# US 10,122,536 B2 · Central certificate management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,536 B2 - Document ID: US10122536B2 - Status: Granted - Kind: B2 - Application number: 15/088,339 - Filed: 2016-04-01 - Published: 2016-10-06 - Granted: 2018-11-06 - Earliest claimed: 2015-04-02 - Assignees: Totemo AG - Applicants: Totemo AG - Inventors: Marcel Mock - Web page: https://patentgrep.com/patent/US10122536B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/007: {involving hierarchical structures} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Certificate management method for a plurality of clients, the method including: receiving a first certificate for a subject including a public key, an issuer field with an issuer and a serial number field with a serial number, wherein the first certificate for the subject is signed by a first certificate for the issuer; generating a second certificate for the subject including the public key, an issuer field with the issuer and a serial number field with the serial number, wherein the second certificate for the subject is signed by a second certificate for the issuer being different to the first certificate for the issuer; and transmitting the second certificate for the subject to one of the plurality of clients; and performing an action on the basis of the public key of the second certificate for the subject. ## Claims ### Claim 1 A method for certificate management for a plurality of clients performed by a certificate management system with at least one processor configured to perform the steps of: receiving a first certificate for a subject, wherein the first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer; generating a second certificate for the subject, wherein the generated second certificate for the subject comprises the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer; receiving a request for the second certificate for the subject from one of the plurality of clients; and transmitting the second certificate for the subject to the one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject. ### Claim 2 (depends on 1) The method according to claim 1, wherein the first certificate for the first issuer comprises at least one of: an issuer field with a second issuer, a serial number field with a second serial number, and a second public key, and the second certificate for the first issuer comprises at least one of: an issuer field with a third issuer being different from the second issuer, a serial number field with a third serial number being different from the second serial number, and a third public key being different from the second public key. ### Claim 3 (depends on 1) The method according to claim 1, wherein the second certificate for the first issuer comprises an issuer field with a second issuer and the second certificate is signed by a certificate for the second issuer. ### Claim 4 (depends on 1) The method according to claim 1, wherein the second certificate for the first subject comprises an Authority Information Access Extension in order to allow the one of the plurality of clients receiving the second certificate for the subject to download the second certificate for the first issuer for certificate chain construction. ### Claim 5 (depends on 1) The method according to claim 1, wherein a certificate chain of the first certificate for the subject has a first root certificate and a certificate chain of the second certificate for the subject has a second root certificate being different from the first root certificate. ### Claim 6 (depends on 1) The method according to claim 1, wherein the at least one processor is further configured to perform the steps of: receiving a first certificate for another subject comprising another first public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer; generating a second certificate for the other subject comprising the other first public key, an issuer field with the other first issuer and a serial number field with the other first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate; and transmitting the second certificate for the other subject to one of the plurality of clients. ### Claim 7 (depends on 1) The method according to claim 1, wherein the second certificate for the subject is stored in a storage at the certificate management system. ### Claim 8 (depends on 1) The method according to claim 1, further comprising: receiving, at one of the plurality of clients, the second certificate for the subject; performing, at the one of the plurality of clients, a certificate chain validation process for the received second certificate for the subject; and performing, at the one of the plurality of clients, on the basis of the first public key of the second certificate for the subject: encrypting a message with the first public key of the second certificate for the subject and sending the encrypted message to the subject; or checking the signature of a message of the subject on the basis of the first public key of the second certificate for the subject. ### Claim 9 (depends on 8) The method according to claim 8, wherein the second certificate for the subject is stored in a storage at the one of the plurality of clients and further comprising: checking, if the second certificate for the subject is stored in the storage of the one of the plurality of clients; and if the second certificate for the subject is not stored in the storage at the one of the plurality of clients, the one of the plurality of clients sending a request for the second certificate for the subject to the certificate management system and receiving the second certificate for the subject from the certificate management system. ### Claim 10 A method for handling at a client a certificate for a subject, wherein a first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer, the method comprising the steps: requesting, at the client, a second certificate for the subject; providing, at the client, a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer, the step of providing the second certificate for the subject comprising: checking, if the second certificate for the subject is stored in a storage; if the second certificate for the subject is stored in the storage, retrieving the second certificate for the subject from the storage; and if the second certificate for the subject is not stored in the storage, sending a request for the second certificate for the subject to a certificate management system; receiving the second certificate for the subject from the certificate management system; performing, at the client, a certificate chain validation process for the received second certificate for the subject; and performing, at the client, an action on the basis of the first public key of the second certificate for the subject. ### Claim 11 The method according to 10, wherein a first certificate for another subject comprises another public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer, wherein the method comprises: retrieving a second certificate for the other subject comprising the other public key of the first certificate for the other subject, an issuer field with the other first issuer and a serial number field with the first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate; performing a certificate chain validation process for the received second certificate for the other subject; and performing, at the client, an action on the basis of the other first public key of the second certificate for the other subject. ### Claim 12 A non-transitory computer-readable medium having a program stored therein for certificate management for a plurality of clients configured to perform the following steps, when executed on one or more processor(s): receiving a first certificate for a subject, wherein the first certificate for the subject comprises a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer; generating a second certificate for the subject, wherein the generated second certificate for the subject comprise the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer; and transmitting the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject. ### Claim 13 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein the first certificate for the first issuer comprises at least one of: an issuer field with a second issuer, a serial number field with a second serial number, and a second public key; and the second certificate for the first issuer comprises at least one of: an issuer field with a third issuer being different from the second issuer, a serial number field with a third serial number being different from the second serial number and a third public key being different from the second public key. ### Claim 14 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein the second certificate for the first issuer comprises an issuer field with a second issuer and the second certificate is signed by a certificate for the second issuer. ### Claim 15 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein the second certificate for the first subject comprises an Authority Information Access Extension in order to allow the one of the plurality of clients receiving the second certificate for the subject to download the second certificate for the first issuer for certificate chain construction. ### Claim 16 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein a certificate chain of the first certificate for the subject has a first root certificate and a certificate chain of the second certificate for the subject has a second root certificate being different from the first root certificate. ### Claim 17 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein the steps comprise further: receiving a first certificate for another subject comprising another first public key, an issuer field with another first issuer and a serial number field with another first serial number, wherein the first certificate for the other subject is signed by a first certificate for the other first issuer; generating a second certificate for the other subject comprising the other first public key, an issuer field with the other first issuer and a serial number field with the other first serial number, wherein the second certificate for the other subject is signed by a second certificate for the other first issuer being different to the first certificate for the other first issuer, wherein the second certificate for the first issuer and the second certificate for the other first issuer are signed by the same certificate and have the same root certificate; transmitting the second certificate for the other subject to one of the plurality of clients. ### Claim 18 (depends on 12) The non-transitory computer-readable medium having the program stored therein according to claim 12, wherein the steps comprise further: storing the second certificate for the subject in a storage; and sending the second certificate for the subject to another of the plurality of clients. ### Claim 19 A certificate management system for managing certificates for a plurality of clients comprising: a memory storing instructions for certificate management; at least one processor configured to execute the instructions and: receive a first certificate for a subject comprising a first public key, an issuer field with a first issuer and a serial number field with a first serial number, wherein the first certificate for the subject is signed by a first certificate for the first issuer; generate a second certificate for the subject comprising the first public key, an issuer field with the first issuer and a serial number field with the first serial number, wherein the second certificate for the subject is signed by a second certificate for the first issuer being different to the first certificate for the first issuer; and transmit the second certificate for the subject to one of the plurality of clients, so that the one of the plurality of clients can perform a certificate chain validation process for the second certificate for the subject and so that the one of the plurality of clients can store the second certificate for the subject.