1. An authentication system comprising a revocation list generation apparatus and a revocation judgement apparatus,
wherein the revocation list generation apparatus includes:
a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not;
a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generate node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order; and
an output unit operable to output the generated node revocation list, and
wherein the revocation judgement apparatus includes:
a certificate obtaining unit operable to obtain a public key certificate identified by one of the leaf identifiers;
a list obtaining unit operable to obtain the node revocation list;
a judgement unit operable to judge that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of a node on a path from the root node to the leaf node having the leaf node identifier identifying the obtained public key certificate, and judge that the obtained public key certificate is valid when the piece of node revocation information does not exist; and
a prohibition unit operable to, upon a judgment that the obtained public key certificate is revoked, prohibit use of the corresponding public key.
2. A revocation list generation apparatus comprising:
a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not;
a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generate node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order; and
an output unit operable to output the generated node revocation list.
3. The revocation list generation apparatus of claim 2, wherein
the tree system includes a plurality of layers, and
the order in which the revocation list generation unit places the obtained pieces of node revocation information is an order of the layers from a root-side layer corresponding to the root node to a leaf-side layer corresponding to the leaf nodes, the root node being a starting point of the order.
4. The revocation list generation apparatus of claim 2, wherein
the order in which the revocation list generation unit places the obtained pieces of node revocation information is an order in which the nodes are positioned on paths from the root node to the leaf nodes, the root node being a starting point of the order and each node of the tree system being included only once in the order.
5. The revocation list generation apparatus of claim 2, wherein
the revocation list generation unit is operable to generate the node revocation information for all revoked nodes excluding the leaf nodes.
6. The revocation list generation apparatus of claim 2, wherein
the revocation list generation unit is operable to:
generate special revocation information for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked, the special revocation information showing that the subordinate nodes are all revoked,
suppress generation of node revocation information for the revoked subordinate nodes, and
generate the revocation information for each revoked node, excluding the leaf nodes, for which special revocation information is not generated, the node revocation information showing whether each directly subordinate node of the revoked node is revoked or not.
7. The revocation list generation apparatus of claim 6, wherein
the tree system is an n-ary tree, n being an integer no less than 2, and
the revocation information generation unit is operable to:
generate the special revocation information for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked, the special revocation information being composed of first attached information showing that all the subordinate nodes are revoked and n node flags showing that each of n directly subordinate nodes is revoked or not,
suppress generation of node revocation information for the revoked subordinate nodes, and
generate the node revocation information for each revoked node, excluding the leaf nodes, for which special revocation information is not generated, the revocation information being composed of second attached information showing that not all the subordinate nodes are revoked and n node flags showing whether each of the n directly subordinate nodes of the revoked node is revoked or not.
8. The revocation list generation apparatus of claim 6, wherein
the tree system is an n-ary tree, n being an integer no less than 2, and
the revocation information generation unit is operable to:
generate the special revocation information for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked, the special revocation information being composed of an n-digit special value showing that each of n directly subordinate nodes of the revoked node is revoked,
suppress generation of node revocation information for the revoked subordinate nodes, and
generate the node revocation information for each revoked nodes, other than leaves, for which special revocation information is not generated, the node revocation information including n node flags showing whether each of the n directly subordinate nodes of the revoked node is revoked or not.
9. The revocation list generation apparatus of claim 2, wherein
all nodes in the tree system storage unit are revoked,
each leaf node in the tree system further has at least one subordinate extension node and at least one extension node flag corresponding to the at least one extension node, in accordance with an extension rule relating to extending the tree system, each lowest extension node being an extension leaf node and corresponding to a different extension public key certificate, an extension leaf identifier identifying the corresponding extension public key certificate, at least one of the extension public key certificates being revoked, all nodes from the root node to the extension leaf node whose identifier identifies the revoked extension public key certificate being revoked, and each extension node flag showing whether the corresponding extension node is revoked or not,
the revocation list generation unit is further operable to, for each revoked extension node excluding the extension leaf nodes, read extension node flags corresponding to each directly subordinate extension node of the revoked extension node from the tree system storage unit, generate extension node revocation information from the read extension node flags, thereby obtaining a plurality of pieces of extension node revocation information equal in number to the revoked extension nodes excluding the extension leaf nodes, and add the pieces of extension revocation node information to the revocation list by placing the obtained pieces of extension node revocation information in an order determined according to placement positions of the revoked extension nodes in the tree system, the root node being a starting point of the order, and
the output unit is operable to output the node revocation list to which the extension node revocation information has been added.
