Method and system for issuing proof-equipped certificates for certificate authority

A method for issuing proof-equipped certificates for a CA, comprising the steps of:

• a) generating a private key and a public key by a software application installed in a computing device which has a processing unit operating the software application and a memory unit storing the keys;
• b) creating a CSR including the public key by the software application;
• c) enabling access to a DKIM email account of a DKIM email server of a specific domain by the software application;
• d) encoding the CSR and embedding the encoded CSR as an email draft by the software application;
• e) asking the DKIM email server to send out a DKIM email based on the email draft from the DKIM email account to a CA server or a CA server cluster by the software application;
• f) creating a certificate according to X.509 specification by the CA server or one server of the CA server cluster, wherein a subject name field or a subject alternative field of the certificate is set as an email address of the DKIM email account;
• a public key field of the certificate is set as the public key in the CSR;
• the DKIM email is kept as a proof in the CA server, one server of the CA server cluster or another storage server with an assigned URL (Uniform Resource Locator) for download;
• the URL is derived from the certificate;
• the resulting certificate is a proof-equipped certificate;
• and
• g) sending back the proof-equipped certificate in the form of email to the DKIM email server for the computing device to download or making the proof-equipped certificate downloadable for the computing device by the CA server or one server of the CA server cluster.

A system for issuing proof-equipped certificates for a CA, installed or mounted in a server or a server cluster, comprising:

• an I/O processing module, for receiving a DKIM email sent from a DKIM email server, wherein the DKIM email server is asked to send out the DKIM email from a DKIM email account by a software application, wherein the software application is installed in a computing device which is connected to the I/O processing module;
• the computing device has a processing unit and a memory unit;
• the software application is operated by the processing unit and for generating a private key and a public key, creating a CSR including the public key, enabling access to the DKIM email account of the DKIM email server of a specific domain, and encoding the CSR and embedding the encoded CSR in an email draft;
• the DKIM email is based on the email draft;
• the memory unit stores the keys;
• and
• a certificate generation module, signally connected with the I/O processing module, for creating a certificate according to X.509 specification with the DKIM email from the I/O processing module, wherein a subject name field or a subject alternative field of the certificate is set as an email address of the DKIM email account;
• a public key field of the certificate is set as the public key in the CSR;
• the DKIM email is encoded and embedded in a reserved field of the certificate as a proof;
• the encoding of the DKIM email preserves a DKIM signature and all the parts covered by the DKIM signature;
• the resulting certificate is a proof-equipped certificate;
• wherein the I/O processing module is further for sending back the proof-equipped certificate in the form of email to the DKIM email server for the computing device to download or making the proof-equipped certificate downloadable for the computing device.