# US 10,313,136 B2 · Method and a system for verifying the authenticity of a certificate in a web browser using the SSL/TLS protocol in an encrypted internet connection to an HTTPS website > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,136 B2 - Document ID: US10313136B2 - Status: Granted - Kind: B2 - Application number: 15/335,136 - Filed: 2016-10-26 - Published: 2017-04-27 - Granted: 2019-06-04 - Earliest claimed: 2015-10-26 - Assignees: Online Solutions Oy - Applicants: Online Solutions Oy - Inventors: Jyrki Salmi - Web page: https://patentgrep.com/patent/US10313136B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/321: {involving a third party or a trusted authority} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/168: {above the transport layer} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for verifying the authenticity of a certificate in a web browser using an SSL/TLS protocol in an encrypted Internet connection to an HTTPS website includes establishing an encrypted connection to the HTTPS website using the web browser on a user's terminal device. A certificate including a public key of the HTTPS website and signed by a trusted certificate authority is sent to the user's web browser from the web server using the Internet connection. The certificate authority that signed the certificate is compared against the list of trusted certificate authorities. The certificate authority is verified as being included in the list. The thumbprint of the certificate is sent as an additional security check key using a second messaging channel, external to the Internet connection between HTTPS website and web browser of the user's terminal device, and the contact data in the customer register. The additional security check key is compared with the thumbprint received by the web. ## Claims ### Claim 1 A method for verifying the authenticity of a certificate in a web browser using an SSL/TLS (Secure Socked Layer/Transport Layer Security) protocol in an encrypted internet connection to an HTTPS (Hypertext Transfer Protocol Secure) website, wherein a web server of the HTTPS website has an SSL certificate provided with a thumbprint issued by a certificate authority governed by a third party, the web server has registered contact data of a user in a customer register and the web browser has a list of trusted certificate authorities, the method comprising: establishing an encrypted connection to the HTTPS website placed on the web server with the Internet connection as a first messaging channel using the web browser on the user's terminal device; authenticating the user during a first step of a two phase login process to the HTTPS website with steps including: sending a certificate including a public key of the HTTPS website and signed by a trusted certificate authority to the user's web browser from the web server using the Internet connection; comparing the certificate authority that has signed the certificate against the list of trusted certificate authorities embedded in the web browser; and verifying that the certificate authority is included in the list; and authenticating the user during a second step of the two phase process to the HTTPS website after completing the verifying the certificate authority with steps including: sending the thumbprint of the certificate as an additional security check key from the web server using a second messaging channel, external to the Internet connection between HTTPS website and web browser of the user's terminal device, and the contact data in the customer register based on the first step of the two phase login process; comparing the additional security check key with the thumbprint received by the web browser from the web server via the Internet connection for verifying the authenticity of the certificate; and generating the certificate on a certificate server utilizing the private key of the certificate server and the public key of the HTTPS website. ### Claim 2 (depends on 1) The method according to claim 1, wherein the sending the thumbprint includes using a user's mobile phone network as the second messaging channel. ### Claim 3 (depends on 2) The method according to claim 2, wherein the sending the thumbprint includes sending the additional security check key to the user's mobile phone network terminal device as a mobile phone network message after the user has logged in. ### Claim 4 (depends on 1) The method according to claim 1, wherein the sending the thumbprint includes using a mail delivery as said second messaging channel. ### Claim 5 (depends on 4) The method according to claim 4, wherein the sending the thumbprint includes sending said additional security check key to the user via a mail delivery before the user has logged in as part of a key code list, which is required for the user's login to the HTTPS website. ### Claim 6 (depends on 1) The method according to claim 1, wherein the sending the thumbprint includes using a software application separate from the web browser as said second messaging channel. ### Claim 7 A system for verifying the authenticity of a certificate in a web browser using the SSL/TLS (Secure Socked Layer/Transport Layer Security) protocol in an encrypted Internet connection with an HTTPS (Hypertext Transfer Protocol Secure) website, said system including: a user's terminal device comprising a web browser for browsing HTTPS websites; a web server for maintaining an HTTPS website, said web server having a public key of the HTTPS website and a private key of the HTTPS website for identifying the HTTPS website, a certificate with a unique thumbprint created by a trusted certificate authority governed by a third party, and a customer register for storing contact data of users independent of the Internet connection between the HTTPS website and web browser of the user's terminal device, said web server being arranged to send a certificate including a public key and signed by the certificate authority to the web browser on the user's terminal device, the HTTPS website having a two phase login process with a first phase for authenticating the user before an authenticity verification of the certificate and a second phase for authenticating the user after completing the verification of authenticity of the certificate; an encrypted Internet connection for connecting the web server to the web browser on the user's terminal device and vice versa as a first messaging channel; and a second messaging channel external to the Internet connection for sending an additional security check key, said additional security check key comprising the thumbprint of the certificate for verifying the authenticity of the certificate; a certificate server generating the certificate utilizing the private key of the certificate server and the public key of the HTTPS website; wherein said web server is arranged to send the additional security check key on the second messaging channel to the user based on the user data in said customer register, and wherein the contact data of users is related to said second messaging channel. ### Claim 8 (depends on 7) The system according to claim 7, wherein the second messaging channel comprises a mobile phone network. ### Claim 9 (depends on 8) The system according to claim 8, wherein the system further includes a modem arranged in association with the web server for sending a mobile phone network message that includes an additional security check key from the web server to the user's mobile phone network terminal device. ### Claim 10 (depends on 7) The system according to claim 7, wherein said second messaging channel is a mail delivery. ### Claim 11 (depends on 7) The system according to claim 7, wherein said system further comprises a second server connected to said web server and a software application separate from the web browser wherein said second server and said software application are arranged to form a second messaging channel. ### Claim 12 (depends on 11) The system according to claim 11, wherein said system further comprises a second terminal device of the user for storing and using of said software application.