Automatic certificate enrollment in a special-purpose appliance
A digital certificate is created transparently on a mobile device. A VPN appliance receives user credentials from an app, the credentials familiar to the user and associated with an enterprise authentication service. The credentials are validated, comprising the first user authentication in a two-factor authentication method. The user is then presented with a display in the app asking for a PIN. The appliance generates a PIN and sends it to the user via the user enterprise email. The user enters the PIN in the app display. This is the second factor in the two-factor authentication. Once the user is authenticated, the appliance sends data for generating a Certificate Signing Request (CSR) to the app. The app generates a CSR and the appliance sends the CSR to an enterprise CA. A certificate is signed and enrolled. The signed digital certificate is then sent to the wrapped app.
1. A method comprising:
receiving user credentials from a wrapped app running on a device, the user credentials received at a separate virtual private network (VPN) appliance part of an enterprise network;
validating the user credentials against the enterprise network including an authentication service;
sending Certificate Signing Request (CSR) generation data from the VPN appliance to the wrapped app running on the device, wherein the first wrapped app generates a CSR using the CSR generation data;
receiving the CSR from the device at the VPN appliance, wherein the VPN appliance sends the CSR to an enterprise Certificate Authority (CA);
delivering a signed certificate to the wrapped app running on the device;
storing the signed certificate in a keystore in the wrapped app, said keystore only accessible by the wrapped app; and
establishing a secure per-app service tunnel between the wrapped app and the VPN appliance, wherein said service tunnel is only utilized by the wrapped app.
2. The method of claim 1 , wherein after the user credentials are validated against the authentication service, an enrollment pin is sent in an email to an enterprise email account corresponding to the user.
3. The method of claim 2 , wherein the user provides the enrollment pin to the VPN appliance.
4. The method of claim 1 , wherein the signed certificate is maintained in data-at-rest (DAR) in the wrapped app.
5. The method of claim 1 , wherein the keystore is not accessible to other applications or the operating system on the mobile device.
6. The method of claim 1 , wherein the wrapped app is an app wrapped in a security layer.
7. The method of claim 6 , wherein the security layer is operable to enhance or modify a request before the request is passed to the operating system or other software or hardware component on the device.
8. The method of claim 1 , wherein the secure per-app service tunnel can only be used by the wrapped app.
9. A non-transitory computer readable storage medium comprising:
computer code for receiving user credentials from a wrapped app running on a device, the user credentials received at a separate virtual private network (VPN) appliance part of an enterprise network;
computer code for validating the user credentials against the enterprise network including an authentication service;
computer code for sending Certificate Signing Request (CSR) generation data from the VPN appliance to the wrapped app running on the device, wherein the first wrapped app generates a CSR using the CSR generation data;
computer code for receiving the CSR from the device at the VPN appliance, wherein the VPN appliance sends the CSR to an enterprise Certificate Authority (CA);
computer code for delivering a signed certificate to the wrapped app running on the first device;
computer code for storing the signed certificate in a keystore in the wrapped app, said keystore only accessible by the wrapped app; and
computer code for establishing a secure per-app service tunnel between the wrapped app and the VPN appliance, wherein said service tunnel is only utilized by the wrapped app.
10. The non-transitory computer readable storage medium of claim 9 , wherein after the user credentials are validated against the authentication service, and an enrollment pin is sent in an email to an enterprise email account corresponding to the user.