US 2019/0245700 A1 · Managing And Negotiating Certificates

Abstract

Systems and techniques are described herein for managing and negotiating SSL certificates as part of a handshake between a client computing device and a website hosting infrastructure. Certificates for a website are stored in a common storage and are lazy-loaded into cache memory when the website is requested by a client. Certificates are served by the hosting infrastructure responsive to a handshake request from a client by determining if a certificate for a hostname in the handshake request is in cache memory. When available, a cached certificate is served. When a cached certificate for the hostname is unavailable, a certificate is retrieved from the common storage, placed in cache memory, and served. OCSP stapling data is lazy-loaded and served also from the cache memory. Hence, a certificate is available immediately upon deployment, without costly reconfiguration of the hosting platform to accommodate new certificates and new hostnames.

Claims20

Dependent claims

In a digital medium environment to serve content to a client, a method implemented by a load balancer, the method comprising:

receiving, by the load balancer, a handshake request from the client;
negotiating, by the load balancer, when the handshake request does not include a hostname, a handshake with the client by sending a default certificate to the client;
or
negotiating, by the load balancer, when the handshake request does include the hostname, the handshake with the client by:
determining, when a cached certificate for the hostname is in a cache memory, the cached certificate as a certificate to send to the client;
or
when the cached certificate for the hostname is not in the cache memory:
obtaining an additional certificate for the hostname from a common storage;
adding the additional certificate to the cache memory;
and
determining the additional certificate as the certificate to send to the client;
and
sending, to the client, the certificate to send to the client.

10 more elements

In a digital medium environment to serve content, a system comprising:

an encrypted network storage;
a cache memory;
a handshake receiving module implemented at least partially in hardware of a load balancer to receive a handshake request from a client;
a legacy support module implemented at least partially in hardware of the load balancer to negotiate, when the handshake request does not include a hostname, a handshake with the client by sending a default certificate to the client;
a server name indication module implemented at least partially in hardware of the load balancer to negotiate, when the handshake request does include the hostname, the handshake with the client by:
determining, when a cached certificate for the hostname is in the cache memory, the cached certificate as a certificate to send to the client;
or
when the cached certificate for the hostname is not in the cache memory:
obtaining an additional certificate for the hostname from the encrypted network storage;
adding the additional certificate to the cache memory;
and
determining the additional certificate as the certificate to send to the client;
and
a handshake sending module implemented at least partially in hardware of the load balancer to send, to the client, the certificate to send to the client.

11 more elements

In a digital medium environment to serve content to a client, a method implemented by a load balancer, the method comprising:

a step for receiving a handshake request from the client;
a step for negotiating, when the handshake request does not include a hostname, a handshake with the client by sending a default certificate to the client;
or
a step for negotiating, when the handshake request does include the hostname, the handshake with the client by:
determining, when a cached certificate for the hostname is in a cache memory, the cached certificate as a certificate to send to the client;
or
when the cached certificate for the hostname is not in the cache memory:
obtaining an additional certificate for the hostname from a common storage;
adding the additional certificate to the cache memory;
and
determining the additional certificate as the certificate to send to the client;
determining, when cached status protocol data for the certificate to send to the client is in the cache memory, the cached status protocol data as status protocol data to send to the client;
or
when the cached status protocol data for the certificate to send to the client is not in the cache memory:
obtaining, from an endpoint indicated by the certificate to send to the client, additional status protocol data for the certificate to send to the client;
adding the additional status protocol data to the cache memory;
and
determining the additional status protocol data as the status protocol data to send to the client;
and
a step for sending, to the client, the certificate to send to the client and the status protocol data to send to the client.

17 more elements

Dependencies are inferred from the claim text.

Managing And Negotiating Certificates

Life of this patent

Managing And Negotiating Certificates

Life of this patent

Abstract

Claims20