Abstract: By implementing a mutable certificates approach, a server to which a digital certificate has been issued may update one or more certificate fields without the need for a new certificate or other intervention from the issuing certificate authority. A certificate authority uses extensions to identify fields that a server may update, and to identify a set or range of allowable values for those fields. A server may use the extensions to identify one or more fields to be updated, and the values to which those fields should be updated. The server may sign those field values with its private key. A client, upon receiving a digital certificate from a server with fields for updating, validates the field values using the server's public key, and then proceeds to update the certificate field values.

Abstract: By implementing a mutable certificates approach, a server to which a digital certificate has been issued may update one or more certificate fields without the need for a new certificate or other intervention from the issuing certificate authority. A certificate authority uses extensions to identify fields that a server may update, and to identify a set or range of allowable values for those fields. A server may use the extensions to identify one or more fields to be updated, and the values to which those fields should be updated. The server may sign those field values with its private key. A client, upon receiving a digital certificate from a server with fields for updating, validates the field values using the server's public key, and then proceeds to update the certificate field values.

Abstract: A method and system are disclosed for renewing and revoking certificates. In one embodiment, a certificate may include a renewal extension field with renewal information. Multiple sets of renewal information may be recursively embedded. Upon determining that a certificate will shortly expire, a server may determine that the certificate has a renewal extension field with renewal information, and may request a symmetric key from a certificate authority to decrypt the renewal information. The certificate authority may respond by providing a symmetric key, and the server may use the symmetric key to decrypt the renewal information, which may include updated field values for the certificate. If a server requests a symmetric key too early, i.e., too long before a certificate expires, then certificate authority may deny the request, and the server may determine to wait and then try requesting the symmetric key again.