Automatic digital certificate request with software deployment

1 . A method comprising:

receiving, at a computer having a processor, an instruction to deploy software to a server;

in response to the instruction, the computer using an identity of a server cluster of the server to retrieve a setting for the server cluster that designates that a new cryptographic certificate should be requested for the server upon deploying software to the server and based on the retrieved setting, generating a public key/private key pair while preventing the private key from being exposed to any person and automatically requesting the new cryptographic certificate for the server from a second computer, wherein automatically requesting the new cryptographic certificate comprises sending the public key when requesting the new cryptographic certificate;

the second computer providing the new cryptographic certificate to the computer;

the computer providing the new cryptographic certificate to the server; and

the computer deploying the software to the server.

2 . The method of claim 1 further comprising:

after receiving the new cryptographic certificate, storing the new cryptographic certificate in a secured location that the server can access but that no person can access.

3 . The method of claim 2 further comprising:

after storing the new cryptographic certificate, causing the server to access the secured location to retrieve the new cryptographic certificate.

4 . The method of claim 3 wherein causing the server to access the secured location comprises causing the server to reboot and request the new cryptographic certificate during startup.

5 . The method of claim 1 wherein automatically requesting the new cryptographic certificate comprises determining the last time a new cryptographic certificate was requested and automatically requesting the new cryptographic certificate when the last time is at least a threshold time span from the current time.

6 . A system comprising:

a deployment server comprising a processor and memory configured to:

receive an instruction from an entity to deploy software to a server; and

in response to the instruction to deploy software, using an identity of a server cluster of the server to retrieve a setting for the server cluster that designates that a new cryptographic certificate should be requested for the server when deploying software to the server and based on the retrieved setting calling an application interface to request the new cryptographic certificate;

an application server comprising a processor and memory configured to execute the application interface to:

receive the request for the new cryptographic certificate; and

in response to the request, obtain the new cryptographic certificate through steps comprising generating a public key/private key pair and submitting the public key to a certificate authority without exposing the private key to the entity; and

a secure digital vault, configured to receive the new cryptographic certificate, wherein the entity is not allowed to access the secure digital vault and is not allowed access to the new cryptographic certificate.

7 . The system of claim 6 wherein the application server obtains the new cryptographic certificate from the certificate authority and creates a certificate file by adding the private key to the new cryptographic certificate.

8 . The system of claim 6 wherein before calling the application to request a new cryptographic certificate, determining that a time span since a current cryptographic certificate was created exceeds a threshold.

9 . The system of claim 6 wherein the server obtains the new cryptographic certificate and the private key from the secure digital vault.

10 . A method comprising:

receiving a request for a cryptographic certificate from a deployment server, wherein the deployment server is configured to deploy software to an application server in response to an instruction from an entity and wherein the deployment server is configured to use an identity of a server cluster of the server to retrieve a setting for the server cluster that designates that the cryptographic certificate should be requested for the server when deploying software to the server and to generate the request for the cryptographic certificate based on the retrieved setting;

obtaining the cryptographic certificate through steps comprising:

generating a public key/private key pair without exposing the private key to the entity; and

requesting the cryptographic certificate from a certificate authority; and

storing the cryptographic certificate in a secure digital vault that is accessible to the application server without exposing the cryptographic certificate to the entity.

11 . The method of claim 10 wherein the request for the cryptographic certificate is generated by the deployment server after determining that a time period since a last cryptographic certificate was requested exceeds a threshold.

12 . The method of claim 10 further comprising adding the private key to the cryptographic certificate to form a cryptographic file in the secure digital vault.