# US 2026/0100971 A1 · Automated secure sockets layer certificate discovery and management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2026/0100971 A1 - Document ID: US20260100971A1 - Status: Published application - Kind: A1 - Application number: 18/908,296 - Filed: 2024-10-07 - Published: 2026-04-09 - Earliest claimed: 2024-10-07 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: John David Weber; Steve Baylon; Paul Huddy; Rakesh Jain; Don L. Maxwell; Pramod Muppala; Ajesh Philip; Nancy D. Royall; Jonathan Shilling - Web page: https://patentgrep.com/patent/US20260100971A1 ## CPC - H04L 63/166: {at the transport layer} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, computer program products, and methods are described herein for automated secure transport protocol (STP) certificate discovery and management. The present disclosure is configured to generate a list of servers to be scanned for STP certificates. A trust store file within each server in the list of servers is periodically scanned, wherein the scan is configured to identify (i) one or more STP certificates and an associated expiration date for each of the one or more STP certificates and (ii) additional STP certificates that have been added to the filesystem. A frequency of the scan of each trust store file is determined based on a proximity to the associated expiration date of at least one of the one or more STP certificates. The list of servers is updated to include the identified one or more STP certificates and the associated expiration date of the one or more STP certificates. ## Claims ### Claim 1 A system for automated secure transport protocol (STP) certificate discovery and management, the system comprising: a non-transitory storage device with computer-readable program code stored thereon; and a processing device coupled to the non-transitory device, wherein the processing device is configured to execute the computer-readable program code to: generate a list of servers to be scanned for secure transport protocol certificates, wherein the list of servers to be scanned for STP certificates comprises one or more servers with a filesystem; scan a trust store file of one or more trust stores within each server in the list of servers, wherein the scan is configured to identify (i) one or more STP certificates and an associated expiration date for each of the one or more STP certificates and (ii) additional STP certificates that have been added to the filesystem; determine a frequency of the scan of the trust store file of the one or more trust stores based on a proximity to the associated expiration date of at least one of the one or more STP certificates, wherein the frequency of the scan increases closer to the associated expiration date of the at least one STP certificate; and update the list of servers to include the identified one or more STP certificates and the associated expiration date of the one or more STP certificates. ### Claim 2 (depends on 1) The system of claim 1, wherein executing the instructions further causes the processing device to execute the computer-readable program code to: scan the STP certificate of the one or more servers; based on the scan of the STP certificate, identify one or more servers named on a subject alternative name list, wherein the subject alternative name list comprises a list of servers with unique names having a same STP certificate in use; determine that the STP certificate is located within each server identified on the subject alternative name list; and determine that all servers with the STP certificate in use are listed on the subject alternative name list. ### Claim 3 (depends on 1) The system of claim 1, wherein prior to scanning the one or more trust stores, the system implements a checksum to verify that the trust store has not changed since a last-in-time scan, and in response to verifying that the trust store has not changed, the system foregoes the scan of the trust store. ### Claim 4 (depends on 1) The system of claim 1, wherein scanning further comprises (i) comparing the plurality of STP certificates stored in the trust store to determine the existence of a renewed certificate associated with a first Universal Resource Locator (URL) and an expired certificate associated with the first URL, and (ii) in response to determining the existence of the renewed certificate and the expired certificate, automatically removing the expired certificate from the trust store. ### Claim 5 (depends on 1) The system of claim 1, wherein the scan further comprises a scan of a keystore file of one or more keystores and of one or more STP certificates not within the trust store and/or keystore. ### Claim 6 (depends on 1) The system of claim 1, wherein STP certificates are automatically renewed based on the associated expiration date of the STP certificate and wherein the renewed one or more STP certificates are automatically copied to the server which has the STP certificate in use. ### Claim 7 (depends on 6) The system of claim 6, wherein the server restarts to activate the renewed one or more STP certificates, and wherein the restart is scheduled based on a manually selected time frame. ### Claim 8 A computer program product for automated secure transport protocol (STP) certificate discovery and management, the computer program product comprising a non-transitory computer-readable medium comprising code causing an apparatus to: generate a list of servers to be scanned for STP certificates, wherein the list of servers to be scanned for STP certificates comprises one or more servers with a filesystem; scan a trust store file of one or more trust stores within each server in the list of servers, wherein the scan is configured to identify (i) one or more STP certificates and an associated expiration date for each of the one or more STP certificates and (ii) additional STP certificates that have been added to the filesystem; determine a frequency of the scan of the trust store file of the one or more trust stores based on a proximity to the associated expiration date of at least one of the one or more STP certificates, wherein the frequency of the scan increases closer to the associated expiration date of the at least one STP certificate; and update the list of servers to include the identified one or more STP certificates and the associated expiration date of the one or more STP certificates. