one or more processors; and

a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to:

obtain a symmetric key generated using a key exchange algorithm, the symmetric key also provided to a first client-based service;

receive a request from the first client-based service to access a client certificate private key that is managed by a certificate manager and encrypted with a key-encryption-key, the request including a secret message encrypted with the symmetric key, the secret message generated by the first client-based service;

verify the request received from the first client-based service originates from a trusted device;

access the key-encryption key, in response to verifying the request originates from the trusted device, the key-encryption key accessed only by the certificate manager and not shared with any of the client-based services;

decrypt the client certificate private key with the key-encryption key;

decrypt the secret message with the symmetric key;

encrypt the client certificate private key with the secret message; and

provide access to the client certificate private key encrypted with the secret message to the first client-based service as a response to the request.