Data in transit protection with exclusive control of keys and certificates across heterogeneous distributed computing environments

A computer system for certificate and key management, the computer system comprising:

• a bus system;
• a hardware security module;
• a storage device connected to the bus system, wherein the storage device stores program instructions;
• and
• a processor connected to the bus system, wherein the processor executes the program instructions to:
• deploy a signed certificate corresponding to an enterprise to a plurality of cryptographic communication protocol endpoint proxies located in a heterogeneous distributed computing environment where a private key corresponding to the enterprise is not placed in any of the plurality of cryptographic communication protocol endpoint proxies;
• receive, using the hardware security module, offload of cryptographic communications from the plurality of cryptographic communication protocol endpoint proxies to the hardware security module where the hardware security module verifies connection authenticity for the plurality of cryptographic communication protocol endpoint proxies across the heterogeneous distributed computing environment using the private key corresponding to the enterprise that remains within a security boundary of the hardware security module;
• receive, using a cryptographic communication protocol endpoint proxy of the computer, a connection with the cryptographic communication protocol endpoint proxy from a user client device via a network, the user client device wanting to access a set of sensitive data corresponding to the enterprise using the connection;
• and
• generate, using the cryptographic communication protocol endpoint proxy, a base point G on an elliptic curve and a cryptographic nonce to calculate a hash of a digest of handshake messages between the user client device and the computer based on cryptographic communication protocol information provided by the user client device in a client hello message,
• wherein the heterogeneous distributed computing environment comprises a hybrid multi-cloud and edge environment comprised of a plurality of clouds provided by different cloud providers comprising TLS endpoint-ingress and a plurality of edge devices comprising TLS endpoint-ingress.

A computer program product for certificate and key management, the computer program product comprising a computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a method of:

• deploying, by the computer, a signed certificate corresponding to an enterprise to a plurality of cryptographic communication protocol endpoint proxies located in a heterogeneous distributed computing environment where a private key corresponding to the enterprise is not placed in any of the plurality of cryptographic communication protocol endpoint proxies;
• receiving, by the computer using a hardware security module of the computer, offload of cryptographic communications from the plurality of cryptographic communication protocol endpoint proxies to the hardware security module where the hardware security module verifies connection authenticity for the plurality of cryptographic communication protocol endpoint proxies across the heterogeneous distributed computing environment using the private key corresponding to the enterprise that remains within a security boundary of the hardware security module;
• receiving, by the computer using a cryptographic communication protocol endpoint proxy of the computer, a connection with the cryptographic communication protocol endpoint proxy from a user client device via a network, the user client device wanting to access a set of sensitive data corresponding to the enterprise using the connection;
• and
• generating, by the computer using the cryptographic communication protocol endpoint proxy, a base point G on an elliptic curve and a cryptographic nonce to calculate a hash of a digest of handshake messages between the user client device and the computer based on cryptographic communication protocol information provided by the user client device in a client hello message,
• wherein the heterogeneous distributed computing environment comprises a hybrid multi-cloud and edge environment comprised of a plurality of clouds provided by different cloud providers comprising TLS endpoint-ingress and a plurality of edge devices comprising TLS endpoint-ingress.