Oracle International Corporation

Mina Anes

Mauruthi Geetha Mohan

Anthony Long

David Dale Becker

Bill Chau

Tony Long

Sanjeeb Kumar Sahoo

Adam Franklin Wilford

Brady Turner

Jodi Robertson

Benjamin Charles Gay

Timothy Kraus

Shane Burgess

Operations may include receiving, from a first network entity, a first request for a first certificate revocation list (CRL) that identifies a first CRL distribution point (CDP) corresponding to the first CRL; mapping the first CDP to a first CRL identifier of a set of available CRL identifiers; locating, in a CRL repository, a first CRL based on the first CRL identifier; and transmitting the first CRL to the first network entity.

Certificate revocation list management services

According to certain implementations, a certificate management service of a cloud service provider requests a certificate for a domain from a certificate authority utilizing an HTTP-based challenge. The certificate authority responds with a challenge string and a subdirectory within the domain. The challenge string and subdirectory within the domain are sent from the certificate management service to a proxy server of the cloud service provider that manages a flow of data to a host that hosts the domain. When the certificate authority sends a request to the sub directory within the domain, the request is intercepted at the proxy server. Instead of forwarding the request to the host that hosts the domain, the proxy server responds to the certificate authority with the challenge string. This verifies ownership of the domain, which is required to obtain the certificate for the domain.

Obtaining a domain certificate utilizing a proxy server

A method may include transmitting a request for metadata associated with a compute instance and receiving, by a computing system, metadata associated with the compute instance signed with a private key. The private key may be associated with a public key. The method may include receiving a request to access a cloud resource and transmitting the request for the metadata. The method may also include receiving the metadata. The metadata may indicate that the compute instance is hosted on the computing system. The method may also include transmitting, to an instance principal service, a request for an instance principal certificate. The request may include the metadata signed with the private key and be cryptographically verified by the instance principal service using the public key. The method may also include receiving the instance principal certificate and providing access to the could resource based on the instance principal certificate.

Secure instance metadata as cryptographic identity

Growing community of inventors

Bothell, WA, United States of America

Mina Anes