Handling of digital certificates

A method, in a controlling certificate authority, for handling digital certificates in a communication network, the controlling certificate authority comprising first and second certificate authorities, wherein the first certificate authority has issued at least one digital certificate, the method comprising:

• determining whether a revocation condition for revoking the at least one certificate is fulfilled, the at least one digital certificate having been issued by the first certificate authority, the at least one digital certificate being valid and not presently revoked, and any given digital certificate that is not revoked is uniquely identified by a unique identifier;
• based on a result of the determining:
• trigger the first certificate authority to revoke the at least one digital certificate;
• and
• trigger the second certificate authority to issue at least one further digital certificate to have a same unique identifier as one of the at least one digital certificate that is revoked.

A method, in a network managing node, for handling digital certificates in a communication network, the communication network comprising a first certificate authority having issued at least one digital certificate, the method comprising:

• sending information, to a network node of the communication network for the network node, requesting a further digital certificate to be issued by a second certificate authority for a digital certificate;
• wherein the information requesting a further digital certificate comprises an identifier uniquely identifying a digital certificate issued by the first digital certificate authority, and the further digital certificate comprises the same identifier in the request;
• and
• wherein the further digital certificate replaces the digital certificate, which is issued and revoked by the first certificate authority.

A controlling certificate authority for handling digital certificates in a communication network, the controlling certificate authority comprising:

• one or more processing circuits configured to function as first and second certificate authorities, wherein the first certificate authority has issued at least one digital certificate;
• wherein the controlling certificate authority is configured to:
• determine whether a revocation condition for revoking the at least one first digital certificate is fulfilled, the at least one digital certificate having been issued by the first certificate authority, the at least one digital certificate being valid and not presently revoked, and any given digital certificate that is not revoked is uniquely identified by a unique identifier;
• based on a result of the determining, trigger the first certificate authority to revoke the at least one digital certificate;
• and
• based on the result of the determining, trigger the second certificate authority to issue at least one further digital certificate to have a same unique identifier as one of the at least one digital certificate that is revoked.

A network node for handling digital certificates in a communication network, the network node maintaining a digital certificate issued by a first certificate authority of the communication network, the network node comprising:

• one or more processing circuits configured to cause the network node to:
• send a request for issuing, by a second certificate authority of the communication network, a further digital certificate, wherein the request for issuing a further digital certificate comprises an identifier uniquely identifying the digital certificate issued by the first digital certificate authority, and the further digital certificate is identified by the same identifier in the request;
• and
• receive the further digital certificate, the further digital certificate having been issued by the second certificate authority, wherein the further digital certificate replaces the digital certificate issued and revoked by the first digital certificate authority.

A network managing node for handling digital certificates in a communication network, the communication network comprising:

• a first certificate authority having issued at least one digital certificate;
• and
• one or more processing circuits configured to cause the network managing node to send information, to a network node of the communication network for the network node, requesting a further digital certificate to be issued by a second certificate authority for a digital certificate;
• and
• wherein the information requesting a further digital certificate comprises an identifier uniquely identifying a digital certificate issued by the first certificate authority, and the further digital certificate comprises the same identifier in the request;
• and
• wherein the further digital certificate replaces the digital certificate, which is issued and revoked by the first certificate authority.

A computer program product stored in a non-transitory computer readable medium for controlling the handling of digital certificates in a communication network, the communication network comprising a first certificate authority having issued at least one digital certificate, the computer program product comprising software instructions which, when run on one or more processors of the communication network, causes the communication network to:

• determine whether a revocation condition for revoking the at least one digital certificate is fulfilled, wherein:
• the at least one digital certificate was issued by the first certificate authority;
• the at least one digital certificate is valid and not presently revoked;
• any given digital certificate that is not revoked is uniquely identified by a unique identifier;
• based on a result of the determining:
• revoke, by the first certificate authority, the at least one digital certificate;
• and
• issue, by a second certificate authority, at least one further digital certificate to have a same unique identifier as one of the at least one digital certificate that is revoked.