Sectigo Extends Certificate Manager with Five DevOps Integrations

Sectigo (formerly Comodo CA) has announced five new integrations for its Sectigo Certificate Manager platform, targeting the tools most commonly found in enterprise DevOps pipelines: Docker, Kubernetes, Ansible, Terraform, and HashiCorp Vault. The move is designed to give IT and security teams a unified Public Key Infrastructure (PKI) solution that fits naturally into modern infrastructure-as-code and container orchestration workflows.

What Is Sectigo Certificate Manager?

Sectigo Certificate Manager is a cloud-based certificate lifecycle management platform that enables enterprises to issue, renew, revoke, and audit public certificates, private certificates, and IoT device certificates from a single pane of glass. Key capabilities include:

• Centralized management of public, private, and IoT certificates
• Risk reduction through automated certificate renewal and expiry tracking
• Faster threat response via real-time visibility into certificate status
• Compliance and auditability support across the certificate inventory
• Reduced operational overhead through automation hooks

Why These Five Integrations Matter for DevOps

Docker, Kubernetes, Ansible, Terraform, and HashiCorp Vault collectively represent a large share of the tooling used to build, deploy, and configure modern enterprise infrastructure. Each plays a distinct role where certificate management is increasingly critical:

• Docker — Container images and registries require TLS certificates to secure image pulls, inter-service communication, and registry authentication.
• Kubernetes — Cluster components (API server, etcd, kubelets) and service meshes rely heavily on mutual TLS (mTLS); certificate rotation at scale is a common operational pain point.
• Ansible — Playbooks that provision or configure systems can now call Sectigo directly to issue and deploy certificates as part of an automated run, eliminating manual steps.
• Terraform — Infrastructure-as-code workflows can embed certificate provisioning alongside resource creation, ensuring certificates exist before services go live.
• HashiCorp Vault — Vault is widely used as a secrets backend; integrating Sectigo allows Vault-issued certificates to be backed by a trusted public or private CA without operating a standalone PKI.

The PKI Challenge in DevOps Environments

DevOps environments are inherently complex. Microservices, ephemeral containers, and dynamic infrastructure mean that the number of certificates an organization must track can grow rapidly, and short-lived certificates may need to be issued and rotated on timescales measured in hours rather than years. This creates two overlapping problems:

• Scale — Hundreds or thousands of certificates may be active at any moment across clusters and services.
• Expertise — Engineering teams that excel at container orchestration are not always PKI specialists, yet they are expected to deploy and maintain a functioning CA hierarchy.

Lindsay Kent, VP of Product Management at Sectigo, addressed this directly in the announcement:

“All sizeable enterprises either use or are implementing DevOps today. As they do so, these enterprises are also finding that they suddenly need to become PKI experts and must roll out their own PKI to ensure identity for containers and related services.”

Lindsay Kent, VP of Product Management, Sectigo

Visibility, Control, and Flexibility

A key design goal of the integrations is to give operations teams granular control over certificate properties—such as validity period, key algorithm, subject alternative names, and issuing CA—without requiring them to leave their existing toolchain. Kent elaborated:

“These integrations between Sectigo Certificate Manager and the most popular DevOps orchestration tools give operations teams full visibility and control over the certificate properties they choose. An expert partner, like Sectigo, can ensure enterprises follow accepted security practices and can keep implementations current with changes in cryptography needed to stay safe in a changing computing environment.”

Lindsay Kent, VP of Product Management, Sectigo

Importantly, Sectigo Certificate Manager is designed to coexist with existing tooling. Enterprises that already use a different PKI solution or prefer to continue issuing certificates through their current DevOps tool can still connect Sectigo Certificate Manager in a monitoring and reporting capacity, gaining visibility into certificate deployments without replacing their existing workflows.

Practical Takeaways for DevOps and Security Teams

• If your organization runs Kubernetes at scale, evaluate whether certificate rotation for cluster components is automated—manual rotation is a common source of outages.
• Terraform and Ansible users can explore whether certificate issuance can be embedded directly into provisioning pipelines to enforce a “certificate before service” policy.
• Teams already using HashiCorp Vault for secrets management can assess whether integrating a managed CA (rather than a self-signed root) satisfies compliance requirements for certificate trust chains.
• Even if a full migration to Sectigo Certificate Manager is not planned, the monitoring-only mode can be a low-risk first step to gain inventory visibility across certificate sprawl.

As DevOps adoption grows, so does the attack surface associated with unmanaged or expired certificates. Integrations like these reflect a broader industry shift toward treating certificate lifecycle management as a first-class concern in CI/CD and infrastructure pipelines rather than an afterthought.

Overview: Why This Partnership Matters for DevOps

Venafi, a provider of machine identity protection, and GMO GlobalSign, a global Certificate Authority (CA) and identity security vendor, announced an expanded technology partnership and integration aimed squarely at the certificate management pain points that DevOps teams face daily. The integration connects Venafi Cloud with GlobalSign’s high-performance PKI solutions, enabling enterprises to issue, manage, and revoke trusted TLS certificates at scale across hybrid infrastructure, multiple clouds, and containerized environments.

