Secure distribution of cryptographic certificates
Disclosed are various embodiments for securely distributing certificates or encryption keys. A management service can receive an enrollment request from a client device. The management service can then send a key request to a certificate provider, the key request comprising a user identifier. The management service can also send a skeleton payload to an enterprise gateway. In response, the management service can receive an encrypted profile from the enterprise gateway, the encrypted profile comprising the skeleton payload with an encryption key inserted by the enterprise gateway into the skeleton payload. Finally, the management service can send the encrypted profile to the client device.
1. A system, comprising:
a computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
receive an enrollment request from a client device;
send a key request to a certificate provider, the key request comprising a user identifier;
send a skeleton payload to an enterprise gateway, wherein the skeleton payload is a preformatted file comprising one or more empty elements;
receive an encrypted profile from the enterprise gateway, the encrypted profile comprising the skeleton payload with an encryption key inserted by the enterprise gateway into the skeleton payload; and
send the encrypted profile to the client device.
2. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least insert the user identifier into the skeleton payload.
3. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to at least send the user identifier to the enterprise gateway.
4. The system of claim 1 , wherein the encrypted profile further comprises a certificate included in the skeleton payload and the certificate comprises the encryption key.
5. The system of claim 4 , wherein the certificate is a Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate.
6. The system of claim 1 , wherein the machine-readable instructions further cause the computing device to sign the encrypted profile with a signing certificate.
7. The system of claim 1 , wherein the enrollment request comprises the user identifier.
8. A method, comprising:
receiving an enrollment request from a client device;
sending a key request to a certificate provider, the key request comprising a user identifier;
sending a skeleton payload to an enterprise gateway, wherein the skeleton payload is a preformatted file comprising one or more empty elements;
receiving an encrypted profile from the enterprise gateway, the encrypted profile comprising the skeleton payload with an encryption key inserted by the enterprise gateway into the skeleton payload; and
sending the encrypted profile to the client device.
9. The method of claim 8 , further comprising inserting the user identifier into the skeleton payload.
10. The method of claim 8 , further comprising sending the user identifier to the enterprise gateway.
11. The method of claim 8 , wherein the encrypted profile further comprises a certificate included in the skeleton payload and the certificate comprises the encryption key.
12. The method of claim 11 , wherein the certificate is a Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate.
13. The method of claim 8 , further comprising signing the encrypted profile with a signing certificate.
14. The method of claim 8 , wherein the enrollment request comprises the user identifier.
15. A non-transitory, computer-readable medium, comprising machine-readable instructions that, when executed by a processor of a computing device, cause the computing device to at least:
receive an enrollment request from a client device;
send a key request to a certificate provider, the key request comprising a user identifier;
send a skeleton payload to an enterprise gateway, wherein the skeleton payload is a preformatted file comprising one or more empty elements;
receive an encrypted profile from the enterprise gateway, the encrypted profile comprising the skeleton payload with an encryption key inserted by the enterprise gateway into the skeleton payload; and
send the encrypted profile to the client device.
16. The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to at least insert the user identifier into the skeleton payload.
17. The non-transitory, computer-readable medium of claim 15 , wherein the encrypted profile further comprises a certificate included in the skeleton payload and the certificate comprises the encryption key.
18. The non-transitory, computer-readable medium of claim 17 , wherein the certificate is a Secure/Multipurpose Internet Mail Extensions (S/MIME) certificate.
19. The non-transitory, computer-readable medium of claim 15 , wherein the machine-readable instructions further cause the computing device to sign the encrypted profile with a signing certificate.
20. The non-transitory, computer-readable medium of claim 15 , wherein the enrollment request comprises the user identifier.