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the code further causes the apparatus to: scan the STP certificate of the one or more servers; based on the scan of the certificate, identify one or more servers named on a subject alternative name list, wherein the subject alternative name list comprises a list of servers with unique names having a same STP certificate in use; determine that the STP certificate is located within each server identified on the subject alternative name list; and determine that all servers with the STP certificate in use are listed on the subject alternative name list. ### Claim 10 (depends on 8) The computer program product of claim 8, wherein prior to scanning the one or more trust stores, the system implements a checksum to verify that the trust store has not changed since a last-in-time scan, and in response to verifying that the trust store has not changed, the system foregoes the scan of the trust store. ### Claim 11 (depends on 8) The computer program product of claim 8, wherein scanning further comprises (i) comparing the plurality of STP certificates stored in the trust store to determine the existence of a renewed certificate associated with a first Universal Resource Locator (URL) and an expired certificate associated with the first URL, and (ii) in response to determining the existence of the renewed certificate and the expired certificate, automatically removing the expired certificate from the trust store. ### Claim 12 (depends on 8) The system of claim 8, wherein the scan further comprises a scan of a keystore file of one or more keystores and of one or more STP certificates not within a trust store and/or keystore. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein STP certificates are automatically renewed based on the associated expiration date of the STP certificate and wherein the renewed one or more STP certificates are automatically copied to the server which has the STP certificate in use. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the server restarts to activate the renewed one or more STP certificates, and wherein the restart is scheduled based on a manually selected time frame. ### Claim 15 A method for automated secure transport protocol (STP) certificate discovery and management, the method comprising: generating a list of servers to be scanned for STP certificates, wherein the list of servers to be scanned for STP certificates comprises one or more servers with a filesystem; scanning a trust store file of one or more trust stores within each server in the list of servers, wherein the scan is configured to identify (i) one or more STP certificates and an associated expiration date for each of the one or more STP certificates and (ii) additional STP certificates that have been added to the filesystem; determining a frequency of the scan of the trust store file of the one or more trust stores based on a proximity to the associated expiration date of at least one of the one or more STP certificates, wherein the frequency of the scan increases closer to the associated expiration date of the at least one STP certificate; and updating the list of servers to include the identified one or more STP certificates and the associated expiration date of the one or more STP certificates. ### Claim 16 (depends on 15) The method of claim 15, wherein the method further comprises: scanning the STP certificate of the one or more servers; based on the scan of the certificate, identifying one or more servers named on a subject alternative name list, wherein the subject alternative name list comprises a list of servers with unique names having a same STP certificate in use; determining that the STP certificate is located within each server identified on the subject alternative name list; and determining that all servers with the STP certificate in use are listed on the subject alternative name list. ### Claim 17 (depends on 15) The method of claim 15, wherein prior to scanning the one or more trust stores, the system implements a checksum to verify that the trust store has not changed since a last-in-time scan, and in response to verifying that the trust store has not changed, the system foregoes the scan of the trust store. ### Claim 18 (depends on 15) The method of claim 15, wherein scanning further comprises (i) comparing the plurality of STP certificates stored in the trust store to determine the existence of a renewed certificate associated with a first Universal Resource Locator (URL) and an expired certificate associated with the first URL, and (ii) in response to determining the existence of the renewed certificate and the expired certificate, automatically removing the expired certificate from the trust store. ### Claim 19 (depends on 15) The method of claim 15, wherein STP certificates are automatically renewed based on the associated expiration date of the STP certificate and wherein the renewed one or more STP certificates are automatically copied to the server which has the STP certificate in use. ### Claim 20 (depends on 19) The method of claim 19, wherein the server restarts to activate the renewed one or more STP certificates, and wherein the restart is scheduled based on a manually selected time frame.