Creating a digital certificate for a service using a local certificate authority

1. A method comprising:

creating a local certificate authority (CA) hosted by a computing machine, the local CA having certificate signing authority for a signing session defined by a period of time;

creating a certificate signing request (CSR) comprising data of a local service being hosted by the computing machine;

creating, by a processing device, a service certificate for the local service using at least a portion of the data in the CSR;

signing the service certificate using a private key of the local CA, the private key being stored locally on the computing machine; and

providing the service certificate to the local service.

2. The method of claim 1 , further comprising:

removing the signing authority of the local CA.

3. The method of claim 2 , further comprising:

creating a plurality of CSRs for a plurality of local services, the plurality of CSRs comprising data of respective local services;

creating service certificates for the plurality of local services using the data in the respective CSRs;

signing the service certificates using the private key of the local CA prior to removing the signing authority of the local CA; and

providing the service certificates to the respective local services.

4. The method of claim 2 , wherein removing the signing authority of the local CA comprises:

determining that one or more criteria for removing signing authority for the local CA are satisfied.

5. The method of claim 2 , wherein removing the signing authority of the local CA comprises:

destroying a private key of the local CA, wherein the private key of the local CA is stored in local non-persistent memory.

6. The method of claim 1 , wherein creating the local CA comprises:

creating the private key and a public key to represent the local CA;

storing the private key and the public key in local non-persistent memory; and

creating a CA certificate having signing authority, wherein the CA certificate is created using the private key and public key of the local CA.

7. The method of claim 1 , further comprising:

signing, by the processing device, the CSR using a locally stored private key of the local service.

8. A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device of a computing machine, cause the processing device to:

create a certificate signing request (CSR) comprising data of a local service being hosted by the computing machine for a signing session defined by a period of time;

create a service certificate for the local service using at least a portion of the data in the CSR;

sign, by the processing device, the service certificate using data of a local certificate authority (CA) hosted by the computing machine; and

provide the service certificate to the local service.

9. The non-transitory computer-readable storage medium of claim 8 , wherein the processing device is further to:

remove signing authority of the local CA.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the processing device is further to:

create a plurality of CSRs for a plurality of local services, the plurality of CSRs comprising data of respective local services;

create service certificates for the plurality of local services using the data in the respective CSRs;

sign the service certificates using the private key of the local CA prior to removing the signing authority of the local CA; and

provide the service certificates to the respective local services.

11. The non-transitory computer-readable storage medium of claim 9 , wherein the processing device is further to:

determine that one or more criteria to remove the signing authority for the local CA are satisfied.

12. The non-transitory computer-readable storage medium of claim 9 , wherein to remove the signing authority of the local CA, the processing device is to:

destroy a private key of the local CA, wherein the private key of the local CA is stored in local non-persistent memory.

13. The non-transitory computer-readable storage medium of claim 8 , wherein to create the local CA, the processing device is to:

create a private key and a public key to represent the local CA;

store the private key and the public key in local non-persistent memory; and

create a CA certificate having signing authority, wherein the CA certificate is created using the private key and public key of the local CA.

14. The non-transitory computer-readable storage medium of claim 8 , wherein the data of the local CA comprises a locally stored private key of the local CA.

15. A computing machine comprising:

a memory;

a processing device, operatively coupled to the memory, to:

create a certificate signing request (CSR) comprising data of a local service being hosted by the computing machine for a signing session defined by a period of time;

create a service certificate for the local service using at least a portion of the data in the CSR;

sign the service certificate using data of a local certificate authority (CA) hosted by the computing machine; and

provide the service certificate to the local service.

16. The computing machine of claim 15 , wherein the processing device is further to:

remove signing authority of the local CA.

17. The computing machine of claim 16 , wherein the processing device is further to:

create a plurality of CSRs for a plurality of local services, the plurality of CSRs comprising data of respective local services;

create service certificates for the plurality of local services using the data in the respective CSRs;

sign the service certificates using the private key of the local CA prior to removing the signing authority of the local CA; and

provide the service certificates to the respective local services.

18. The computing machine of claim 16 , wherein to remove the signing authority of the local CA, the processing device is to:

destroy a private key of the local CA, wherein the private key of the local CA is stored in local non-persistent memory.

19. The computing machine of claim 15 , wherein the data of the local CA comprises a locally stored private key of the local CA.

20. The computing machine of claim 15 , wherein to create the local CA, the processing device is to:

create a private key and a public key to represent the local CA;

store the private key and the public key in local non-persistent memory; and

create a CA certificate having signing authority, wherein the CA certificate is created using the private key and public key of the local CA.