Methods and apparatus to renew digital certificates
An example disclosed method for use in a device configured to communicate using digital certificates includes, in response to a request, receiving a digital certificate for use in secure communications between the device and another device; evaluating, using a logic circuit, the digital certificate to determine a validity of the digital certificate; when the digital certificate is valid, allowing use of the digital certificate by the device; and when the digital certificate is invalid, preventing use of the digital certificate by the device.
1. A method for use in a device configured to communicate using digital certificates, the method comprising:
in response to an instruction to generate a certificate signing request (CSR), generating the CSR in accordance with the instruction, wherein generating the CSR comprises generating characteristics of the CSR, wherein the CSR characteristics prohibit the use of at least one of one or more outdated security schemes and one or more key sizes;
transmitting the CSR;
in response to a request, receiving, by the device, a new digital certificate to replace an existing digital certificate for use in secure communications between the device and another device;
when the new digital certificate is received, prior to storing or otherwise implementing the new digital certificate on the device, evaluating, using a logic circuit of the device, the new digital certificate to determine a validity of the new digital certificate to replace the existing digital certificate, the evaluating comprises determining whether the new digital certificate utilizes any of the at least one of the one or more outdated security schemes and one or more key sizes prohibited by the CSR characteristics;
when the new digital certificate is valid, allowing use of the new digital certificate by the device in place of the existing digital certificate; and
when the new digital certificate is invalid, prohibiting use of the new digital certificate by the device and enabling the device to continue operating using the existing digital certificate despite receipt of the new digital certificate by the device.
2. The method of claim 1 , further comprising, when the new digital certificate is invalid, notifying a host of the invalidity, wherein the host is configured to track expiration dates of digital certificates.
3. The method of claim 1 , wherein the new digital certificate includes a public key of an asymmetric encryption scheme.
4. The method of claim 1 , wherein determining the validity of the new digital certificate comprises determining whether the new digital certificate is based on an undesired encryption function.
5. The method of claim 4 , wherein the undesired encryption function is a type of hash function.
6. The method of claim 1 , wherein determining the validity of the new digital certificate comprises determining a size of a key associated with the new digital certificate.
7. The method of claim 1 , wherein determining the validity of the new digital certificate comprises determining whether a validity period of the new digital certificate matches a time of the apparatus.
8. The method of claim 1 , wherein determining the validity of the new digital certificate comprises determining whether the new digital certificate is a match with a private key of an asymmetric encryption scheme.
9. The method of claim 1 , wherein prohibiting use of the new digital certificate by the device includes rejecting the new digital certificate and prohibiting storage of the new digital certificate on the device.
10. The method of claim 1 , wherein prohibiting use of the new digital certificate when the new digital certificate is determined to be invalid comprises discarding the new digital certificate before installing the new digital certificate on the device.
11. The method of claim 1 , wherein the device includes a digital certificate storage that stores the existing digital certificate for use on the device, the new digital certificate is received by the device to replace the existing digital certificate in the digital certificate storage, and prohibiting use of the new digital certificate when the new digital certificate is determined to be invalid comprises preventing the new digital certificate from being stored in the digital certificate storage.
12. An apparatus comprising:
a request generator generates and transmits a certificate signing request (CSR); and
a certificate verifier evaluates a new digital certificate received in response to the CSR to replace an existing digital certificate, wherein the certificate verifier is configured to:
when the new digital certificate is received, prior to storing or otherwise implementing the new digital certificate on the device, determine whether the new digital certificate received by the apparatus is valid by determining whether the new digital certificate utilizes any of the at least one of the one or more outdated security schemes and one or more key sizes prohibited by the CSR characteristics;
when the new digital certificate is valid, allow use of the digital certificate by the apparatus; and
when the new digital certificate is invalid, prohibit use of the new digital certificate by the apparatus protecting the apparatus against negative impacts to functionality of the apparatus caused by the invalid digital certificate and enable the apparatus to continue operating using the existing digital certificate despite receipt of the new digital certificate by the device, wherein at least one of the request generator and the certificate verifier is implemented by a logic circuit of the apparatus.
13. The apparatus of claim 12 , wherein the certificate verifier is configured to, when the new digital certificate is invalid, notify a host of the invalidity, wherein the host is configured to track expiration dates of digital certificates.
14. The apparatus of claim 12 , wherein the new digital certificate includes a public key of an asymmetric encryption scheme.
15. The apparatus of claim 12 , wherein the certificate verifier is configured to determine the validity of the new digital certificate by determining whether the digital certificate is based on an undesired encryption function.
16. The method of claim 15 , wherein the undesired encryption function is a type of hash function.
17. The apparatus of claim 12 , wherein the certificate verifier is configured to determine the validity of the new digital certificate by determining a size of a key associated with the new digital certificate.
18. The apparatus of claim 12 , wherein the certificate verifier is configured to determine the validity of the new digital certificate by determining whether a validity period of the new digital certificate matches a time of the apparatus.
19. The apparatus of claim 12 , wherein the certificate verifier is configured to determine the validity of the new digital certificate by determining whether the new digital certificate is a match with a private key of an asymmetric encryption scheme.
20. The apparatus of claim 12 , wherein prohibiting use of the new digital certificate by the device includes rejecting the new digital certificate and prohibiting storage of the new digital certificate on the device.
21. A machine-readable storage device comprising instructions that, when executed, cause a machine to at least:
in response to an instruction to generate a certificate signing request (CSR), generate the CSR in accordance with the instruction, wherein the CSR comprises characteristics of the CSR, wherein the CSR characteristics prohibit the use of at least one of one or more outdated security schemes and one or more key sizes;
transmit the CSR;
in response to a request, receive a new digital certificate to replace an existing digital certificate for use in secure communications between the device and another device;
when the new digital certificate is received, prior to storing or otherwise implementing the new digital certificate on the device, evaluate, using a logic circuit, the new digital certificate to determine a validity of the digital certificate to replace the existing digital certificate, the new digital certificate is evaluated to determine whether the new digital certificate utilizes any of the at least one of the one or more outdated security schemes and one or more key sizes prohibited by the CSR characteristics;
when the new digital certificate is valid, allow use of the new digital certificate by the device in place of the existing digital certificate; and
when the new digital certificate is invalid, prevent use of the new digital certificate by the device certificate and enable continued operation using the existing digital certificate despite receipt of the new digital certificate.