Central certificate management

1. A method for certificate management for a plurality of clients performed by a certificate management system with at least one processor configured to perform the steps of:

receiving a first certificate for a subject, wherein the first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer;

generating a second certificate for the subject, wherein the generated second certificate for the subject comprises the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer;

receiving a request for the second certificate for the subject from one of the plurality of clients; and

transmitting the second certificate for the subject to the one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.

2. The method according to claim 1 , wherein

the first certificate for the first issuer comprises at least one of:

an issuer field with a second issuer, a serial number field with a second serial number, and a second public key, and

the second certificate for the first issuer comprises at least one of: an issuer field with a third issuer being different from the second issuer, a serial number field with a third serial number being different from the second serial number, and a third public key being different from the second public key.

3. The method according to claim 1 , wherein the second certificate for the first issuer comprises an issuer field with a second issuer and the second certificate is signed by a certificate for the second issuer.

4. The method according to claim 1 , wherein

the second certificate for the first subject comprises an Authority Information Access Extension in order to allow the one of the plurality of clients receiving the second certificate for the subject to download the second certificate for the first issuer for certificate chain construction.

5. The method according to claim 1 , wherein a certificate chain of the first certificate for the subject has a first root certificate and a certificate chain of the second certificate for the subject has a second root certificate being different from the first root certificate.

6. The method according to claim 1 , wherein the at least one processor is further configured to perform the steps of:

receiving a first certificate for another subject comprising another first public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer;

generating a second certificate for the other subject comprising the other first public key, an issuer field with the other first issuer and a serial number field with the other first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate; and

transmitting the second certificate for the other subject to one of the plurality of clients.

7. The method according to claim 1 , wherein the second certificate for the subject is stored in a storage at the certificate management system.

8. The method according to claim 1 , further comprising:

receiving, at one of the plurality of clients, the second certificate for the subject;

performing, at the one of the plurality of clients, a certificate chain validation process for the received second certificate for the subject; and

performing, at the one of the plurality of clients, on the basis of the first public key of the second certificate for the subject:

encrypting a message with the first public key of the second certificate for the subject and sending the encrypted message to the subject; or

checking the signature of a message of the subject on the basis of the first public key of the second certificate for the subject.

9. The method according to claim 8 , wherein the second certificate for the subject is stored in a storage at the one of the plurality of clients and further comprising:

checking, if the second certificate for the subject is stored in the storage of the one of the plurality of clients;

and

if the second certificate for the subject is not stored in the storage at the one of the plurality of clients, the one of the plurality of clients sending a request for the second certificate for the subject to the certificate management system and receiving the second certificate for the subject from the certificate management system.

10. A method for handling at a client a certificate for a subject, wherein a first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer, the method comprising the steps:

requesting, at the client, a second certificate for the subject;

providing, at the client, a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer, the step of providing the second certificate for the subject comprising:

checking, if the second certificate for the subject is stored in a storage;

if the second certificate for the subject is stored in the storage, retrieving the second certificate for the subject from the storage; and

if the second certificate for the subject is not stored in the storage, sending a request for the second certificate for the subject to a certificate management system;

receiving the second certificate for the subject from the certificate management system;

performing, at the client, a certificate chain validation process for the received second certificate for the subject; and

performing, at the client, an action on the basis of the first public key of the second certificate for the subject.

11. The method according to 10 , wherein a first certificate for another subject comprises another public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer, wherein the method comprises:

retrieving a second certificate for the other subject comprising the other public key of the first certificate for the other subject, an issuer field with the other first issuer and a serial number field with the first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate;

performing a certificate chain validation process for the received second certificate for the other subject; and

performing, at the client, an action on the basis of the other first public key of the second certificate for the other subject.

12. A non-transitory computer-readable medium having a program stored therein for certificate management for a plurality of clients configured to perform the following steps, when executed on one or more processor(s):

receiving a first certificate for a subject, wherein the first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer;

generating a second certificate for the subject, wherein the generated second certificate for the subject comprise the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer;

and

transmitting the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.

13. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein

the first certificate for the first issuer comprises at least one of: an issuer field with a second issuer, a serial number field with a second serial number, and a second public key; and

the second certificate for the first issuer comprises at least one of: an issuer field with a third issuer being different from the second issuer, a serial number field with a third serial number being different from the second serial number and a third public key being different from the second public key.

14. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein the second certificate for the first issuer comprises an issuer field with a second issuer and the second certificate is signed by a certificate for the second issuer.

15. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein

the second certificate for the first subject comprises an Authority Information Access Extension in order to allow the one of the plurality of clients receiving the second certificate for the subject to download the second certificate for the first issuer for certificate chain construction.

16. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein a certificate chain of the first certificate for the subject has a first root certificate and a certificate chain of the second certificate for the subject has a second root certificate being different from the first root certificate.

17. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein the steps comprise further:

receiving a first certificate for another subject comprising another first public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer;

generating a second certificate for the other subject comprising the other first public key, an issuer field with the other first issuer and a serial number field with the other first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate;

transmitting the second certificate for the other subject to one of the plurality of clients.

18. The non-transitory computer-readable medium having the program stored therein according to claim 12 , wherein the steps comprise further:

storing the second certificate for the subject in a storage;

and

sending the second certificate for the subject to another of the plurality of clients.

19. A certificate management system for managing certificates for a plurality of clients comprising:

a memory storing instructions for certificate management;

at least one processor configured to execute the instructions and:

receive a first certificate for a subject comprising a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer;

generate a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer;

and

transmit the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.