Systems and methods for computer digital certificate management and analysis

Patent metadata

Field	Value
Publication number	US-9531705-B1
Application number	US-201414206478-A
Country	US
Kind code	B1
Filing date	Mar 12, 2014
Priority date	Mar 14, 2013
Publication date	Dec 27, 2016
Grant date	Dec 27, 2016

Abstract

Described herein are methods and systems for updating digital certificates on a computer and testing to confirm that the update was performed correctly. The testing may involve confirming that a server's common name (CN) and/or a server's subject alternative name (SAN) matches the domain name server (DNS) name utilized to access the server, confirming that, for all the certificates sent in chain, each certificate's expiration date is less than or equal to the expiration date of that certificate's parent certificate, confirming that the certificates' authority key identifier (AKI), subject key identifier (SKI), and/or authority information access (AIA) are in compliance, and comparing available cipher suites to a list of pre-approved cipher suites.

First claim

What is claimed is:

1. A computer-implemented method for testing security settings for a computing device comprising:
receiving at least one digital certificate from the computing device, the at least one digital certificate including a certificate chain that includes a first certificate preceding a second certificate, each certificate in the certificate chain having an expiration date;
identifying whether the first certificate's expiration date is later than the second certificate's expiration date;
determining that the at least one digital certificate is invalid when the first certificate's expiration date is later than the second certificate's expiration date;
determining whether the first certificate contains an Authority Information Access (AIA) entry with a URL that can be utilized to retrieve a third certificate;
when the first certificate contains such a URL:
using the URL in the first certificate's AIA to retrieve the third certificate, and
comparing the third certificate to the second certificate; and

determining that the at least one digital certificate is invalid when the second certificate is not identical to the third certificate.

2. The computer-implemented method of claim 1 , further comprising:
determining whether the first certificate is directly certified by the second certificate; and
determining that the at least one digital certificate is invalid when the first certificate is not directly certified by the second certificate.

3. The computer-implemented method of claim 1 , further comprising:
determining whether both of the following conditions are met:
whether the first certificate contains an authority key identifier (AKI); and
whether the second certificate contains a subject key identifier (SKI);

determining that the at least one digital certificate is not invalid when at least one of the conditions is not met; and
when both of the conditions are met:
determining that the at least one digital certificate is invalid when the first certificate's AKI does not equal the second certificate's SKI.

4. The computer-implemented method of claim 1 , further comprising:
determining an “Issuer” entry for the first certificate;
determining a “Subject” entry for the second certificate; and
determining that the at least one digital certificate is invalid when the first certificate's “Issuer” entry does not equal the second certificate's “Subject” entry.

5. The computer-implemented method of claim 1 , the method further comprising:
retrieving a set of cipher suites for the computing device;
retrieving a list of approved cipher suites; and
determining whether a cipher suite in the computing device's set of cipher suites matches a cipher suite in the list of approved cipher suites.

6. The computer-implemented method of claim 1 , the method further comprising:
retrieving a set of cipher suites for the computing device;
retrieving a list of approved cipher suites; and
determining whether each cipher suite in the computing device's set of cipher suites matches a cipher suite in the list of approved cipher suites.

7. The computer-implemented method of claim 1 , the method further comprising:
determining the computing device is insecure when a setting on the computing device enables client-side renegotiation of secure communications.

8. A device comprising:
a processor; and
a memory coupled to the processor, the memory comprising instructions that, when executed by the processor, cause the processor to effectuate operations comprising:
receiving, at a computing device with the processor, at least one digital certificate from the server, the at least one digital certificate including a certificate chain that includes a first certificate preceding a second certificate, each certificate in the certificate chain having an expiration date;
identifying whether the first certificate's expiration date is later than the second certificate's expiration date;
determining that the at least one digital certificate is invalid when the first certificate's expiration date is later than the second certificate's expiration date;
determining that the at least one digital certificate is invalid when the first certificate's expiration date is later than the second certificate's expiration date;
determining whether the first certificate contains an Authority Information Access (AIA) entry with a URL that can be utilized to retrieve a third certificate;
when the first certificate contains such a URL:
using the URL in the first certificate's AIA to retrieve the third certificate, and
comparing the third certificate to the second certificate; and

determining that the at least one digital certificate is invalid when the second certificate is not identical to the third certificate.

9. The device of claim 8 , the instructions further comprising:
determining an “Issuer” entry for the first certificate;
determining a “Subject” entry for the second certificate; and
determining that the at least one digital certificate is invalid when the first certificate's “Issuer” entry does not equal the second certificate's “Subject” entry.

10. The device of claim 8 , the instructions further comprising:
determining whether the first certificate is directly certified by the second certificate; and
determining that the at least one digital certificate is invalid when the first certificate is not directly certified by the second certificate.

11. The device of claim 8 , the instructions further comprising:
determining whether both of the following conditions are met:
whether the first certificate contains an authority key identifier (AKI); and
whether the second certificate contains a subject key identifier (SKI);

determining that the at least one digital certificate is not invalid when at least one of the conditions is not met; and
when both of the conditions are met:
determining that the at least one digital certificate is invalid when the first certificate's AKI does not equal the second certificate's SKI.

12. A computer-implemented method for testing security settings for a server comprising:
receiving, at a computing device with a processor, at least one digital certificate from the server; and
determining, via the computing device's processor, whether the at least one digital certificate is valid, wherein the step of determining whether the at least one digital certificate is valid comprises:
receive one or more domain name server (DNS) names utilized, by the computing device, to contact the server;
identify one or more subject alternative names (SAN) in the at least one digital certificate;
determining that the at least one digital certificate is invalid when at least one of the one or more DNS names does not have a corresponding entry in the one or more SAN entries; and
determining that the at least one digital certificate is not invalid when each of the one or more DNS names does have a corresponding entry in the one or more SAN entries, wherein the at least one digital certificate comprises a certificate chain that includes a first certificate and a second certificate, each certificate in the certificate chain having an expiration date, wherein the first certificate precedes the second certificate in the certificate chain, and wherein the step of determining whether the at least one digital certificate is valid further comprises:
identifying whether the first certificate's expiration date is later than the second certificate's expiration date; and
determining that the at least one digital certificate is invalid when the first certificate's expiration date is later than the second certificate's expiration date;

determ

Assignees

• United Services Automobile Ass (Usaa)
• Usaa

Inventors

• Mehner Carl
• Lawrence Dale

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title