TLS server certificate replacement using a notification mechanism
The present disclosure is related to devices, systems, and methods for TLS server certificate replacement using a notification mechanism. An example method can include establishing a first secure TLS connection between a client and a server verified by a first TLS certificate, creating a subscription for the client to receive a notification associated with a TLS certificate change, loading a second certificate to replace the first certificate, providing a notification to the client, wherein the notification includes the second certificate and a web token scoped to the client, and establishing a second secure TLS connection verified by the second TLS certificate responsive to the client verifying the web token.
1. A method, comprising:
establishing a first secure Transport Layer Security (TLS) connection between a client and a server verified by a first TLS certificate;
creating a subscription for the client to receive a notification associated with a TLS certificate change;
loading a second certificate to replace the first certificate;
providing a notification to the client, wherein the notification includes the second certificate and a web token scoped to the client; and
establishing a second secure TLS connection verified by the second TLS certificate responsive to the client verifying the web token.
2. The method of claim 1 , wherein the method includes receiving the first TLS certificate and the second TLS certificate issued by a custom certificate authority.
3. The method of claim 1 , wherein the first TLS certificate and the second TLS certificate are self-signed certificates.
4. The method of claim 1 , wherein creating the subscription includes receiving, from the client, an identification of a notification endpoint, a thumbprint of a certificate corresponding to the endpoint, and an access token audience.
5. The method of claim 4 , wherein the method includes providing the notification to the client responsive to verifying the certificate corresponding to the endpoint based on the thumbprint.
6. The method of claim 4 , wherein the web token is a JSON web token scoped for the client, and wherein the client verifying the web token includes retrieving JSON web key sets (JWKS) and verifying the JSON web token based on the JWKS.
7. The method of claim 1 , wherein the method includes breaking a chain of trust of the first TLS certificate.
8. A non-transitory machine-readable medium having instructions stored thereon which, when executed by a processor, cause the processor to:
establish a first secure Transport Layer Security (TLS) connection between a client and a server verified by a first TLS certificate;
create a subscription for the client to receive a notification associated with a TLS certificate change;
load a second certificate to replace the first certificate;
provide a notification to the client, wherein the notification includes the second certificate and a web token scoped to the client; and
establish a second secure TLS connection verified by the second TLS certificate responsive to the client verifying the web token.
9. The medium of claim 8 , including instructions to receive the first TLS certificate and the second TLS certificate issued by a custom certificate authority.
10. The medium of claim 8 , wherein the first TLS certificate and the second TLS certificate are self-signed certificates.
11. The medium of claim 8 , wherein the instructions to create the subscription include instructions to receive, from the client, an identification of a notification endpoint, a thumbprint of a certificate corresponding to the endpoint, and an access token audience.
12. The medium of claim 11 , including instructions to provide the notification to the client responsive to verifying the certificate corresponding to the endpoint based on the thumbprint.
13. The medium of claim 11 , wherein the web token is a JSON web token scoped for the client, and wherein the client verifying the web token includes retrieving JSON web key sets (JWKS) and verifying the JSON web token based on the JWKS.
14. The medium of claim 8 , wherein the method includes breaking a chain of trust of the first TLS certificate.
15. A system, comprising:
a first connection engine configured to establish a first secure Transport Layer Security (TLS) connection between a client and a server verified by a first TLS certificate;
a subscription engine configured to create a subscription for the client to receive a notification associated with a TLS certificate change;
a second certificate engine configured to load a second certificate to replace the first certificate;
a notification engine configured to provide a notification to the client, wherein the notification includes the second certificate and a web token scoped to the client; and
a second connection engine configured to establish a second secure TLS connection verified by the second TLS certificate responsive to the client verifying the web token.
16. The system of claim 15 , wherein the first connection engine is configured to receive the first TLS certificate and the second TLS certificate issued by a custom certificate authority.
17. The system of claim 15 , wherein the first TLS certificate and the second TLS certificate are self-signed certificates.
18. The system of claim 15 , wherein the subscription engine is configured to receive, from the client, an identification of a notification endpoint, a thumbprint of a certificate corresponding to the endpoint, and an access token audience.
19. The system of claim 18 , wherein the notification engine is configured to provide the notification to the client responsive to verifying the certificate corresponding to the endpoint based on the thumbprint.
20. The system of claim 18 , wherein the web token is a JSON web token scoped for the client, and wherein the client verifying the web token includes retrieving JSON web key sets (JWKS) and verifying the JSON web token based on the JWKS.