A method by a management server (104, 704), comprising: receiving (112, 304, 402) a credentials request from a requesting management node (102a, 602a, 702) from a plurality of management nodes on a network, wherein the credentials request includes a public key of the requesting management node; determining whether the management server (104, 704) has encrypted credentials encrypted for the requesting management node in a credentials cache, wherein the encrypted credentials are encrypted using the public key of the requesting management node (102a, 602a) and cannot be decrypted by the management server (104, 704); sending (124, 206, 406) the encrypted credentials to the requesting management node when the management server (104, 704) has the encrypted credentials, wherein the requesting management node (102a, 602a), after receiving the encrypted credentials, can decrypt the encrypted credentials using a private key of the requesting management node; and when the management server (104, 704) does not have the encrypted credentials: sending (126, 408) a multicast request to one or more peer management nodes from the plurality of management nodes on the network, the multicast request including the public key of the requesting management node; receiving (130, 410) a unicast response from a responding management node from the one or more peer management nodes, the unicast response including the encrypted credentials encrypted for the requesting management node; and sending the encrypted credentials received from the responding management node to the requesting management node. receiving (112, 304, 402) a credentials request from a requesting management node (102a, 602a, 702) from a plurality of management nodes on a network, wherein the credentials request includes a public key of the requesting management node; determining whether the management server (104, 704) has encrypted credentials encrypted for the requesting management node in a credentials cache, wherein the encrypted credentials are encrypted using the public key of the requesting management node (102a, 602a) and cannot be decrypted by the management server (104, 704); sending (124, 206, 406) the encrypted credentials to the requesting management node when the management server (104, 704) has the encrypted credentials, wherein the requesting management node (102a, 602a), after receiving the encrypted credentials, can decrypt the encrypted credentials using a private key of the requesting management node; and when the management server (104, 704) does not have the encrypted credentials: sending (126, 408) a multicast request to one or more peer management nodes from the plurality of management nodes on the network, the multicast request including the public key of the requesting management node; receiving (130, 410) a unicast response from a responding management node from the one or more peer management nodes, the unicast response including the encrypted credentials encrypted for the requesting management node; and sending the encrypted credentials received from the responding management node to the requesting management node. sending (126, 408) a multicast request to one or more peer management nodes from the plurality of management nodes on the network, the multicast request including the public key of the requesting management node; receiving (130, 410) a unicast response from a responding management node from the one or more peer management nodes, the unicast response including the encrypted credentials encrypted for the requesting management node; and sending the encrypted credentials received from the responding management node to the requesting management node.