Identity-based certificate management
Methods for managing digital certificates, including issuance, validation, and revocation are disclosed. Various embodiments involve querying a directory service with entries that correspond to a particular client identity and have attributes including certificate issuance limits and certificate validity time values. The validity time values are adjustable to revoke selectively the certificates based upon time intervals set forth in validity identifiers included therein.
1. A method comprising:
as implemented by an authentication server, the authentication server configured with specific executable instructions,
receiving a digital certificate revocation request corresponding to a client identity referenced by a user account name, wherein the digital certificate revocation request is submitted via a browser application and comprises a validity time stamp;
querying a directory service for an entry that corresponds to the client identity, wherein the entry comprises a validity time value;
modifying the validity time value in the entry in the directory service such that the modified validity time value is the validity time stamp; and
revoking a digital certificate issued to a client system and associated with the client identity that has a validity start time before the modified validity time value or a validity end time before the modified validity time value.
2. The method of claim 1 , wherein the entry comprises an issuance count value corresponding to a number of digital certificates issued to the client identity.
3. The method of claim 2 , further comprising decrementing the issuance count value in the entry by a number of digital certificates that are revoked.
4. The method of claim 2 , wherein the issuance count value does not exceed a certificate issuance limit value associated with the client identity.
5. The method of claim 1 , wherein the directory service is a Standard Query Language (SQL) database.
6. The method of claim 1 , wherein the validity time stamp comprises a dynamic certificate validation date.
7. The method of claim 6 , wherein the dynamic certificate validation date of the validity time stamp is configured to be modified through an administration panel user interface.
8. The method of claim 1 , wherein the validity time stamp comprises a set of date values that identify a year, month, and day, and a set of time values that identify an hour and minute.
9. A system comprising:
a database; and
a computing system comprising one or more computing devices, said computing system programmed via executable instructions to at least:
receive a digital certificate revocation request corresponding to a client identity referenced by a user account name, wherein the digital certificate revocation request is submitted via a browser application and comprises a validity time stamp;
query the database for an entry that corresponds to the client identity, wherein the entry comprises a validity time value;
modify the validity time in the entry in the database such that the modified validity time value is the validity time stamp; and
revoke a digital certificate issued to a client system and associated with the client identity that has a validity start time before the modified validity time value or a validity end time before the modified validity time value.
10. The system of claim 9 , wherein the entry comprises an issuance count value corresponding to a number of digital certificates issued to the client identity.
11. The system of claim 10 , wherein the computing system is further programmed via executable instructions to decrement the issuance count value in the entry by a number of digital certificates that are revoked.
12. The system of claim 10 , wherein the issuance count value does not exceed a certificate issuance limit value associated with the client identity.
13. The system of claim 9 , wherein the database is a Standard Query Language (SQL) database.
14. The system of claim 9 , wherein the validity time stamp comprises a dynamic certificate validation date.
15. The system of claim 14 , wherein the dynamic certificate validation date of the validity time stamp is configured to be modified through an administration panel user interface.
16. The system of claim 9 , wherein the validity time stamp comprises a set of date values that identify a year, month, and day, and a set of time values that identify an hour and minute.
17. A non-transitory computer storage medium that comprises executable instructions that when executed by a computing system, directs the computing system to at least:
receive a digital certificate revocation request corresponding to a client identity referenced by a user account name, wherein the digital certificate revocation request is submitted via a browser application and comprises a validity time stamp;
query a database for an entry that corresponds to the client identity, wherein the entry comprises a validity time value;
modify the validity time value in the entry in the database such that the modified validity time value is the validity time stamp; and
revoke a digital certificate issued to a client system and associated with the client identity that has a validity start time before the modified validity time value or a validity end time before the modified validity time value.
18. The non-transitory computer storage medium of claim 17 , wherein the entry comprises an issuance count value corresponding to a number of digital certificates issued to the client identity.
19. The non-transitory computer storage medium of claim 18 , wherein the executable instructions, when executed by a computing system, further directs the computing system to decrement the issuance count value in the entry by a number of digital certificates that are revoked.
20. The non-transitory computer storage medium of claim 17 , wherein the validity time stamp comprises a set of date values that identify a year, month, and day, and a set of time values that identify an hour and minute.
21. The method of claim 1 , wherein revoking a digital certificate further comprises revoking the digital certificate without using a certificate revocation list or an online certificate status protocol.
22. A method comprising:
as implemented by an authentication server, the authentication server configured with specific executable instructions,
receiving a digital certificate revocation request corresponding to a client identity, wherein the digital certificate revocation request is submitted via a browser application and comprises a validity time stamp;
querying a directory service for an entry that corresponds to the client identity, wherein the entry comprises a validity time value, wherein the entry comprises an issuance count value corresponding to a number of digital certificates issued to the client identity, and wherein the issuance count value does not exceed a certificate issuance limit value associated with the client identity;
modifying the validity time value in the entry in the directory service such that the modified validity time value is the validity time stamp; and
revoking a digital certificate issued to a client system and associated with the client identity that has a validity start time before the modified validity time value or a validity end time before the modified validity time value.
23. A system comprising:
a database; and
a computing system comprising one or more computing devices, said computing system programmed via executable instructions to at least:
receive a digital certificate revocation request corresponding to a client identity, wherein the digital certificate revocation request is submitted via a browser application and comprises a validity time stamp;
query the database for an entry that corresponds to the client identity, wherein the entry comprises a validity time value, wherein the entry comprises an issuance count value corresponding to a number of digital certificates issued to the client identity, and wherein the issuance count value does not exceed a certificate issuance limit value associated with the client identity;
modify the validity time in the entry in the database such that the modified validity time value is the validity time stamp; and
revoke a digital certificate issued to a client system and associated with the client identity that has a validity start time before the modified validity time value or a validity end time before the modified validity time value.