Reducing latency for certificate validity messages using private content delivery networks
Techniques are disclosed for accelerating online certificate status protocol (OCSP) response distribution to relying parties using a content delivery network (CDN). A certificate authority generates updated OCSP responses for OCSP responses cached in the CDN that are about to expire. In addition, the certificate authority pre-generates cache keys in place of CDNs generating the keys. The certificate authority sends the OCSP responses and the cache keys in one transaction, and the CDN, in turn, serves requests for the OCSP responses using the cache keys. For new certificates, a private CDN is pre-populated with an OCSP response for a certificate concurrent with that certificate being issued. Doing so effectively uses the PCDN as an origin server for OCSP responses, reducing CA infrastructure needs.
1. A computer-implemented method for reducing response latency for certificate validity messages using a private content delivery network, the method comprising:
generating, by a certificate authority, a digital certificate;
upon generating the digital certificate and a certificate validity message for the digital certificate, prompting, by the certificate authority, a computing server in a private content delivery network (PCDN) to request the certificate validity message, wherein the PCDN caches content for distribution to a plurality of local CDN nodes; and
upon receiving a request for the certificate validity message from the PCDN, sending the certificate validity message to the PCDN.
2. The method of claim 1 , wherein the PCDN responds to requests for the certificate validity message from the plurality of local CDN nodes.
3. The method of claim 2 , wherein each local CDN node, after receiving the certificate validity message from the PCDN, caches the certificate validity message.
4. The method of claim 1 , wherein the certificate validity message is an online certificate status protocol (OCSP) response.
5. The method of claim 1 , wherein the digital certificate is an SSL certificate binding a public key listed in the certificate to a server domain named in the certificate.
6. The method of claim 1 , wherein the certificate validity message specifies a validity period for relying on the certificate validity message.
7. The method of claim 6 , further comprising:
generating an updated certificate validity message for the digital certificate; and
sending the updated certificate validity message to the PCDN.
8. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for reducing response latency for certificate validity messages using a private content delivery network, the operation comprising:
generating, by a certificate authority, a digital certificate;
upon generating the digital certificate and a certificate validity message for the digital certificate, prompting, by the certificate authority, a computing server in a private content delivery network (PCDN) to request the certificate validity message, wherein the PCDN caches content for distribution to a plurality of local CDN nodes; and
upon receiving a request for the certificate validity message from the PCDN, sending the certificate validity message to the PCDN.
9. The computer-readable storage medium of claim 8 , wherein the PCDN responds to requests for the certificate validity message from the plurality of local CDN nodes.
10. The computer-readable storage medium of claim 9 , wherein each local CDN node, after receiving the certificate validity message from the PCDN, caches the certificate validity message.
11. The computer-readable storage medium of claim 8 , wherein the certificate validity message is an online certificate status protocol (OCSP) response.
12. The computer-readable storage medium of claim 8 , wherein the digital certificate is an SSL certificate binding a public key listed in the certificate to a server domain named in the certificate.
13. The computer-readable storage medium of claim 8 , wherein the certificate validity message specifies a validity period for relying on the certificate validity message.
14. The computer-readable storage medium of claim 13 , wherein the operation further comprises:
generating an updated certificate validity message for the digital certificate; and
sending the updated certificate validity message to the PCDN.
15. A system, comprising:
a processor; and
a memory hosting an application, which, when executed on the processor, performs an operation for reducing response latency for certificate validity messages using a private content delivery network, the operation comprising:
generating, by a certificate authority, a digital certificate,
upon generating the digital certificate and a certificate validity message for the digital certificate, prompting, by the certificate authority, a computing server in a private content delivery network (PCDN) to request the certificate validity message, wherein the PCDN caches content for distribution to a plurality of local CDN nodes, and
upon receiving a request for the certificate validity message from the PCDN, sending the certificate validity message to the PCDN.
16. The system of claim 15 , wherein the PCDN responds to requests for the certificate validity message from the plurality of local CDN nodes, and wherein each local CDN node, after requesting the certificate validity message from the PCDN, caches the certificate validity message.
17. The system of claim 15 , wherein the certificate validity message is an online certificate status protocol (OCSP) response.
18. The system of claim 15 , wherein the digital certificate is an SSL certificate binding a public key listed in the certificate to a server domain named in the certificate.
19. The system of claim 15 , wherein the certificate validity message specifies a validity period for relying on the certificate validity message.
20. The system of claim 19 , wherein the operation further comprises:
generating an updated certificate validity message for the digital certificate; and
sending the updated certificate validity message to the PCDN.