Accelerating OCSP responses via content delivery network collaboration
Techniques are disclosed for accelerating online certificate status protocol (OCSP) response distribution to relying parties using a content delivery network (CDN). A certificate authority generates updated OCSP responses for OCSP responses cached in the CDN that are about to expire. In addition, the certificate authority pre-generates cache keys in place of CDNs generating the keys. The certificate authority sends the OCSP responses and the cache keys in one transaction, and the CDN, in turn, consumes the new OCSP responses using the cache keys.
1. A computer-implemented method for distributing certificate validity messages to a content delivery network (CDN) computing device, the computer-implemented method comprising:
generating, at a certificate authority (CA) computing device separate from the CDN computing device, a plurality of certificate validity messages;
identifying, at the CA computing device, a CDN cache key algorithm corresponding to a cache of the CDN computing device;
generating, at the CA computing device, a plurality of CDN cache keys using the CDN cache key algorithm; and
transmitting, from the CA computing device to the CDN computing device, at least one certificate validity message of the plurality of certificate validity messages and at least one CDN cache key of the plurality of CDN cache keys, wherein the CDN computing device uses the at least one CDN cache key to store the at least one certificate validity message in the cache.
2. The computer-implemented method of claim 1 , further comprising identifying a set of certificate validity messages that expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificate validity messages.
3. The computer-implemented method of claim 1 , further comprising identifying a set of certificates that at least one of have been revoked or expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
4. The computer-implemented method of claim 1 , further comprising identifying a set of certificates for which a respective status has been requested by one or more client computing devices at least a threshold number of times, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
5. The computer-implemented method of claim 1 , wherein said identifying the CDN cache key algorithm, comprises:
receiving the CDN cache key algorithm from the CDN computing device.
6. The computer-implemented method of claim 1 , wherein each of the plurality of certificate validity messages is an online certificate status protocol (OCSP) response.
7. The computer-implemented method of claim 1 , further comprising, transmitting, from the CA computing device to the CDN computing device, the plurality of certificate validity messages and the plurality of CDN cache keys to the CDN computing device, wherein the CDN computing device uses the plurality of CDN cache keys to store the plurality of certificate validity messages in the cache.
8. Non-transitory computer-readable storage media storing instructions, which, when executed by one or more processors of a certificate authority (CA) computing device separate from a content delivery network (CDN) computing device, cause the one or more processors to:
generate a plurality of certificate validity messages;
identify a CDN cache key algorithm corresponding to a cache of the CDN computing device;
generate a plurality of CDN cache keys using the CDN cache key algorithm; and
transmit, to the CDN computing device, at least one certificate validity message of the plurality of certificate validity messages and at least one CDN cache key of the plurality of CDN cache keys, wherein the CDN computing device uses the at least one CDN cache key to store the at least one certificate validity message in the cache.
9. The non-transitory computer-readable storage media of claim 8 , wherein the instructions further cause the one or more processors to identify a set of certificate validity messages that expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificate validity messages.
10. The non-transitory computer-readable storage media of claim 8 , wherein the instructions further cause the one or more processors to identify a set of certificates that at least one of have been revoked or expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
11. The non-transitory computer-readable storage media of claim 8 , wherein the instructions further cause the one or more processors to identify a set of certificates for which a respective status has been requested by one or more client computing devices at least a threshold number of times, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
12. The non-transitory computer-readable storage media of claim 8 , wherein, to identify the CDN cache key algorithm, the instructions further cause the one or more processors to:
receive the CDN cache key algorithm from the CDN computing device.
13. The non-transitory computer-readable storage media of claim 8 , wherein each of the plurality of certificate validity messages is an online certificate status protocol (OCSP) response.
14. The non-transitory computer-readable storage media of claim 8 , wherein the instructions further cause the one or more processors to transmit, to the CDN computing device, the plurality of certificate validity messages and the plurality of CDN cache keys to the CDN computing device, wherein the CDN computing device uses the plurality of CDN cache keys to store the plurality of certificate validity messages in the cache.
15. A system, comprising:
one or more processors of a certificate authority (CA) computing device that is separate from a content delivery network (CDN) computing device, the one or more processors configured to:
generate a plurality of certificate validity messages;
identify a CDN cache key algorithm corresponding to a cache of the CDN computing device;
generate a plurality of CDN cache keys using the CDN cache key algorithm; and
transmit, to the CDN computing device, at least one certificate validity message of the plurality of certificate validity messages and at least one CDN cache key of the plurality of CDN cache keys, wherein the CDN computing device uses the at least one CDN cache key to store the at least one certificate validity message in the cache.
16. The system of claim 15 , wherein the one or more processors are further configured to identify a set of certificate validity messages that expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificate validity messages.
17. The system of claim 15 , wherein the one or more processors are further configured to identify a set of certificates that at least one of have been revoked or expire within a certain time period, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
18. The system of claim 15 , wherein the one or more processors are further configured to identify a set of certificates for which a respective status has been requested by one or more client computing devices at least a threshold number of times, wherein the plurality of certificate validity messages is generated based at least in part on the set of certificates.
19. The system of claim 15 , wherein to identify the CDN cache key algorithm, the one or more processors are configured to:
receive the CDN cache key algorithm from the CDN computing device.
20. The system of claim 15 , wherein each of the plurality of certificate validity messages is an online certificate status protocol (OCSP) response.