Efficient management of certificates on an enterprise network

1 . A non-transitory machine-readable storage medium that provides instructions that, when executed by a set of one or more processors, are configurable to cause said set of one or more processors to perform operations comprising:

identifying a first managed endpoint associated with a current certificate and corresponding current private key to be renewed;

sending a first one or more messages to the first managed endpoint to cause the first managed endpoint to generate a new public/private key pair including a new private key and a corresponding certificate signing request (CSR), generate a corresponding symmetric key based on the corresponding current private key, and encrypt the new private key with the corresponding symmetric key to generate an encrypted new private key;

providing the CSR to a certificate authority (CA) on behalf of the managed endpoint and receiving a corresponding new certificate from the CA;

sending a second one or more messages to the managed endpoint to cause the managed endpoint to replace the current certificate with the corresponding new certificate;

receiving a copy of the encrypted new private key from the first managed endpoint; and

providing the copy of the encrypted new private key and the corresponding new certificate to a second managed endpoint, the second managed endpoint to replace the current certificate with the corresponding new certificate, generate the corresponding symmetric key with the corresponding current private key, decrypt the encrypted new private key with the corresponding symmetric key, and replace the corresponding current private key with the new private key.

2 . The non-transitory machine-readable storage medium of claim 1 , wherein the first one or more messages are sent to a certificate manager operable on the managed endpoint, the certificate manager to interact with a security subsystem of the managed endpoint to cause the security subsystem to generate the new public/private key pair and the CSR.

3 . The non-transitory machine-readable storage medium of claim 2 , wherein the first one or more messages are further to cause the managed endpoint to generate a signature over the CSR with the corresponding current private key, the non-transitory machine-readable storage medium including instructions that, when executed by the set of one or more processors, are configurable to cause said set of one or more processors to perform additional operations comprising:

verifying the signature using a current public key associated with the corresponding current private key.

4 . The non-transitory machine-readable storage medium of claim 3 , wherein the security subsystem includes a hardware-based security manager to restrict access to encryption keys and certificates, including the current certificate and the corresponding current private key, the certificate manager to make calls via an application programming interface (API) of the hardware-based security manager to cause the managed endpoint to generate the new public/private key pair and CSR, generate the signature over the CSR with the corresponding current private key, generate the corresponding symmetric key based on the corresponding current private key, and to further cause the managed endpoint to encrypt the new private key with the corresponding symmetric key.

5 . The non-transitory machine-readable storage medium of claim 2 , wherein the certificate manager is to access a configuration file on the managed endpoint to determine a storage location of the current certificate and the corresponding current private key.

6 . The non-transitory machine-readable storage medium of claim 1 , wherein the corresponding symmetric key is generated using a key derivation function (KDF) using the corresponding current private key as an input.

7 . The non-transitory machine-readable storage medium of claim 6 , wherein the KDF comprises a hashed message authentication code KDF (HKDF) which is to use a random salt value in addition to the corresponding current private key as input to generate the corresponding symmetric key.

8 . The non-transitory machine-readable storage medium of claim 1 , further including instructions that, when executed by the set of one or more processors, are configurable to cause the set of one or more processors to perform additional operations comprising:

automatically determining, based on a data structure that stores indications of which managed endpoints share key pairs, to the perform the providing of the copy of the encrypted new private key and the corresponding new certificate to the second managed endpoint.

9 . The non-transitory machine-readable storage medium of claim 1 , wherein the managed endpoint comprises one of a plurality of managed endpoints and the current certificate comprises one of a plurality of certificates of the plurality of managed endpoints, wherein the non-transitory machine-readable storage medium includes instructions that, when executed by the set of one or more processors, are configurable to cause said set of one or more processors to perform additional operations comprising:

querying the plurality of managed endpoints to identify validity information associated with the plurality of certificates;

using the validity information to identify a subset of certificates for which certificate renewal is needed, including the current certificate;

for each certificate in the subset of certificates, performing operations to acquire a new certificate on behalf of a corresponding managed endpoint of the plurality of managed endpoints.

10 . A method for a cloud-based management service to acquire certificates on behalf of a plurality of endpoints, comprising:

identifying a first managed endpoint associated with a current certificate and corresponding current private key to be renewed;

sending a first one or more messages to the first managed endpoint to cause the first managed endpoint to generate a new public/private key pair including a new private key and a corresponding certificate signing request (CSR), generate a corresponding symmetric key based on the corresponding current private key, and encrypt the new private key with the corresponding symmetric key to generate an encrypted new private key;

providing the CSR to a certificate authority (CA) on behalf of the managed endpoint and receiving a corresponding new certificate from the CA;

sending a second one or more messages to the managed endpoint to cause the managed endpoint to replace the current certificate with the corresponding new certificate;

receiving a copy of the encrypted new private key from the first managed endpoint; and

providing the copy of the encrypted new private key and the corresponding new certificate to a second managed endpoint, the second managed endpoint to replace the current certificate with the corresponding new certificate, generate the corresponding symmetric key with the corresponding current private key, decrypt the encrypted new private key with the corresponding symmetric key, and replace the corresponding current private key with the new private key.

11 . The method of claim 10 , wherein the first one or more messages are sent to a certificate manager operable on the managed endpoint, the certificate manager to interact with a security subsystem of the managed endpoint to cause the security subsystem to generate the new public/private key pair and the CSR.

12 . The method of claim 11 , wherein the first one or more messages are further to cause the managed endpoint to generate a signature over the CSR with the corresponding current private key, the method further comprising:

verifying the signature using a current public key associated with the corresponding current private key.

13 . The method of claim 12 , wherein the security subsystem includes a hardware-based security manager to restrict access to encryption keys and certificates, including the current certificate and the corresponding current private key, the certificate manager to make calls via an application programming interface (API) of the hardware-based security manager to cause the managed endpoint to generate the new public/private key pair and CSR, generate the signature over the CSR with the corresponding current private key, generate the corresponding symmetric key based on the corresponding current private key, and to further cause the managed endpoint to encrypt the new private key with the corresponding symmetric key.

14 . The method of claim 11 , wherein the certificate manager is to access a configuration file on the managed endpoint to determine a storage location of the current certificate and the corresponding current private key.

15 . The method of claim 10 , wherein the corresponding symmetric key is generated using a key derivation function (KDF) using the corresponding current private key as an input.

16 . The method of claim 15 , wherein the KDF comprises a hashed message authentication code KDF (HKDF) which is to use a random salt value in addition to the corresponding current private key as input to generate the corresponding symmetric key.

17 . The method of claim 10 , further comprising:

automatically determining, based on a data structure that stores indications of which managed endpoints share key pairs, to the perform the providing of the copy of the encrypted new private key and the corresponding new certificate to the second managed endpoint.

18 . The method of claim 10 , wherein the managed endpoint comprises one of a plurality of managed endpoints and the current certificate comprises one of a plurality of certificates of the plurality of managed endpoints, wherein the method further comprising:

querying the plurality of managed endpoints to identify validity information associated with the plurality of certificates;

using the validity information to identify a subset of certificates for which certificate renewal is needed, including the current certificate;

for each certificate in the subset of certificates, performing operations to acquire a new certificate on behalf of a corresponding managed endpoint of the plurality of managed endpoints.