Splitting certificate status responses evenly across multiple distributed certificate status responders
View Patent ↗Techniques are disclosed for evenly distributing certificate status validity messages across multiple response servers. A certificate authority (CA) may partition subsets of online certificate status protocol (OCSP) responses to each be handled by OCSP response servers. The partitions are based on serial numbers of the underlying digital certificates of the OCSP responses. For example, to determine which OCSP response server is assigned to distribute a particular OCSP response, a modulo operation may be performed between the last octet value of the underlying certificate serial number and the total number of available OCSP response servers of the CA. The result yields a partition number that may be used to identify the corresponding OCSP response server.
1. A method for responding to requests to determine a validity status of a digital certificate, the method comprising:
receiving, by a first response server, a request to provide a status of a digital certificate from a requesting client;
evaluating the request to identify a response server, of a plurality of response servers, assigned to process the request;
upon determining the identified response server is the first response server, sending a certificate status validity message corresponding to the request to the requesting client; and
otherwise, forwarding the request to the identified response server, wherein the identified response server sends the certificate status validity message, which indicates the certificate status as being either valid or invalid, to the requesting client.
2. The method of claim 1 , wherein the request is an online certificate status protocol (OCSP) request, and wherein the certificate status validity message is an OCSP response.
3. The method of claim 1 , wherein the first response server stores certificate validity messages corresponding to at least one of a plurality of digital certificates in a cache, wherein the first response server is assigned to send the certificate validity messages to requesting clients.
4. The method of claim 3 , wherein sending the certificate status validity message comprises:
retrieving, from the cache, the certificate status validity message corresponding to the request; and
sending the certificate status validity message to the requesting client.
5. The method of claim 1 , wherein evaluating the request comprises:
performing a modulo operation using a last octet of a serial number of the digital certificate identified in the request and a total number of available response servers.
6. The method of claim 5 , wherein a result of the modulo operation identifies the response server assigned to process the request.
7. A non-transitory computer-readable storage medium storing instructions, which, when executed on a hardware processor, performs an operation for responding to requests to determine a validity status of a digital certificate, the operation comprising:
receiving, by a first response server, a request to provide a status of a digital certificate from a requesting client;
evaluating the request to identify a response server, of a plurality of response servers, assigned to process the request;
upon determining the identified response server is the first response server, sending a certificate status validity message corresponding to the request to the requesting client; and
otherwise, forwarding the request to the identified response server, wherein the identified response server sends the certificate status validity message, which indicates the certificate status as being either valid or invalid, to the requesting client.
8. The computer-readable storage medium of claim 7 , wherein the request is an online certificate status protocol (OCSP) request, and wherein the certificate status validity message is an OCSP response.
9. The computer-readable storage medium of claim 7 , wherein the first response server stores certificate validity messages corresponding to at least one of a plurality of digital certificates in a cache, wherein the first response server is assigned to send the certificate validity messages to requesting clients.
10. The computer-readable storage medium of claim 9 , wherein sending the certificate status validity message comprises:
retrieving, from the cache, the certificate status validity message corresponding to the request; and
sending the certificate status validity message to the requesting client.
11. The computer-readable storage medium of claim 7 , wherein evaluating the request comprises:
performing a modulo operation using a last octet of a serial number of the digital certificate identified in the request and a total number of available response servers.
12. The computer-readable storage medium of claim 11 , wherein a result of the modulo operation identifies the response server assigned to process the request.
13. A system, comprising:
a hardware processor; and
a memory hosting an application, which, when executed on the processor, performs an operation for responding to requests to determine a validity status of a digital certificate, the operation comprising:
receiving, by a first response server, a request to provide a status of a digital certificate from a requesting client;
evaluating the request to identify a response server, of a plurality of response servers, assigned to process the request;
upon determining the identified response server is the first response server, sending a certificate status validity message corresponding to the request to the requesting client; and
otherwise, forwarding the request to the identified response server, wherein the identified response server sends the certificate status validity message, which indicates the certificate status as being either valid or invalid, to the requesting client.
14. The system of claim 13 , wherein the request is an online certificate status protocol (OCSP) request, and wherein the certificate status validity message is an OCSP response.
15. The system of claim 13 , wherein the first response server stores certificate validity messages corresponding to at least one of a plurality of digital certificates in a cache, wherein the first response server is assigned to send the certificate validity messages to requesting clients.
16. The system of claim 15 , wherein sending the certificate status validity message comprises:
retrieving, from the cache, the certificate status validity message corresponding to the request; and
sending the certificate status validity message to the requesting client.
17. The system of claim 13 , wherein evaluating the request comprises:
performing a modulo operation using a last octet of a serial number of the digital certificate identified in the request and a total number of available response servers.
18. The system of claim 13 , wherein a result of the modulo operation identifies the response server assigned to process the request.