System and method for automated customer verification
Techniques are disclosed for identifying and authenticating prospective certificate authority customers of a secure socket layer (SSL) certificate prior to receiving an order from the customer. The CA generates a list of prospective customers of digital certificates (e.g., by scanning networked servers via the Internet for the presence of an installed digital certificate). The CA retrieves data for each customer on the list and determines, based on a set of approval criteria, which prospective customers to target in enrollment campaigns. For each approved customer, the CA initiates an enrollment process prior to receiving a request from the customer to provide a certificate.
1. A computer-implemented method for identifying and authenticating a domain name associated with a computer server prior to receiving a request for a digital certificate, the method comprising:
scanning, by a processor associated with a first certificate authority, a communication port of a plurality of computer servers, each of the plurality of computer servers hosting a respective website;
identifying, by the processor, a group of computer servers of the plurality of computer servers that include a first digital certificate generated by a second certificate authority and installed thereon based on said scanning the communication port of the plurality of computer servers, wherein the second certificate authority is different from the first certificate authority; and
for at least one computer server of the group of computer servers:
performing, by the processor, a security handshake,
receiving, by the processor, the first digital certificate based on said performing the security handshake,
parsing, by the processor, the first digital certificate;
identifying, by the processor, a domain name and organization information of an organization associated with the website hosted by the at least one computer server based on said parsing the first digital certificate,
verifying, by the processor, in one or more databases, the domain name and the organization information of the organization,
prior to receiving a request for a second digital certificate that associates the organization with the domain name, performing a first partial authentication, by the processor, of the organization for the second digital certificate based on said verifying the domain name and the organization information, wherein authentication of the organization is based on the first partial authentication and a second partial authentication, wherein the first partial authentication comprises performing one or more initial steps of the authentication of the organization,
receiving, by the processor, the request for the second digital certificate from the organization,
based on receiving the request for the second digital certificate and performing the first partial authentication, performing, by the processor, the second partial authentication of the organization for the second digital certificate, wherein the second partial authentication comprises performing one or more subsequent steps of the authentication of the organization, and
generating, by the processor, the second digital certificate based on the first partial authentication and the second partial authentication.
2. The method of claim 1 , further comprising, prior to receiving the request for the second digital certificate from the organization, sending a message to the organization, wherein the message indicates an availability of a partially approved second digital certificate.
3. The method of claim 1 , wherein the second partial authentication is based on information obtained from the organization after said receiving the request for the second digital certificate from the organization.
4. A non-transitory computer-readable storage medium storing computer-executable instructions for identifying and authenticating a domain name associated with a computer server prior to receiving, at a first certificate authority, a request for a digital certificate that, when executed by a processor, cause the processor to:
scan a communication port of a plurality of computer servers, each of the computer servers hosting a respective website;
identify a group of computer servers of the plurality of computer servers that include a first digital certificate generated by a second certificate authority and installed thereon based on the scan of the communication port of the plurality of computer servers; and
for at least one computer server of the group of computer servers:
perform a security handshake,
receive the first digital certificate based on said performing the security handshake,
parse the first digital certificate,
identify a domain name and organization information of an organization associated with the website hosted by the at least one computer server based on parsing of the first digital certificate,
verify, in one or more databases, the domain name and the organization information of the organization, and
prior to receiving a request for a second digital certificate from the organization, perform a first partial authentication of the organization for the second digital certificate based on verification of the domain name and the organization information, wherein the second digital certificate associates the organization with the domain name, wherein authentication of the organization is based on the first partial authentication and a second partial authentication, wherein the first partial authentication comprises performing one or more initial steps of the authentication of the organization.
5. The computer-readable storage medium of claim 4 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to send a message to the organization, wherein the message indicates an availability of a partially approved second digital certificate.
6. The non-transitory computer-readable storage medium of claim 4 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to, receive the request for the second digital certificate from the organization.
7. The non-transitory computer-readable storage medium of claim 6 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to, generate the second digital certificate based on the first partial authentication of the organization for the second digital certificate and the request for the second digital certificate.
8. The non-transitory computer-readable storage medium of claim 7 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to, after reception of the request for the second digital certificate, perform the second partial authentication of the organization for the second digital certificate.
9. The non-transitory computer-readable storage medium of claim 7 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to, based on receiving the request for the second digital certificate and performing the first partial authentication, perform the second partial authentication of the organization for the second digital certificate, wherein the second partial authentication comprises performing one or more subsequent steps of the authentication of the organization.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the second partial authentication is based on information obtained from the organization after reception of the request for the second digital certificate from the organization.
11. The non-transitory computer-readable storage medium of claim 9 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to generate the second digital certificate based on the first partial authentication and the second partial authentication.
12. A system, comprising:
a processor associated with a first certificate authority; and
non-transitory, computer readable media storing computer-executable instructions for identifying and authenticating potential customers of digital certificates prior to receiving, at the first certificate authority, a request for a digital certificate from the potential customers, wherein the computer-executable instructions when executed by the processor, cause the processor to:
scan a communication port of a plurality of computer servers, each of the computer servers hosting a respective website,
identify at least one computer server of the plurality of computer servers that includes a first digital certificate generated by a second certificate authority and installed thereon based on said scanning the communication port of the plurality of computer servers, and
for the at least one computer server:
perform a security handshake,
receive the first digital certificate based on the security handshake,
parse the first digital certificate,
identify a domain name and organization information of an organization associated with the website hosted by the at least one computer server based on parsing the first digital certificate,
verify, in one or more databases, the domain name and the organization information of the organization,
prior to receiving a request for a second digital certificate that associates the organization with the domain name, perform a first partial authentication of the organization for the second digital certificate based on verification of the domain name and the organization information, wherein authentication of the organization is based on the first partial authentication and a second partial authentication, wherein the first partial authentication comprises performing one or more initial steps of the authentication of the organization,
receive the request for the second digital certificate from the organization,
based on receiving the request for the second digital certificate and performing the first partial authentication, perform the second partial authentication of the organization for the second digital certificate, wherein the second partial authentication comprises performing one or more subsequent steps of the authentication of the organization, and
generate the second digital certificate based on the first partial authentication and the second partial authentication.
13. The system of claim 12 , wherein the computer-executable instructions, when executed by the processor, further cause the processor to send a message to the organization, wherein the message indicates an availability of a partially approved second digital certificate.
14. The system of claim 12 , wherein the second partial authentication is based on information obtained from the organization after reception of the request for the second digital certificate from the organization.