Automated provisioning of certificates

Patent metadata

Field	Value
Publication number	US-9819497-B2
Application number	US-201514755508-A
Country	US
Kind code	B2
Filing date	Jun 30, 2015
Priority date	Jun 30, 2015
Publication date	Nov 14, 2017
Grant date	Nov 14, 2017

Abstract

In a computer-implemented method for automated provisioning a certificate in a computing system a certificate signing request is accessed from a computing node by a centralized management tool of the computing system. The certificate signing request is provided to a certificate authority by the centralized management tool. A signed certificate is accessed from the certificate authority for the computing node. The signed certificate is provided to the computing node, by the centralized management tool, such that there is automated provisioning of the signed certificate at the computing node to establish trust of the computing node in the computing system.

First claim

We claim:

1. A computer-implemented method for automated provisioning of a certificate in a computing system, said computer-implemented method comprising:
accessing a certificate signing request from a computing node by a centralized management tool of said computing system,
wherein the computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM, and
wherein the centralized management tool is stored and executed on a single client device communicatively coupled with said computing system;

providing said certificate signing request to a certificate authority by said centralized management tool;
accessing a signed certificate from said certificate authority for said computing node; and
providing said signed certificate to said computing node, by said centralized management tool, wherein said signed certificate replaces a self-signed certificate at said computing node such that there is automated provisioning of said signed certificate at said computing node to establish trust of said computing node in said computing system.

2. The computer-implemented method of claim 1 , wherein said computing node is a storage device in a storage area network.

3. The computer-implemented method of claim 1 , wherein said signed certificate is a X.509 certificate.

4. The computer-implemented method of claim 1 , further comprising:
providing a root certificate to said computing node by said centralized management tool.

5. The computer-implemented method of claim 1 , further comprising:
providing a certificate revocation list to said computing node by said centralized management tool.

6. The computer-implemented method of claim 1 , further comprising:
informing services associated with said computing node to utilize said signed certificate rather than a self-signed certificate.

7. A non-transitory computer-readable storage medium having instructions embodied therein that when executed cause a computer system to perform a method of automated provisioning of a certificate in a computing system, the method comprising:
accessing a signed certificate from a certificate authority for a computing node, by a centralized management tool, wherein said computing node initially comprises an untrusted self-signed certificate,
wherein the computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM, and
wherein the centralized management tool is stored and executed on a single client device communicatively coupled with said computing system; and

providing said signed certificate to said computing node, by said centralized management tool, wherein said signed certificate replaces said untrusted self-signed certificate at said computing node such that there is automated provisioning of said signed certificate at said computing node to establish trust of said computing node in said computing system.

8. The non-transitory computer-readable storage medium of claim 7 , wherein said computing node is a storage device.

9. The non-transitory computer-readable storage medium of claim 7 , further comprising:
providing a certificate revocation list to said computing node by said centralized management tool.

10. A computer-implemented method for automated provisioning of a certificate in a computing system, said computer-implemented method comprising:
providing an untrusted self-signed certificate to a centralized management tool of said computing system,
wherein the centralized management tool is stored and executed on a single client device communicatively coupled with said computing system;

providing a certificate signing request to a certificate authority via said centralized management tool of said computing system; and
accessing a signed certificate from said certificate authority via said centralized management tool, wherein services associated with said computing node utilize said signed certificate rather than said untrusted self-signed certificate such that there is automated provisioning of said signed certificate at a computing node to establish trust of said computing node in said computing system,
wherein the computing node is a host in a virtualization infrastructure that provides underlying hardware for supporting a virtual machine (VM) and a workload of the VM.

11. The computer-implemented method of claim 10 , wherein said computing node is a storage device.

12. The computer-implemented method of claim 10 , wherein said signed certificate is a X.509 certificate.

13. The computer-implemented method of claim 10 , further comprising:
accessing a root certificate.

14. The computer-implemented method of claim 10 , further comprising:
accessing a certificate revocation list.

Assignees

• Vmware Inc

Inventors

• Gunti Mukund
• CHINTALAPATI Kalyan Ram
• Sundriyal Suresh
• Thole Tushar
• Daingade Swapnil
• Reddy Sridhar T
• Engineer Anu
• Dirks Patrick William Penzias
• Bhattacharjee Ratnadeep

Classifications

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title