Patent ID: 8146159

Claim:
A method for inspecting security certificates, the method comprising the steps of: (a) scanning, by a network security device, messages of a security protocol between a server and a client system, by steps including: (i) scanning said messages for an object ID (OID) equal to 1.2.840.113549.1.1.4, and (ii) scanning said messages for an OID equal to 2.16.840.1.113730.1.13; (b) detecting said messages having a security certificate; (c) detecting suspicious security certificates from said messages, by steps including: (i) upon detecting said OID that is equal to 2.16.840.1.113730.1.13 in said messages, checking a comment length of said OID that is equal to 2.16.840.1.113730.1.13 for invalid-certificate criteria; and (ii) prior to said step of checking, determining that said OID that is equal to 1.2.840.113549.1.1.4 and said OID that is equal to 2.16.840.1.113730.1.13 are in the same trust chain member by searching for a second appearance of said OID that is equal to 1.2.840.113549.1.1.4; (d) aborting particular sessions of said security protocol associated with said suspicious security certificates.