Interface and manager for multiple certificate authorities
An interface of a certificate management system acts as a target for management of digital authentication certificates from a group of candidate certificate authorities. Entities make certificate signing requests on behalf of subjects. The requests are received at an interface that appears to the requesting entities as a sole source of the signed certificates. But a certificate management component that processes the requests received by the interface applies a selection technique to select a particular certificate authority from a group of candidate certificate authorities available to sign the certificates. The certificate management component forwards the request to the particular certificate authority, receives back the signed certificate, and responds to the certificate signing request with the signed certificate. Although the certificate signing requests were all made via a same interface, the signed certificates can have different chains of trust. Various criteria may be used for the selection.
1. A system, comprising:
one or more computing nodes comprising one or more processors and memory storing program instructions that implement:
a certificate manager; and
a common interface configured to receive certificate signing requests directed to the certificate manager;
the certificate manager configured to:
for a first certificate signing request of the certificate signing requests:
apply a certificate authority selection technique, comprising apply a selection ratio that specifies a ratio at which particular ones of a group of candidate certificate authorities are to be selected, to select a certificate authority from the group of candidate certificate authorities;
forward the first request to the selected certificate authority;
receive, from the selected certificate authority, a first signed certificate; and
respond to the first certificate signing request with the first signed certificate;
adjust, in accordance with one or more criterion, the selection ratio; and
for a second certificate signing request of the certificate signing requests:
apply the certificate authority selection technique to select, in accordance with the adjusted selection ratio another certificate authority from the group of candidate certificate authorities;
forward the second request to the other selected certificate authority;
receive, from the other selected certificate authority, a second signed certificate; and
respond to the second certificate signing request with the second signed certificate.
2. The system of claim 1 , wherein, for another plurality of certificate signing requests, application of the certificate authority selection technique comprises:
selecting the certificate authority from the group of candidate certificate authorities based on data specified in the request, the data comprising:
a type of validation process, comprising domain validated, organization validated, or extended validation; or
a challenge type, comprising email, DNS or HTTP.
3. The system of claim 1 , wherein the group of candidate certificate authorities
are subordinate certificate authorities that issue certificates that:
share a common PKI root hierarchy; or
chain to a root found in a same trust store.
4. The system of claim 1 ,
wherein one or more of the candidate certificate authorities and the certificate manager are hosted by resources of a multi-tenant service provider network that provides clients of the service provider service-based access to the certificate manager via the common interface; and
wherein the common interface is configured to receive certificate signing requests from clients internal to the provider network and from clients external to the provider network.
5. A computer-implemented method, comprising:
receiving, via a common certificate signing request interface, a plurality of certificate signing requests;
for each of the plurality of certificate signing requests:
applying, by a certificate manager, a certificate authority selection technique, comprising selecting from a group of candidate certificate authorities in accordance with a selection ratio that specifies a ratio at which particular ones of the candidate certificate authorities are to be selected, to select a certificate authority;
forwarding the certificate signing request to the selected certificate authority;
receiving, from the certificate authority, a signed certificate; and
responding to the certificate signing request with the signed certificate;
wherein at least some of the signed certificates are signed by different ones of the candidate certificate authorities;
adjusting, in accordance with one or more criterion, the ratio for one or more of the candidate certificate authorities; and
responsive to another certificate signing request, selecting from the candidate certificate authorities in accordance with the adjusted selection ratio.
6. The computer-implemented method of claim 5 ,
wherein, for another plurality of certificate signing requests, said applying the certificate authority selection technique to select a certificate authority comprises:
determining, from the respective signing request, the type of validation for the requested certificate; and
selecting the certificate authority based at least in part on the type of validation.
7. The computer-implemented method of claim 5 , wherein, for another plurality of certificate signing requests, said applying the certificate authority selection technique to select the certificate authority comprises selecting from the candidate certificate authorities based at least in part on a characteristic of a network.
8. The computer-implemented method of claim 5 , wherein, for another plurality of certificate signing requests, said applying the certificate authority selection technique to select the certificate authority comprises selecting from the candidate certificate authorities based at least in part on a characteristic of a certificate authority.
9. The computer-implemented method of claim 5 , wherein, for another plurality of certificate signing requests, said applying the certificate authority selection technique to select the certificate authority comprises selecting from the candidate certificate authorities based at least in part on a load balancing technique comprising round-robin, least response time, least bandwidth, traffic over time, and the least packets, or a custom load method.
10. The computer-implemented method of claim 5 , comprising:
hosting, by resources of a multi-tenant service provider network that provides clients of the service provider service-based access to a certificate manager that performs said receiving, said applying, said forwarding, said receiving, and said responding.
11. The computer-implemented method of claim 10 , further comprising:
hosting, by resources of the multi-tenant service provider, one or more of the candidate certificate authorities.
12. The computer-implemented method of claim 10 ,
wherein said receiving the plurality of certificate signing requests comprises receiving at least some of the certificate signing requests, via the common request interface, from one or more processes internal to the provider network and from one or more processes external to the provider network.
13. The computer-implemented method of claim 5 , further comprising:
receiving, via the common interface, a certificate revocation request; and
forwarding the revocation request to the corresponding certificate authority.
14. One or more non-transitory computer-readable media storing program instructions that when executed on or across one or more processors perform:
receiving, via a common request interface, a plurality of certificate signing requests;
for each of the plurality of certificate signing requests:
applying, by a certificate manager, a certificate authority selection technique, comprising selecting from a group of candidate certificate authorities in accordance with a selection ratio that specifies a ratio at which particular ones of the candidate certificate authorities are to be selected, to select a certificate authority;
forwarding the certificate signing request to the selected certificate authority;
receiving, from the certificate authority, a signed certificate; and
responding to the certificate signing request with the signed certificate; and
wherein the certificate manager that performs said applying the certificate authority selection technique to select the certificate authorities performs said receiving the signed certificates and said responding to the certificate signing requests with the signed certificates;
adjusting, in accordance with one or more criterion, the selection ratio for one or more of the candidate certificate authorities; and
responsive to another certificate signing request, selecting from the candidate certificate authorities in accordance with the adjusted selection ratio.
15. The one or more non-transitory computer-readable media of claim 14 , wherein, for another plurality of certificate signing requests, to perform said applying the certificate authority selection technique the program instructions perform:
selecting the certificate authority from the group of candidate certificate authorities based on data specified in the request, the data comprising:
a type of validation process comprising domain validated, organization validated, or extended validation; or
a challenge type for a validation process, the challenge type comprising email, DNS or HTTP.
16. The one or more non-transitory computer-readable media of claim 14 , wherein, for another plurality of certificate signing requests, to perform said applying the certificate authority selection technique the program instructions perform:
selecting the certificate authority from the group of candidate certificate authorities based on one or more load balancing techniques comprising round-robin, least connections, weighted least connections, least response time, least bandwidth and the least packets, or a custom load method.
17. The one or more non-transitory computer-readable media of claim 14 , wherein, for another plurality of certificate signing requests, to perform said applying the certificate authority selection technique the program instructions perform:
selecting the certificate authority from the group of candidate certificate authorities based at least in part on a characteristic of a network.
18. The one or more non-transitory computer-readable media of claim 14 , comprising program instructions that when executed on or across one or more processors perform:
receiving, via the common interface, a certificate revocation request; and
forwarding the revocation request to the corresponding certificate authority.