TECHNICAL FIELD

Various embodiments disclosed herein generally relate to server authentication. More specifically, the embodiments of the present invention relate load balancing digital authentication certificates in an infrastructure service.

BACKGROUND

Content delivery networks, edge cloud platforms, and other types of infrastructure services send and receive huge volumes of data. Such infrastructure services provide a variety of functions to their customers such as content caching, load balancing, and security. Caching allows content to be stored closer to end users relative to the customer origin servers from which it is obtained. Load balancing distributes incoming traffic across a customer's servers to avoid burdening any one server or point-of-presence (PoP) with an inordinate amount of traffic.

To ensure security within an infrastructure service, a trusted third party such as a certificate authority is used to verify the revocation status of public keys held by servers within the infrastructure service. A certificate authority will issue certificates to an infrastructure service and the network proceeds to distribute the digital certificates throughout the edge network of the infrastructure service. When a client application attempts to access cached content stored in a infrastructure service or attempts to connect to an origin server through the infrastructure service, the network first presents the user device with a digital authentication certificate alongside a time-stamped online certificate status protocol (OCSP) response (e.g. OCSP stapling) that is used to prove ownership of a public key, determine the revocation status of the digital certificate, and prove the identity of the owner of the certificate.

To facilitate the establishment of secure connections with client applications, an infrastructure service (or elements within the infrastructure service) will routinely send OCSP requests to a certificate authority. The OCSP request prompts the certificate authority to check whether or not the digital certificate held by the infrastructure service has been revoked. If the digital certificate has not been revoked, the certificate authority returns a time stamped and signed OCSP response to the infrastructure service. When a client application attempts to connect to the infrastructure service, the infrastructure service will present a digital certificate and the time stamped and signed OCSP response to complete the transport layer security (TLS) handshake. When the client application receives certificate and the OCSP response, the client application validates the authenticity of the certificate and a secure connection is established. Therefore, the infrastructure service must routinely send OCSP requests the certificate authority to update the time stamp and revocation status of the infrastructure service's certificate. However, if the certificate authority is unable to receive OCSP requests from the infrastructure service, the infrastructure service cannot update the revocation status and time stamp of the certificate and secure connections with client applications may not be able to be established. For instance, if a certificate authority goes offline, an infrastructure service will not be able to send. OCSP requests to the certificate authority and in turn, will not be able to obtain up to date OCSP responses.

The authentication process of digital certificates is often completed outside of the infrastructure service. As such, if the connection between the infrastructure service and the certificate authority is faulty, or if the certificate authority is non-operative, then the certificate cannot be validated. Other issues arise when a certificate authority is removed from a browser trust store of a client application which can prevent the client application from determining the revocation status of a digital certificate. If the revocation status of the certificate cannot be validated by the certificate authority, a secure connection between the user device and the infrastructure service cannot be established. Without the establishment of a secure connection, the client application is unable to access content stored within the network or connect to an origin server through the infrastructure provided by the infrastructure service.

As such, there are a number of challenges and inefficiencies created in traditional server authentication. For example, infrastructure services are unable to protect against a certificate authority going offline thereby preventing users from accessing the infrastructure service. Thus, it can be difficult to establish reliable and secure connections between users and the edge nodes of an infrastructure service. It is with respect to these and other problems that embodiments of the present invention have been made.

OVERVIEW

Systems and methods are disclosed herein for obtaining and distributing digital authentication certificates to an infrastructure service such that servers within the edge network of the infrastructure service may be more readily authenticated. In one implementation, an infrastructure service includes an edge network which further includes one or more edge nodes. The edge network receives a content request, sent by a client application, to establish a secure connection with an origin customer. The edge network, or an element within the edge network such as an edge node, point of presence, or a server within, serves the client application a digital certificate and then monitors to determine if the digital certificate is validated by the client application.

The edge network, after serving a client application a digital certificate, sets a timer or counter to determine if the authentication of the certificate was successful. Upon time-out, the edge network may determine that the certificate authority is offline and will serve the client application a new digital certificate issued by a different certificate authority. The edge network then proceeds to monitor to determine if the new certificate is signed. Alternatively, the edge network can ping a client application after serving the client a digital certificate to determine if the client application is online or determine whether the client was able to authenticate the digital certificate it was served.

In the same or another implementation, an infrastructure service obtains digital certificates from multiple certificate authorities and then replicates and distributes the digital certificates throughout the edge network. The infrastructure service pings the certificate authorities to determine which certificate authorities are active. If any one certificate authority fails to respond to the ping sent by the infrastructure service, the infrastructure service notifies the edge network to cease using digital certificates originating from the one or more inactive certificate authorities. Additionally, the infrastructure service may load balance the distribution of digital certificates originating from active certificate authorities to points-of-presence within the edge network. The points-of-presence within the edge network may further load balance the issuing of digital certificates to client applications to avoid burdening any one of the active certificate authorities with an inordinate amount of traffic.

The infrastructure service continues to ping inactive certificate authorities to monitor when the inactive or otherwise unavailable certificate authorities become available to issue and sign digital certificates. Once the infrastructure service determines that the previously inactive certificate authorities are active, the infrastructure service notifies the points of presence within the edge network to resume the use of digital certificates from the previously inactive certificate authorities.

Embodiments of the present invention also include computer-readable storage media having sets of instructions to cause one or more processors to perform the methods, variations of the methods, and other operations described herein.

While multiple embodiments are disclosed, still other embodiments of the present invention will become apparent to those skilled in the art from the following detailed description, which shows and describes illustrative embodiments of the invention. As will be realized, the invention is capable of modifications in various aspects, all without departing from the scope of the present invention. Accordingly, the drawings and detailed description are to be regarded as illustrative in nature and not restrictive.

