System and method for dynamic retrieval of certificates with remote lifecycle management

A method of importing, creating, renewing, rekeying, retrieving, assigning, or acquiring a leaf certificate for a public key and an associated private key of an asymmetric key pair, used in client authentication between applications executing on distributed devices in an Internet of Things (IoT), Industrial IoT (IIoT), or Operational Technology (OT) environment, in data signing with digital signatures, and in key unwrapping, the method comprising:

• providing a client application executing on a first device, a server application executing on a second device, a plurality of trusted intermediate certificates and trusted root certificates issued by a certificate authority (CA), a key distribution service (KDS), a KDS portal, a KDS administrator, a KDS proxy, a client KDS interface, a member identifier, a member universally unique identifier (UUID), a member domain name system (DNS) hostname, a symmetric KDS member (M-PSK), a M-PSK identity hint, a tenant identifier, an application identifier, a dynamic host configuration protocol (DHCP) service, and a domain name system (DNS) service;
• importing, by the KDS administrator on the KDS portal, a first plurality of leaf certificates and a first plurality of associated private keys in single or batch mode;
• creating, by the KDS administrator on the KDS portal, an asymmetric key pair and sending a create leaf certificate request for the public key to the certificate authority;
• renewing, by the KDS administrator on the KDS portal, an expiry of the first plurality of leaf certificates by sending a request to the certificate authority;
• rekeying, by the KDS administrator on the KDS portal, by creating a new asymmetric key pair and sending a rekey leaf certificate request with the leaf certificate and a new public key to the certificate authority;
• retrieving, by the KDS administrator on the KDS portal, a second plurality of leaf certificates and a second plurality of associated private keys as a batch generated by the certificate authority and associated with a batch identifier;
• wherein the batch is generated on request by the KDS administrator on the KDS portal or autonomously generated by the certificate authority,
• authenticating with the KDS, by the client application executing on the first device, using the tenant identifier, the symmetric KDS member (M-PSK), the M-PSK identity hint, and a first DNS hostname, wherein the first device is registered by the first DNS hostname on the DNS service configured with the KDS or the KDS proxy, and wherein the first device is registered as a member device on the KDS;
• acquiring, by the client application, the plurality of trusted intermediate and root certificates, the leaf certificate, and the associated private key from the KDS, using at least the tenant identifier for the plurality of trusted intermediate and root certificates and a subject name for leaf certificates, wherein the acquired leaf certificate and the associated private key is used in certificate-based client authentication, for mutual authentication, over a secure transport protocol during communication with the server application executing on the second device, or in data signing with digital signatures, or in key unwrapping;
• initiating, by the client application, a secure session using a security protocol, wherein the session is initiated using the acquired leaf certificate and the associated private key for certificate-based client authentication, to establish secure communications with the server application executing on the second device;
• and
• verifying, by the client application, a certificate status programmatically using the client KDS interface, without requiring human intervention, and without service disruption, and wherein a further certificate-based client authentication is executed upon certificate renewal or rekey by re-acquiring the leaf certificate, the associated private key, and the plurality of trusted intermediate and root certificates.