Handling of certificates by intermediate actors
Handling of certificates by intermediate actors, including: receiving, by a proxy and from a client, a client certificate and a first private key; generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate; generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination; and providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate.
1 . A method of handling of certificates by intermediate actors, the method comprising:
receiving, by a proxy and from a client, a client certificate and a first private key, wherein the client certificate comprises a short-term client certificate;
generating, by the proxy and based on the client certificate and the first private key, an intermediate certificate;
generating, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination;
providing, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate;
receiving, from the client, a long-term client certificate and a second private key, wherein the long-term client certificate comprises a trusted root for the client;
generating the short-term client certificate and the first private key, wherein the short-term client certificate is signed using the second private key; and
providing, to the client, the short-term client certificate and the first private key.
2 . The method of claim 1 , wherein the second private key is received in an encrypted form.
3 . The method of claim 2 , wherein the second private key is stored in the client in the crypted form, wherein the second private key is encrypted using a public key corresponding to another private key inaccessible to the client.
4 . The method of claim 1 , further comprising:
selecting, by the proxy and in response to another request from a different client to connect to the destination, the alternate certificate for the destination; and
providing, to the different client, another certificate chain comprising the alternate certificate, another intermediate certificate corresponding to the different client, and another client certificate received from the different client.
5 . The method of claim 1 , wherein the alternate certificate comprises a subset of data of a destination certificate received from the destination.
6 . The method of claim 1 , further comprising inspecting encrypted content transferred to or from the client by decrypting the encrypted content.
7 . The method of claim 1 , wherein the alternate certificate is one of a plurality of alternate certificates each corresponding to different destinations and generated, by the proxy, using a same private key.
8 . The method of claim 1 , further comprising determining, in response to the request from the client, whether the alternative certificate for the destination is currently stored, wherein generating the alternate certificate is performed in response to determining that no alternate certificate for the destination is currently stored.
9 . The method of claim 8 wherein determining, in response to the request from the client, whether the alternate certificate for the destination is currently stored comprises performing a lookup keyed by a destination certificate received from the destination.
10 . A computer program product for handling of certificates by intermediate actors, the computer program product disposed on a non-transitory computer readable medium, the computer program product including computer program instructions configurable to cause a system to:
receive, by a proxy and from a client, a client certificate and a first private key;
generate, by the proxy and based on the client certificate and the first private key, an intermediate certificate;
generate, by the proxy and in response to a request from the client to connect to a destination, an alternate certificate for the destination;
provide, to the client, a certificate chain comprising the alternate certificate, the intermediate certificate, and the client certificate;
receive, from the client, a long-term client certificate and a second private key, wherein the long-term client certificate comprises a trusted root for the client;
generate the short-term client certificate and the first private key, wherein the short-term client certificate is signed using the second private key; and
provide, to the client, the short-term client certificate and the first private key.
11 . The computer program product of claim 10 , wherein the second private key is received in an encrypted form.
12 . The computer program product of claim 11 , wherein the second private key is stored in the client in the encrypted form, wherein the second private key is encrypted using a public key corresponding to another private key inaccessible to the client.
13 . The computer program product of claim 10 further comprising:
selecting, by the proxy and in response to another request from a different client to connect to the destination, the alternate certificate for the destination; and
providing, to the different client, another certificate chain comprising the alternate certificate, another intermediate certificate corresponding to the different client, and another client certificate received from the different client.
14 . The computer program product of claim 10 , wherein the alternate certificate comprises a subset of data of a destination certificate received from the destination.
15 . The computer program product of claim 10 further comprising inspecting encrypted content transferred to or from the client by decrypting the encrypted content.
16 . The computer program product of claim 10 , wherein the alternate certificate is one of a plurality of alternate certificates each corresponding to different destinations and generated, by the proxy, using the same private key.
17 . The computer program code of claim 10 further comprising determining, in response to the request from the client, whether the alternative certificate for the destination is currently stored, wherein generating the alternate certificate is performed in response to determining that no alternate certificate for the destination is currently stored.
18 . The computer program code of claim 17 , wherein determining, in response to the request from the client, whether the alternate certificate for the destination is currently stored comprises performing a lookup keyed by a destination certificate received from the destination.