Venafi Platform 20.4: What’s New
The Venafi Trust Protection Platform version 20.4 includes many new and enhanced capabilities, including several that deepen integration of the Venafi Platform and products into public cloud environments. For example, you can now use Google Cloud SQL for the Venafi Platform database and customers who want to securely operate the Venafi Platform in AWS, can use native AWS authentication methods.
Highlights from the Venafi 20.4 release are listed below. More details are available in the technical release notes and upgrade considerations article online.
On-Demand Webinar Now Available
An on-demand webinar is available that highlights many of the updates in the 20.3 and 20.4 releases. You can access the recording here.
Trust Protection Platform Updates
1. Google Cloud SQL Support
What Problem Does It Solve?
Before the 20.4 release, Venafi customers did not have the option to use Google Cloud SQL for the Trust Protection Platform database.
How Does it Work?
When hosting the Venafi Platform in the Google Cloud, using Cloud SQL is now an available database option.
What’s the Benefit?
Flexibility – You now have more cloud-native options when deploying the Venafi Platform in cloud environments.
2. SAML Signing Certificate Monitoring
What Problem Does It Solve?
Customers that integrate the Venafi Platform with modern SSO solutions (using SAML 2.0 support introduced in the 20.3 release), want to ensure the SAML signing certificate doesn't expire which would block users from accessing the Platform.
How Does it Work?
The Venafi Platform automatically monitors your SAML signing certificate and will notify you before the certificate expires.
What’s the Benefit?
Availability – Eliminates Venafi Platform downtime caused by an expired SAML signing certificate.
3. Okta Configuration
What Problem Does It Solve?
Venafi customers want to integrate the Venafi Platform with their Okta SSO solution without having to manually configure a SAML Service Provider Metadata XML file.
How Does it Work?
Instead of manually parsing out configuration details from an XML file, customers now indicate in the Venafi Platform UI that they are using Okta and follow screen instructions to configure the integration.
What’s the Benefit?
Manageability – Integration is faster, easier, and less error prone.
4. User Interface Enhancements
What Problem Does It Solve?
Accessibility of the Aperture interface should be a good experience for all types of users.
How Does it Work?
Venafi is continually working to improve the Trust Protection Platform interfaces, both for Section 508 support for U.S. federal government customers and for all customers in general. In 20.4, you might notice bigger font sizes and more color contrast in the Aperture interface, making it easier to read.
What’s the Benefit?
Ease-of-Use – The Aperture interface looks better and is easier to read.
Additional Trust Protection Platform Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new Venafi Platform features.
TLS Protect Updates
1. Google Cloud CA Service Integration – Beta Support
What Problem Does It Solve?
Maintaining a private PKI on-premises can be burdensome and may require special administrative expertise.
How Does it Work?
Since the 20.2 release, Google Cloud customers with early access to the Google Cloud CA Service could get private trust certificates issued by a private CA they control, hosted in the Google Cloud. In 20.4, the integration supports the beta stage of Google Cloud CA Service. The beta release also introduces support for Google Cloud regions as well as the ability to issue certificates off intermediate roots.
What’s the Benefit?
Increased Efficiency – Venafi customers using Google Cloud can save time and money setting up their private PKI infrastructure.
2. Authenticate Using IAM Assigned Roles in Amazon Web Services (AWS)
What Problem Does It Solve?
Customers want to securely operate the Venafi Platform in AWS, using native AWS authentication methods, and avoid having to store application access credentials in Venafi which is a security concern.
How Does it Work?
The 20.4 release introduces a new capability that allows a Venafi Platform installation running on a EC2 instance, with appropriate IAM role assigned, to authenticate against AWS.
What’s the Benefit?
Increased Security and Operational Simplicity – By using native AWS authentication methods, customers can take advantage of assigning IAM roles to EC2 instances, allowing them to authenticate and gain access to AWS resources according to the IAM role assigned. This allows them to comply with customer specific security policies such as not issuing static API keys that could be misused.
Additional TLS Protect Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new TLS Protect features.
SSH Protect
1. Discovery of SSH keys in OpenSSH native format
What Problem Does It Solve?
Administrators want to be able to discover SSH keys in different formats. Previously, supported formats were PEM/PKCS1, Tectia and PuTTY. There is a new OpenSSH native format which is now default for OpenSSH 7.8 and above. SSH Protect now enables system administrators to discover SSH keys in OpenSSH native format.
