Automated step-up digital certificate installation process
Techniques are disclosed for rapidly securing a server in response to request for a high-assurance digital certificate. As described, a CA may issue a basic tier certificate after performing a verification process to confirm that a party requesting a certificate for a given network domain, in fact, has control of that domain. Once issued and provisioned on the server, the server can establish secure connections with clients. At the same time, the CA continues to perform progressive identity verification processes for progressively higher tiers of certificates. Once the identity verification process at each tier is complete, the CA issues a new certificate for the corresponding tier, which may then be provisioned on the server. After performing all of the identity verification processes, the server can issue the requested high-assurance certificate.
1. A computer-implemented method for issuing a sequence of digital certificates to a requesting party, the method comprising:
in response to receiving, by a certificate authority, via a processor, a request for a digital certificate having a specified certificate type:
performing an initial identity verification process associated with an initial tier of digital certificates issued by the certificate authority, wherein the initial tier of digital certificates precedes a tier associated with the specified certificate type,
upon successfully completing the initial identity verification process, issuing a digital certificate with a certificate type corresponding to the initial tier,
performing one or more subsequent identity verification processes, wherein each subsequent identity verification process is associated with a subsequent tier of digital certificates issued by the certificate authority, and
upon successfully completing each subsequent identity verification process, issuing a digital certificate corresponding to the subsequent tier, until successfully completing an identity verification process associated with the specified certificate type and issuing a digital certificate having the specified certificate type, wherein each digital certificate is provisioned on a server having a network domain and allows the server to establish secure network connections.
2. The method of claim 1 , wherein the initial tier of digital certificates comprise Domain Validation (DV) certificates and wherein the initial identity verification process comprises receiving an indication verifying that the requesting party controls the network domain to be named in the DV certificate.
3. The method of claim 1 , wherein a first subsequent tier of digital certificates comprises Organization Validation (OV) certificates and wherein the subsequent identity verification process associated with the first subsequent tier of digital certificates comprises receiving a verification that an organization to be named in the OV certificate exists as stated in enrollment data provided by the requesting party.
4. The method of claim 1 , wherein a second subsequent tier of digital certificates comprises Extended Validation (EV) certificates and wherein the subsequent identity verification process associated with the second subsequent tier of digital certificates comprises receiving a verification that an individual submitting the request on behalf of an organization to be named in the OV certificate is authorized by the organization to submit the request.
5. The method of claim 1 , further comprising, after completing one of the subsequent identity verification processes and issuing the digital certificate corresponding to the associated tier of digital certificates, revoking a digital certificate issued for a previous tier.
6. The method of claim 1 , wherein each subsequent identity verification process is performed after successfully completing a previous one of the identify verification processes.
7. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for issuing a sequence of digital certificates to a requesting party, the operation comprising:
in response to receiving, by a certificate authority, a request for a digital certificate having a specified certificate type:
performing an initial identity verification process associated with an initial tier of digital certificates issued by the certificate authority, wherein the initial tier of digital certificates precedes a tier associated with the specified certificate type,
upon successfully completing the initial identity verification process, issuing a digital certificate with a certificate type corresponding to the initial tier,
performing one or more subsequent identity verification processes, wherein each subsequent identity verification process is associated with a subsequent tier of digital certificates issued by the certificate authority, and
upon successfully completing each subsequent identity verification process, issuing a digital certificate corresponding to the subsequent tier, until successfully completing an identity verification process associated with the specified certificate type and issuing a digital certificate having the specified certificate type, wherein each digital certificate is provisioned on a server having a network domain and allows the server to establish secure network connections.
8. The computer-readable storage medium of claim 7 , wherein the initial tier of digital certificates comprise Domain Validation (DV) certificates and wherein the initial identity verification process comprises receiving an indication verifying that the requesting party controls the network domain to be named in the DV certificate.
9. The computer-readable storage medium of claim 7 , wherein a first subsequent tier of digital certificates comprises Organization Validation (OV) certificates and wherein the subsequent identity verification process associated with the first subsequent tier of digital certificates comprises receiving a verification that an organization to be named in the OV certificate exists as stated in enrollment data provided by the requesting party.
10. The computer-readable storage medium of claim 7 , wherein a second subsequent tier of digital certificates comprises Extended Validation (EV) certificates and wherein the subsequent identity verification process associated with the second subsequent tier of digital certificates comprises receiving a verification that an individual submitting the request on behalf of an organization to be named in the OV certificate is authorized by the organization to submit the request.
11. The computer-readable storage medium of claim 7 , wherein the operation further comprises, after completing one of the subsequent identity verification processes and issuing the digital certificate corresponding to the associated tier of digital certificates, revoking a digital certificate issued for a previous tier.
12. The computer-readable storage medium of claim 7 , wherein each subsequent identity verification process is performed after successfully completing a previous one of the identify verification processes.
13. A system, comprising:
a processor; and
a memory storing one or more application programs configured to perform an operation for issuing a sequence of digital certificates to a requesting party, the operation comprising:
in response to receiving, by a certificate authority via the processor, a request for a digital certificate having a specified certificate type:
performing an initial identity verification process associated with an initial tier of digital certificates issued by the certificate authority, wherein the initial tier of digital certificates precedes a tier associated with the specified certificate type;
upon successfully completing the initial identity verification process, issuing a digital certificate with a certificate type corresponding to the initial tier;
performing one or more subsequent identity verification processes, wherein each subsequent identity verification process is associated with a subsequent tier of digital certificates issued by the certificate authority; and
upon successfully completing each subsequent identity verification process, issuing a digital certificate corresponding to the subsequent tier, until successfully completing an identity verification process associated with the specified certificate type and issuing a digital certificate having the specified certificate type, wherein each digital certificate is provisioned on a server having a network domain and allows the server to establish secure network connections.
14. The system of claim 13 , wherein the initial tier of digital certificates comprise Domain Validation (DV) certificates and wherein the initial identity verification process comprises receiving an indication verifying that the requesting party controls the network domain to be named in the DV certificate.
15. The system of claim 13 , wherein a first subsequent tier of digital certificates comprises Organization Validation (OV) certificates and wherein the subsequent identity verification process associated with the first subsequent tier of digital certificates comprises receiving a verification that an organization to be named in the OV certificate exists as stated in enrollment data provided by the requesting party.
16. The system of claim 13 , wherein a second subsequent tier of digital certificates comprises Extended Validation (EV) certificates and wherein the subsequent identity verification process associated with the second subsequent tier of digital certificates comprises receiving a verification that an individual submitting the request on behalf of an organization to be named in the OV certificate is authorized by the organization to submit the request.
17. The system of claim 13 , wherein the operation further comprises, after completing one of the subsequent identity verification processes and issuing the digital certificate corresponding to the associated tier of digital certificates, revoking a digital certificate issued for a previous tier.
18. The system of claim 13 , wherein each subsequent identity verification process is performed after successfully completing a previous one of the identify verification processes.