Amazon Technologies, Inc.

Michael S Slaughter

Trevoli Ponds-White

Georgy Sebastian

James Darrin Flanagan

Todd Lawrence Cignetti

Graeme David Baer

Jonathan Kozolchyk

Marcel Andrew Levy

Param Sharma

Kyle Benjamin Schultheiss

Brandonn Gorman

Manikandan Subramanian

Kenneth Lawler

Dayong Hao

Chris Stoner

Derek Bronson

Israel Galvez

A public certificate authority (CA) manages versioned sets of a collection of individual policies that serve as a basis for how a certificate issuance workflow processes certificate requests, and tracks the particular set of policies applied by the issuance workflow process to produce a particular certificate. For example, the public CA responds to a certificate request by identifying a current policy collection version, and performing a certificate issuance workflow in accordance with the set of individual policy versions specified by the current policy collection version. If the requested certificate is correctly produced, the public CA publishes the certificate and records, to a tracking data store, an identifier of the certificate and the policy collection version used in performance of the issuance workflow. The records may be used to respond to audit requests, matching certificates to the policy collection version used in performance of the issuance workflow for that certificate.

Versioned policy collection management for certificate issuance

Components of a public certificate authority (CA) generate respective cryptographic assertions during performance of respective tasks of a certificate issuance workflow and a workflow approval component approves/rejects certificate issuance, based upon verification of the cryptographic assertions. For example, a workflow manager may assign tasks of a certificate workflow process to a number of components that process the tasks. The components generate responses and sign the respective responses with keys particular to each component. The workflow manager gathers the cryptographic assertions and sends them to a workflow approval component that validates the assertions, verifies the assertions indicate successful completion of the workflow and approves or rejects certificate issuance.

Cryptographic assertions for certificate issuance

A certificate renewal service may receive an indication to request renewal of a certificate in a test mode that allows testing of certificate characteristic property change effects. The certificate renewal service may select, based on the renewal of the certificate being requested in the test mode, a renewal time for renewing of the certificate. The certificate renewal service may change, based on the renewal of the certificate being requested in the test mode, one or more properties of one or more certificate characteristics of the certificate in a certificate renewal request. The certificate renewal service may request renewal of the certificate based on the renewal time with one or more changes to the one or more properties of the one or more certificate characteristics.

Certificate chaos test mode

Methods, systems, and computer-readable media for a certificate management system with forced certificate renewal are disclosed. The certificate management system may receive a request to renew a digital certificate. The request may be received at a selected time prior to an automatic renewal date for the certificate, and the automatic renewal date may be stored by the certificate management system. The certificate management system may acquire, based at least in part on the request to renew the certificate, a renewed certificate from a certificate authority. The renewed certificate may be obtained prior to the automatic renewal date. The renewed certificate may be exported from the certificate management system and bound to a computing resource (e.g., a server) prior to the automatic renewal date.

Certificate management system with forced certificate renewal

An interface of a certificate management system acts as a target for management of digital authentication certificates from a group of candidate certificate authorities. Entities make certificate signing requests on behalf of subjects. The requests are received at an interface that appears to the requesting entities as a sole source of the signed certificates. But a certificate management component that processes the requests received by the interface applies a selection technique to select a particular certificate authority from a group of candidate certificate authorities available to sign the certificates. The certificate management component forwards the request to the particular certificate authority, receives back the signed certificate, and responds to the certificate signing request with the signed certificate. Although the certificate signing requests were all made via a same interface, the signed certificates can have different chains of trust. Various criteria may be used for the selection.

Interface and manager for multiple certificate authorities

Techniques for validating digital certificate information before signing are described. A method of validating digital certificate information before signing may include generating a to-be-signed (TBS) certificate, providing the TBS certificate to a certificate pre-issuance validation service to perform one or more validations on the TBS certificate, and receiving a request to issue a signed certificate based on the TBS certificate following validation of the TBS certificate by the certificate pre-issuance validation service.

Validating certificate information before signing

Growing community of inventors

Stone Mountain, GA, United States of America

Michael S Slaughter