Certificate Revocation Proxy Service for API Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current digital certificate revocation checks rely on public certificate authorities, which are unreliable and complex, leading to downtime and latency issues, and require updates across multiple web clients.
Innovation Solution
A proxy revocation service that queries public certificate authorities for revocation statuses and maintains a database, providing a singular API-accessible endpoint for web clients to perform revocation checks, using OCSP and CRLs to determine certificate validity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web clients directly query public certificate authorities for revocation checks, then revocation status verification is performed, but the system experiences downtime and latency issues due to unreliability of public CAs
Solution Approach 1:
The patent introduces a proxy revocation service as an intermediary between web clients and public certificate authorities. This proxy service caches revocation statuses and provides a singular API endpoint, eliminating direct client queries to unreliable public CAs and reducing both latency and downtime issues.
2Reliability
If public certificate authorities are used for revocation checks, then certificate validity is verified, but the complexity increases requiring updates across multiple web clients
Solution Approach 1:
The proxy revocation service acts as a centralized intermediary that handles all revocation check logic, caching strategies, and updates. This eliminates the need for complex client-side implementations and updates across multiple web clients, while maintaining reliable certificate validity verification.
Solution Approach 2:
The proxy service creates and maintains a local copy/cache of revocation statuses from public certificate authorities. This cached copy allows the service to respond to client queries without always contacting the original CAs, reducing complexity and improving response time while maintaining verification accuracy.
3Ease of operation
If a proxy revocation service is implemented, then complexity on web clients is reduced and reliability is improved, but additional infrastructure is required
Solution Approach 1:
While the proxy service does add infrastructure, it centralizes the complexity in a single manageable component rather than distributing it across multiple web clients. The proxy service can be implemented as a simple cache-based system that receives updates from CAs and serves clients via a standard API, making the added infrastructure relatively straightforward to maintain.
Data Source
AI summary
A proxy revocation service provides a reliable service for performing revocation checks. The proxy revocation service queries public certificate authorities for the revocation status of a set of digital certificates and maintains a database of the revocation statuses. The proxy revocation service provides a singular endpoint that is Application Protocol Interface (API) accessible to web clients. Web clients communicate with the proxy revocation service through use of API message to perform revocation checks, rather than communicating with the public certificate authorities using an online certificate status protocol (OCSP). Use of the proxy revocation service provides both a reliable service for performing revocation checks as well as shifts the complexity away from the web clients.