Central certificate management

A method for handling at a client a certificate for a subject, wherein a first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer, the method comprising the steps:

• requesting, at the client, a second certificate for the subject;
• providing, at the client, a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer, the step of providing the second certificate for the subject comprising:
• checking, if the second certificate for the subject is stored in a storage;
• if the second certificate for the subject is stored in the storage, retrieving the second certificate for the subject from the storage;
• and
• if the second certificate for the subject is not stored in the storage, sending a request for the second certificate for the subject to a certificate management system;
• receiving the second certificate for the subject from the certificate management system;
• performing, at the client, a certificate chain validation process for the received second certificate for the subject;
• and
• performing, at the client, an action on the basis of the first public key of the second certificate for the subject.

The method according to 10, wherein a first certificate for another subject comprises another public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer, wherein the method comprises:

• retrieving a second certificate for the other subject comprising the other public key of the first certificate for the other subject, an issuer field with the other first issuer and a serial number field with the first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate;
• performing a certificate chain validation process for the received second certificate for the other subject;
• and
• performing, at the client, an action on the basis of the other first public key of the second certificate for the other subject.

A non-transitory computer-readable medium having a program stored therein for certificate management for a plurality of clients configured to perform the following steps, when executed on one or more processor(s):

• receiving a first certificate for a subject, wherein the first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer;
• generating a second certificate for the subject, wherein the generated second certificate for the subject comprise the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer;
• and
• transmitting the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.

A certificate management system for managing certificates for a plurality of clients comprising:

• a memory storing instructions for certificate management;
• at least one processor configured to execute the instructions and:
• receive a first certificate for a subject comprising a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer;
• generate a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer;
• and
• transmit the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.