Amazon Technologies, Inc.

Marcel Andrew Levy

Jonathan Kozolchyk

Peter Zachary Bowen

Todd Lawrence Cignetti

Brandonn Gorman

Param Sharma

Kyle Benjamin Schultheiss

Ronald Andrew Hoskinson

Nicholas Wexler

Kenneth Lawler

Sandeep Shantharaj

Jose Maria Silveira Neto

Preston Anthony Elder, Iii

Gregory Branchek Roth

Darren Ernest Canavor

Darin Keith McAdams

Zachary Ganwise Fewtrell

Blake Parker Hess

Manikandan Subramanian

Pradeep Ramarao

Andrew Alphus Kimbrough

Graeme David Baer

Michael S Slaughter

Josh Rosenthol

Trevoli Ponds-White

Derek William Bolt

Georgy Sebastian

Timothy Sterling Loverin

James Spencer

Brenda Lee Leary

Nandit Tiku

Andrew Ketcham

Frank Gregory Williston

Derek Bronson

Israel Galvez

Chandan Kundapur

A credential management system with time-based credential validity period reduction is disclosed. The credential management system, responsive to determining to renew a current version of a time-based security credential, determines a validity time period length for a renewal version of the time-based security credential based on (1) a validity time period length for the current version of the time-based security credential and/or (2) renewal completion metrics for the respective credential holder. The credential management system obtains, from a credential authority, a renewed version of the time-based security credential having the determined validity time period length, and returns the renewed version to the credential holder. Receipt of the renewed version initiates performance of a deployment of the renewed credential at the respective credential holder to update use of the current version of the time-based security credential. Completion metrics are transmitted to the credential management system, for determining a next validity time.

Time-based credential validity period reduction

An automated server-based scheme allows a hosted service such as an individual computer system, computer application, or network service, to infer root certificate authorities present in client trust stores. Presenting a random selection of one or more digital certificates to a given client seeking a favorite icon URL, in response to a Transport Layer Security (TLS) connection request from the client, allows the service operator's trained machine learning system to define a customized set of potentially-trusted root certificate authorities based on learned successes and failures of connections with the given client, as well as other parties. The hosted service operator may employ a certificate manager and/or client-specific rules for presenting the certificates.

Systems and methods for server-based trust store discovery

Techniques for certificate authority (CA) selection are described. A certificate management service of a cloud provider network receives a first request to generate a certificate from an electronic device, the first request including an indication of an identity of a user and an identification of a domain name to associate with the certificate. A CA selection policy applicable to the first request is identified, the CA selection policy including a CA selection rule. A CA to generate the certificate is identified by evaluating the CA selection rule, the CA selection rule associates at least a portion of the domain name with the CA. A second request to generate the certificate is sent to the identified CA. The certificate or an identification of the certificate from the CA is returned to the electronic device.

Certificate authority selection in a cloud provider network

An interface of a certificate management system acts as a target for management of digital authentication certificates from a group of candidate certificate authorities. Entities make certificate signing requests on behalf of subjects. The requests are received at an interface that appears to the requesting entities as a sole source of the signed certificates. But a certificate management component that processes the requests received by the interface applies a selection technique to select a particular certificate authority from a group of candidate certificate authorities available to sign the certificates. The certificate management component forwards the request to the particular certificate authority, receives back the signed certificate, and responds to the certificate signing request with the signed certificate. Although the certificate signing requests were all made via a same interface, the signed certificates can have different chains of trust. Various criteria may be used for the selection.

Interface and manager for multiple certificate authorities

Techniques are described for enabling users of a certificate management service to create certificate issuance policies that can be applied to certificate issuance requests across both public and private certificate authorities (CAs) and other certificate-related services. According to embodiments described herein, a certificate issuance policy includes one or more certificate issuance rules to be applied to requests associated with one or more specified user accounts or roles for certificate-related resources (e.g., public certificates, private certificates, etc.). The application of a certificate issuance rule can be conditioned on a particular request context (e.g., based on a user account or role associated with a request, a type of certificate requested, a subject name identified in the request, etc.) and can specify a wide range of actions to be performed on requests matching a rule (e.g., allowing or denying a request, modifying one or more parameters of the request, etc.).