10. A revocation judgement apparatus,
wherein a revocation list generation apparatus includes (a) a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, (b) a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generate revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and (c) an output unit operable to generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order,
the revocation judgement apparatus comprising:
a certificate obtaining unit operable to obtain a public key certificate identified by one of the leaf identifiers;
a list obtaining unit operable to obtain the node revocation list;
a judgement unit operable to judge that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of the leaf node among pieces of node revocation information corresponding to nodes on a path from the root node to the leaf node identified by the leaf node identifier, and judge that the obtained public key certificate is valid when said piece of node revocation information does not exist; and
a prohibition unit operable to, upon a judgment that the obtained public key certificate is revoked, prohibit use of the corresponding public key.
11. The revocation judgement apparatus of claim 10, wherein
the tree system is composed of a plurality of layers,
the pieces of node revocation information are placed in an order of the layers from a root-side layer corresponding to the root node to a leaf-side layer corresponding to the leaf nodes, the root node being a starting point of the order, and
the judgement unit is operable to judge whether the obtained public key certificate is revoked, with use of the pieces of node revocation information placed in the order.
12. The revocation judgement apparatus of claim 10, wherein
the order in which the pieces of node revocation information are placed is an order in which the nodes are positioned on the paths from the root node to the leaf nodes, the root node being a starting point of the order and each node being included only once in the order, and
the judgement unit is operable to judge whether the obtained public key certificate is revoked, with the use of the pieces of node revocation information placed in the order.
13. The revocation judgement apparatus of claim 10, wherein
the node revocation information is generated for all revoked nodes excluding the leaf nodes,
and the judgement unit is operable to judge whether the obtained public key certificate is revoked, with use of the pieces of node revocation information.
14. The revocation judgement apparatus of claim 10, wherein
special revocation information is generated for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked, the special revocation information showing that the subordinate nodes are all revoked,
generation of node revocation information is suppressed for the revoked subordinate nodes,
the node revocation information is generated for each revoked node, excluding the leaf nodes, for which special revocation information is not generated, the revocation information including n node flags showing whether each of n directly subordinate nodes of the revoked node is revoked or not, and
the judgement unit is operable to judge whether the obtained public key certificate is revoked, with use of the pieces of special revocation information and the pieces of node revocation information.
15. The revocation judgement apparatus of claim 14, wherein
the special revocation information generated for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked is composed of first attached information that shows that all the subordinate nodes are revoked, and n node flags showing that each of n directly subordinate nodes is revoked or not,
generation of node revocation information is suppressed for the revoked subordinate nodes,
the node revocation information generated for each node, excluding the leaf nodes, for which special revocation information is not generated is composed of second attached information showing that the subordinate nodes are not all revoked and n node flags showing whether each of n directly subordinate nodes of the revoked nodes is revoked or not, and
the judgement unit is operable to judge whether the obtained public key certificate is revoked, with use of the pieces of special revocation information and the pieces of node revocation information.
16. The revocation judgement apparatus of claim 14, wherein
the special revocation information generated for each revoked node, excluding the leaf nodes, whose subordinate nodes are all revoked is composed of a special n-digit value that shows whether each of n directly subordinate nodes of the revoked node is revoked or not,
generation of node revocation information is suppressed for the revoked subordinate nodes,
the node revocation information generated for each node, excluding the leaf nodes, for which special revocation information is not generated includes n node flags showing whether each of n directly subordinate nodes of the revoked node is revoked or not, and
the judgement unit is operable to judge whether the obtained public key certificate is revoked, with use of the pieces of special revocation information and the pieces of node revocation information.