The Problem: Certificate Chaos in DevOps Environments

As organizations adopt DevOps practices, the number of machine identities—cryptographic keys and certificates used by services, containers, APIs, and devices—grows rapidly. Without centralized oversight, individual developers and teams tend to handle certificate procurement on their own, which leads to several compounding problems:

• Unauthorized CAs: Developers obtain certificates from CAs that haven’t been approved by the security team, bypassing policy controls.
• Self-signed and wildcard certificates: Teams reach for convenience over security, introducing weak credentials into production systems.
• Manual lifecycle management: Certificates expire unexpectedly, causing outages that are entirely avoidable with automation.
• Expanded attack surface: Errors and vulnerabilities introduced through ad hoc certificate practices accumulate in production, increasing organizational risk.

The result is an environment where security teams lack visibility and DevOps teams lack guardrails—a combination that creates both compliance gaps and operational fragility.

What the Venafi Cloud and GlobalSign Integration Provides

The combined solution embeds trusted certificate issuance directly into the tools and workflows developers already use, while giving security teams the policy enforcement and visibility they need. Key components include:

Out-of-the-Box Tool Integrations

Venafi Cloud ships with pre-built integrations for widely adopted DevOps toolchains, including:

• HashiCorp Terraform and HashiCorp Vault
• SaltStack and Ansible
• Docker
• Jetstack cert-manager (for Kubernetes environments)

These integrations allow certificates to be provisioned and renewed automatically as part of existing pipelines, without requiring developers to interact with PKI infrastructure directly.

Standard Interfaces and APIs

For teams that need custom integration, the solution exposes well-documented standard interfaces:

• REST API for programmatic certificate management
• VCert SDK (open source, available in Go and Python) for embedding certificate operations into custom tooling
• ACME protocol support for automated certificate issuance compatible with existing ACME clients

Eliminating In-House PKI Overhead

By using GlobalSign’s cloud-based PKI services, organizations avoid the cost and complexity of building and operating their own CA infrastructure. This includes ancillary services such as Online Certificate Status Protocol (OCSP) responders and Certificate Revocation Lists (CRL), which are required for a functioning PKI but are often underinvested in when managed in-house.

Key Benefits of the Integration

• High-speed issuance: Supports DevOps use cases requiring ultra-fast certificate delivery, with certificates issued in seconds.
• CI/CD pipeline integration: Policy-enforced certificate issuance can be embedded directly into continuous integration and delivery pipelines, with appropriate policies applied per environment.
• Outage prevention: Automated certificate lifecycle management eliminates the manual renewal errors that cause unplanned downtime.
• Improved security posture: Infrastructure is secured as it is provisioned, enabling consistent end-to-end HTTPS across environments.
• Regulatory compliance: The solution is designed to support compliance with PCI DSS, NIST guidelines, HIPAA, and other audit frameworks by enforcing standardized certificate policies.
• Unified visibility: Security teams gain complete visibility into which certificates are in use, where they were issued, and whether they comply with enterprise policy—without slowing down development teams.

What Industry Stakeholders Said

Kevin Bocek, Vice President of Security Strategy and Threat Intelligence at Venafi, described the integration as addressing a long-standing gap: “Venafi Cloud eliminates the machine identity risks that have plagued DevOps, hybrid and multi-cloud environments. DevOps teams get the fastest, easiest way to automate TLS certificates whether they’re using ready-to-use integrations or powerful APIs. And security teams are happy knowing trusted certificates are being used correctly because they have complete visibility.”

Nisarg Desai, Director of Product Management for IoT and DevOps at GlobalSign, emphasized the compliance angle: “By combining GlobalSign’s highly scalable PKI for DevOps solution with Venafi Cloud certificate policy management and enforcement, organizations are now able to improve security, boost productivity and comply with regulatory frameworks—such as PCI DSS, NIST, and HIPAA—with just a few lines of code.”

Practical Takeaways for DevOps and Security Teams

If your organization is running workloads across hybrid or multi-cloud infrastructure and certificate management is handled inconsistently across teams, this kind of integrated solution addresses real operational and security gaps. Specifically:

• If you are already using HashiCorp Vault or cert-manager for secrets and certificate management in Kubernetes, a Venafi Cloud integration can add policy enforcement and CA-level trust without replacing existing tooling.
• If your security team struggles with certificate visibility—not knowing what certificates exist, who issued them, or when they expire—centralized machine identity management is the appropriate solution category to evaluate.
• If building and maintaining an internal CA is consuming engineering resources without providing commensurate control, offloading to a managed PKI service like GlobalSign’s reduces operational overhead while improving auditability.

The ACME protocol support is particularly relevant for teams already familiar with Let’s Encrypt workflows, as it allows existing automation to be redirected toward an enterprise-grade CA with policy controls attached.