Assisted certificate enrollment
View Patent ↗A certificate enrollment assistant module may be provided to inject a challenge password into a certificate signing request to be sent, to a Certificate Authority, from a computing device. The certificate enrollment assistant module, thereby, acts as a trusted proxy to assist the computing device in building a valid certificate signing request without the computing device having access to the challenge password.
1. A method of assisting a computing device to request a certificate, said method comprising:
receiving, from a computing device, a certificate signing request;
amending said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;
determining a hash of said password-carrying certificate signing request;
transmitting said hash to said computing device;
receiving, from said computing device, said certificate signing request and a signature;
amending said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;
encrypting said signed, password-carrying certificate signing request to produce an encrypted signed, password-carrying certificate signing request; and
transmitting, to said computing device, said encrypted, signed, password-carrying certificate signing request.
2. The method of claim 1 further comprising, subsequent to said receiving said certificate signing request, authenticating said certificate signing request.
3. The method of claim 1 further comprising, subsequent to said receiving said certificate signing request, updating said certificate signing request to include further information.
4. The method of claim 1 further comprising:
receiving a certificate including a public cryptographic key;
wherein said encrypting comprises using said public cryptographic key to encrypt said signed, password-carrying certificate signing request.
5. The method of claim 4 wherein said certificate comprises a Registration Authority certificate.
6. A certificate enrolment assistant module comprising:
a communication subsystem operable to:
receive, from a computing device, a certificate signing request;
transmit a hash to said computing device;
receive, from said computing device, said certificate signing request and a signature;
transmit, to said computing device, an encrypted, signed, password-carrying certificate signing request;
a processor adapted to:
amend said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;
determine said hash of said password-carrying certificate signing request;
amend said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;
encrypt said signed, password-carrying certificate signing request to produce said encrypted signed, password-carrying certificate signing request.
7. A corporate communication infrastructure within which the certificate enrolment assistant module of claim 6 is deployed.
8. A computer-readable medium containing computer-executable instructions that, when performed by a processor in a computing device, cause said processor to:
receive, from a computing device, a certificate signing request;
amend said certificate signing request to include a challenge password to produce a password-carrying certificate signing request;
determine a hash of said password-carrying certificate signing request;
transmit said hash to said computing device;
receive, from said computing device, said certificate signing request and a signature;
amend said certificate signing request to include a challenge password to produce a signed, password-carrying certificate signing request;
encrypt said signed, password-carrying certificate signing request to produce an encrypted signed, password-carrying certificate signing request; and
transmit, to said computing device, said encrypted, signed, password-carrying certificate signing request.