Multi-tenant hardware-backed transport layer security key management

1 . A method for data processing, comprising:

receiving, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform;

retrieving, from a database, a digital certificate and an encrypted private key associated with the tenant of the multi-tenant cloud platform, the digital certificate comprising a public key associated with the tenant of the multi-tenant cloud platform;

obtaining a symmetric key that is wrapped using an asymmetric public key associated with the server host, wherein the wrapped symmetric key is provisioned by a symmetric key distribution service;

transmitting an application programming interface (API) call that includes the encrypted private key associated with the tenant of the multi-tenant cloud platform and the wrapped symmetric key provisioned by the symmetric key distribution service;

receiving an API response comprising a cryptographic signature associated with the private key of the tenant of the multi-tenant cloud platform; and

providing, to a client device associated with the request, the digital certificate associated with the tenant and the cryptographic signature associated with the private key of the tenant, wherein the digital certificate is used to verify the cryptographic signature.

2 . The method of claim 1 , further comprising:

receiving a sign-up or provisioning request for the web domain associated with the tenant of the multi-tenant cloud platform;

generating the private key for the tenant in response to the sign-up or provisioning request;

using the private key to generate a certificate signing request (CSR) that includes a domain name system (DNS) name for the web domain; and

transmitting the CSR to a certificate authority (CA) selected by the tenant.

3 . The method of claim 2 , further comprising:

obtaining the digital certificate from the CA in accordance with the CSR;

encrypting the private key of the tenant using the symmetric key provisioned by the symmetric key distribution service; and

storing the digital certificate and the encrypted private key in the database.

4 . The method of claim 1 , wherein the API call is configured to cause a key protection component of the server host to:

unwrap the symmetric key using an asymmetric private key of the server host;

decrypt the encrypted private key of the tenant using the unwrapped symmetric key;

generate the cryptographic signature using the decrypted private key of the tenant; and

return the cryptographic signature via the API response.

5 . The method of claim 1 , further comprising:

establishing a secure connection with a web browser that requested access to the web domain of the tenant after performing a successful transport layer security (TLS) handshake procedure; and

exchanging data with the web browser via the secure connection, wherein TLS encryption of the data is performed by the server host.

6 . The method of claim 1 , wherein obtaining the wrapped symmetric key comprises:

transmitting, to the symmetric key distribution service, a first message comprising the asymmetric public key of the server host and the symmetric key wrapped with an intermediate key accessible to the symmetric key distribution service; and

receiving, from the symmetric key distribution service, a second message comprising the symmetric key wrapped with the asymmetric public key of the server host.

7 . The method of claim 6 , wherein the first message is configured to cause the symmetric key distribution service to:

unwrap the symmetric key using the intermediate key accessible to the symmetric key distribution service;

rewrap the symmetric key using the asymmetric public key of the server host; and

return the rewrapped symmetric key to the server host via the second message.

8 . The method of claim 6 , further comprising:

storing, in the database, the symmetric key that is wrapped with the intermediate key accessible to the symmetric key distribution service.

9 . The method of claim 6 , wherein the symmetric key distribution service comprises a hardware security module (HSM), a master host, a quorum-based key sharing service, or a combination thereof.

10 . The method of claim 1 , wherein obtaining the symmetric key comprises:

retrieving, from the database, the symmetric key wrapped with the asymmetric public key associated with the server host, wherein the database comprises one or more instances of the symmetric key that are wrapped with respective asymmetric public keys associated with other server hosts in a sub-system of the multi-tenant cloud platform that includes the server host and the database.

11 . The method of claim 1 , wherein:

the database comprises a plurality of private keys corresponding to a plurality of tenants of the multi-tenant cloud platform; and

the plurality of private keys are encrypted using the symmetric key.

12 . The method of claim 1 , wherein the digital certificate and the encrypted private key are stored in association with the tenant of the multi-tenant cloud platform.

13 . The method of claim 1 , wherein the encrypted private key and the public key of the tenant are used for transport layer security (TLS) authentication.

14 . The method of claim 1 , wherein the symmetric key is provisioned for a sub-system of the multi-tenant cloud platform that includes the server host and the database.

15 . An apparatus for data processing, comprising:

at least one processor;

at least one memory coupled with the at least one processor; and

instructions stored in the at least one memory and executable by the at least one processor to cause the apparatus to:

receive, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform;

retrieve, from a database, a digital certificate and an encrypted private key associated with the tenant of the multi-tenant cloud platform, the digital certificate comprising a public key associated with the tenant of the multi-tenant cloud platform;

obtain a symmetric key that is wrapped using an asymmetric public key associated with the server host, wherein the wrapped symmetric key is provisioned by a symmetric key distribution service;

transmit an application programming interface (API) call that includes the encrypted private key associated with the tenant of the multi-tenant cloud platform and the wrapped symmetric key provisioned by the symmetric key distribution service;

receive an API response comprising a cryptographic signature associated with the private key of the tenant of the multi-tenant cloud platform; and

provide, to a client device associated with the request, the digital certificate associated with the tenant and the cryptographic signature associated with the private key of the tenant, wherein the digital certificate is used to verify the cryptographic signature.

16 . The apparatus of claim 15 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

receive a sign-up or provisioning request for the web domain associated with the tenant of the multi-tenant cloud platform;

generate the private key for the tenant in response to the sign-up or provisioning request;

use the private key to generate a certificate signing request (CSR) that includes a domain name system (DNS) name for the web domain; and

transmit the CSR to a certificate authority (CA) selected by the tenant.

17 . The apparatus of claim 16 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

obtain the digital certificate from the CA in accordance with the CSR;

encrypt the private key of the tenant using the symmetric key provisioned by the symmetric key distribution service; and

store the digital certificate and the encrypted private key in the database.

18 . The apparatus of claim 15 , wherein:

unwrap the symmetric key using an asymmetric private key of the server host;

decrypt the encrypted private key of the tenant using the unwrapped symmetric key;

generate the cryptographic signature using the decrypted private key of the tenant; and

return the cryptographic signature via the API response.

19 . The apparatus of claim 15 , wherein the instructions are further executable by the at least one processor to cause the apparatus to:

establish a secure connection with a web browser that requested access to the web domain of the tenant after performing a successful transport layer security (TLS) handshake procedure; and

exchange data with the web browser via the secure connection, wherein TLS encryption of the data is performed by the server host.

20 . A non-transitory computer-readable medium storing code for data processing, the code comprising instructions executable by at least one processor to:

receive, at a server host, a request to access a web domain associated with a tenant of a multi-tenant cloud platform;

retrieve, from a database, a digital certificate and an encrypted private key associated with the tenant of the multi-tenant cloud platform, the digital certificate comprising a public key associated with the tenant of the multi-tenant cloud platform;

obtain a symmetric key that is wrapped using an asymmetric public key associated with the server host, wherein the wrapped symmetric key is provisioned by a symmetric key distribution service;

transmit an application programming interface (API) call that includes the encrypted private key associated with the tenant of the multi-tenant cloud platform and the wrapped symmetric key provisioned by the symmetric key distribution service;

receive an API response comprising a cryptographic signature associated with the private key of the tenant of the multi-tenant cloud platform; and

provide, to a client device associated with the request, the digital certificate associated with the tenant and the cryptographic signature associated with the private key of the tenant, where the digital certificate is used to verify the cryptographic signature.