Proxy certificates used for operating securely between users' customers and cloud apps

A computer-implemented method of an entity distinct from and not controlled by an organization operating a cloud-based inspection proxy for encrypted sessions, established via the cloud-based inspection proxy, between organization browsers and clients (collectively organization browsers) and cloud-based resources, wherein the organization browsers are used by users in the organization, the method comprising the cloud-based inspection proxy:

• initializing an intermediate CA certificate by generating an intermediate public-private key pair, sending an unsigned intermediate CA certificate in a certificate signing request to an Hardware Security Module (“HSM”), and receiving a signed intermediate CA certificate that has been chained to a root CA certificate in response to the sent unsigned intermediate CA certificate;
• receiving a request from an organization browser to establish a session accessing a cloud-based resource at a domain, wherein the cloud-based inspection proxy does not already have a domain-specific short-lived certificate that is trusted by the organization browsers for the domain;
• generating the domain-specific short-lived certificate for the domain by signing the domain-specific short-lived certificate using an intermediate private key and chaining the domain-specific short-lived certificate to an organization certificate stored in the organization browser;
• posing as the domain using the domain-specific short-lived certificate during the session with the organization browser;
• relaying traffic between the organization browser and the domain, including decrypting and encrypting session traffic between the organization browser and the domain;
• and
• inspecting at least some session traffic relayed during the session by applying rules supplied by the organization to the distinct entity.

A non-transitory computer readable medium holding computer instructions that, when executed on hardware possessed by an entity distinct from and not controlled by an organization, implement operating a cloud-based inspection proxy for encrypted sessions, established via the cloud-based inspection proxy, between organization browsers and clients (collectively organization browsers) and cloud-based resources, wherein the organization browsers are used by users in the organization, and implement actions including:

• initializing an intermediate CA certificate by generating an intermediate public-private key pair, sending an unsigned intermediate CA certificate in a certificate signing request to an Hardware Security Module (“HSM”), and receiving a signed intermediate CA certificate that has been chained to a root CA certificate in response to the sent unsigned intermediate CA certificate;
• receiving a request from an organization browser to establish a session accessing a cloud-based resource at a domain, wherein the cloud-based inspection proxy does not already have a domain-specific short-lived certificate that is trusted by the organization browsers for the domain;
• generating the domain-specific short-lived certificate for the domain by signing the domain-specific short-lived certificate using an intermediate private key and chaining the domain-specific short-lived certificate to an organization certificate stored in the organization browser;
• posing as the domain using the domain-specific short-lived certificate during the session with the organization browser;
• relaying traffic between the organization browser and the domain, including decrypting and encrypting session traffic between the organization browser and the domain;
• and
• inspecting at least some session traffic relayed during the session by applying rules supplied by the organization to the distinct entity.

A system including processor hardware coupled to a non-transitory computer readable medium holding computer instructions that, when executed on hardware possessed by an entity distinct from and not controlled by an organization, implement operating a cloud-based inspection proxy for encrypted sessions, established via the cloud-based inspection proxy, between organization browsers and clients (collectively organization browsers) and cloud-based resources, wherein the organization browsers are used by users in the organization, and implement actions including:

• initializing an intermediate CA certificate by generating an intermediate public-private key pair, sending an unsigned intermediate CA certificate in a certificate signing request to an Hardware Security Module (“HSM”), and receiving a signed intermediate CA certificate that has been chained to a root CA certificate in response to the sent unsigned intermediate CA certificate;
• receiving a request from an organization browser to establish a session accessing a cloud-based resource at a domain, wherein the cloud-based inspection proxy does not already have a domain-specific short-lived certificate that is trusted by the organization browsers for the domain;
• generating the domain-specific short-lived certificate for the domain by signing the domain-specific short-lived certificate using an intermediate private key and chaining the domain-specific short-lived certificate to an organization certificate stored in the organization browser;
• posing as the domain using the domain-specific short-lived certificate during the session with the organization browser;
• relaying traffic between the organization browser and the domain, including decrypting and encrypting session traffic between the organization browser and the domain;
• and
• inspecting at least some session traffic relayed during the session by applying rules supplied by the organization to the distinct entity.