Skip to main content

 

 

Venafi Platform 21.1: What’s New  

 
The Venafi Trust Protection Platform was updated to version 21.1 on April 7, 2021.  
 
If recent events have you looking at how you can better secure your software supply chain, the breach at SolarWinds and JetBrains announced in December 2020 should have you rethinking your strategy. This breach involved multiple security failures and occurred ‘left’, in the software build process. With more cloud native deployments and more reliance on DevOps, CI/CD pipelines, and build automation, securing machine identities for within the software development process is more important than ever. In the 21.1 release, Venafi introduces several features to help you secure your software supply chains.  
 
Highlights from the Venafi 21.1 release are listed below. More details are available in the technical release notes and upgrade considerations article online.  
 
Machine Identity Management Global Summit 2021 – Have You Registered?  
Join Venafi customers near, far and “virtually” at our Machine Identity Management Global Summit 2021 on May 10-12! This year’s Summit promises to best yet with 75 Sessions, 6 Keynotes and 3 full days of Machine Identity Management best practices, learnings and collaboration. Get expert advice for TLS, code-signing, SSH, multi-cloud, IoT, DevOps and more. Join the lively roundtables, technical talks and featured “how-to” sessions, and get CPE credits for your attendance on the live days. For a sneak peek of the Agenda and to register for free, click here.  

 

Trust Protection Platform Updates  

 
1.    Adaptable Credentials 

 
What Problem Does It Solve?  
Customers want Venafi to integrate with the enterprise solution they use to store and manage all the passwords/secrets they maintain for the many systems and devices that need privileged access. Integration with these privileged access management solutions eliminates the need to manually setup and maintain credentials into the Venafi Platform, which is time consuming, error prone and inefficient.  
 
How Does it Work?  
Venafi builds and delivers software drivers designed to connect with many of the most common certificate authorities (CAs), application servers, enterprise monitoring systems for notification use cases and a driver to connect with the popular privileged access provider, CyberArk. But if the Venafi Driver Library does not include the driver you need, you can use a Venafi Adaptable Driver. In addition, because they are customizable, you can use an Adaptable driver in place of an existing driver to provide tighter integration between your business processes and Trust Protection Platform. In this case, the new Adaptable Credentials driver lets you integrate or customize the integration of the Trust Protection Platform with third-party credential management systems.  
 
What’s the Benefit?  
Security and Automation – Customers can now have the Trust Protection Platform automatically pull credentials from their existing privileged access management solution instead of manually entering them into the platform. In addition, when credentials are rotated in the privileged access management solution, there is no need to update the Trust Protection Platform with the newer version of the credential.  

 
2.    Adaptable Integration with HashiCorp Vault  

 
What Problem Does It Solve?  
Venafi customers leveraging HashiCorp Vault for storing secrets need products like TLS Protect to have access to those secrets.  
 
How Does it Work?  
This integration uses the new Adaptable Credentials driver to connect the Trust Protection Platform with HashiCorp Vault. The HashiCorp Vault script is available in the Venafi Marketplace https://marketplace.venafi.com/  
 
What’s the Benefit?  
Efficiency through Automation – In addition to enabling the Trust Protection Platform to automatically pull credentials from HashiCorp Vault, this integration offers a useful guide for customers wanting to use Adaptable Credentials with other credential management solutions.  

 
3.    Inline Placement of Keys and Certificates During Discovery  

 
What Problem Does It Solve?  
Venafi customers that are discovering large numbers of keys and certificates and then using placement rules to organize them in folders might find performance affected by other jobs running on the Venafi Platform.  
 
How Does it Work?  
Certificate and SSH key placement now happens inline, with minimal latency, immediately after being discovered. In addition, the certificate reconciliation algorithm is improved so that it places less load on the CPU and database, allowing discovery and placement of keys and certificates to be completed in less time.  
 
What’s the Benefit?  
Performance – Discovery and placement of keys and certificates is faster, more predictable, and more efficient.  

