Systems and methods for digital certificate security

One or more non-transitory computer-readable media having instructions, stored thereon, that when executed by one or more processors of a computing system cause the computing system to:

• identify a plurality of digital certificates, individual digital certificates of the plurality of digital certificates including respective internal information;
• determine external information associated with the individual digital certificates, the external information not contained within the respective digital certificate, wherein the external information at least includes a configuration of a server on which an individual digital certificate is installed, and specific data regarding a cipher suite that is used for the individual digital certificates, wherein the external information is determined at different points in time;
• store the internal information and the external information for the plurality of digital certificates;
• identify a set of digital certificates, from the plurality of digital certificates based on the stored internal information or the external information in the database, that are associated with a client;
• identify differences in the stored external information between respective individual digital certificates of the set of digital certificates wherein the differences include a determination whether the stored external information has changed between the different points in time;
• identify a plurality of servers or locations where a same digital certificate has been installed;
• and
• generate a removal request to be sent to a certificate authority to request removal of one or more vulnerable digital certificates based on the differences in the stored external information.

One or more non-transitory computer-readable media having instructions, stored thereon, that when executed by one or more processors of a computing system cause the computing system to:

• identify a plurality of digital certificates, individual digital certificates of the plurality of digital certificates including respective internal information;
• determine external information associated with the individual digital certificates, the external information not contained within the respective digital certificate, wherein the external information at least includes a configuration of a server on which an individual digital certificate is installed, and specific data regarding a cipher suite that is used for the individual digital certificates, wherein the external information is determined at different points in time;
• store the internal information and the external information for the plurality of digital certificates;
• identify a set of digital certificates, from the plurality of digital certificates based on the stored internal information or the external information in the database, that are associated with a client;
• obtain expected information to indicate expected values for the external information of the set of digital certificates;
• compare the expected information to the stored external information to determine whether the expected information is different than the external information for one or more digital certificates of the set of digital certificates wherein differences include a determination whether the external information has changed between the different points in time;
• identify a plurality of servers or locations where a same digital certificate has been installed;
• and
• generate a removal request to be sent to a certificate authority to request removal of one or more vulnerable digital certificates based on the differences in the external information.