# US 10,771,260 B2 · Systems and methods for digital certificate security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,260 B2 - Document ID: US10771260B2 - Status: Granted - Kind: B2 - Application number: 15/184,997 - Filed: 2016-06-16 - Published: 2016-12-22 - Granted: 2020-09-08 - Earliest claimed: 2015-06-16 - Assignees: Vellitas LLC - Applicants: Vellitas LLC - Inventors: Seth Martin Shearer; Spencer Vernon Shearer - Web page: https://patentgrep.com/patent/US10771260B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/45: Structures or tools for the administration of authentication - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 2221/2101: Auditing as a secondary aspect - H04L 2209/64: Self-signed certificates - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments describe apparatuses, systems, and methods for analyzing digital certificates. A system may scan the internet to identify all publicly available digital certificates. The system may further determine external information for individual digital certificates that is not found within the digital certificate. The system may store the external information and internal information that is found within the digital certificates. The system may run one or more queries on the stored information to identify one or more vulnerable digital certificates among a set of digital certificates associated with a client. For example, the system may identify differences between the internal information and/or external information among the digital certificates of the set and/or may compare the internal information and/or external information for the digital certificates of the set to expected information. Other embodiments may be described and claimed. ## Claims ### Claim 1 A computer-implemented method comprising: identifying a plurality of digital certificates, individual digital certificates of the plurality of digital certificates including respective internal information; determining external information associated with the individual digital certificates, the external information not contained within the respective digital certificate, wherein the external information at least includes a configuration of a server on which an individual digital certificate is installed, and specific data regarding a cipher suite that is used for the individual digital certificates, wherein the external information is determined at different points in time; storing the internal information and the external information for the plurality of digital certificates in a database; running a query against the database to identify one or more vulnerable digital certificates associated with a client based on the internal information and the external information, wherein the query is to identify a plurality of servers or locations where a same digital certificate has been installed, and the query includes determining whether the external information has changed between the different points in time; and generating a removal request to be sent to a certificate authority to request removal of the one or more vulnerable digital certificates. ### Claim 2 (depends on 1) The method of claim 1, further comprising identifying the one or more vulnerable digital certificates based on one or more differences between the external information of different digital certificates among a set of digital certificates that are associated with the client. ### Claim 3 (depends on 1) The method of claim 1, wherein the external information includes one or more of: geolocation information associated with a physical location where the digital certificate is stored; a Domain Name System (DNS) name of the host server; reverse DNS data to indicate an owner of the host server; an Internet Protocol (IP) address of the host server; whether the host server allows compression to be used; a length of a validity period of the digital certificate; or timing information to indicate a date on which the determining the external information was performed. ### Claim 4 (depends on 1) The method of claim 1, wherein the external information includes geolocation information associated with a physical location where the digital certificate is stored, and wherein the running the query is to identify differences in the physical locations of different digital certificates among a set of digital certificates associated with the client. ### Claim 5 (depends on 4) The method of claim 4, wherein the running the query is to identify digital certificates of the set of digital certificates that are located outside of a geographical boundary to identify the one or more vulnerable digital certificates. ### Claim 6 (depends on 4) The method of claim 4, further comprising generating a map to indicate the physical location of the set of digital certificates. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of digital certificates includes all digital certificates that are accessible via addressable IP address space. ### Claim 8 (depends on 1) The method of claim 1, wherein running the query includes identifying one or more digital certificates having an associated company name or domain name that is similar to a respective company name or domain name of the client. ### Claim 9 (depends on 1) The method of claim 1, wherein the internal information includes one or more of: a company name associated with the digital certificate; a domain name associated with the digital certificate; an expiration date of the digital certificate; a certificate serial number; a subject key identifier; or an authority key identifier. ### Claim 10 (depends on 1) The method of claim 1, wherein the one or more vulnerable digital certificates include one or more non-production digital certificates that were not intended to be publicly used. ### Claim 11 (depends on 1) The method of claim 1, further comprising displaying, to a user, the external information associated with a set of digital certificates that are associated with the client. ### Claim 12 One or more non-transitory computer-readable media having instructions, stored thereon, that