Patent ID: 7275155

Claim:
A method of automatically obtaining a second certificate for a user in a Public Key Infrastructure (PKI) enterprise using a first certificate, the method comprising: accessing a registration server using a user's server and the first certificate of the user to create a connection that authenticates both the user's server identity via a server certificate of the user server and the user's identity via the user's first certificate; creating a secure data channel between the registration server and the user server; forwarding a request for the second certificate from the user server to the registration server; determining in the registration server that the user is entitled to the second certificate by ensuring that the user is still a member of the PKI enterprise and ensuring that the user does not already have the second certificate; forwarding a request from the registration server to an authority to generate a private/public key pair; sending the private key to the user from the authority via the secure data channel; sending the public key from the authority to another authority to be signed; and forwarding the second certificate from the another authority to a directory.