Granted Patent B1

US 9,614,833 · App. 14/530,315 · Granted Apr 4, 2017

Abstract

Claims (52)

1. A computer-implemented method for managing a plurality of digital certificates deployed on a server computing system, the method comprising:

identifying, in server configuration data stored on the server computing system, two or more digital certificates associated with a first server application hosted at an IP address and port on the server computing system, wherein each digital certificate is used to establish secure communication sessions between the server application and clients;

recording, for each digital certificate associated with the first server application, metadata indicating at least a validity period; and

managing a lifecycle of one or more of the digital certificates associated with the first server application based on the recorded metadata.

2. The method of claim 1 , further comprising:

identifying, in the server configuration data stored on the server computing system, one or more digital certificates associated with a second server application hosted at the IP address and port;

recording, for each digital certificate associated with the second server application, metadata indicating at least a validity period; and

managing a lifecycle of each of digital certificate associated with the first server application based on the recorded metadata.

3. The method of claim 2 , wherein the first server application and the second server application have distinct hostnames.

4. The method of claim 1 , wherein managing the lifecycle of one or more of the digital certificates associated with the first server application:

identifying one or more of the digital certificates to be renewed based on the recorded validity period;

generating, for each of the digital certificates to be renewed, a certificate signing request (CSR) submitted to a issuing certificate authority (CA);

receiving, for each CSR, a digital certificate; and

deploying each replacement digital certificate on the server computing system.

5. The method of claim 1 , wherein deploying each replacement digital certificate on the server computing system includes updating the server configuration data to reference each replacement certificate.

6. The method of claim 1 , wherein the two or more digital certificates associated with the first server application each employ a distinct key generation algorithm.

7. The method of claim 1 , wherein the server application is a web server hosting one or more websites, and wherein the configuration data stored on the server computing system provides configuration data for each of the one or more web sites.

8. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for managing a plurality of digital certificates deployed on a server computing system, the operation comprising:

identifying, in server configuration data stored on the server computing system, two or more digital certificates associated with a first server application hosted at an IP address and port on the server computing system, wherein each digital certificate is used to establish secure communication sessions between the server application and clients;

recording, for each digital certificate associated with the first server application, metadata indicating at least a validity period; and

managing a lifecycle of one or more of the digital certificates associated with the first server application based on the recorded metadata.

9. The computer-readable storage medium of claim 8 , wherein the operation further comprises:

identifying, in the server configuration data stored on the server computing system, one or more digital certificates associated with a second server application hosted at the IP address and port;

recording, for each digital certificate associated with the second server application, metadata indicating at least a validity period; and

managing a lifecycle of each of digital certificate associated with the first server application based on the recorded metadata.

10. The computer-readable storage medium of claim 9 , wherein the first server application and the second server application have distinct hostnames.

11. The computer-readable storage medium of claim 8 , wherein managing the lifecycle of one or more of the digital certificates associated with the first server application:

identifying one or more of the digital certificates to be renewed based on the recorded validity period;

generating, for each of the digital certificates to be renewed, a certificate signing request (CSR) submitted to a issuing certificate authority (CA);

receiving, for each CSR, a digital certificate; and

deploying each replacement digital certificate on the server computing system.

12. The computer-readable storage medium of claim 8 , wherein deploying each replacement digital certificate on the server computing system includes updating the server configuration data to reference each replacement certificate.

13. The computer-readable storage medium of claim 8 , wherein the two or more digital certificates associated with the first server application each employ a distinct key generation algorithm.

14. The computer-readable storage medium of claim 8 , wherein the server application is a web server hosting one or more websites, and wherein the configuration data stored on the server computing system provides configuration data for each of the one or more web sites.

15. A server computing system, comprising:

a processor; and

a memory hosting a certificate discovery and management application, which, when executed on the processor, performs an operation for managing a plurality of digital certificates deployed on the server computing system, the operation comprising:

identifying, in server configuration data stored on the server computing system, two or more digital certificates associated with a first server application hosted at an IP address and port on the server computing system, wherein each digital certificate is used to establish secure communication sessions between the server application and clients,

recording, for each digital certificate associated with the first server application, metadata indicating at least a validity period, and

managing a lifecycle of one or more of the digital certificates associated with the first server application based on the recorded metadata.

16. The system of claim 15 , wherein the operation further comprises:

identifying, in the server configuration data stored on the server computing system, one or more digital certificates associated with a second server application hosted at the IP address and port;

recording, for each digital certificate associated with the second server application, metadata indicating at least a validity period; and

managing a lifecycle of each of digital certificate associated with the first server application based on the recorded metadata.

17. The system of claim 16 , wherein the first server application and the second server application have distinct hostnames.

18. The system of claim 15 , wherein managing the lifecycle of one or more of the digital certificates associated with the first server application:

identifying one or more of the digital certificates to be renewed based on the recorded validity period;

generating, for each of the digital certificates to be renewed, a certificate signing request (CSR) submitted to a issuing certificate authority (CA);

receiving, for each CSR, a digital certificate; and

deploying each replacement digital certificate on the server computing system.

19. The system of claim 15 , wherein deploying each replacement digital certificate on the server computing system includes updating the server configuration data to reference each replacement certificate.

20. The system of claim 15 , wherein the server application is a web server hosting one or more websites, and wherein the configuration data stored on the server computing system provides configuration data for each of the one or more web sites.

Assignments (11)