Supporting secure sessions in a cloud-based proxy service

A non-transitory computer-readable storage medium that provides instructions that, when executed by a processor, causes said processor to perform operations comprising:

• receiving a first secure session request from a first client device for a secure session, wherein the first secure session request is received at the proxy server as a result of a DNS (Domain Name System) request for a first domain resolving to the proxy server;
• participating in a secure session negotiation with the first client device including transmitting a digital certificate to the first client device, wherein the digital certificate is bound to the first domain and a set of one or more other domains;
• receiving a first encrypted request from the first client device for an action to be performed on a resource that is hosted at a first origin server corresponding to the first domain;
• decrypting the first encrypted request;
• participating in a secure session negotiation with the first origin server including receiving a digital certificate from the first origin server;
• encrypting the decrypted request using the received digital certificate from the first origin server;
• and
• transmitting the encrypted request to the first origin server.

An apparatus, comprising:

• a set of one or more processors;
• a set of one or more non-transitory computer-readable storage mediums storing instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
• receiving a first secure session request from a first client device for a secure session, wherein the first secure session request is received at the proxy server as a result of a DNS (Domain Name System) request for a first domain resolving to the proxy server;
• participating in a secure session negotiation with the first client device including transmitting a digital certificate to the first client device, wherein the digital certificate is bound to the first domain and a set of one or more other domains;
• receiving a first encrypted request from the first client device for an action to be performed on a resource that is hosted at a first origin server corresponding to the first domain;
• decrypting the first encrypted request;
• participating in a secure session negotiation with the first origin server including receiving a digital certificate from the first origin server;
• encrypting the decrypted request using the received digital certificate from the first origin server;
• and
• transmitting the encrypted request to the first origin server.