17. The revocation judgement apparatus of claim 10, wherein
all nodes in the revocation list generation apparatus are revoked, each leaf node in the tree system further has at least one subordinate extension node and at least one extension node flag corresponding to the at least one extension node, in accordance with an extension rule relating to extending the tree system, each lowest extension node being an extension leaf node and corresponding to a different extension public key certificate, an extension leaf identifier identifying the corresponding extension public key certificate, at least one of the extension public key certificates being revoked, all nodes from the root node to the extension leaf node whose identifier identifies the revoked extension public key certificate being revoked, and each extension node flag showing whether the corresponding extension node is revoked or not,
the revocation list generation apparatus is further operable to, for each revoked extension node excluding the extension leaf nodes, read extension node flags corresponding to each directly subordinate extension node of the revoked extension node from the tree system storage unit, generate extension node revocation information from the read extension node flags, thereby obtaining a plurality of pieces of extension node revocation information equal in number to the revoked extension nodes excluding the extension leaf nodes, add the pieces of extension revocation node information to the revocation list by placing the obtained pieces of extension node revocation information in an order determined according to placement positions of the revoked extension nodes in the tree system, the root node being a starting point of the order, and output the node revocation list to which the extension node revocation information has been added,
the certificate obtaining unit is further operable to obtain an extension public key certificate identified by an extension leaf identifier showing one of the extension leaf nodes,
the list obtaining unit is operable to obtain the node revocation list to which the extension node revocation information has been added, and
the judgement unit is further operable to, judge that the obtained extension public key certificate is revoked when, in the acquired node revocation list, a piece of extension node revocation information exists that includes a node flag showing revocation of an extension leaf node on a path from the root node to the extension leaf node having the extension leaf node identifier identifying the obtained extension public key certificate, and
judge that the obtained extension public key certificate is valid when the piece of extension node revocation information does not exist.
18. A revocation list generation method used in a revocation list generation apparatus,
the revocation list generation apparatus including:
a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, and
the revocation list generation method comprising:
a revocation list generation step of, for each revoked node excluding the leaf nodes, reading node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generating node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and generating the revocation list by placing the obtained pieces of node revocation information in an order determined according to the placement positions of the revoked nodes in the tree system, the root node being a starting point of the order; and
an output step of outputting the generated revocation list.
19. A revocation list generation program stored on a computer readable medium and used in a revocation list generation apparatus,
the revocation list generation apparatus including:
a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, and
the revocation list generation program causing the revocation list generation apparatus to perform a method comprising:
a revocation list generation step of, for each revoked node excluding the leaf nodes, reading node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generating node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes,
and generating the revocation list by placing the obtained pieces of node revocation information in an order determined according to the placement positions of the revoked nodes in the tree system, the root node being a starting point of the order; and
an output step of outputting the generated revocation list.
20. A computer-readable recording medium having recorded thereon a revocation list generation program used in a revocation list generation apparatus,
the revocation list generation apparatus including:
a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, and
the revocation list generation program causing the revocation list generating apparatus to perform a method comprising:
a revocation list generation step of, for each revoked node excluding the leaf nodes, reading node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generating node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and generating the revocation list by placing the obtained pieces of node revocation information in an order determined according to the placement positions of the revoked nodes in the tree system, the root node being a starting point of the order; and
an output step of outputting the generated revocation list.
21. A revocation judgement method used in a revocation judgement apparatus,
wherein a revocation list generation apparatus includes (a) a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, (b) a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, and generate node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and (c) an output unit operable to generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order,
the revocation judgement method comprising:
a certificate obtaining step of obtaining a public key certificate identified by one of the leaf identifiers;
a list obtaining step of obtaining the revocation list;
a judgement step of judging that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of a leaf node on a path from the root node to the leaf node having the leaf node identifier identifying the obtained public key certificate, and judging that the obtained public key certificate is valid when the piece of node revocation information does not exist; and
prohibiting, upon a judgment that the obtained public key certificate is revoked, use of the corresponding public prohibit key.
22. A revocation judgement program stored on a computer readable medium and used in a revocation judgement apparatus,
wherein a revocation list generation apparatus includes (a) a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, (b) a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, and generate node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and (c) an output unit operable to generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order,
the revocation judgement program causing the revocation judgement apparatus to perform a method comprising:
a certificate obtaining step of obtaining a public key certificate identified by one of the leaf identifiers;
a list obtaining step of obtaining the revocation list;
a judgement step of judging that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of a leaf node on a path from the root node to the leaf node having the leaf node identifier identifying the obtained public key certificate, and judging that the obtained public key certificate is valid when the piece of node revocation information does not exist; and
prohibiting, upon a judgment that the obtained public key certificate is revoked, use of the corresponding public prohibit key.
