Cryptographic bridge for securing public key infrastructure (PKI)

1. A system for securing public key infrastructure with a custom microservice bridge that restricts client device access to a digital certificate, the system comprising:

a client device comprising a microprocessor executing a client application, the application configured to generate and digitally sign an identification token;

a central server configured generate an access token in response to authentication of the identification token; an

interface layer comprising a secure microservice bridge remote from the client device, the microservice bridge comprising a microservice orchestrator and a set of APIs that interact with the client device, the central server, and an enterprise digital certificate manager, the interface layer configured to:

in response to a call from the application, access an application-specific digital certificate stored by the enterprise digital certificate manager and generate an application-specific private key;

encrypt the application-specific private key for digital signature at the client application; in response to a call from the central server, access the application-specific digital certificate stored by the enterprise digital certificate manager and generate an application-specific public key; and

format the application-specific public key in a format compatible with the identification token for decrypting the digital signature at the central server;

wherein the client device is restricted from having access to the digital certificate, the private key, and the public key.

2. The system of claim 1 , the interface layer further configured to renew the digital certificate on a periodic basis.

3. The system of claim 1 , the interface layer comprising one or more secure APIs.

4. The system of claim 1 , the interface layer architecture comprising one or more microservice units.

5. The system of claim 1 , the identification token comprising a JSON web token (JWT) and the public key comprising a JSON web key (JWK).

6. One or more non-transitory computer-readable media storing computer-executable instructions which, when executed by a processor on a computer system, perform a method for protecting public key infrastructure using a secure microservice bridge remote from a client device and comprising a set of APIs that limits digital certificate access by a client device, the method comprising, at the secure microservice bridge:

receiving a call from an authorized application at the client device for digital signature of an identification token;

obtaining an application-specific private key from a digital certificate management system;

encrypting the private key for the application;

receiving a call from a central server for decryption of the digitally signed identification token;

obtaining an application-specific public key from the digital certificate management system; and

converting the public key to a format compatible with the identification token for the central server;

wherein the client device is restricted from having access to the digital certificate, the private key and the public key.

7. The media of claim 6 , the method further comprising, at the secure microservice bridge, using an API from the set of APIs, renewing the digital certificate on a periodic basis.

8. The media of claim 6 , the identification token comprising a JSON web token (JWT) and the public key comprising a JSON web key (JWK).

9. A method for protecting public key infrastructure using a secure microservice bridge comprising an API interface remote from a client device that eliminates maintenance of digital certificates, public keys, and private keys at the application level, the method comprising:

at the client device, at a client application, at a client device:

receiving user credentials;

generating a JSON web token (JWT);

digitally signing the JWT using an encrypted application-specific private key;

at a central server:

receiving the JWT;

decrypting the JWT using a JSON web key (JWK);

in response to authenticating the JWT, transmitting an access token to the client application;

at the secure microservice bridge comprising the API interface:

receiving a call from the client application;

obtaining an application-specific private key from a digital certificate management system;

encrypting an application-specific private key for the application for digital signature of the JWT;

receiving a call from a central server for decryption of the digitally signed JWT;

obtaining an application-specific public key from the digital certificate management system; and

converting the public key to a JWK for the central server for decryption of the JWT;

wherein the client device is restricted from having access to the digital certificate, the private key, and the public key.

10. The method of claim 9 , wherein the application does not have direct access to the digital certificate management system.

11. The method of claim 9 , wherein the digital certificate and the public key are not stored at the central server.

12. The method of claim 11 , wherein the central server does not have direct access to the digital certificate management system.

13. The method of claim 9 , further comprising, at the secure API interface, automatically renewing the digital certificate on a periodic basis.

14. The method of claim 9 , wherein interface architecture comprises one or more microservice units.