Source: helpnetsecurity.com
Overview: Why This Partnership Matters for DevOps
Venafi, a provider of machine identity protection, and GMO GlobalSign, a global Certificate Authority (CA) and identity security vendor, announced an expanded technology partnership and integration aimed squarely at the certificate management pain points that DevOps teams face daily. The integration connects Venafi Cloud with GlobalSign’s high-performance PKI solutions, enabling enterprises to issue, manage, and revoke trusted TLS certificates at scale across hybrid infrastructure, multiple clouds, and containerized environments.
The Problem: Certificate Chaos in DevOps Environments
As organizations adopt DevOps practices, the number of machine identities—cryptographic keys and certificates used by services, containers, APIs, and devices—grows rapidly. Without centralized oversight, individual developers and teams tend to handle certificate procurement on their own, which leads to several compounding problems:
- Unauthorized CAs: Developers obtain certificates from CAs that haven’t been approved by the security team, bypassing policy controls.
- Self-signed and wildcard certificates: Teams reach for convenience over security, introducing weak credentials into production systems.
- Manual lifecycle management: Certificates expire unexpectedly, causing outages that are entirely avoidable with automation.
- Expanded attack surface: Errors and vulnerabilities introduced through ad hoc certificate practices accumulate in production, increasing organizational risk.
The result is an environment where security teams lack visibility and DevOps teams lack guardrails—a combination that creates both compliance gaps and operational fragility.
What the Venafi Cloud and GlobalSign Integration Provides
The combined solution embeds trusted certificate issuance directly into the tools and workflows developers already use, while giving security teams the policy enforcement and visibility they need. Key components include:
Out-of-the-Box Tool Integrations
Venafi Cloud ships with pre-built integrations for widely adopted DevOps toolchains, including:
- HashiCorp Terraform and HashiCorp Vault
- SaltStack and Ansible
- Docker
- Jetstack cert-manager (for Kubernetes environments)
These integrations allow certificates to be provisioned and renewed automatically as part of existing pipelines, without requiring developers to interact with PKI infrastructure directly.
Standard Interfaces and APIs
For teams that need custom integration, the solution exposes well-documented standard interfaces:
- REST API for programmatic certificate management
- VCert SDK (open source, available in Go and Python) for embedding certificate operations into custom tooling
- ACME protocol support for automated certificate issuance compatible with existing ACME clients
Eliminating In-House PKI Overhead
By using GlobalSign’s cloud-based PKI services, organizations avoid the cost and complexity of building and operating their own CA infrastructure. This includes ancillary services such as Online Certificate Status Protocol (OCSP) responders and Certificate Revocation Lists (CRL), which are required for a functioning PKI but are often underinvested in when managed in-house.
Key Benefits of the Integration
- High-speed issuance: Supports DevOps use cases requiring ultra-fast certificate delivery, with certificates issued in seconds.
- CI/CD pipeline integration: Policy-enforced certificate issuance can be embedded directly into continuous integration and delivery pipelines, with appropriate policies applied per environment.
- Outage prevention: Automated certificate lifecycle management eliminates the manual renewal errors that cause unplanned downtime.
- Improved security posture: Infrastructure is secured as it is provisioned, enabling consistent end-to-end HTTPS across environments.
- Regulatory compliance: The solution is designed to support compliance with PCI DSS, NIST guidelines, HIPAA, and other audit frameworks by enforcing standardized certificate policies.
- Unified visibility: Security teams gain complete visibility into which certificates are in use, where they were issued, and whether they comply with enterprise policy—without slowing down development teams.
What Industry Stakeholders Said
Kevin Bocek, Vice President of Security Strategy and Threat Intelligence at Venafi, described the integration as addressing a long-standing gap: “Venafi Cloud eliminates the machine identity risks that have plagued DevOps, hybrid and multi-cloud environments. DevOps teams get the fastest, easiest way to automate TLS certificates whether they’re using ready-to-use integrations or powerful APIs. And security teams are happy knowing trusted certificates are being used correctly because they have complete visibility.”
Nisarg Desai, Director of Product Management for IoT and DevOps at GlobalSign, emphasized the compliance angle: “By combining GlobalSign’s highly scalable PKI for DevOps solution with Venafi Cloud certificate policy management and enforcement, organizations are now able to improve security, boost productivity and comply with regulatory frameworks—such as PCI DSS, NIST, and HIPAA—with just a few lines of code.”
Practical Takeaways for DevOps and Security Teams
If your organization is running workloads across hybrid or multi-cloud infrastructure and certificate management is handled inconsistently across teams, this kind of integrated solution addresses real operational and security gaps. Specifically:
- If you are already using HashiCorp Vault or cert-manager for secrets and certificate management in Kubernetes, a Venafi Cloud integration can add policy enforcement and CA-level trust without replacing existing tooling.
- If your security team struggles with certificate visibility—not knowing what certificates exist, who issued them, or when they expire—centralized machine identity management is the appropriate solution category to evaluate.
- If building and maintaining an internal CA is consuming engineering resources without providing commensurate control, offloading to a managed PKI service like GlobalSign’s reduces operational overhead while improving auditability.
The ACME protocol support is particularly relevant for teams already familiar with Let’s Encrypt workflows, as it allows existing automation to be redirected toward an enterprise-grade CA with policy controls attached.