On-demand generation and distribution of cryptographic certificates
A method and proxy device for on-demand generation of cryptographic certificates. The method includes receiving, by a proxy device, a request to access a cloud application; identifying a domain name designated in the received request; determining if the identified domain name is signed by a valid cryptographic certificate saved locally in the proxy device; and sending, to a certificate generator system, a certification request to issue a new cryptographic certificate to sign the identified domain name, when the identified domain name is not a signed domain name.
1. A method for on-demand generation of cryptographic certificates, comprising:
receiving, by a proxy device, a request to access a cloud application;
identifying a domain name designated in the received request;
determining when the identified domain name is signed by a valid cryptographic certificate saved locally in the proxy device;
querying at least one of a certificate generator system and a plurality of proxy devices regarding availability of a cryptographic certificate signing the un-signed domain name, wherein the certificate generator system is the centralized system serving the plurality of proxy devices; and
sending, to the certificate generator system, a certification request to issue a new cryptographic certificate to sign the identified domain name, when the identified domain name is not a signed domain name.
2. The method of claim 1 , further comprising:
receiving the newly issued cryptographic certificate from the certificate generator system; and
serving the newly issued cryptographic certificate to a client device requesting to access the cloud application.
3. The method of claim 1 , further comprising;
frequently pulling, from the certificate generator system, newly issued cryptographic certificates.
4. The method of claim 1 , further comprising:
propagating the newly issued cryptographic certificate to the plurality of proxy devices through the proxy device using the newly issued cryptographic certificate.
5. The method of claim 1 , further comprising:
serving a valid cryptographic certificate locally saved in the proxy device, when the identified domain name is a signed domain name.
6. The method of claim 1 , wherein the proxy device is any of: a forward proxy and a suffix proxy.
7. The method of claim 1 , wherein the certification request is a request to update a valid cryptographic certificate locally saved in the proxy device with the identified domain name.
8. The method of claim 1 , wherein the identified domain name is a modified domain name of an original domain name designating the cloud application.
9. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for on-demand generation of cryptographic certificates, the process comprising:
receiving, by a proxy device, a request to access a cloud application;
identifying a domain name designated in the received request;
determining when the identified domain name is signed by a valid cryptographic certificate saved locally in the proxy device;
querying at least one of a certificate generator system and a plurality of proxy devices regarding availability of a cryptographic certificate signing the un-signed domain name, wherein the certificate generator system is the centralized system serving the plurality of proxy devices; and
sending, to the certificate generator system, a certification request to issue a new cryptographic certificate to sign the identified domain name, when the identified domain name is not a signed domain name.
10. A proxy device for on-demand generation of cryptographic certificates, comprising:
a processing circuitry; and
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the proxy device to:
receive, by a proxy device, a request to access a cloud application;
identify a domain name designated in the received request;
determine when the identified domain name is signed by a valid cryptographic certificate saved locally in the proxy device;
query at least one of a certificate generator system and a plurality of proxy devices regarding availability of a cryptographic certificate signing the un-signed domain name, wherein the certificate generator system is the centralized system serving the plurality of proxy devices; and
send, the a certificate generator system, a certification request to issue a new cryptographic certificate to sign the identified domain name, when the identified domain name is not a signed domain name.
11. The proxy device of claim 10 , wherein the proxy device is further configured to:
receive the newly issued cryptographic certificate from the certificate generator system; and
serve the newly issued cryptographic certificate to a client device requesting to access the cloud application.
12. The proxy device of claim 10 , wherein the proxy device is further configured to:
frequently pull, from the certificate generator system, newly issued cryptographic certificates.
13. The proxy device of claim 10 , wherein the proxy device is further configured to:
propagate the newly issued cryptographic certificate to the plurality of proxy devices through the proxy device using the newly issued cryptographic certificate.
14. The proxy device of claim 10 , wherein the proxy device is further configured to:
serve a valid cryptographic certificate locally saved in the proxy device, when the identified domain name is a signed domain name.
15. The proxy device of claim 10 , wherein the proxy device is any of: a forward proxy and a suffix proxy.
16. The proxy device of claim 10 , wherein the certification request is a request to update a valid cryptographic certificate locally saved in the proxy device with the identified domain name.
17. The proxy device of claim 10 , wherein the identified domain name is a modified domain name of an original domain name designating the cloud application.