Short-duration digital certificate issuance based on long-duration digital certificate validation

1. A computer-implemented method comprising:

issuing a first digital certificate to an entity, the first digital certificate specifying a critical extension enabling validation of the entity to a certificate authority service, wherein the critical extension prevents the first digital certificate from being used for authentication of a server of the entity and the first digital certificate:

specifies at least one subject field specific to the entity;

specifies a first public cryptographic key;

corresponds to a first private cryptographic key; and

specifies a first validity period for the first digital certificate;

receiving, from the entity, a request for issuance of a second digital certificate, the request including the first digital certificate and a digital signature, the second digital certificate being usable for authentication of the server of the entity;

determining, based at least in part on a validity period specified within the first digital certificate and the first public cryptographic key, whether to issue the second digital certificate; and

issuing the second digital certificate to have the at least one subject field and a second validity period that is shorter than the first validity period.

2. The computer-implemented method of claim 1 , wherein the first digital certificate is an X.509 certificate.

3. The computer-implemented method of claim 1 , wherein the critical extension specifies a date of validation of the entity by the certificate authority service prior to issuance of the first digital certificate, one or more standards utilized by the certificate authority service to validate the entity, and an identifier corresponding to the entity.

4. The computer-implemented method of claim 1 , wherein the second digital certificate further includes a second public cryptographic key that is distinct from the first public cryptographic key specified in the first digital certificate.

5. A system, comprising:

one or more processors; and

memory to store instructions that is executable by the one or more processors to cause the system to:

issue a first digital certificate to an entity, the first digital certificate specifying a critical extension that prevents the first digital certificate from being used for authentication of a server of the entity and:

enabling validation of the entity; and

specifying at least one subject field specific to the entity;

receive, from the entity, a request for issuance of a second digital certificate, the request including the first digital certificate and the second digital certificate usable for authentication of the entity;

determine, based at least in part on information specified within the first digital certificate, whether to issue the second digital certificate; and

issue the second digital certificate to have information that is based at least in part on the information specified within the first digital certificate and to have the at least one subject field specific to the entity.

6. The system of claim 5 , wherein:

the request for issuance of the second digital certificate includes a digital signature; and

the instructions, if executed, further cause the system to verify the digital signature using a public cryptographic key specified within the first digital certificate.

7. The system of claim 5 , wherein:

the information specified within the first digital certificate includes a validity period for the first digital certificate; and

the instructions, if executed, further cause the system to utilize the validity period for the first digital certificate to verify that the first digital certificate has not expired and can be utilized for issuance of the second digital certificate.

8. The system of claim 7 , wherein the information of the second digital certificate specifies a shorter validity period than the validity period for the first digital certificate.

9. The system of claim 5 , wherein the information included within the second digital certificate is further based at least in part on a validity period specified by the entity within the request for issuance of the second digital certificate.

10. The system of claim 5 , wherein the second digital certificate is further issued to have one or more additional subject fields not included within the first digital certificate.

11. The system of claim 5 , wherein the critical extension indicates that the first digital certificate should not be used for authentication.

12. The system of claim 11 , wherein the critical extension includes a date of validation of the entity prior to issuance of the first digital certificate, one or more standards utilized to validate the entity, and an identifier corresponding to the entity.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

receive, from an entity, a request for issuance of a digital certificate usable for authentication of the entity, the request including a previously issued digital certificate specifying a critical extension usable for validating the entity to a certificate authority service and that prevents the previously issued digital certificate from being used for authentication of a server of the entity, the previously issued digital certificate further specifying at least one subject field specific to the entity;

determine, based at least in part on information specified within the previously issued digital certificate, whether to issue the digital certificate; and

issue the digital certificate to have information that is based at least in part on the information specified within the previously issued digital certificate and to have the at least one subject field specific to the entity.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further include instructions that when executed by the one or more processors of the computer system cause the computer system to obtain a desired validity period defined by the entity within the request to determine whether to issue the digital certificate.

15. The non-transitory computer-readable storage medium of claim 13 , wherein the previously issued digital certificate was issued by the computer system in response to a request from the entity for issuance of the previously issued digital certificate.

16. The non-transitory computer-readable storage medium of claim 13 , wherein:

the previously issued digital certificate further specifies a public cryptographic key that corresponds to a private cryptographic key;

the information specified within the previously issued digital certificate includes a validity period for the previously issued digital certificate; and

the instructions further include instructions that if executed by the one or more processors cause the computer system to utilize the validity period to verify that the previously issued digital certificate has not expired and can be utilized for issuance of the digital certificate.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the information included within the issued digital certificate specifies a shorter validity period than the validity period for the previously issued digital certificate.

18. The non-transitory computer-readable storage medium of claim 16 , wherein the request for issuance of the digital certificate is digitally signed by the entity utilizing the private cryptographic key corresponding to the public cryptographic.

19. The non-transitory computer-readable storage medium of claim 13 , wherein the critical extension indicates one or more standards utilized to validate the entity.

20. The non-transitory computer-readable storage medium of claim 19 , wherein the critical extension further indicates that the previously issued digital certificate should not be used for authentication.