Accelerating OCSP responses via content delivery network collaboration
Techniques are disclosed for accelerating online certificate status protocol (OCSP) response distribution to relying parties using a content delivery network (CDN). A certificate authority generates updated OCSP responses for OCSP responses cached in the CDN that are about to expire. In addition, the certificate authority pre-generates cache keys in place of CDNs generating the keys. The certificate authority sends the OCSP responses and the cache keys in one transaction, and the CDN, in turn, consumes the new OCSP responses using the cache keys.
1. A computer-implemented method for distributing certificate validity messages to a first computing device associated with a content delivery network (CDN), the computer-implemented method comprising:
generating, at a second computing device associated with a certificate authority (CA), a plurality of certificate validity messages;
transmitting, by the second computing device, the plurality of certificate validity messages to the first computing device;
determining, by the second computing device, at least one certificate validity message of the plurality of certificate validity messages that requires updating; and
prior to receiving a request for the at least one certificate validity message from the first computing device, transmitting the at least one certificate validity message from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in a cache of the first computing device.
2. The computer-implemented method of claim 1 , wherein the first computing device is separate from the second computing device.
3. The computer-implemented method of claim 1 , wherein the first computing device comprises a CDN computing device and the second computing device comprises a CA computing device.
4. The computer-implemented method of claim 1 , further comprising transmitting one or more cache keys from the second computing device to the first computing device.
5. The computer-implemented method of claim 1 , further comprising transmitting one or more cache keys from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in the cache of the first computing device using the one or more cache keys.
6. The computer-implemented method of claim 1 , further comprising:
generating, at the second computing device, one or more cache keys;
transmitting the one or more cache keys from the second computing device to the first computing device; and
utilizing the at least one certificate validity message and the one or more cache keys to update the cache of the first computing device.
7. The computer-implemented method of claim 1 , further comprising:
identifying a cache key algorithm associated with the cache;
generating, at the second computing device, one or more cache keys using the cache key algorithm; and
transmitting the one or more cache keys from the second computing device to the first computing device.
8. The computer-implemented method of claim 1 , wherein determining the at least one certificate validity message of the plurality of certificate validity messages to transmit to the first computing device comprises identifying the at least one certificate validity message as expiring within a certain time period.
9. The computer-implemented method of claim 1 , wherein determining the at least one certificate validity message of the plurality of certificate validity messages to transmit to the first computing device comprises identifying the at least one certificate validity message has at least one of been revoked or expires within a certain time period.
10. The computer-implemented method of claim 1 , wherein determining the at least one certificate validity message of the plurality of certificate validity messages to transmit to the first computing device comprises identifying the at least one certificate validity message for which a respective status has been requested by one or more client computing devices at least a threshold number of times.
11. The computer-implemented method of claim 1 , wherein each of the plurality of certificate validity messages is an online certificate status protocol response.
12. The computer-implemented method of claim 1 , wherein each of the plurality of certificate validity messages identifies a status of a corresponding digital certificate.
13. The computer-implemented method of claim 1 , wherein the first computing device updates one or more certificate validity messages using the at least one certificate validity message.
14. A non-transitory, computer-readable storage media storing instructions, which, when executed on a processor, cause the processor to:
generate, at a second computing device associated with a certificate authority (CA), a plurality of certificate validity messages;
transmit, by the second computing device, the plurality of certificate validity messages to a first computing device associated with a content delivery network (CDN),
determine, by the second computing device, at least one certificate validity message of the plurality of certificate validity messages that require updating; and
prior to receiving a request for the at least one certificate validity message from the first computing device, transmit the at least one certificate validity message from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in a cache of the first computing device.
15. The non-transitory, computer-readable storage media of claim 14 , wherein the first computing device comprises a CDN computing device and the second computing device comprises a CA computing device.
16. The non-transitory, computer-readable storage media of claim 14 , wherein execution of instructions on the processor further cause the processor to transmit one or more cache keys from the second computing device to the first computing device.
17. The non-transitory, computer-readable storage media of claim 14 , wherein execution of instructions on the processor further cause the processor to transmit one or more cache keys from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in the cache of the first computing device using the one or more cache keys.
18. A system, comprising:
a processor and a memory hosting an application, which, when executed on the processor, causes the processor to:
generate, at a second computing device associated with a certificate authority (CA), a plurality of certificate validity messages;
transmit, by the second computing device, the plurality of certificate validity messages to a first computing device associated with a content delivery network (CDN);
determine, by the second computing device, at least one certificate validity message of the plurality of certificate validity messages that require updating; and
prior to receiving a request for the at least one certificate validity message from the first computing device, transmit the at least one certificate validity message from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in a cache of the first computing device.
19. The system of claim 18 , wherein execution of the application on the processor further cause the processor to transmit one or more cache keys from the second computing device to the first computing device.
20. The system of claim 18 , wherein execution of the application on the processor further cause the processor to transmit one or more cache keys from the second computing device to the first computing device, wherein the first computing device stores the at least one certificate validity message in the cache of the first computing device using the one or more cache keys.