Digital certificate expiry notification

A system for allowing a computer application or computer service to notify a user 10 that his certificate is within some specified interval before its expiry date utilizing information that is already contained in a standard digital certificate, together with current data information that is already known by the application 12 or service 16 to enforce expiry of the certificate when it occurs. No additional storage of information is required.

A system for allowing a computer application or computer service to notify a user that a certificate is within some specified interval before its expiry date utilises information that is already contained in a standard digital certificate, together with current date information that is already known by the application or service to enforce expiry of the certificate when it occurs. No additional storage of information is required. In addition, only a small amount of processing time is needed and only when the certificate is already being used or verified. With reference to FIG. 1 , when a user 10 wishes to make use of a computer application 12 , such as a web browser or email client on a computer 13 , the user 10 requests some action or service 16 that requires a certificate 11 of the user and the use of a private key associated with the user's certificate (box 20 in FIG. 2 ). The service requested by the user 10 is typically remote from the user 10 and computer 13 . The service may be access to information on a website for which the user 10 is asked to authenticate himself as the person named in a certificate 11 , which certificate 11 has been obtained elsewhere (box 22 in FIG. 2 ). On prompting from the website web server, the application 12 retrieves the certificate 11 (and the public key if required) from a certificate store 14 (box 24 in FIG. 2 ), which may be on a server to which the user has access or on the disk of a local machine 13 . The application 12 having retrieved the certificate 11 from the certificate store 14 sends it to the web server (even if the certificate 11 has expired). In existing systems, the web server hosting the requested service compares an expiry date of the certificate with the current date to which it has access to check if the certificate 11 is still valid. If the certificate 11 has expired then the service 16 or action requested will not be allowed. In the present system, however the application 12 compares the certificate expiry date with the current date and if the difference is less than some threshold value, the application 12 notifies the user 10 that the certificate 11 will expire in a given amount of time (box 26 in FIG. 2 ). The notification may typically be by means of a message or alert, possibly including an audible warning. The method described herein then follows with the step that the application 12 can be used to access the service 16 send the certificate 11 to that server. The service 16 then verifies that the certificate 11 is valid and uses it to authenticate the communication with the user (box 30 in FIG. 2 ). In addition to the check mentioned above conducted by the application 12 , the service 16 may compare the certificate expiry date with the current date and if the difference is less than a threshold value, it generates a notification to be returned to the user 10 (box 28 in FIG. 2 ). The is threshold value may be a parameter of the server 16 or it may be sent (e.g. as a cookie) with the request to the server 16 . It is common practice for the user to be asked to confirm use of the private key associated with a certificate, or, if there is more than one certificate available, to ask the user to select which certificate to use. The confirmation request or certificate selector may display the time left before the certificate expires, either always, with the highlight of a date and time when the threshold will be passed, or only when the threshold has actually been passed. Where the application 12 is a web browser accessing a web 30 server, the web server may notify the user that the certificate is soon to expire, either by adding the warning into a server generated page, or by returning a separate warning page with links to take the user to the page originally requested. The threshold value and the user preferences for notification may be incorporated into a cookie to allow a personalisation without the need for storage of that information by a server which runs the service 16 . Where a service 16 cannot modify its response in order to deliver the notification, it may send a notification by other means. For example, the commonly used kind of certificate contains the users email address so that the service 16 may send notification by email. In this case a well designed service will include measures to avoid excessive repeated notifications. The method and system described above can also be used for email applications to enable authenticated signature of emails, in addition to the uses described above in relation to websites. A problem is also sometimes encountered in relation to email, if an email is sent in an encrypted form. If the certificate required for the reading of an email has expired, then the key required to decrypt the email may no longer be valid, given that the certificate has expired. A new key given with a new reissued certificate would not be able to access the encrypted email because the old (invalid) key is required. A solution to this problem would be to attach the certificate to the email, which even if the certificate has expired, may be used for a brief grace period after expiry of the certificate. The implementation of the method is very simple in that the existing systems are already carrying out a test of whether the certificate has expired. Implementation of the system simply requires the posing of the question when will the certificate expire, together with action following the response to the question. At present a system will simply ask the question has the certificate expired. The threshold time period until expiry of the certificate may be set by the user, for example to one week in order to give the user sufficient time to obtain reissue of the certificate at a time convenient to them. This information may be stored in a cookie which may include such information as whether the user wants a warning and if so, what period should be used. On is initiating the system with the service 16 the server driving the service 16 sends the user 10 a cookie bearing details that have been entered by the user 10 concerning his requirements. The user 10 then sends the cookie to the service 16 each time it is used. Consequently, there 20 is no need for a server running the server 16 to store the user's preferences. The method and system described above will make use of the date of expiry in conjunction with the current date, both of which pieces of information are already known by a user computer running his application 12 and also by a server running a service 16 with which he is communicating. Consequently, the method and system is very simple to implement by a person skilled in the art. Thus, in order to ensure a continuous service the user 10 is warned in enough time to obtain a new certificate before the old one expires. Consequently, given that it may take approximately half an hour to renew a certificate for a user on a network with a particular institution and that it may take considerably longer to renew a certificate with an external organisation, much time is saved by the system of issuing warnings.