QR Code Certificate Enrollment for Firewalled Servers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Servers behind firewalls, which block outbound network connections, face challenges in initiating digital certificate enrollment processes with certificate authorities, as they cannot create and send certificate signing requests (CSRs) from the system where the key pair is generated or installed.

Innovation Solution

A certificate assistant on the server generates a public key pair and encodes the CSR into QR codes, allowing a mobile device to scan and transmit the enrollment data to the certificate authority, bypassing the firewall restriction.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If a server is placed behind a firewall to secure the private key, then security is improved, but the server cannot initiate outbound network connections to send CSR to the certificate authority

Engineering Contradiction:

ImprovesecurityVSAvoidcertificate enrollment capability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

A mobile device acts as an intermediary between the firewall-protected server and the certificate authority. The server exports the public key to the mobile device via QR code, which then transmits the CSR to the CA. This mediator approach allows the server to maintain firewall protection while still completing certificate enrollment through the mobile device's network capabilities.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the server generates and stores the private key locally, then security is improved, but the server cannot create and send the CSR from the same system

Engineering Contradiction:

Improvekey securityVSAvoidenrollment process flexibility

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The certificate enrollment process is segmented into distinct phases: key generation on the secure server, public key export via QR code to the mobile device, and CSR transmission from the mobile device to the CA. This segmentation allows the private key to remain securely stored on the server while enabling flexible enrollment through the mobile device.

Inventive Principle:

Principle #1Segmentation

3Reliability

If outbound network connections are blocked by firewall, then security is improved, but digital certificate enrollment cannot be initiated

Engineering Contradiction:

Improvenetwork securityVSAvoidcertificate issuance process

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The traditional mechanical network connection method for transmitting CSR is replaced with an optical encoding system (QR code) that can be captured by a mobile device camera. This substitution bypasses the firewall's network blocking mechanism while maintaining secure key handling, enabling certificate enrollment through a different transmission paradigm.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS9537854B2Transmitting encoded digital certificate data to certificate authority using mobile device

Publication Date: 2017.01.03 DIGICERT INC

AI summary

Techniques are disclosed for managing a digital certificate enrollment process. A certificate assistant on a server is configured to encode certificate enrollment data in a barcode graphic, such as a quick response (QR) code. A mobile phone application can then scan the barcode graphic using a camera to recover and transmit the enrollment data to a certificate authority. Doing so allows a system administrator (or other user) to complete the certificate enrollment process in cases where the server is blocked from connecting to a certificate authority (CA) directly, e.g., because the server is behind a firewall blocking any outbound network connections from being initiated.