Custom rules for global certificate issuance

Techniques for managing certificate metrics are described. A method of managing certificate metrics can include adding certificate data associated with one or more certificates to a plurality of slots of a metric certificate data store, reading, by a metric publisher, the certificate data associated with a first slot of the metric certificate data store in response to an event, determining a metric associated with each certificate associated with a subset of the certificate data associated with the first slot of the metric certificate data store, and providing the metric associated with each certificate to a resource monitoring service.

Management of certificate metrics

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by private certificate authorities. A private certificate authority hosted by the computing resource service provider is able to issue signed certificates to network entities within the customer enterprise. The certificate management service provides a network-accessible application programming interface to the private certificate authority that allows applications to create and deploy private certificates programmatically. The system provides the flexibility to create private certificates for applications that require custom certificate lifetimes or resource names.

Certificate authority

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, customers may use the certificate management service to generate private certificate authority which can issue signed certificates to network entities within the customer enterprise. In an embodiment, the private certificate authority is hosted by the computing resource service provider, and the certificate management service automates the renewal and management of active certificates. In an embodiment, the certificate management service allows customer applications to create, renew, and revoke certificates issued by both private and public certificate authorities via an application programming interface.

Certificate manager

The present disclosure generally relates to systems and methods for the gradual application of a new digital certificate to a service endpoint or server, with repeated rollbacks to an old digital certificate, whereby the new certificate is applied to a service endpoint and automatically rolled back to the previous certificate after an amount of time. After a period that corresponds to a set amount of time minus the time the new certificate was applied to the endpoint, the process starts again, except with an increased period of time for the new certificate.

Management of digital certificate with repeated rollback

A computer system detects that a digital certificate is set to expire within a threshold amount of time. In response to detecting that the digital certificate is set to expire, the computer system generates an update to cause a second computer system to perform operations to indicate an upcoming expiration of the digital certificate. The computer system provides the update to the second computer system to cause the second computer system to perform the operations.

Detecting digital certificate expiration through request processing

A computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by public and/or private certificate authorities. In an embodiment, when a new certificate is generated, a certificate template is used to apply various settings and policies for the new certificate. In various examples, templates may be used to establish default values, enforce required and optional values, place restrictions on one or more data fields, and enforce signature requirements. In some embodiments, the template establishes rules for rejecting certificate requests that don't conform to the template.

Certificate generation method

In an embodiment, a computing resource service provider provides a certificate management service that allows customers of the computing resource service provider to create, distribute, manage, and revoke digital certificates issued by private certificate authorities. In an embodiment, a private certificate authority hosted by the computing resource service provider is able to issue signed certificates to network entities within the customer enterprise. In an embodiment, the certificate management service provides a network-accessible application programming interface to the private certificate authority that allows applications to create and deploy private certificates programmatically. In an embodiment, the system provides the flexibility to create private certificates for applications that require custom certificate lifetimes or resource names.

A set of consumers of a producer-consumer system includes a main consumer subset and a backstop consumer subset. A plurality of updates to message processing information are deployed to the set of consumers. Each update of the plurality of updates is first deployed to the backstop consumer sub-set and is subsequently deployed to the main consumer subset. The main consumer subset may obtain messages from producers and attempt to process the messages. By contrast, the backstop consumer subset may obtain messages only after a failed processing attempt by the main consumers. Upon obtaining a message, a main consumer may process the message successfully or may fail processing and provide the message for processing by a backstop consumer, which may be more up to date than the main consumer.

Forward message compatibility safety in producer-consumer systems

A method and system for generating multiple profiles corresponding to different digital certificates. The profile includes intrinsic attributes and derived attributes associated with a digital certificate. The system enables a customer system to filter digital certificates based on a suitability of the various digital certificates for use with a given application to be executed by or on behalf of the customer system. The suitability may be determined based on a comparison of certificate requirements associated with a customer system's request and one or more of the intrinsic attributes and derived attributes.

Growing community of inventors

Seattle, WA, United States of America

Marcel Andrew Levy