Application specific certificate management
Application specific certificate deployment may be provided. An application may generate a security certificate comprising a public key and a first private key. The public key may be stored in a shared segment of a memory store, from where it may be retrieved and signed. The signed public key may be re-deployed and/or used to transmit securely encrypted resources.
1. A method for encrypted resource access by managed applications, comprising:
generating, based on an application requesting to retrieve encrypted resources, a public key and a private key, wherein the public and private keys are generated from a security certificate that is created for the request;
storing the public key in a shared segment of a memory store, wherein the memory store is accessible by the requesting application and at least one other application, and wherein a server remote from the requesting application retrieves the public key from the memory store and sends it to a certificate authority for signature;
receiving, at a computing device, a signed version of the public key from the certificate authority;
retrieving the encrypted resources from the remote server, wherein the encrypted resources are encrypted according to the public key by the remote server; and
decrypting the encrypted resources according to the private key.
2. The method of claim 1 , wherein the shared segment of the memory store is located on a different physical device.
3. The method of claim 1 , wherein the public and private keys are generated from the security certificate based on a determination that the encrypted resources require secure retrieval.
4. The method of claim 3 , wherein the security certificate comprises a one-time use security certificate.
5. The method of claim 1 , further comprising storing a second private key for re-use.
6. The method of claim 5 , further comprising:
encrypting the second private key according to the public key; and
storing the second private key in the shared segment of the memory store.
7. The method of claim 1 , further comprising placing the signed version of the public key in a memory segment accessible by the requesting application.
8. A non-transitory, computer-readable medium containing instructions that are executed by a processor, causing the processor to perform stages comprising:
generating, based on an application requesting to retrieve encrypted resources, a public key and a private key, wherein the public and private keys are generated from a security certificate that is created for the request;
storing the public key in a shared segment of a memory store, wherein the memory store is accessible by the requesting application and at least one other application, and wherein a server remote from the requesting application retrieves the public key from the memory store and sends it to a certificate authority for signature;
receiving, at a computing device, a signed version of the public key from the certificate authority;
retrieving the encrypted resources from the remote server, wherein the encrypted resources are encrypted according to the public key by the remote server; and
decrypting the encrypted resources according to the private key.
9. The non-transitory, computer-readable medium of claim 8 , wherein the shared segment of the memory store is located on a different physical device.
10. The non-transitory, computer-readable medium of claim 8 , wherein the public and private keys are generated from the security certificate based on a determination that the encrypted resources require secure retrieval.
11. The non-transitory, computer-readable medium of claim 10 , wherein the security certificate comprises a one-time use security certificate.
12. The non-transitory, computer-readable medium of claim 8 , the stages further comprising storing a second private key for re-use.
13. The non-transitory, computer-readable medium of claim 12 , the stages further comprising:
encrypting the second private key according to the public key; and
storing the second private key in the shared segment of the memory store.
14. The non-transitory, computer-readable medium of claim 8 , the stages further comprising placing the signed version of the public key in a memory segment accessible by the requesting application.
15. An apparatus comprising:
a memory store; and
a processor coupled to the memory store, wherein the processor is configured to perform stages comprising:
generating, based on an application requesting to retrieve encrypted resources, a public key and a private key, wherein the public and private keys are generated from a security certificate that is created for the request;
storing the public key in a shared segment of the memory store, wherein the memory store is accessible by the requesting application and at least one other application, and wherein a server remote from the requesting application retrieves the public key from the memory store and sends it to a certificate authority for signature;
receiving, at a computing device, a signed version of the public key from the certificate authority;
retrieving the encrypted resources from the remote server, wherein the encrypted resources are encrypted according to the public key at the remote server; and
decrypting the encrypted resources according to the private key.
16. The apparatus of claim 15 , wherein the shared segment of the memory store is located on a different physical device.
17. The apparatus of claim 15 , wherein the public and private keys are generated from the security certificate based on a determination that the encrypted resources require secure retrieval.
18. The apparatus of claim 17 , wherein the security certificate comprises a one-time use security certificate.
19. The apparatus of claim 15 , the stages further comprising storing a second private key for re-use.
20. The apparatus of claim 19 , the stages further comprising:
encrypting the second private key according to the public key; and
storing the second private key in the shared segment of the memory store.