management sensor, the application fingerprint to the CMS in response to the first instructions;

receiving, by the certificate management sensor, second instructions from the CMS to generate a certificate signing request (CSR) for a new, renewed or replacement certificate for the application, wherein the second instructions are generated by the CMS based on the application fingerprint received from the certificate management sensor;

generating, by the certificate management sensor, the CSR for the new, renewed or replacement certificate for the application in response to the second instructions;

transmitting, by the certificate management sensor, the CSR to the CMS over the first network in response to the second instructions;

receiving, by the certificate management sensor, third instructions from the CMS to automatically install the new, renewed or replacement certificate on the second computing device in response to the CSR; and

initiating execution of the third instructions to automatically install the new, renewed or replacement certificate on the second computing system.

14. The non-transitory computer readable storage medium of claim 13 , wherein the initiating execution of the third instructions comprises:

accessing, by the certificate management sensor, the second computing system over the second network via a remote session; and

executing the third instructions to automatically install new, renewed or replacement certificate on the second computing device via the remote session.

15. The non-transitory computer readable storage medium of claim 13 , wherein the initiating execution of the third instructions comprises instructing an agent operating on the second computing device to install the cryptographic certificate according to the third instructions.

16. The non-transitory computer readable storage medium of claim 13 , wherein the byte pattern comprises a fixed number of bytes extracted from the file from at least one of a first 1 kB, a last 1 kB, or a middle 1 kB of the file.

17. The non-transitory computer readable storage medium of claim 13 , wherein the first instructions to analyze the second computing device further comprise directions to identify a configuration of the second computing device, the configuration comprising at least one of an operating system, an IP address, a port used by the cryptographic network traffic, an expiration date of the cryptographic certificate, a signature algorithm information, key length information, or certificate issuer information.

Assignments (11)