How Does it Work?
Recent versions of Linux and UNIX distributions use OpenSSH native format when generating SSH keys. SSH Protect is now capable of discovering SSH keys in OpenSSH format (in addition to PEM/PKCS1, Tectia and Putty) using agentless or Server Agent discovery.
What’s the Benefit?
Increased Visibility – Organizations will now have improved visibility over their SSH keys.
Additional SSH Protect Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new SSH Protect features.
CodeSign Protect
1. Migration of Code Signing Certificates Managed by Venafi TLS Protect
What Problem Does It Solve?
Customers may have existing code signing certificates and keys stored within TPP using TLS Protect. These are not visible and cannot be used by Venafi CodeSign Protect. Customers may want to save costs by reusing their existing certificates with CodeSign Protect.
How Does it Work?
Select the code signing certificates stored in TLS Protect and select the migration option to move them to CodeSign Protect.
What’s the Benefit?
Increased Automation and Security – Customers can now easily move code signing certificates and keys that were stored in TLS Protect to CodeSign Protect for quicker spin-up to using CodeSign Protect to ensure that they are more securely protected.
2. Improved HSM integrations
What Problem Does It Solve?
When customers rely on HSMs alone for managing their code signing private keys, they may create multiple partitions or use multiple HSMs to segment access to certain keys. This can result in many partitions created or HSM’s needed which adds management complexity and increases costs.
In addition, accessing HSMs can be slow which increases the time it takes to sign code using a private key stored within an HSM.
How Does it Work?
With CodeSign Protect, customers can use fewer HSM partitions to provide the same level of control access because that control is being handled by CodeSign Protect. In addition, CodeSign Protect is aware when a customer moves a key from one partition to another and automatically updates where that private key is stored.
What’s the Benefit?
Ease of Use & Reduced Costs – Managing HSMs, HSM partitions, and keys is complex and can be expensive to manage when multiple HSMs are needed to segment controlled access to keys. CodeSign Protect insulates the user who needs access to the private code signing key, from the complexities of where the keys are stored in HSMs or HSM partitions.
In addition, this release optimizes the initialization of HSM encryption system to vastly decrease the time it takes to access private keys.
3. Proxy Support for Code Signing Client
What Problem Does It Solve?
CodeSign Protect relies on a lightweight code signing client that resides where the signing operation takes place. This client needs to communicate with the CodeSign Protect server. In some cases, customers may have a firewall in place that makes this connection difficult or impossible.
How Does it Work?
A proxy sits between the code signing client and the CodeSign Protect server and allows clients, even behind firewalls, to communicate with the CodeSign Protect server.
What’s the Benefit?
Enhanced Security – enables centralized code signing services, even on machines that are signing on computers behind a firewall.
Additional CodeSign Protect Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new CodeSign Protect features.
Ecosystem Partner Updates
While separate from the Venafi 20.4 release, several Venafi Ecosystem Partners have recently introduced products and updates that might complement your current use of the Venafi Platform and products.
These include:
- Anjuna Secure Enclaves
Anjuna has built an integration with Venafi to protect VCert certificate distribution with the hardware-grade secure memory and storage confines of an Anjuna Enterprise Enclave. This provides additional runtime and storage protection invulnerable to malicious software, IT insiders, and bad actors. Learn more
- Broadcom Layer7 and APIIDA API Manager
API gateways use large numbers of machine identities to establish trust and privacy. Now Venafi customers have two options to integrate API gateways with machine identity management with drivers for Broadcom Layer7 API Gateway and APIIDA API Gateway Manager. Learn more
- CA Auto-Approval Adaptable Workflow
This Venafi Warrior Community developed solution is a Trust Protection Platform Adaptable Workflow PowerShell script that simplifies the certificate request lifecycle by introducing logic for automatic approval based on CA template. Learn more
- HP JetAdvantage Security Manager
Now you can automate provisioning of certificates to HP printers or multifunction devices, further extending your single, enterprise-wide machine identity management program. Learn more
- Oracle HTTP Server Adaptable Driver
With Oracle HTTP Server managing the frontlines of application availability, human oversight could have a catastrophic impact on availability and promised SLA. This machine identity management solution automates typical lifecycle events for Oracle HTTP Server. Learn more