23. A computer-readable recording medium having stored thereon a revocation judgement program used in a revocation judgement apparatus,
wherein a revocation list generation apparatus includes (a) a tree system storage unit having a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, the plurality of nodes including a root node and a plurality of leaf nodes, each leaf node in the tree system being in correspondence with a different public key certificate, each leaf node having a leaf identifier for identifying the corresponding public key certificate, at least one of the public key certificates being revoked, all nodes on a path being revoked, the path being from the root node to the leaf node shown by the leaf identifier that identifies the revoked public key certificate, and each one of the node flags showing whether the corresponding node is revoked or not, (b) a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, and generate node revocation information from the read node flags, thereby obtaining a plurality of pieces of revocation information equal in number to the revoked nodes excluding the leaf nodes, and (c) an output unit operable to generate the revocation list by placing the obtained pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree system, the root node being a starting point of the order,
the revocation judgement program causing the revocation list generation apparatus to perform a method comprising:
a certificate obtaining step of obtaining a public key certificate identified by one of the leaf identifiers;
a list obtaining step of obtaining the revocation list;
a judgement step of judging that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of a leaf node on a path from the root node to the leaf node having the leaf node identifier identifying the obtained public key certificate, and judging that the obtained public key certificate is valid when the piece of node revocation information does not exist; and
prohibiting, upon a judgment that the obtained public key certificate is revoked, use of the corresponding public prohibit key.
24. An authentication system comprising:
a revocation list generation apparatus comprising:
a tree system storage unit storing a data tree structure of a plurality of nodes that compose a tree system and a plurality of node flags that correspond to the plurality of nodes, among which are a root node and a plurality of leaf nodes, arranged in hierarchical levels, the tree structure having a plurality of node paths from the root node to the leaf nodes through the hierarchical levels, each one of the node flags showing whether the corresponding node is revoked or not,
each leaf node corresponding to a different public key certificate and including identification information that identifies the corresponding public key certificate,
wherein when a leaf node is revoked, every node along a path from the root node to the revoked leaf node is also revoked;
a revocation list generation unit operable to, for each revoked node excluding the leaf nodes, read node flags corresponding to each directly subordinate node of the revoked node from the tree system storage unit, generate node revocation information from the read node flags, and generate a revocation list by placing the obtain pieces of node revocation information in an order determined according to placement positions of the revoked nodes in the tree structure, the root node being a starting point of the order; and
an output unit operable to output the generated node revocation list; and
a revocation judgement apparatus comprising:
a certificate obtaining unit operable to obtain a public key certificate identified by the identification information of one of the leaf nodes;
a list obtaining unit operable to obtain the node revocation list; and
a judgement unit operable to:
judge that the obtained public key certificate is revoked when, in the acquired node revocation list, a piece of node revocation information exists that includes a node flag showing revocation of a leaf node on a path from the root node to the leaf node having the leaf node identifier identifying the obtained public key certificate; and
judge that the obtained public key certificate is not revoked when the piece of node revocation information does not exist.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A method for installing at least one root certificate on a computer with a root update mechanism, the method comprising at least one first computer with a root update mechanism to receiving through a distributed network at least one root certificate and at least one certificate in the legacy certificate chain from at least one other computer.
2. The method of claim 1, wherein data associated with the at least one certificate in the legacy certificate chain is modified in a manner that forces the at least one root certificate to be downloaded from a root updating facility.
3. The method of claim 1, wherein the at least one root certificate is an extended validation root certificate.
4. The method of claim 1, wherein the at least one root certificate is a root certificate that replaces an existing root certificate in the at least one first computer’s root storage facility.
5. The method of claim 1, wherein the distributed network is the Internet and the at least one other computer is a web-server.
6. The method of claim 5, wherein the at least one root certificate is embedded in a configuration file of the at least one other computer.
7. The method of claim 6, wherein at least one cross-certificate required to build a chain to the at least one root certificate is received by the at least one first computer in addition to the at least one root certificate and the at least one cross-certificate required to build a chain to the at least one root certificate is embedded in a configuration file of the at least one other computer.
8. The method of claim 1, wherein the at least one first computer receives from the at least one other computer the at least one root certificate where the at least one other computer has sent the at least one root certificate through an API function and the at least one other computer has intercepted the API function and modified the API function’s results to return the at least one root certificate along with the at least one certificate in the legacy certificate chain.
