Certificate revocation at datacenters
Methods, systems, and devices supporting data processing are described. In some systems, a first service executing on a datacenter may receive a request to establish a secure connection and a certificate from a second service. The datacenter may be provisioned with an indication of certificates that have been revoked by a certificate authority (CA). The first service may validate a certificate chain for the certificate from the second service based on the certificates that have been revoked by the CA. If a certificate of the certificate chain has been revoked, the first service may not establish the connection with the second service. If the certificates of the certificate chain have not been revoked, the first service may establish a secure connection with the second service. The services may communicate in accordance with validating the certificate chain.
1. A method for data processing, comprising:
receiving, at a first service executing on a datacenter and from a second service, a request to establish a secure connection, wherein the datacenter is provisioned, prior to the request, with an indication of a plurality of certificates that have been revoked by a certificate authority;
receiving, from the second service based at least in part on receiving the request, an indication of a certificate associated with the second service, wherein the indication includes a web token that is digitally signed by the certificate using a private key;
validating, at the first service and based at least in part on validating that the web token is validly signed at the first service, a certificate chain associated with the certificate based at least in part on the indication of the plurality of certificates that have been revoked by the certificate authority; and
communicating with the second service in accordance with validating the certificate chain.
2. The method of claim 1 , further comprising:
receiving, at the first service, the indication of the plurality of certificates such that the first service is provisioned with the indication of the plurality of certificates.
3. The method of claim 1 , wherein validating the certificate chain comprises:
transmitting, to a micro-service executing in the datacenter, a certificate revocation request including the indication of the certificate; and
receiving, from the micro-service in response to the certificate revocation request, a certificate revocation response, wherein the first service communicates with the second service based at least in part on the certificate revocation response received from the micro-service.
4. The method of claim 1 , further comprising:
determining, based at least in part on validating the certificate chain, that the certificate is invalid in accordance with the certificate being included in the plurality of certificates; and
performing, based at least in part on determining that the certificate is invalid, an action in accordance with a security policy.
5. The method of claim 4 , wherein performing the action comprises:
transmitting, to the second service, an indication of a failure to establish the secure connection or establishing the secure connection with the second service and logging the invalid certificate.
6. The method of claim 1 , further comprising:
determining, based at least in part on validating the certificate chain, that the certificate is valid in accordance with the certificate not being included in the plurality of certificates; and
establishing the secure connection with the second service based at least in part on determining the certificate is valid.
7. The method of claim 1 , further comprising:
determining that the certificate is associated with a user device supported by the datacenter based at least in part on the certificate chain associated with the certificate, wherein the certificate chain is signed by a private certificate authority, wherein the first service communicates with the user device based at least in part on validating the certificate chain.
8. The method of claim 1 , wherein the plurality of certificates comprises public certificate authority certificates, internal certificate authority certificates, or both.
9. The method of claim 1 , further comprising:
transmitting, based at least in part on receiving the request, an indication of a certificate associated with the first service to the second service.
10. The method of claim 1 , wherein validating the certificate chain comprises:
validating the certificate chain on a local area network associated with the datacenter.
11. The method of claim 1 , wherein the indication of the plurality of certificates comprises a certificate revocation list or a database including a plurality of revoked certificates.
12. An apparatus for data processing, comprising:
one or more processors;
one or more memories coupled with the one or more processors; and
instructions stored in the one or more memories and executable by the one or more processors to cause the apparatus to:
receive, at a first service executing on a datacenter and from a second service, a request to establish a secure connection, wherein the datacenter is provisioned, prior to the request, with an indication of a plurality of certificates that have been revoked by a certificate authority;
receive, from the second service based at least in part on receiving the request, an indication of a certificate associated with the second service, wherein the indication includes a web token that is digitally signed by the certificate using a private key;
validate, at the first service and based at least in part on validating that the web token is validly signed at the first service, a certificate chain associated with the certificate based at least in part on the indication of the plurality of certificates that have been revoked by the certificate authority; and
communicate with the second service in accordance with validating the certificate chain.
13. The apparatus of claim 12 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:
receive, at the first service, the indication of the plurality of certificates such that the first service is provisioned with the indication of the plurality of certificates.
14. The apparatus of claim 12 , wherein the instructions to validate the certificate chain are executable by the one or more processors to cause the apparatus to:
transmit, to a micro-service executing in the datacenter, a certificate revocation request including the indication of the certificate; and
receive, from the micro-service in response to the certificate revocation request, a certificate revocation response, wherein the first service communicates with the second service based at least in part on the certificate revocation response received from the micro-service.
15. The apparatus of claim 12 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:
determine, based at least in part on validating the certificate chain, that the certificate is invalid in accordance with the certificate being included in the plurality of certificates; and
transmit, to the second service, an indication of a failure to establish the secure connection based at least in part on determining that the certificate is included in the plurality of certificates.
16. The apparatus of claim 12 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:
determine, based at least in part on validating the certificate chain, that the certificate is valid in accordance with the certificate not being included in the plurality of certificates; and
establish the secure connection with the second service based at least in part on determining the certificate is valid.
17. The apparatus of claim 12 , wherein the instructions are further executable by the one or more processors to cause the apparatus to:
determine that the certificate is associated with a user device supported by the datacenter based at least in part on the certificate chain associated with the certificate, wherein the certificate chain is signed by a private certificate authority, wherein the first service communicates with the user device based at least in part on validating the certificate chain.
18. A non-transitory computer-readable medium storing code for data processing, the code comprising instructions executable by one or more processors to:
receive, at a first service executing on a datacenter and from a second service, a request to establish a secure connection, wherein the datacenter is provisioned, prior to the request, with an indication of a plurality of certificates that have been revoked by a certificate authority;
receive, from the second service based at least in part on receiving the request, an indication of a certificate associated with the second service, wherein the indication includes a web token that is digitally signed by the certificate using a private key;
validate, at the first service and based at least in part on validating that the web token is validly signed at the first service, a certificate chain associated with the certificate based at least in part on the indication of the plurality of certificates that have been revoked by the certificate authority; and
communicate with the second service in accordance with validating the certificate chain.