# US 8,788,811 B2 · Server-side key generation for non-token clients > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,811 B2 - Document ID: US8788811B2 - Status: Granted - Kind: B2 - Application number: 12/790,354 - Filed: 2010-05-28 - Published: 2011-12-01 - Granted: 2014-07-22 - Earliest claimed: 2010-05-28 - Assignees: Red Hat, Inc. - Applicants: Christina Fu; Andrew Wnuk - Inventors: Christina Fu; Andrew Wnuk - Web page: https://patentgrep.com/patent/US8788811B2 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 9/0822: {using key encryption key} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 67/00: Network arrangements or protocols for supporting network services or applications (user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00) - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and system for server-side key generation for non-token clients is described. ## Claims ### Claim 1 A method, comprising: receiving, at a certificate manager of a computing system from a requester, a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device; determining that the certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate; generating the transport key pair for the digital certificate for the non-token client with the soft token by a server-side key generation engine of the computing system when the certificate enrollment request includes the server-side key indicator; receiving a password from the requester as part of the certificate enrollment request; encrypting the certificate enrollment request including the password with the public key of the transport key pair; encrypting the private key by the server-side key generation engine; and delivering the encrypted private key to the requester. ### Claim 2 (depends on 1) The method of claim 1, further comprising: encrypting the private key in an encrypted file using the password by the server-side key generation engine, wherein said delivering comprises delivering the encrypted file to the requester. ### Claim 3 (depends on 2) The method of claim 2, wherein the method further comprises decrypting the encrypted password by the server-side key generation engine using a private key of the transport key pair. ### Claim 4 (depends on 2) The method of claim 2, wherein the encrypted file is a Public Key Cryptography Standard (PKCS) #12 file. ### Claim 5 (depends on 2) The method of claim 2, wherein said encrypting the private key in the encrypted file further comprises encrypting the digital certificate with the private key in the encrypted file. ### Claim 6 (depends on 2) The method of claim 2, further comprising sending a message to the requester with a link to a location of the encrypted file to allow the requester to retrieve the encrypted file. ### Claim 7 (depends on 2) The method of claim 2, further comprising sending an email message to the requester with the encrypted file as an attachment to the email message. ### Claim 8 (depends on 1) The method of claim 1, further comprising: identifying a server-side key generation certificate profile of the computing system when the certificate enrollment request includes the server-side key indicator; and processing the certificate enrollment request according to the server-side key generation certificate profile when the certificate enrollment request includes the server-side key indicator. ### Claim 9 (depends on 1) The method of claim 1, further comprising: presenting to the requester a user interface for the certificate enrollment request on a web page, wherein the user interface comprises an input field to receive a password from the requester; receiving the certificate enrollment request and the password from the requester, wherein at least the password of the certificate enrollment request is encrypted using a public key of a transport key pair; decrypting the password by the server-side key generation engine using a private key of the transport key pair; approving, by the certificate manager, the certificate enrollment request to issue the digital certificate; and encrypting at least the private key of the digital certificate in an encrypted file using the decrypted password, wherein said delivering comprises delivering the encrypted file to the requester. ### Claim 10 (depends on 9) The method of claim 9, further comprising presenting a second user interface comprising a link to a location of the encrypted file to allow the requester to retrieve the encrypted file when the certificate enrollment request is approved. ### Claim 11 (depends on 9) The method of claim 9, further comprising sending an email message to the requester with the encrypted file as an attachment when the certificate enrollment request is approved. ### Claim 12 (depends on 9) The method of claim 9, further comprising: encrypting the private key using a private storage key by the server-side key generation engine; and archiving the private key in a key repository. ### Claim 13 (depends on 1) The method of claim 1, further comprising: receiving a password from an administrator of the computing system; encrypting the private key in an encrypted file using the password by the server-side key generation engine, wherein said delivering comprises delivering the encrypted file to the requester; and providing the password generated by the computing system. ### Claim 14 (depends on 13) The method of claim 13, wherein said providing the password comprises: creating a service task to manually notify the requester of the password; and notifying an agent of the certificate system of the service task to manually notify the requester of the password. ### Claim 15 A certificate system, comprising: a data storage device to store data concerning key pairs of digital certificates issued by a certificate authority (CA); a certificate manager, coupled to the data storage device, to receive from a requester a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device, and to determine that the certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate for the non-token client with the soft token; and a server-side key generation engine, coupled to the certificate manager, to generate the transport key pair for the digital certificate when the certificate enrollment request includes the server-side key indicator, to receive a password from the requester as part of the certificate enrollment request, to encrypt the certificate enrollment request including the password with the public key of the transport key pair, and to deliver the digital certificate and key pair to the requester. ### Claim 16 (depends on 15) The certificate system of claim 15, wherein the server-side key generation engine comprises: a key generator to generate the key pair; a key encryption module, coupled to the key generator, to encrypt the private key; and a key delivery module, coupled to the key encryption module, to deliver the encrypted private key to the requester. ### Claim 17 (depends on 16) The certificate system of claim 16, wherein the server-side key generation engine further comprises a key archival module, coupled to the key encryption module, to archive the private key in the data storage device, and wherein the key encryption module is to encrypt the private key using a private storage key and archive the encrypted private key in a key repository. ### Claim 18 (depends on 16) The certificate system of claim 16, wherein the key encryption module is to decrypt the password if encrypted, and encrypt the private key in an encrypted file using the password, and wherein the key delivery module is to deliver the encrypted file to the requester. ### Claim 19 A non-transitory machine-readable storage medium having instructions, which when executed, cause a computing system to perform operations, comprising: receiving, at a certificate manager of the computing system from a requester, a certificate enrollment request for a digital certificate for a non-token client, the digital certificate of the non-token client comprising a soft token that does not employ a hardware security device; determining that certificate enrollment request includes a server-side key indicator to generate a transport key pair, including a public key and a private key, for the digital certificate; generating the transport key pair for the digital certificate for the non-token client with the soft token by a server-side key generation engine of the computing system when the certificate enrollment request includes the server-side key indicator; receiving a password from the requester as part of the certificate enrollment request; encrypting the certificate enrollment request including the password with the public key of the transport key pair; encrypting the private key by the server-side key generation engine; and delivering the encrypted private key to the requester. ### Claim 20 (depends on 19) The non-transitory machine-readable storage medium of claim 19, further comprising: encrypting the private key in an encrypted file using the password by the server-side key generation engine, wherein said delivering comprises delivering the encrypted file to the requester. ### Claim 21 (depends on 20) The non-transitory machine-readable storage medium of claim 20, wherein said receiving the password from the requester comprises receiving an encrypted password that has been encrypted using a transport key, and wherein the operations further comprise decrypting the encrypted password by the server-side key generation engine using the transport key. ### Claim 22 (depends on 19) The non-transitory machine-readable storage medium of claim 19, further comprising: presenting to the requester a user interface for the certificate enrollment request on a web page, wherein the user interface comprises an input field to receive a password from the requester; receiving the certificate enrollment request and the password from the requester, wherein at least the password of the certificate enrollment request is encrypted using a transport key; decrypting the password by the server-side key generation engine; approving, by the certificate manager, the certificate enrollment request to issue the digital certificate; and encrypting at least the private key of the digital certificate in an encrypted file using the decrypted password, wherein said delivering comprises delivering the encrypted file to the requester.