Providing and installing digital certificates
A method for providing a digital certificate to a device, comprises: receiving a device identification dataset, uniquely identifying the device; determining a key creation dataset including a certificate identifier, the certificate identifier being based on the device identification dataset; sending the key creation dataset to the device; receiving a certificate creation request related to a first domain name based on the key creation dataset from the device, the first domain name including the certificate identifier; sending the certificate creation request or a modified certificate creation request to a certificate authority; and providing the digital certificate to the device, the digital certificate being a wildcard certificate based on the first domain name signed by the certificate authority.
1. A computer-implemented method for providing a digital certificate to a device, the computer-implemented method comprising:
receiving a device identification dataset at a server, the device identification dataset uniquely identifying the device;
determining a key creation dataset including a certificate identifier and a pre-shared secret at the server, the certificate identifier being a hash of the device identification dataset, a processor of the device being configured to initiate creation of the digital certificate based on the key creation dataset, and the pre-shared secret being installed on the device during manufacturing of the device;
sending the key creation dataset from the server to the device;
receiving a certificate creation request related to a first domain name based on the key creation dataset at the server from the device, the first domain name including the certificate identifier;
sending the certificate creation request or a modified certificate creation request from the server to a certificate authority; and
providing the digital certificate from the server to the device, the digital certificate being a wildcard certificate based on the first domain name and the wildcard certificate being signed by the certificate authority.
2. The computer-implemented method according to claim 1 , wherein the device identification dataset comprises at least one of:
a serial number of the device,
a material number of the device,
a vendor name of the device, or
a model name of the device.
3. The computer-implemented method according to claim 2 , further comprising:
querying a database for information related to the device; and
receiving, from the database, at least one of the serial number of the device, the material number of the device, the vendor name of the device or the model name of the device.
4. The computer-implemented method according to claim 1 , wherein the device identification dataset comprises:
an institution identifier, wherein
the institution identifier identifies an institution hosting the device, and
the institution identifier is determined based on credentials of an active user.
5. The computer-implemented method according to claim 1 , wherein the key creation dataset further includes a certificate request domain name.
6. The computer-implemented method according to claim 5 , wherein the certificate request domain name corresponds to at least one of a uniform resource locator, a uniform resource identifier, or an internet protocol address.
7. The computer-implemented method according to claim 5 , wherein the certificate request domain name is a domain name used to request the digital certificate.
8. The computer-implemented method according to claim 1 , wherein the certificate creation request is an Enrollment over Secure Transport request.
9. The computer-implemented method according to claim 1 , wherein
the certificate creation request includes a further pre-shared secret;
the method further includes performing, in response to receiving the certificate creation request, a check whether the further pre-shared secret of the certificate creation request matches the pre-shared secret of the key creation dataset; and
the sending of the certificate creation request is executed only in case of the further pre-shared secret of the certificate creation request matching the pre-shared secret of the key creation dataset.
10. The computer-implemented method according to claim 9 , wherein
the certificate creation request includes the certificate identifier; and
the performing of the check further includes checking that the further pre-shared secret of the certificate creation request is related to the certificate identifier.
11. The computer-implemented method according to claim 1 , wherein the sending the key creation dataset to the device comprises:
automatically transmitting the key creation dataset to the device via a secure communication channel, or
storing the key creation dataset on a portable storage medium and transmitting the key creation dataset to the device via the portable storage medium.
12. A computer-implemented method for installing a digital certificate on a device, the computer-implemented method comprising:
receiving, from a server, a key creation dataset including a certificate identifier and a pre-shared secret, the certificate identifier being a hash of a device identification dataset related to the device and the pre-shared secret being installed on the device during manufacturing of the device;
determining a certificate creation request related to a first domain name based on the key creation dataset, the first domain name including the certificate identifier and a processor of the device being configured to initiate creation of the digital certificate based on the key creation dataset;
sending the certificate creation request to a certificate authority via the server;
receiving the digital certificate, the digital certificate being a wildcard certificate based on the first domain name and the wildcard certificate being signed by the certificate authority; and
installing the digital certificate.
13. A server configured to provide a digital certificate to a device, the server comprising:
a memory storing computer-executable instructions; and
at least one processor configured to execute the computer-executable instructions to cause the server to
receive a device identification dataset, the device identification dataset uniquely identifying the device,
determine a key creation dataset including a certificate identifier and a pre-shared secret, the certificate identifier being a hash of the device identification dataset, a processor of the device being configured to initiate creation of the digital certificate based on the key creation dataset, and the pre-shared secret being installed on the device during manufacturing of the device,
send the key creation dataset to the device,
receive a certificate creation request related to a first domain name based on the key creation dataset from the device, the first domain name including the certificate identifier,
send the certificate creation request to a certificate authority, and
provide the digital certificate to the device, the digital certificate being a wildcard certificate based on the first domain name and the wildcard certificate being signed by the certificate authority.
14. A device for installing a digital certificate, the device comprising:
a memory storing computer-executable instructions; and
at least one processor configured to execute the computer-executable instructions to cause the device to
receive, from a server, a key creation dataset including a certificate identifier and a pre-shared secret, the certificate identifier being a hash of a device identification dataset related to the device and the pre-shared secret being installed on the device during manufacturing of the device,
determine a certificate creation request related to a first domain name based on the key creation dataset, the first domain name including the certificate identifier and a processor of the device being configured to initiate creation of the digital certificate based on the key creation dataset,
send the certificate creation request to a certificate authority via the server,
receive the digital certificate, the digital certificate being a wildcard certificate based on the first domain name and the wildcard certificate being signed by the certificate authority, and
install the digital certificate.
15. A non-transitory computer program product storing instructions which, when executed by a computer, cause the computer to carry out the computer-implemented method of claim 1 .
16. A non-transitory computer-readable storage medium storing instructions which, when executed by a computer, cause the computer to carry out the computer-implemented method of claim 1 .
17. The computer-implemented method according to claim 3 , wherein the device identification dataset comprises:
an institution identifier, wherein
the institution identifier identifies an institution hosting the device, and
the institution identifier is determined based on credentials of an active user.
18. The computer-implemented method according to claim 3 , wherein
the certificate creation request includes a further pre-shared secret;
the method further includes performing, in response to receiving the certificate creation request, a check whether the further pre-shared secret of the certificate creation request matches the pre-shared secret of the key creation dataset; and
the sending of the certificate creation request is executed only in case of the further pre-shared secret of the certificate creation request matching the pre-shared secret of the key creation dataset.
19. The computer-implemented method according to claim 18 , wherein
the certificate creation request includes the certificate identifier; and
the performing of the check further includes checking that the further pre-shared secret of the certificate creation request is related to the certificate identifier.
20. The computer-implemented method according to claim 18 , wherein the sending the key creation dataset to the device comprises:
automatically transmitting the key creation dataset to the device via a secure communication channel, or
storing the key creation dataset on a portable storage medium and transmitting the key creation dataset to the device via the portable storage medium.
21. A non-transitory computer program product storing instructions which, when executed by a computer, cause the computer to carry out the computer-implemented method of claim 12 .
22. A non-transitory computer-readable storage medium storing instructions which, when executed by a computer, cause the computer to carry out the computer-implemented method of claim 12 .