Dynamic certificate generation on a certificate authority cloud
Techniques are disclosed for dynamically generating a digital certificate for a customer server. A customer server creates a certificate profile and receives an associated profile identifier from a certificate authority (CA). The customer server installs an agent application received from the CA. The agent application generates a public/private key pair and an identifier associated with the customer server. The agent application sends a signed request to the CA that includes the profile identifier, server identifier, and the public key corresponding to the key pair. Upon receiving the credentials, the CA generates a dynamically updatable certificate. Thereafter, if the customer changes information associated with the certificate (or if external conditions require a change to the certificate, such as a key compromise or change in security standards), the CA may generate an updated certificate based on the certificate profile changes and the public key.
1. A method for generating a digital certificate, comprising:
receiving, at a certificate authority computing device, a certificate profile associated with a customer computing system;
in response to receiving the certificate profile, sending an agent application to the customer computing system and instructing, by the certificate authority computing device, the agent application installed on the customer computing system to generate a first private key, a first public key, and a customer computing system identifier;
receiving the first public key, the customer computing system identifier, and a profile identifier associated with the certificate profile from the agent application;
generating a first certificate based on the first public key and the certificate profile; and
sending the first certificate to the customer computing system.
2. The method of claim 1 , further comprising:
monitoring the certificate profile to detect changes in the certificate profile made by a user, wherein the certificate profile includes a plurality of digital certificate attributes used by a certificate authority (CA) in generating a digital certificate;
detecting at least one change in the certificate profile;
in response to detecting the at least one change, generating a second certificate based on the change in the certificate profile, wherein attributes of the second certificate reflect the at least one change in the certificate profile; and
sending the second certificate to the agent application.
3. The method of claim 2 , wherein the change in the certificate profile modifies one or more subject alternative names (SANs) named in the first certificate.
4. The method of claim 1 , further comprising:
sending a request to the agent application to generate a certificate request;
receiving the certificate request and a second public key;
generating a second certificate signing the second public key; and
sending the second certificate to the agent application.
5. A non-transitory computer-readable storage medium storing instructions, which, when executed on a processor, performs an operation for generating a digital certificate, the operation comprising:
receiving, at a certificate authority computing device, a certificate profile associated with a customer computing system;
in response to receiving the certificate profile, sending an agent application to the customer computing system and instructing, by the certificate authority computing device, the agent application installed on the customer computing system to generate a first private key, a first public key, and a customer computing system identifier;
receiving the first public key, the customer computing system identifier, and a profile identifier associated with the certificate profile from the agent application;
generating a first certificate based on the first public key and the certificate profile; and
sending the first certificate to the customer computing system.
6. The computer-readable storage medium of claim 5 , wherein the operation further comprises:
monitoring the certificate profile to detect a change in the certificate profile;
in response to a detected change, generating a second certificate based on the change in the certificate profile, wherein attributes of the second certificate reflect the at least one change in the certificate profile; and
sending the second certificate to the agent application.
7. The computer-readable storage medium of claim 5 , wherein the operation further comprises:
sending a request to the agent application to generate a certificate request;
receiving the certificate request and a second public key;
generating a second certificate signing the second public key; and
sending the second certificate to the agent application.
8. A system, comprising:
a processor and a memory hosting an application, which, when executed on the processor, performs an operation for generating a digital certificate, the operation comprising:
receiving, at the system, a certificate profile associated with a customer computing system;
in response to receiving the certificate profile, sending an agent application to the customer computing system and instructing, by the system, the agent application installed on the customer computing system to generate a first private key, a first public key, and a customer computing system identifier;
receiving the first public key, the customer computing system identifier, and a profile identifier associated with the certificate profile from the agent application;
generating a first certificate based on the first public key and the certificate profile; and
sending the first certificate to the customer computing system.
9. The system of claim 8 , wherein the operation further comprises:
monitoring the certificate profile to detect a change in the certificate profile;
in response to a detected change, generating a second certificate based on the change in the certificate profile, wherein attributes of the second certificate reflect the at least one change in the certificate profile; and
sending the second certificate to the agent application.
10. The system of claim 8 , wherein the operation further comprises:
sending a request to the agent application to generate a certificate request;
receiving the certificate request and a second public key;
generating a second certificate signing the second public key; and
sending the second certificate to the agent application.
11. A method for dynamically generating digital certificates, the method implemented by a certificate authority computing device of one or more processors, and the method comprising:
receiving a request for a first digital certificate from a customer of a customer computing system, wherein the request includes a certificate profile associated with the customer computing system, and wherein the certificate profile includes a plurality of digital certificate attributes;
in response to receiving the certificate profile, sending an agent application to the customer computing system and instructing, by the certificate authority computing device, the agent application installed on the customer computing system to generate a first private key, a first public key, and a customer computing system identifier;
generating the first digital certificate based on the first public key and the certificate profile;
sending, to the agent application, a first digital certificate to the customer computing system;
monitoring the certificate profile to detect changes in the certificate profile;
detecting at least one change in the certificate profile;
in response to detecting the at least one change, generating a second digital certificate that reflects the at least one change in the certificate profile; and
sending, to the agent application, the second digital certificate to the customer computing system.
12. The method of claim 11 , wherein the certificate profile includes a common name and wherein detecting the change to the certificate profile comprises detecting a change in the common name.
13. The method of claim 11 , wherein the certificate profile includes a subject name and wherein detecting the change to the certificate profile comprises detecting a change in the subject name.
14. The method of claim 11 , wherein the certificate profile includes a subject alternate name and wherein detecting the change to the certificate profile comprises detecting a change in the subject alternate name.
15. The method of claim 11 , wherein the certificate profile includes a signature algorithm identification and wherein detecting the change to the certificate profile comprises detecting a change in the signature algorithm identification.
16. The method of claim 11 , wherein the certificate profile includes usage restrictions and wherein detecting the change to the certificate profile comprises detecting a change in the usage restrictions.
17. The method of claim 11 , wherein the certificate profile includes credentials and wherein detecting the change to the certificate profile comprises detecting a change in the credentials.
18. The method of claim 11 , wherein the certificate profile includes a user identifier and wherein detecting the change to the certificate profile comprises detecting a change in the user identifier.
19. The method of claim 11 , wherein the certificate profile includes a password and wherein detecting the change to the certificate profile comprises detecting a change in the password.