Distributing certificate bundles according to fault domains

A method, comprising:

• detecting a trigger condition to distribute a first certificate bundle comprising a first set of one or more certificate authority certificates;
• determining, for each particular network entity of a plurality of network entities associated with a computer network, a fault domain associated with the particular network entity, from among a plurality of fault domains associated with the computer network,
• wherein each particular fault domain, of the plurality of fault domains, represents at least one single point of failure;
• partitioning the plurality of network entities into a plurality of certificate distribution groups based on a set of one or more partitioning criteria,
• wherein the set of one or more partitioning criteria comprises the fault domain associated with the particular network entity, and
• wherein each particular certificate distribution group, of the plurality of certificate distribution groups, comprises a particular subset of network entities, of the plurality of network entities,
• wherein the particular subset of network entities is associated with a particular single point of failure corresponding to a particular fault domain of the plurality of fault domains;
• selecting a first certificate distribution group, of the plurality of certificate distribution groups, for distribution of the first certificate bundle, wherein the first certificate distribution group comprises a first subset of network entities that is associated with a first fault domain of the plurality of fault domains;
• transmitting the first certificate bundle to the first subset of network entities;
• wherein the method is performed by at least one device including a hardware processor.

A system, comprising:

• at least one hardware processor;
• the system being configured to execute operations, using the at least one hardware processor, the operations comprising:
• detecting a trigger condition to distribute a first certificate bundle comprising a first set of one or more certificate authority certificates;
• determining, for each particular network entity of a plurality of network entities associated with a computer network, a fault domain associated with the particular network entity, from among a plurality of fault domains associated with the computer network,
• wherein each particular fault domain, of the plurality of fault domains, represents at least one single point of failure;
• partitioning the plurality of network entities into a plurality of certificate distribution groups based on a set of one or more partitioning criteria,
• wherein the set of one or more partitioning criteria comprises the fault domain associated with the particular network entity, and
• wherein each particular certificate distribution group, of the plurality of certificate distribution groups, comprises a particular subset of network entities, of the plurality of network entities,
• wherein the particular subset of network entities is associated with a particular single point of failure corresponding to a particular fault domain of the plurality of fault domains;
• selecting a first certificate distribution group, of the plurality of certificate distribution groups, for distribution of the first certificate bundle, wherein the first certificate distribution group comprises a first subset of network entities that is associated with a first fault domain of the plurality of fault domains;
• transmitting the first certificate bundle to the first subset of network entities.