Securely rotating a server certificate

A method, comprising:

• providing, to a discovery endpoint, a request for a current list of certificates associated with a server instance;
• verifying that the current list of certificates associated is a trusted list of certificates associated with the server instance by:
• receiving a data object including the current list of certificates cryptographically signed by a first server certificate;
• and
• determining that the first server certificate used to cryptographically sign the current list of certificates is included within a client list of one or more server certificates, the client list including a local list of server certificates accessible to a client;
• based on verifying that the current list of certificates is a trusted list, generating an updated client list including the current list of certificates;
• receiving, from the server instance, a call response including a second server certificate included within the updated client list;
• and
• based on determining that the second server certificate is included within the updated client list, initiating a trusted session between the client and the server instance.

A system, comprising:

• one or more processors;
• memory in electronic communication with the one or more processors;
• and
• instructions stored in the memory, the instructions being executable by the one or more processors to:
• receive, from a server instance, a call response including a first server certificate for verifying an identity of the server instance;
• determine that the first server certificate does not match at least one certificate from a client list of one or more server certificates, the client list including a local list of server certificates accessible to a client and associated with verifying the identity of the server instance;
• based on the first server certificate not matching the one or more server certificates from the client list, providing, to a discovery endpoint, a request for a current list of certificates associated with verifying the identity of the server instance;
• verify that the current list of certificates from the discovery endpoint is a trusted list of server certificates associated with verifying the identity of the server instance, wherein verifying the current list of certificates comprises:
• receiving a data object including the current list of certificates cryptographically signed by a second server certificate;
• and
• determining that the second server certificate used to cryptographically sign the data object is included within the client list of one or more server certificates;
• and
• based on verifying that the current list of certificates is a trusted list, generate an updated client list including the current list of certificates.