Automated monitoring and managing of certificates

Patent metadata

Field	Value
Publication number	US-10432610-B2
Application number	US-201514755642-A
Country	US
Kind code	B2
Filing date	Jun 30, 2015
Priority date	Jun 30, 2015
Publication date	Oct 1, 2019
Grant date	Oct 1, 2019

Abstract

In a computer-implemented method for automated monitoring certificate expiration, automatically periodically accessing a plurality of computing nodes in a computing system for certificate expiration of a certificate of the plurality of computing nodes. The automatically periodically accessing is provided by a central management tool of the computing system. Automatically determining the certificate of the plurality of computing nodes has an impending certificate expiration by the central management tool of said computing system. In response to the determining, automatically generating an alert, by the central management tool, that indicates the impending certificate expiration of the certificate.

First claim

What is claimed is:

1. A computer-implemented method for automated monitoring of certificate expiration and automated provisioning of a signed certificate in a computing system, said computer-implemented method comprising:
automatically periodically accessing a plurality of computing nodes in said computing system for said certificate expiration of a certificate of said plurality of computing nodes, wherein said automatically periodically accessing is provided by a centralized management tool of said computing system;
automatically determining said certificate of said plurality of computing nodes has an impending certificate expiration, by said centralized management tool of said computing system;
in response to said determining, automatically generating an alert, by said centralized management tool, that indicates said impending certificate expiration of said certificate;
accessing, by said centralized management tool of said computing system, a certificate signing request from a computing node of said plurality of computing nodes,
wherein said computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM, and wherein said centralized management tool is stored and executed on a single client device communicatively coupled with said computing system;
providing said certificate signing request to a certificate authority by said centralized management tool;
accessing a signed certificate from said certificate authority for said computing node; and
providing said signed certificate to said computing node, by said centralized management tool, such that there is automated provisioning of said signed certificate at said computing node to establish trust of said computing node in said computing system.

2. The computer-implemented method of claim 1 , wherein said plurality of computing nodes comprise a respective plurality of hosts for hosting a plurality of virtual machines in said computing system.

3. The computer-implemented method of claim 1 , wherein said plurality of computing nodes comprise a plurality of storage devices in a storage area network.

4. The computer-implemented method of claim 1 , wherein said certificate is a X.509 certificate.

5. The computer-implemented method of claim 1 , further comprising:
periodically pushing certificate revocation lists to said plurality of computing nodes by said centralized management tool.

6. A computer-implemented method for automated remediation of certificate expiration and automated provisioning of a signed certificate in a computing system, said computer-implemented method comprising:
in response to initiation of adding a computing node to said computing system, automatically accessing said certificate expiration of a certificate of said computing node by a centralized management tool of said computing system;
automatically determining said certificate of said computing node has an impending certificate expiration, by said centralized management tool of said computing system; and
in response to said automatically determining, automatically providing said computing node a new certificate to replace said certificate with said impending certificate expiration, by said centralized management tool of said computing system, said automatically providing said computing node said new certificate comprising:
accessing, by said centralized management tool of said computing system, a certificate signing request from said computing node,
wherein said computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM, and wherein said centralized management tool is stored and executed on a single client device communicatively coupled with said computing system;
providing said certificate signing request to a certificate authority by said centralized management tool;
accessing a signed certificate from said certificate authority for said computing node; and
providing said signed certificate to said computing node, by said centralized management tool, such that there is automated provisioning of said signed certificate at said computing node to establish trust of said computing node in said computing system.

7. The computer-implemented method of claim 6 , wherein said computing node is a storage device in a storage area network.

8. The computer-implemented method of claim 6 , wherein said certificate is a X.509 certificate.

9. The computer-implemented method of claim 6 , further comprising:
periodically pushing certificate revocation lists to said computing node by said centralized management tool.

10. A computer-implemented method for automated pushing of a certificate revocation list and automated provisioning of a signed certificate in a computing system, said computer-implemented method comprising:
in response to revocation of a certificate in a first computing node in said computing system, accessing a certificate revocation list that indicates that said first computing node untrustworthy, by a centralized management tool of said computing system, from a certificate authority; and
automatically providing said certificate revocation list to other computing nodes in said computing system, by said centralized management tool, such that said first computing node is untrustworthy to said other computing nodes;
accessing, by said centralized management tool of said computing system, a certificate signing request from said computing node of said plurality of computing nodes,
wherein said computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM, and wherein said centralized management tool is stored and executed on a single client device communicatively coupled with said computing system;
providing said certificate signing request to a certificate authority by said centralized management tool;
accessing a signed certificate from said certificate authority for said computing node; and
providing said signed certificate to said computing node, by said centralized management tool, such that there is automated provisioning of said signed certificate at said computing node to establish trust of said computing node in said computing system.

11. The computer-implemented method of claim 10 , wherein said other computing nodes are hosts for hosting respective virtual machines in said computing system.

12. The computer-implemented method of claim 10 , wherein said other computing nodes are storage devices in a storage area network.

13. The computer-implemented method of claim 10 , wherein said certificate is a X.509 certificate.

14. The computer-implemented method of claim 10 , wherein said automatically providing said certificate revocation list to other computing nodes in said computing system further comprises:
automatically periodically pushing updated certificate revocation lists to other computing nodes in said computing system.

Assignees

• Vmware Inc

Inventors

• Gunti Mukund
• CHINTALAPATI Kalyan Ram
• Sundriyal Suresh
• Thole Tushar
• Daingade Swapnil
• Reddy Sridhar T
• Engineer Anu
• Bhattacharjee Ratnadeep

Classifications

• H04L63/166

  at the transport layer · CPC title

• H04L63/108

  when the policy decisions are valid for a limited amount of time · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title