Abstract: According to certain implementations, a certificate management service of a cloud service provider requests a certificate for a domain from a certificate authority utilizing an HTTP-based challenge. The certificate authority responds with a challenge string and a subdirectory within the domain. The challenge string and subdirectory within the domain are sent from the certificate management service to a proxy server of the cloud service provider that manages a flow of data to a host that hosts the domain. When the certificate authority sends a request to the subdirectory within the domain, the request is intercepted at the proxy server. Instead of forwarding the request to the host that hosts the domain, the proxy server responds to the certificate authority with the challenge string. This verifies ownership of the domain, which is required to obtain the certificate for the domain.

Abstract: Operations may include receiving, from a first network entity, a first request for a first certificate revocation list (CRL) that identifies a first CRL distribution point (CDP) corresponding to the first CRL; mapping the first CDP to a first CRL identifier of a set of available CRL identifiers; locating, in a CRL repository, a first CRL based on the first CRL identifier; and transmitting the first CRL to the first network entity.

Abstract: A method may include transmitting a request for metadata associated with a compute instance and receiving, by a computing system, metadata associated with the compute instance signed with a private key. The private key may be associated with a public key. The method may include receiving a request to access a cloud resource and transmitting the request for the metadata. The method may also include receiving the metadata. The metadata may indicate that the compute instance is hosted on the computing system. The method may also include transmitting, to an instance principal service, a request for an instance principal certificate. The request may include the metadata signed with the private key and be cryptographically verified by the instance principal service using the public key. The method may also include receiving the instance principal certificate and providing access to the could resource based on the instance principal certificate.

Abstract: Operations may include receiving, from a first network entity, a first request for a first certificate revocation list (CRL) that identifies a first CRL distribution point (CDP) corresponding to the first CRL; mapping the first CDP to a first CRL identifier of a set of available CRL identifiers; locating, in a CRL repository, a first CRL based on the first CRL identifier; and transmitting the first CRL to the first network entity.

Abstract: According to certain implementations, a certificate management service of a cloud service provider requests a certificate for a domain from a certificate authority utilizing an HTTP-based challenge. The certificate authority responds with a challenge string and a subdirectory within the domain. The challenge string and subdirectory within the domain are sent from the certificate management service to a proxy server of the cloud service provider that manages a flow of data to a host that hosts the domain. When the certificate authority sends a request to the sub directory within the domain, the request is intercepted at the proxy server. Instead of forwarding the request to the host that hosts the domain, the proxy server responds to the certificate authority with the challenge string. This verifies ownership of the domain, which is required to obtain the certificate for the domain.

Abstract: A method may include transmitting a request for metadata associated with a compute instance and receiving, by a computing system, metadata associated with the compute instance signed with a private key. The private key may be associated with a public key. The method may include receiving a request to access a cloud resource and transmitting the request for the metadata. The method may also include receiving the metadata. The metadata may indicate that the compute instance is hosted on the computing system. The method may also include transmitting, to an instance principal service, a request for an instance principal certificate. The request may include the metadata signed with the private key and be cryptographically verified by the instance principal service using the public key. The method may also include receiving the instance principal certificate and providing access to the could resource based on the instance principal certificate.

Abstract: Operations may include receiving, from a first network entity, a first request for a first certificate revocation list (CRL) that identifies a first CRL distribution point (CDP) corresponding to the first CRL; mapping the first CDP to a first CRL identifier of a set of available CRL identifiers; locating, in a CRL repository, a first CRL based on the first CRL identifier; and transmitting the first CRL to the first network entity.

Abstract: A method may include transmitting a request for metadata associated with a compute instance and receiving, by a computing system, metadata associated with the compute instance signed with a private key. The private key may be associated with a public key. The method may include receiving a request to access a cloud resource and transmitting the request for the metadata. The method may also include receiving the metadata. The metadata may indicate that the compute instance is hosted on the computing system. The method may also include transmitting, to an instance principal service, a request for an instance principal certificate. The request may include the metadata signed with the private key and be cryptographically verified by the instance principal service using the public key. The method may also include receiving the instance principal certificate and providing access to the could resource based on the instance principal certificate.

Abstract: According to certain implementations, a certificate management service of a cloud service provider requests a certificate for a domain from a certificate authority utilizing an HTTP-based challenge. The certificate authority responds with a challenge string and a subdirectory within the domain. The challenge string and subdirectory within the domain are sent from the certificate management service to a proxy server of the cloud service provider that manages a flow of data to a host that hosts the domain. When the certificate authority sends a request to the sub directory within the domain, the request is intercepted at the proxy server. Instead of forwarding the request to the host that hosts the domain, the proxy server responds to the certificate authority with the challenge string. This verifies ownership of the domain, which is required to obtain the certificate for the domain.