Certificate entitlement licenses for authenticating public key infrastructure certificate enrollment
Systems and methods for authenticating public key infrastructure certificate enrollment using certificate entitlement licenses. One example system includes a device manager including an electronic processor. The electronic processor is configured to receive a request for software for an electronic device including a unique electronic device identifier. The electronic processor is configured to determine, based on the request, whether the electronic device is entitled to participate in a certificate management service. The electronic processor is configured to, responsive to determining that the electronic device is entitled to participate in a certificate management service, transmit a certificate entitlement license request including the unique device identifier to a certificate entitlement license manager. The electronic processor is configured to receive, from the certificate entitlement license manager, a certificate entitlement license for the unique device identifier. The electronic processor is configured to deliver the certificate entitlement license based on the unique device identifier.
1. A system for authenticating public key infrastructure certificate enrollment, the system comprising:
a device manager including an electronic processor configured to:
receive a request for access to an external software service, the request being generated by an electronic device connect service on behalf of an electronic device, the request including a unique electronic device identifier;
determine, based on the request, whether the electronic device is entitled to participate in the certificate management service;
responsive to determining that the electronic device is entitled to participate in a certificate management service, transmit a certificate entitlement license request including the unique device identifier to a certificate entitlement license manager;
receive, from the certificate entitlement license manager, a certificate entitlement license for the unique device identifier; and
deliver the certificate entitlement license based on the unique device identifier;
wherein the electronic device connect service is either internal or external to the electronic device.
2. The system of claim 1 , wherein delivering the certificate entitlement license includes transmitting a secure software package including the certificate entitlement license to the electronic device.
3. The system of claim 1 , further comprising:
the certificate entitlement license manager;
wherein the certificate entitlement license manager includes a second electronic processor configured to, responsive to receiving the certificate entitlement license request, generate the certificate entitlement license for the unique device identifier.
4. The system of claim 3 , wherein the second electronic processor is further configured to:
receive, from the electronic device, a certificate request including a certificate entitlement license identifier associated with the certificate entitlement license, the unique device identifier, and a device type for the electronic device;
validate the certificate request based on the certificate entitlement license identifier and the unique device identifier;
responsive to validating the certificate request, generate a public key certificate based on a profile associated with the device type and the certificate request; and
transmit, to the electronic device, the public key certificate.
5. The system of claim 4 , wherein:
the certificate request further includes a service type; and
the electronic processor is further configured to generate the public key certificate based on a profile associated with the device type and the service type.
6. The system of claim 1 , wherein:
wherein delivering the certificate entitlement license includes delivering at least one selected from a group consisting of a certificate entitlement license identifier, a certificate entitlement license value, a certificate entitlement license validity period, the unique device identifier, and a device type for the electronic device.
7. The system of claim 1 , wherein the certificate entitlement license request further includes at least one selected from a group consisting of a device type and a service type.
8. A method for authenticating public key infrastructure certificate enrollment comprising:
receiving, at a device manager, a request for access to an external software service, the request being generated by an electronic device connect service on behalf of an electronic device, the request including a unique electronic device identifier;
determining, with the device manager, based on the request, whether the electronic device is entitled to participate in a certificate management service;
responsive to determining that the electronic device is entitled to participate in the certificate management service, transmitting a certificate entitlement license request including the unique device identifier to a certificate entitlement license manager;
receiving, from the certificate entitlement license manager, a certificate entitlement license for the unique device identifier; and
delivering, with the device manager, the certificate entitlement license based on the unique device identifier;
wherein the electronic device connect service is either internal or external to the electronic device.
9. The method of claim 8 , further comprising:
wherein delivering the certificate entitlement license includes generating, based on the unique device identifier, a secure software package including the certificate entitlement license; and
transmitting the secure software package to the electronic device.
10. The method of claim 8 , further comprising:
generating, with the certificate entitlement license manager, a certificate entitlement license for the unique device identifier in response to receiving the certificate entitlement license request.
11. The method of claim 8 , further comprising:
receiving, by the certificate entitlement license manager from the electronic device, a certificate request including a certificate entitlement license identifier associated with the certificate entitlement license, the unique device identifier, and a device type for the electronic device;
validating, with the certificate entitlement license manager, the certificate request based on the certificate entitlement license identifier and the unique device identifier;
responsive to validating the certificate request, generating a public key certificate based on a profile associated with the device type and the certificate request; and
transmitting, to the electronic device, the public key certificate.
12. The method of claim 11 , further comprising:
generating the public key certificate based on a profile associated with the device type and a service type.
13. The method of claim 8 , wherein:
wherein delivering the certificate entitlement license includes delivering at least one selected from a group consisting of a certificate entitlement license identifier, a certificate entitlement license value, a certificate entitlement license validity period, the unique device identifier, and a device type for the electronic device.
14. The method of claim 8 , wherein the certificate entitlement license request further includes at least one selected from a group consisting of a device type and a service type.
15. A device comprising:
an electronic processor configured to:
receive, via an application programming interface, a certificate entitlement license request including a unique device identifier identifying an electronic device and a device type for the electronic device;
validate the certificate entitlement license request based on the device type;
responsive to validating the certificate entitlement license request, generate a certificate entitlement license for the unique device identifier;
transmit, via the application programming interface, the certificate entitlement license based on the unique device identifier;
receive, from the electronic device, a certificate request including certificate entitlement license identifier associated with the certificate entitlement license, the unique device identifier, and a device type for the electronic device;
validate the certificate request based on the certificate entitlement license identifier and the unique device identifier;
responsive to validating the certificate request, generate a public key certificate based on a profile associated with the device type and the certificate entitlement license identifier; and
transmit, to the electronic device, the public key certificate.
16. The device of claim 15 , wherein:
the certificate request further includes a service type; and
the electronic processor is further configured to generate the public key certificate based on a profile associated with the device type, the certificate entitlement license identifier, and the service type.
17. The device of claim 15 , wherein the electronic processor is further configured to transmit the certificate entitlement license by transmitting a certificate entitlement license response message that includes at least one selected from a group consisting of a certificate entitlement license identifier, a certificate entitlement license value, a certificate entitlement license validity period, the unique device identifier, the device type, and a message checksum.