Method and apparatus for selecting a certificate authority

1. A method for selecting a certificate authority in a communication system comprising a plurality of administrative domains, the method comprising:

at a certificate authority selection unit,

receiving, from an end-entity via an interface, a certificate service request associated with an identifier;

selecting, based on the identifier, one of the plurality of administrative domains in the communication system, wherein the plurality of administrative domains are serviced by a plurality of certificate authorities;

retrieving a security profile for the end-entity; and

selecting, based on the security profile for the end-entity, one of the plurality of certificate authorities to process the certificate service request.

2. The method of claim 1 , wherein the identifier comprises a distinguished name having a set of attributes.

3. The method of claim 2 , wherein the one administrative domain is selected based on the set of attributes in the distinguished name.

4. The method of claim 2 , wherein a mapping table is used to select the administrative domain based on the distinguished name.

5. The method of claim 1 further comprising the certificate authority selection unit selecting a registration authority based on the security profile for the end-entity.

6. The method of claim 1 further comprising the certificate authority selection unit selecting an administrative entity to service the certificate service request based on the security profile for the end-entity, wherein the selected certificate authority is mapped to the selected administrative entity.

7. The method of claim 1 further comprising the certificate authority selection unit determining a policy identification that identifies a set of policies for the selected administrative domain, and selecting the certificate authority based on the policy identification.

8. The method of claim 7 further comprising the certificate authority selection unit applying the set of policies for the selected administrative domain to the certificate service request.

9. The method of claim 1 , wherein the certificate service request comprises one of a certificate enrollment request, a certificate renewal request, or a certificate revocation request.

10. The method of claim 1 further comprising the certificate authority selection unit selecting a signing key from a plurality of signing keys and identifying the signing key to the selected certificate authority for signing a certificate as a result of processing the certificate service request.

11. The method of claim 10 , wherein the signing key is a private key in a public/private key pair that is selected from a plurality of public/private key pairs.

12. A system for processing certificate service requests, the system comprising:

a plurality of administrative domains coupled to and serviced by a plurality of certificate authorities;

an interface that receives a certificate service request from an end-entity, wherein the certificate service request is associated with a distinguished name;

a certificate authority selection unit coupled to the plurality of administrative domains and the interface and that:

selects, based on the distinguished name, one of the plurality of administrative domains;

determines a policy identification that identifies a set of policies for the selected administrative domain

retrieves a security profile for the end-entity; and

selects, based on the security profile and the policy identification, one of the plurality of certificate authorities to process the certificate service request.

13. The system of claim 12 , wherein the interface comprises a common interface that places the certificate service request in a common format, wherein the common interface is accessible across multiple geographical regions.

14. The system of claim 12 , wherein the plurality of certificate authorities comprise virtual certificate authorities on a single physical machine.

15. The system of claim 12 , wherein at least some of the plurality of certificate authorities are located on different physical machines.

16. The system of claim 12 , wherein the system comprises a public key infrastructure (PKI) system.

17. A non-transitory computer-readable storage element having computer readable code stored thereon for programming a computer to perform a method for selecting a certificate authority in a communication system comprising a plurality of administrative domains, the method comprising:

receiving, from an end-entity via an interface, a certificate service request associated with a distinguished name having a set of attributes;

selecting, based on the attributes of the distinguished name, one of the plurality of administrative domains in the communication system, wherein the plurality of administrative domains a serviced by a plurality of virtual certificate authorities;

retrieving a security profile for the end-entity;

selecting, based on the security profile for the end-entity, one of the plurality of virtual certificate authorities to process the certificate service request;

selecting a key pair from a plurality of key pairs, wherein the selected key pair comprises a private key and a public key, and identifying the key pair to the selected virtual certificate authority for signing a certificate using the private key upon processing the certificate service request.

18. The non-transitory computer-readable storage element of claim 1 , wherein the method further comprising:

determining a policy identification that identifies a set of policies for the selected administrative domain; and

using a mapping function to select the virtual certificate authority based on the policy identification and the security profile for the end-entity.