Machine identity and certificate management

Inventory, issue and renew certificates and keys automatically, and prepare cryptography for change.

Talk to an ExpertBrowse products

The problem

“We need to stop certificate outages and know which keys and certificates we run.”

Certificates expire on dates nobody tracks. A missed renewal takes down a payment page, an API or an internal service, usually outside working hours.

Machines, services and applications now outnumber people. Their certificates and keys are rarely inventoried, so weak algorithms and orphaned certificates stay in place.

Proposed approach

  1. Step 1

    Discover every certificate and key

    Scan networks, cloud accounts and certificate authorities to build one inventory with owners and expiry dates. You cannot automate what you cannot see.

  2. Step 2

    Automate issuance and renewal

    Connect applications, load balancers and cloud services to a managed certificate authority so certificates renew without tickets or spreadsheets.

  3. Step 3

    Set cryptographic policy

    Define approved algorithms, key sizes and lifetimes, and report on what does not comply. This also prepares the estate for future changes such as shorter lifetimes and post-quantum algorithms.

Implementation considerations

  • Existing certificate authorities, internal and public
  • Systems that must receive certificates automatically (web, containers, devices)
  • Ownership of certificates before automated renewal is switched on
  • Where signing keys are stored, including hardware security modules

Expected operational benefits

  • Fewer outages caused by expired certificates
  • A current inventory of certificates and keys with owners
  • Evidence of cryptographic policy for audits

Products that address this

Products we work with for this requirement. Details are draft summaries pending vendor confirmation.

Other solutions