Using an ocsp responder as a crl distribution point
AssigneeRed Hat, Inc.
InventorAndrew Wnuk
Life of this patent
Estimating the term…
Abstract
A certificate revocation list (CRL) distribution system receives a request from a client pertaining to a status of a certificate and determines whether the client is an online certificate status protocol (OCSP) compliant client. The certificate status distribution system sends the certificate status to the client using OCSP in response to a determination that the client is an OCSP compliant client and sends a certificate revocation list to the client in response to a determination that the client is not an OCSP compliant client.
Claims19
A method, implemented by a server computing system programmed to perform the following, comprising:
- receiving, by the server computing system, a request from a client pertaining to a status of a certificate;
- determining, by the server computing system, whether the client is an online certificate status protocol (OCSP) compliant client;
- and
- sending, by the server computing system, the certificate status to the client using OCSP in response to a determination that the client is an OCSP compliant client and sending a certificate revocation list to the client in response to a determination that the client is not an OCSP compliant client.
A method, implemented by a client computing system programmed to perform the following, comprising:
- identifying, by the client computing system, a certificate for determining a status of the certificate;
- determining, by the client computing system, a certificate revocation list distribution point for the certificate, wherein the distribution point is an online certificate status protocol responder server;
- and
- sending, by the client computing system, a request for a certificate revocation list pertaining to the certificate to the online certificate status protocol responder server without using OCSP.
A system comprising:
- a persistent storage unit to store a plurality of certificate revocation lists, wherein a certificate revocation list corresponds to an issuing certificate authority;
- a certificate revocation list distribution system coupled to the persistent storage unit to receive a request from a client pertaining to a status of a certificate, to determine whether the client is an online certificate status protocol (OCSP) compliant client, and to send the certificate status to the client using OCSP in response to a determination that the client is an OCSP compliant client and to send a certificate revocation list to the client in response to a determination that the client is not an OCSP compliant client.
A system comprising:
- a persistent storage unit to store certificate data for a certificate;
- and
- a certificate revocation list request system coupled to the persistent storage unit to identify the certificate for determining a status of the certificate, to determine a certificate revocation list distribution point for the certificate, wherein the distribution point is an online certificate status protocol responder server, and to send a request for a certificate revocation list pertaining to the certificate to the online certificate status protocol responder server without using OCSP.
A computer-readable storage medium including instructions that, when executed by a computer system, cause the computer system to perform a set of operations comprising:
- receiving a request from a client pertaining to a status of a certificate;
- determining whether the client is an online certificate status protocol (OCSP) compliant client;
- and
- sending the certificate status to the client using OCSP in response to a determination that the client is an OCSP compliant client and sending a certificate revocation list to the client in response to a determination that the client is not an OCSP compliant client.
A computer-readable storage medium including instructions that, when executed by a computer system, cause the computer system to perform a set of operations comprising:
- identifying a certificate for determining a status of the certificate;
- determining a certificate revocation list distribution point for the certificate, wherein the distribution point is an online certificate status protocol responder server;
- and
- sending a request for a certificate revocation list pertaining to the certificate to the online certificate status protocol responder server without using OCSP.
Dependencies are inferred from the claim text.