Dynamically serving digital certificates based on secure session properties

1. A method in a server, comprising:

receiving a first request from a first client network application executing on a first client device that initiates a first handshake procedure to establish a first secure session;

analyzing the first request to determine a first set of one or more properties of the first request, wherein the determined first set of one or more properties specifies that the first client network application supports:

an Elliptic Curve Digital Signature Algorithm (ECDSA) with a first cryptographic hash algorithm, and

a Rivest-Shamir-Adleman (RSA) signature algorithm with a second cryptographic hash algorithm;

selecting, from a plurality of certificates for a hostname for the server that includes a first certificate that is signed using ECDSA with the first cryptographic hash algorithm and a second certificate that is signed using RSA with the second cryptographic hash algorithm, the first certificate based at least in part on the determined first set of one or more properties of the first request; and

returning the selected first certificate to the first client network application.

2. The method of claim 1 , wherein at least one property of the determined first set of one or more properties is that the first request specifies the hostname.

3. The method of claim 2 , wherein at least one property of the determined first set of one or more properties is that the first request specifies which one or more signature and hash algorithm pairs is supported by the first client network application.

4. The method of claim 1 , further comprising:

receiving a second request from a second client network application executing on a second client device that initiates a second handshake procedure to establish a second secure session;

analyzing the second request to determine a second set of one or more properties of the second request including whether the second request specifies the hostname and whether the second request specifies which one or more signature and hash algorithm pairs is supported by the second client network application;

responsive to the determined second set of properties not specifying the hostname or not specifying which one or more signature and hash algorithm pairs is supported by the second client network application, selecting, from the plurality of certificates for the hostname for the server, the second certificate; and

returning the selected second certificate to the second client network application.

5. The method of claim 1 , wherein the first cryptographic hash algorithm is a same algorithm as the second cryptographic hash algorithm.

6. The method of claim 1 , wherein at least one property of the determined first set of one or more properties includes a list of cipher suites specified in the first request as being supported by the first client network application.

7. The method of claim 1 , wherein selecting the first certificate from the plurality of certificates for the hostname for the server further includes accessing a certificate selection rule that is defined by a customer belonging to the hostname.

8. The method of claim 1 , wherein the received first request from the first client network application is a ClientHello message, and wherein analyzing the first request includes analyzing one or more extensions of the ClientHello message.

9. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a server, will cause said processor to perform operations comprising:

receiving a first message from a first client network application executing on a first client device that initiates a first handshake procedure to establish a first secure session;

determining that the first message includes a first set of one or more properties that specify a hostname for the server and indicate one or more signature and hash algorithm pairs supported by the first client network application;

selecting, from a plurality of certificates for the hostname and based on the first set of one or more properties included in the first message, a first certificate for the hostname that is signed using one of the one or more signature and hash algorithm pairs supported by the first client network application;

transmitting the selected first certificate to the first client network application;

receiving a second message from a second client network application executing on a second client device that initiates a second handshake procedure to establish a second secure session;

determining that the second message does not include a second set of one or more properties that specify the hostname and indicate a set of one or more signature and hash algorithm pairs supported by the second client network application;

selecting, from the plurality of certificates for the hostname and based on the determination that the second message does not include the first set of one or more properties that specify the hostname and indicate one or more signature and hash algorithm pairs supported by the second client network application, a second certificate for the hostname that is compatible for the second client network application, wherein the first certificate and the second certificate use a different signature and hash algorithm pair; and

transmitting the selected second certificate to the second client network application.

10. The non-transitory machine-readable storage medium of claim 9 , wherein selecting the first certificate is further based on a set of one or more cipher suites listed in the first message, wherein the first certificate is compatible with the set of one or more cipher suites.

11. The non-transitory machine-readable storage medium of claim 9 , wherein the selected second certificate is signed using a Rivest-Shamir-Adleman (RSA) signature algorithm with a Secure Hash Algorithm 1 (SHA-1) cryptographic hash algorithm.

12. The non-transitory machine-readable storage medium of claim 9 , wherein the one or more signature and hash algorithm pairs supported by the first client network application include a Rivest-Shamir-Adleman (RSA) signature algorithm with a Secure Hash Algorithm 256 (SHA-256) cryptographic hash algorithm, and wherein the selected first certificate is signed using the RSA signature algorithm with the SHA-256 cryptographic hash algorithm.

13. The non-transitory machine-readable storage medium of claim 9 , wherein the one or more signature and hash algorithm pairs supported by the first client network application include: a Rivest-Shamir-Adleman (RSA) signature algorithm with a Secure Hash Algorithm 256 (SHA-256) cryptographic hash algorithm; and an Elliptic Curve Digital Signature Algorithm (ECDSA) with the SHA-256 cryptographic hash algorithm; and wherein the selected first certificate is signed using ECDSA with the SHA-256 cryptographic hash algorithm.

14. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor of a server, will cause said processor to perform operations comprising:

receiving a first request from a first client network application executing on a first client device that initiates a first handshake procedure to establish a first secure session;

analyzing the first request to determine a first set of one or more properties of the first request, wherein the determined first set of one or more properties specifies that the first client network application supports:

an Elliptic Curve Digital Signature Algorithm (ECDSA) with a first cryptographic hash algorithm, and

a Rivest-Shamir-Adleman (RSA) signature algorithm with a second cryptographic hash algorithm;

selecting, from a plurality of certificates for a hostname for the server that includes a first certificate that is signed using ECDSA with the first cryptographic hash algorithm and a second certificate that is signed using RSA with the second cryptographic hash algorithm, the first certificate based at least in part on the determined first set of one or more properties of the first request; and

returning the selected first certificate to the first client network application.

15. The non-transitory machine-readable storage medium of claim 14 , wherein at least one property of the determined first set of one or more properties is that the first request specifies the hostname.

16. The non-transitory machine-readable storage medium of claim 15 , wherein at least one property of the determined first set of one or more properties is that the first request specifies which one or more signature and hash algorithm pairs is supported by the first client network application.

17. The non-transitory machine-readable storage medium of claim 14 , wherein the operations further comprise:

receiving a second request from a second client network application executing on a second client device that initiates a second handshake procedure to establish a second secure session;

analyzing the second request to determine a second set of one or more properties of the second request including whether the second request specifies the hostname and whether the second request specifies which one or more signature and hash algorithm pairs is supported by the second client network application;

responsive to the determined second set of properties not specifying the hostname or not specifying which one or more signature and hash algorithm pairs is supported by the second client network application, selecting, from the plurality of certificates for the hostname for the server, the second certificate; and

returning the selected second certificate to the second client network application.

18. The non-transitory machine-readable storage medium of claim 14 , wherein the first cryptographic hash algorithm is a same algorithm as the second cryptographic hash algorithm.

19. The non-transitory machine-readable storage medium of claim 14 , wherein at least one property of the determined first set of one or more properties includes a list of cipher suites specified in the first request as being supported by the first client network application.

20. The non-transitory machine-readable storage medium of claim 14 , wherein selecting the first certificate from the plurality of certificates for the hostname for the server further includes accessing a certificate selection rule that is defined by a customer belonging to the hostname.

21. The non-transitory machine-readable storage medium of claim 14 , wherein the received first request from the first client network application is a ClientHello message, and wherein analyzing the first request includes analyzing one or more extensions of the ClientHello message.