when executed by one or more processors of a computing system cause the computing system to: identify a plurality of digital certificates, individual digital certificates of the plurality of digital certificates including respective internal information; determine external information associated with the individual digital certificates, the external information not contained within the respective digital certificate, wherein the external information at least includes a configuration of a server on which an individual digital certificate is installed, and specific data regarding a cipher suite that is used for the individual digital certificates, wherein the external information is determined at different points in time; store the internal information and the external information for the plurality of digital certificates; identify a set of digital certificates, from the plurality of digital certificates based on the stored internal information or the external information in the database, that are associated with a client; identify differences in the stored external information between respective individual digital certificates of the set of digital certificates wherein the differences include a determination whether the stored external information has changed between the different points in time; identify a plurality of servers or locations where a same digital certificate has been installed; and generate a removal request to be sent to a certificate authority to request removal of one or more vulnerable digital certificates based on the differences in the stored external information. ### Claim 13 (depends on 12) The one or more media of claim 12, wherein the external information includes one or more of: geolocation information associated with a physical location where the digital certificate is stored; a Domain Name System (DNS) name of the host server; reverse DNS data to indicate an owner of the host server; an Internet Protocol (IP) address of the host server; whether the host server allows compression to be used; a length of a validity period of the digital certificate; or timing information to indicate a date on which the determining the external information was performed. ### Claim 14 (depends on 12) The one or more media of claim 12, wherein the external information includes geolocation information associated with a physical location where the respective digital certificate is stored, and wherein the instructions, when executed, further cause the system to display a map to indicate the physical location of the digital certificates of the set of digital certificates. ### Claim 15 (depends on 12) The one or more media of claim 12, wherein the external information includes geolocation information associated with a physical location where the respective digital certificate is stored, and wherein the instructions, when executed, further cause the system to identify one or more digital certificates of the set of digital certificates that are located outside a predefined geographical boundary. ### Claim 16 (depends on 12) The one or more media of claim 12, wherein the plurality of digital certificates includes all publicly accessible digital certificates. ### Claim 17 One or more non-transitory computer-readable media having instructions, stored thereon, that when executed by one or more processors of a computing system cause the computing system to: identify a plurality of digital certificates, individual digital certificates of the plurality of digital certificates including respective internal information; determine external information associated with the individual digital certificates, the external information not contained within the respective digital certificate, wherein the external information at least includes a configuration of a server on which an individual digital certificate is installed, and specific data regarding a cipher suite that is used for the individual digital certificates, wherein the external information is determined at different points in time; store the internal information and the external information for the plurality of digital certificates; identify a set of digital certificates, from the plurality of digital certificates based on the stored internal information or the external information in the database, that are associated with a client; obtain expected information to indicate expected values for the external information of the set of digital certificates; compare the expected information to the stored external information to determine whether the expected information is different than the external information for one or more digital certificates of the set of digital certificates wherein differences include a determination whether the external information has changed between the different points in time; identify a plurality of servers or locations where a same digital certificate has been installed; and generate a removal request to be sent to a certificate authority to request removal of one or more vulnerable digital certificates based on the differences in the external information. ### Claim 18 (depends on 17) The one or more media of claim 17, wherein the instructions, when executed, further cause the computing system to, if the expected information is different than the external information for one or more digital certificates of the set of digital certificates, identify the one or more digital certificates to the user. ### Claim 19 (depends on 17) The one or more media of claim 17, wherein the expected information includes an expected geographical boundary, and wherein the external information includes geolocation information to indicate a location where the individual digital certificates of the set of digital certificates. ### Claim 20 (depends on 17) The one or more media of claim 17, wherein the external information includes one or more of: a Domain Name System (DNS) name of the host server; reverse DNS data to indicate an owner of the host server; an Internet Protocol (IP) address of the host server; or whether the host server uses compression.