Identifying and maintaining secure communications
In one embodiment, a system for managing secure communications includes an interface that may receive communication between a first endpoint and a second endpoint. A processor may identify a security certificate included in the communication and determine whether the identified security certificate has previously been stored in a certificate database. If the security certificate has not been previously stored in a certificate database, the processor may store the identified security certificate in the certificate database. The processor may also analyze parameters of the identified security certificate including a host device using the certificate, a network administrator responsible for the host device, an expiration date of the security certificate, and a certification authority issuing the security certificate.
1. A system for managing secure communications, comprising:
a certificate database operable to store a list of previously identified security certificates;
an interface operable to:
receive a communication between a first endpoint and a second endpoint; and
a security certificate module implemented by a processor communicatively coupled to the interface and operable to:
identify a security certificate included in the communication;
analyze parameters of the identified security certificate, wherein the parameters comprise:
a certificate type for the security certificate, wherein the certificate type is associated with certain types of communications;
a host device using the security certificate;
a network administrator responsible for the host device;
an expiration date of the security certificate; and
a certification authority issuing the security certificate;
determine whether the host device is utilizing a correct certificate type for the security certificate in the communication;
compare the identified security certificate to the list of previously identified security certificates;
determine whether the identified security certificate has previously been stored in the certificate database based on the comparison;
determine whether the security certificate is part of a chain of multiple security certificates, wherein:
the chain of multiple security certificates comprises a root certificate linked with one or more intermediate certificates; and
the root certificate is used to sign the one or more intermediate certificates;
determine whether each of the security certificates in the chain of multiple security certificates has been previously stored in the certificate database;
store the identified security certificate in the certificate database in response to:
determining that the identified security certificate has not been previously stored in the certificate database;
determining that the host device is utilizing the correct certificate type for the security certificate in the communication; and
determining that each of the security certificates in the chain of multiple security certificates has been previously stored in the certificate database;
store encryption information associated with the identified security certificate in response to storing the identified security certificate; and
in response to determining that the host device is utilizing a wrong certificate type for the security certificate in the communication, notify, by the security certificate module, a systems administrator that the wrong type of security certificate is being used, and identify the correct type of security certificate to install.
2. The system of claim 1 , wherein:
the interface is further operable to receive an alert indicating that a first security certificate stored in the certificate database has a first expiration date that is set to expire within a predetermined time period; and
the security certificate module is further operable to:
identify the host device using the first security certificate; and
identify the network administrator responsible for the host device, wherein the interface is further operable to communicate the alert message to the network administrator.
3. The system of claim 2 , wherein the predetermined time period is one selected from a group consisting of:
twenty-four hours, one week, one month, and three months.
4. The system of claim 1 , wherein the security certificate is a security sockets layer (SSL) certificate selected from a group consisting of:
an extended validation SSL certificate, an organization validation SSL certificate, and a domain validation SSL certificate.
5. The system of claim 1 , wherein the first endpoint is a web browser and the second endpoint is a web server.
6. The system of claim 1 , wherein the first endpoint is a first server and the second endpoint is a second server, wherein the first and second servers are associated with an enterprise.
7. The system of claim 1 , wherein:
the security certificate module is further operable to determine that the certification authority issuing the security certificate is an unapproved certification authority; and
the interface is further operable to communicate a message to the network administrator responsible for the host device, wherein the message indicates that the security certificate is from an unapproved certification authority.
8. A method for managing secure communications, comprising:
receiving, at an interface, a communication between a first endpoint and a second endpoint;
identifying, using security certificate module implemented by a processor communicatively coupled to the interface, a security certificate included in the communication;
analyzing, using the security certificate module, parameters of the identified security certificate, wherein the parameters comprise:
a certificate type for the security certificate, wherein the certificate type is associated with certain types of communications;
a host device using the security certificate;
a network administrator responsible for the host device;
an expiration date of the security certificate; and
a certification authority issuing the security certificate;
determine whether the host device is utilizing a correct certificate type for the security certificate in the communication;
comparing, using the security certificate module, the identified security certificate to a list of previously identified security certificates stored in a certificate database;
determining, using the security certificate module, whether the identified security certificate has previously been stored in the certificate database based on the comparison;
determining, using the security certificate module, whether the security certificate is part of a chain of multiple security certificates, wherein:
the chain of multiple security certificates comprises a root certificate linked with one or more intermediate certificates; and
the root certificate is used to sign the one or more intermediate certificates;
determining, using the security certificate module, whether each of the security certificates in the chain of multiple security certificates has been previously stored in the certificate database;
storing, using the security certificate module, the identified security certificate in the certificate database in response to:
determining that the identified security certificate has not been previously stored in the certificate database;
determine that the host device is utilizing the correct certificate type for the security certificate in the communication; and
determining that each of the security certificates in the chain of multiple security certificates has been previously stored in the certificate database;
storing, using the security certificate module, encryption information associated with the identified security certificate in response to storing the identified security certificate; and
in response to determining that the host device is utilizing a wrong certificate type for the security certificate in the communication, notify, by the security certificate module, a systems administrator that the wrong type of security certificate is being used, and identify the correct type of security certificate to install.