9. The method of claim 1, wherein at least one cross-certificate required to build a chain to the at least one root certificate is received by the at least one first computer in addition to the at least one root certificate.
10. A method for enabling extended validation on a computer with a root update mechanism, the method comprising a first computer with a root update mechanism receiving through a distributed network at least one extended validation root certificate and at least one certificate in the legacy certificate chain from at least one other computer.
11. The method of claim 10, wherein data associated with at least one certificate in the at least one certificate in the legacy certificate chain is modified in a manner that forces the at least one root certificate to be downloaded from a root updating facility.
12. The method of claim 10, wherein the distributed network is the Internet and the at least one other computer is a web server.
13. The method of claim 12, wherein at least one cross-certificate required to build a chain up to the at least one extended validation root certificate is received with the at least one extended validation root certificate.
14. The method of claim 13, wherein at least one cross-certificate required to build a chain up to the at least one extended validation root certificate is embedded in the configuration file with the at least one extended validation root certificate.
15. The method of claim 10, wherein the at least one first computer receives from the at least one other computer the at least one extended validation root certificate where the at least one other computer has sent the at least one extended validation root certificate through an API function and the at least one other computer has intercepted the API function and modified the API function’s results to return the at least one extended validation root certificate along with the at least one certificate in the legacy certificate chain.
16. A method for updating at least one certificate on a computer, the method comprising:
receiving a request from at least one first computer node for at least one certificate
sending the at least one first computer node at least one updated certificate and at least one certificate in the legacy certificate chain
having the at least one first computer node receive and store the at least one updated certificate
17. The method of claim 16, wherein the at least one updated certificate is a root certificate
18. The method of claim 17, with the additional step of the at least one first computer node validating the at least one certificate in the legacy certificate chain using the at least one root certificate.
19. The method of claim 17, wherein data associated with at least one certificate in the legacy certificate chain is modified in a manner that forces the at least one root certificate to be downloaded from a root updating facility.
20. The method of claim 17, wherein the at least one root certificate is a root certificate that replaces an existing root certificate in the first computer’s root storage facility.
21. The method of claim 17, wherein the at least one root certificate is an extended validation root certificate.
22. The method of claim 16, wherein the distributed network is the Internet and the at least one other computer is a web server.
23. The method of claim 22, wherein the at least one updated certificate is embedded in a configuration file of the at least one other computer.
24. The method of claim 22, wherein the at least one first computer receives from the at least one other computer the at least one root certificate where the at least one other computer has sent the at least one updated certificate through an API function and the at least one other computer has intercepted the API function and modified the API function’s results to return the at least one updated certificate along with the at least one certificate in the legacy certificate chain.
25. A system of downloading a root certificate comprising
at least one webserver
at least one root certificate
at least one certificate in the legacy certificate chain
a means of transmitting both the at least one certificate in the legacy certificate chain and at least one root certificate
26. The system according to claim 25 wherein the at least one root certificate is embedded in the configuration file of the at least one webserver.
27. The system according to claim 25 further comprising at least one cross-certificate required to build a chain to the at least one root certificate.
28. The system according to claim 27 wherein the at least one cross-certificate required to build a chain to the at least one root certificate is embedded into the configuration file of the at least one webserver.
29. The system according to claim 25 wherein the means of transmitting is a means of intercepting an API function on the webserver and modifying the results of the API function to return the at least one root certificate along with the at least one certificate in the legacy certificate chain.
30. A system for enabling extended validation in a web browser comprising
at least one webserver
at least one root certificate where at least one of the at least on root certificates is an extended validation certificate
at least one certificate in the legacy certificate chain
a means of transmitting both the at least one certificate in the legacy certificate chain and at least one root certificate
31. The system according to claim 30 wherein the at least one root certificate is embedded in the configuration file of the at least one webserver.
32. The system according to claim 30 further comprising at least one cross-certificate required to build a chain to the at least one root certificate.
33. The system according to claim 32 wherein the at least one cross-certificate required to build a chain to the at least one root certificate is embedded into the configuration file of the at least one webserver.
34. The system according to claim 30 wherein the means of transmitting is a means of intercepting an API function on the webserver and modifying the results of the API function to return the at least one root certificate along with the at least one certificate in the legacy certificate chain.