This article is based on commentary originally published on cbronline.com, authored by Tim Callan, Senior Fellow at Sectigo.
Why PKI Matters in Modern DevOps
DevOps has moved decisively from a countercultural engineering practice into enterprise mainstream. Speed, automation, and continuous delivery are now central to how organisations build and ship software. Alongside that shift, microservice architecture and containerisation have become the dominant patterns for deploying applications at scale.
That architectural evolution brings a specific security challenge: when every container is its own independent entity, every container also needs a verifiable identity. Without strong identity controls, a DevOps environment is exposed to data theft, service impersonation, and supply-chain attacks. Public Key Infrastructure (PKI) is the foundational technology that addresses this problem.
Container Identity and Mutual TLS Authentication
In a containerised workload, individual services communicate with each other constantly — often across network boundaries. Without authentication, a malicious container or a compromised service could inject itself into that communication, either to intercept data or to impersonate a legitimate workload.
Mutual TLS (mTLS) authentication solves this by requiring both sides of any connection to present a valid TLS certificate issued by a trusted Certificate Authority (CA). Key considerations for implementing mTLS in containers include:
- Certificate issuance per container: Each container or pod should have its own certificate, not a shared credential, so that revocation of a single compromised container does not affect the rest of the fleet.
- Short-lived certificates: Automating short certificate lifetimes reduces the window of exposure if a private key is leaked.
- Automated rotation: Certificate rotation should be handled programmatically — tools such as cert-manager (for Kubernetes) or HashiCorp Vault’s PKI secrets engine are commonly used for this.
- Trust hierarchy: Establish a clear internal CA hierarchy (root CA → intermediate CA → end-entity certificates) so that trust can be scoped and revoked at the appropriate level.
Code Signing in the DevOps Pipeline
Beyond container-to-container authentication, the integrity of the code itself must be verifiable. Code signing certificates allow a development team or a CI/CD pipeline to cryptographically sign artifacts — binaries, container images, scripts, or packages — before they are deployed.
A valid code signature provides two guarantees:
- Origin verification: The artifact was produced by the entity that holds the signing key, confirming that it came from a trusted source (your pipeline, not an attacker).
- Integrity: The artifact has not been modified since it was signed. Any tampering invalidates the signature.
In a DevOps context, code signing should be integrated directly into the CI/CD pipeline so that unsigned artifacts are automatically rejected by deployment gates. Signing keys themselves should be protected using hardware security modules (HSMs) or a secrets management platform, and access to those keys should be strictly limited.
The Challenge: DevOps Teams Are Not PKI Specialists
One of the practical tensions in securing DevOps environments is that the teams responsible for containers and pipelines typically come from a software development background, not an IT security or cryptography background. DevOps engineers are often distributed across business units, embedded in product teams, and focused on velocity. Certificate management is rarely anyone’s primary job.
When DevOps teams are expected to own PKI projects without adequate preparation, common failure modes include:
- Choosing weak key sizes or deprecated encryption algorithms (e.g., RSA-1024, SHA-1).
- Setting excessively long certificate lifetimes that delay revocation of compromised credentials.
- Building “DIY PKI” with private CAs that lack audit trails, revocation mechanisms, or compliance controls.
- Failing to inventory certificates, leading to unexpected expiry outages.
- Storing private keys insecurely in source control or environment variables.
Private PKI solutions can scale to enterprise certificate volumes, but they require deliberate configuration and ongoing governance. A self-managed CA that is not properly secured can itself become an attack vector.
Practical Recommendations for Secure DevOps PKI
Organisations looking to improve PKI posture in their DevOps environments should consider the following steps:
1. Automate Certificate Lifecycle Management
Manual certificate processes do not scale in environments where hundreds or thousands of containers may be created and destroyed daily. Adopt tooling that integrates with your orchestration layer (e.g., Kubernetes, Nomad) to handle certificate issuance, renewal, and revocation automatically.
2. Enforce Policy at the CA Level
Use your CA configuration to enforce minimum key sizes, approved algorithms, and maximum certificate lifetimes. This removes the burden of remembering PKI best practices from individual developers and enforces consistency across the fleet.
3. Maintain a Certificate Inventory
Know what certificates exist, where they are deployed, and when they expire. Certificate discovery tools or a centralised certificate management platform can provide this visibility. Unexpected expirations are one of the most common — and avoidable — causes of production outages.
4. Engage PKI Expertise Early
Whether through an internal security team, a managed PKI provider, or an external consultant, bringing cryptographic expertise into the architecture and design phase is far less costly than remediating a poorly structured PKI after the fact. A knowledgeable partner can also monitor changes to PKI standards and regulatory requirements (such as CA/Browser Forum baseline requirements) and help your organisation stay current.
5. Protect Private Keys
The security of any PKI deployment is only as strong as the protection of its private keys. Use HSMs for CA keys, use secrets management platforms (such as HashiCorp Vault or AWS Secrets Manager) for workload keys, and rotate keys regularly. Audit access to key material and alert on anomalous access patterns.
Summary
PKI is not optional in a containerised, distributed DevOps environment — it is the mechanism that allows services to trust each other and that allows deployed code to be verified as authentic. The challenge for most organisations is not understanding why PKI matters, but building the processes and automation to manage it correctly at scale without requiring every developer to become a cryptography expert. Automating certificate lifecycle management, enforcing policy through CA configuration, maintaining visibility into your certificate inventory, and partnering with domain experts are the practical steps that move PKI from a liability into a genuine security control.