9. The method of claim 8 , further comprising:
receiving an alert indicating that a first security certificate stored in the certificate database has an first expiration date that is set to expire within a predetermined time period;
identifying the host device using the first security certificate;
identifying the network administrator responsible for the host device; and
communicating the alert message to the network administrator.
10. The method of claim 9 , wherein the predetermined time period is one selected from a group consisting of:
twenty-four hours, one week, one month, and three months.
11. The method of claim 8 , wherein the security certificate is a secure sockets layer (SSL) certificate selected from a group consisting of:
an extended validation SSL certificate, an organization validation SSL certificate, and a domain validation SSL certificate.
12. The method of claim 8 , wherein the first endpoint is a web browser and the second endpoint is a web server.
13. The method of claim 8 , wherein the first endpoint is a first server and the second endpoint is a second server, wherein the first and second servers are part of associated with an enterprise.
14. The method of claim 8 , further comprising:
determining that the certification authority issuing the security certificate is an unapproved certification authority; and
communicating a message to the network administrator responsible for the host device, wherein the message indicates that the security certificate is from an unapproved certification authority.
15. A non-transitory computer readable medium comprising logic, the logic operable, when executed by a processor, to:
receive a communication between a first endpoint and a second endpoint;
identify a security certificate included in the communication;
analyze parameters of the identified security certificate, wherein the parameters comprise:
a certificate type for the security certificate, wherein the certificate type is associated with certain types of communications;
a host device using the security certificate;
a network administrator responsible for the host device;
an expiration date of the security certificate; and
a certification authority issuing the security certificate;
determine whether the host device is utilizing a correct certificate type for the security certificate in the communication;
compare the identified security certificate to a list of previously identified security certificates in a certificate database;
determine whether the identified security certificate has previously been stored in the certificate database based on the comparison;
determine whether the security certificate is part of a chain of multiple security certificates, wherein:
the chain of multiple security certificates comprises a root certificate linked with one or more intermediate certificates; and
the root certificate is used to sign the one or more intermediate certificates;
determine whether each of the security certificates in the chain of multiple security certificates has been previously identified and stored in the certificate database;
store the identified security certificate in the certificate database in response to:
determining that the identified security certificate has not been previously stored in the certificate database;
determining that the host device is utilizing the correct certificate type for the security certificate in the communication; and
determining that each of the security certificates in the chain of multiple security certificates has been previously identified and stored in the certificate database;
store encryption information associated with the identified security certificate in response to storing the identified security certificate; and
in response to determining that the host device is utilizing a wrong certificate type for the security certificate in the communication, notify, by the security certificate module, a systems administrator that the wrong type of security certificate is being used, and identify the correct type of security certificate to install.
16. The non-transitory medium of claim 15 , wherein the logic is further operable to:
receive an alert indicating that a first security certificate stored in the certificate database has an first expiration date that is set to expire within a predetermined time period;
identify the host device using the first security certificate;
identify the network administrator responsible for the host device; and
communicate the alert message to the network administrator.
17. The non-transitory medium of claim 16 , wherein the predetermined time period is one selected from a group consisting of:
twenty-four hours, one week, one month, and three months.
18. The non-transitory medium of claim 15 , wherein the security certificate is an secure sockets layer (SSL) certificate selected from a group consisting of:
an extended validation SSL certificate, an organization validation SSL certificate, and a domain validation SSL certificate.
19. The non-transitory medium of claim 15 , wherein the first endpoint is a web browser and the second endpoint is a web server.
20. The non-transitory medium of claim 15 , wherein the first endpoint is a first server and the second endpoint is a second server, wherein the first and second servers are part of an enterprise.