DOCSEARCHbyAlgolia
Submit Docs

Venafi Cloud Documentation

website·Indexed 33 days ago

https://docs.venafi.cloud

Documentation for Venafi Cloud services, including Zero Touch PKI, Next-Gen Trust Security (NGTS), Workload Identity Manager, and Code Sign Manager. Covers REST API integrations, cert-manager installation via Helm, VSatellite management using vsatctl, and enterprise Kubernetes components for certificate management and trust.

Tokens
428.1K
Snippets
1.4K
Records
3K
Agent score
63%

What's inside Venafi

  1. Overview of Workload Identity Manager Configurations

    Configurations in Workload Identity Manager act as the glue that links runtime settings required for issuing certificates. A configuration groups together three primary components:

    1. Sub CA Provider: Provides the template and issues the Workload Identity Manager's own CA certificate upon startup.
    2. Policies: Determine which certificates WIM can issue to clients and which policies clients are authorized to request.
    3. Client Configuration: Defines which clients can interact with WIM instances, including connection methods, authentication, and authorization details (e.g., OIDC, JWKS, or Cloud Instance Metadata).

  2. Overview of the Code Sign Client

    The Code Sign Client connects organizational signing workstations to the CyberArk Code Sign Manager service. It allows users to authenticate via a user API key or a service account to list available keys and certificates and perform signing operations.

  3. Overview of CSI Driver for SPIFFE

    The CSI Driver for SPIFFE (Secure Production Identity Framework for Everyone) is a Container Storage Interface (CSI) driver plugin for Kubernetes. It works alongside cert-manager to transparently deliver SPIFFE SVIDs (SPIFFE Verifiable Identity Documents) as X.509 certificate key pairs to mounting Kubernetes Pods. This allows Pods to securely request a SPIFFE identity document from a Trust Domain with minimal configuration.

  4. Overview of CyberArk Workload Identity Manager

    CyberArk Workload Identity Manager (formerly known as Firefly) is a high-performance, lightweight micro-service designed for the rapid issuance of X.509 machine identities. It is intended for use in globally distributed application architectures that require high-speed, high-volume certificate issuance while maintaining enterprise trust and policy enforcement. The service operates with no dependencies, making it suitable for fast-paced development environments.

  5. Overview of Istio CSR metrics

    Istio CSR exports metrics in the Prometheus text-based format. It provides Go runtime metrics, Process metrics, controller-runtime metrics, and bespoke metrics related to CertificateRequest resources. By default, the HTTP metrics server listens on TCP port 9402 on all interfaces.

  6. Overview of VSatellite and Microsoft AD CS Integration

    VSatellite integrates directly with Microsoft Active Directory Certificate Services (AD CS), eliminating the need for a separate VSatellite Worker. This streamlined architecture simplifies deployment and management while supporting VSatellite High Availability (HA) configurations.

  7. Overview of Venafi Certificate Manager - SaaS integrations

    Venafi Certificate Manager - SaaS provides deep integrations across five primary categories to automate certificate lifecycles and secure digital identities:

    • Authentication and Identity Providers: Centralizes access and user identity management (e.g., CyberArk).
    • Certificate Authorities (CAs): Automates issuance from Public CAs (DigiCert, Entrust, GlobalSign, Let's Encrypt), Private CAs (Zero Touch PKI, Microsoft AD CS), and Custom CAs via the CA Connector Framework.
    • Cloud Providers: Securely stores and provisions certificates in AWS, Azure, and Google Cloud.
    • Machines: Connects directly to application endpoints (load balancers, web servers, databases) to manage keystores and automate provisioning.
    • Notifications: Sends real-time alerts via collaboration tools (PagerDuty, Zoom Team Chat) or custom webhooks.

  8. Overview of FIPS compliance for Palo Alto Networks Kubernetes components

    Palo Alto Networks provides FIPS-compliant versions of its Kubernetes components. Modern FIPS builds utilize the Go Cryptographic Module (Certificate #5247, FIPS 140-3, Level 1), which is embedded directly into the binary. This means compliance is independent of the host, base image, or external libraries like OpenSSL. Earlier builds relied on a Microsoft fork of Go linking to OpenSSL (Certificate #4642, FIPS 140-2), which required a Red Hat UBI base image in FIPS mode.

  9. Overview of Certificate Revocation Workflows

    Certificate Revocation Workflows provide a structured, rule-based approach to validating certificate revocation requests. Key features include:

    • Rule-based evaluation: Rules are applied to specific CA accounts and evaluated sequentially based on priority (manageable via drag-and-drop).
    • Approval Types: Supports 'All' (all approvers must approve) and 'At Least' (a minimum number of approvers must approve) conditions, with an optional 'Final Approver' step.
    • Exceptions: Rules can be overridden based on specific applications or requestors. Processing can either stop upon an exception (automatic approval) or continue to subsequent rules.
    • Auto-Rejection: Requests not acted upon within a specified timeframe (default is 3 calendar days, including weekends) are automatically rejected.
    • Notifications: Automated emails are sent to requestors and approvers throughout the process.

  10. Overview of the OpenSSL CA Connector

    The OpenSSL CA connector allows CyberArk Certificate Manager - SaaS to automate the issuance, renewal, and revocation of certificates from an existing OpenSSL-based CA. The process works by connecting to the OpenSSL host via SSH through a VSatellite, transferring a CSR to a staging directory, executing the OpenSSL CLI using a specific configuration section, and retrieving the signed certificate. Crucially, the CA private key remains on the OpenSSL host and never leaves the server.

  11. Overview of creating custom CA connectors in Certificate Manager - SaaS

    Certificate Manager - SaaS allows the creation of connections to certificate authorities not natively supported by the platform. Custom CA connectors enable users to issue certificates, manually import certificates on demand, and schedule automatic imports. Connectors are developed using the Venafi CA Connector Framework.

  12. Overview of Enterprise Approver Policy for CyberArk Certificate Manager

    The Enterprise Approver Policy replaces the default cert-manager 'approve-all' policy. It allows administrators to define specific rules that a CertificateRequest must satisfy to be approved. If a request fails to conform to any applicable policy, it is set to Denied. If it conforms to all matching policies, it is set to Approved. If no policies match the request, no condition is set, allowing other approvers to process the request.