# US 2021/0243178 A1 · Load balancing across certificates and certificate authorities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243178 A1 - Document ID: US20210243178A1 - Status: Published application - Kind: A1 - Application number: 16/778,328 - Filed: 2020-01-31 - Published: 2021-08-05 - Earliest claimed: 2020-01-31 - Assignees: Fastly, Inc. - Applicants: Fastly Inc. - Inventors: Sean Leach - Web page: https://patentgrep.com/patent/US20210243178A1 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for server authentication in a content delivery network are provided. Various embodiments include a content delivery network obtaining multiple digital certificates from multiple certificate authorities. When a client attempts to access the content delivery network, the network serves the client a digital certificate and then monitors the authentication of the certificate. If the authentication fails, the content delivery network serves the client another digital certificate that was issued from a different certificate authority. In other embodiments, the content delivery network constantly monitors the function of each certificate authority. The content delivery network constantly pings each certificate authority. If any one of the certificate authorities fails to respond to the pings, the content delivery network will presume the certificate authority is non-operational and will stop using certificates from the non-operational certificate authorities until they resume operation. ## Claims ### Claim 1 A method to facilitate se authentication, the method comprising: receiving a request from a client application to establish a secure session; sending a digital certificate to the client application, wherein the digital certificate is associated with a certificate authority; determining that a state of the secure session is anomalous; in response to determining that the state of the secure session is anomalous, sending a different digital certificate associated with a different certificate authority to the client application. ### Claim 2 (depends on 1) The method of claim 1 further comprising determining the state of the secure session is normal when the client application validates the digital certificate, and upon determining the state of the secure session is normal, establishing a secure session. ### Claim 3 (depends on 1) The method of claim 1 wherein determining the state of the secure session further comprises setting a timer or a counter. ### Claim 4 (depends on 3) The method of claim 3, wherein the timer or counter, upon time-out, indicates that the state of the secure session is anomalous. ### Claim 5 (depends on 1) The method of claim 1 further comprising pinging one or more certificate authorities wherein the pinging includes sending one or more of an internee control message protocol (ICMP) echo request, an online certificate status protocol (OCSP) health check, a hypertext transfer protocol (HTTP) health check, or an OCSP request to the one or more certificate authorities. ### Claim 6 (depends on 5) The method of claim 5 wherein pinging the one or more certificate authorities further comprises ceasing use of digital certificates associated with one or more certificate authorities that do not respond the pinging. ### Claim 7 (depends on 6) The method of claim 6 further comprising load balancing distribution of digital certificates to one or more additional client applications wherein the digital certificates are associated with one or more certificate authorities that respond to the pinging. ### Claim 8 A method to facilitate server authentication, the method comprising: pinging one or more certificate authorities; distributing digital authentication certificates to one or more edge nodes in an edge network; determining that an operational state of one or more certificate authorities is anomalous; and in response to determining that the operational state of the one or more certificate authorities is anomalous, notifying the one or more edge nodes in the edge network that the operational state of the one or more certificate authorities is anomalous. ### Claim 9 (depends on 8) The method of claim 8 wherein pinging the one or more certificate authorities further comprises sending one or more of an internet control message protocol (ICMP) echo request, an online certificate status protocol (OCSP) health check, a hypertext transfer protocol (HTTP) health check, or an OCSP request; and determining that the operational state of the one or more certificate authorities is anomalous when the one or more certificate authorities fail to respond to the pinging. ### Claim 10 (depends on 8) The method of claim 8 wherein notifying the one or more edge nodes further comprises directing the one or more edge nodes to cease distribution of digital authentication certificates associated with one or more certificate authorities that have an operational state that is anomalous. ### Claim 11 (depends on 8) The method of claim 8 wherein notifying the one or more edge nodes further comprises directing the one or more edge nodes to use digital authentication certificates associated with the one or more certificate authorities when the operational state of the one or more certificate authorities is normal. ### Claim 12 (depends on 11) The method of claim 11 further comprising load balancing distribution of digital authentication certificates to one or more client applications when the digital authentication certificates are associated with the one or more certificate authorities that have an operational state that is normal. ### Claim 13 (depends on 8) The method of claim 8 wherein distributing digital authentication certificates further comprises ceasing distribution of digital authentication certificates associated with the one or more certificate authorities that have an operational state that is anomalous. ### Claim 14 A computing apparatus comprising: one or more computer readable storage media; one or more processors operatively coupled with the one or more computer-readable storage media; and program instructions stored on the one or more computer readable storage media to facilitate server authentication in a content delivery network that, when executed by the one or more processors, direct the computing apparatus to at least: receive a request from an end point to establish a secure session; send a digital certificate to the end point, wherein the digital certificate is associated with a certificate authority; determine that a state of the secure session is anomalous; in response to determining that the state of the secure session is anomalous, send a different digital certificate associated with a different certificate authority to the end point. ### Claim 15 (depends on 14) The computer-readable storage medium of claim 14, wherein the set of instructions further cause the one or more processors to determine the state of the secure session is normal when the end point validates the digital certificate, and upon determining the state of the secure session is normal, establish a secure session. ### Claim 16 (depends on 14) The computer-readable storage medium of claim 14, wherein the set of instructions further cause the one or more processors to: set a timer; and wherein the timer, upon time-out, indicates that the state of the secure session is anomalous. ### Claim 17 (depends on 14) The computer-readable storage medium of claim 14, wherein the set of instructions further cause the one or more processors to: ping one or more certificate authorities wherein the ping comprises one or more of an Internet control message protocol (ICMP) echo request, an online certificate status protocol (OCSP) health check, a hypertext transfer protocol (HTTP) health check, or an OCSP request; and identify which of the one or more certificate authorities respond to the ping and which of the one or more certificate authorities fail to respond to the ping. ### Claim 18 (depends on 17) The computer-readable storage medium of claim 17, wherein the set of instructions further cause the one or more processors to direct one or more elements of the content delivery network to cease the distribution of digital authentication certificates associated with the one or more certificate authorities that failed to respond to the ping. ### Claim 19 (depends on 18) The computer-readable storage medium of claim 18, wherein the set of instructions further cause the one or more processors to load balance the distribution of digital authentication certificates to one or more additional end points when the digital authentication certificates are associated with the one or more certificate authorities that respond to the ping. ### Claim 20 (depends on 18) The computer-readable storage medium of claim 18, wherein the set of instructions further cause the one or more processors to: ping the one or more certificate authorities which failed to respond to the ping; and notify the one or more elements of the content delivery network when the one or more certificate authorities which failed to respond to the ping, begin to respond to the ping.