4.    Session Management Control 

What Problem Does It Solve?  
Customers want the flexibility to change the default timeout value of their Venafi session and warning when the session is about to timeout. The warning is also a requirement for customers who need to use solutions that are accessible and section 508 compliant.  
 
How Does it Work?  
With the 21.1 release, Venafi customers can now change the default session time out value and maintain that value as they upgrade to future releases (in previous releases, the timeout value would reset to the default each release). In addition, users now get a warning when the session is going to expire and are given the ability to extend the session.  
 
What’s the Benefit?  
Usability – Users won’t unexpectedly be logged out of the Venafi Platform.  

Additional Trust Protection Platform Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new Venafi Platform features.  

 

CodeSign Protect  

 
1.    Time Stamping Enforcement  

 
What Problem Does It Solve?  
Time-stamped code signing signatures are imperative to ensure that code-signed applications continue to run even if the code signing certificate has expired. While it is relatively easy to specify this option within the code signing tool being used, many people forget to do that. The result is that important production software will stop working in the future, when the code signing certificate expires.  
 
How Does it Work?  
Previous releases of CodeSign Protect product provided support for time stamping services such as a standalone time stamp server or a proxy to a public timestamping service. However, there was no way for a code signing administrator to require that developers include options such as time stamping. In this release, a code signing administrator can now configure an environment template that will require timestamping options be used when signing code.  
 
What’s the Benefit?  
Automation & Security – Through process automation, time stamping can be configured to be required and automatically enforced. The benefit if you opt to require this is that developers will be forced to timestamp their applications when they code sign them.  

 

2.    Application Container Signing  

 
What Problem Does It Solve?  
Application containers, such as Kubernetes or Docker images, are pieces of code that execute. As with any piece of code, it is important to digitally sign (code sign) to show the authenticity of the author and demonstrate that they have not been modified after they were signed. Tools such as podmap and skopeo offer signing capabilities but they do not provide private key protection, auditing of signing operations, automation of enforcement of signing workflows, or visibility into what has been signed and by whom.  
 
How Does it Work?  
Venafi CodeSign Protect integrates with mainstream container signing tools such as podman and skopeo.  
 
What’s the Benefit?  
Automation & Security – Without needing to modify build scripts, users can continue to use tools like podman & skopeo to continue signing their containers while CodeSign Protect automatically enforces any workflow requirements, audits the process, and at the same time protects the private keys that are needed for these signing operations.  

 

3.    High Assurance Signing – Pre-qualified Signatures  

 
What Problem Does It Solve?  
Today, customers may use vulnerability scanning tools to ensure that they software that they use is safe for their users to use. However, after running these scans, if the software is not digitally signed, then it is impossible for others to know if the software hasn’t been modified (such as malware insertion) after it was scanned for vulnerabilities.  
 
How Does it Work?  
Venafi CodeSign Protect now provides APIs that allow users, after they have scanned their software (or other artifact), to generate a hash of the software/artifacts, and then store these approved/known hashes into Venafi CodeSign Protect prior to signing. When CodeSign Protect is called to sign these applications, it will verify that the hash of the application matches the approved and stored hash value. If it doesn’t, it will not sign the application/artifact.  
 
What’s the Benefit?  
Security – For organizations wishing to secure their software supply chain, this feature provides high assurance by signing only applications that have been previously scanned.  

 

4.    Sensitive Configuration Control (M-of-N)  

 
What Problem Does It Solve?  
Certain sensitive operations (such as a deletion of a private code signing key) should require multiple approvals to ensure that the operation is not accidentally performed, or perhaps performed with ill intentions in mind.  
 
How Does it Work?  
Venafi CodeSign Protect now enables a configurable option that requires multiple approvers for performing certain code signing operations or project activities (such as deleting a key or project).  
 
What’s the Benefit?  
Security – Protects against intentional and incidental actions when deleting keys and projects.  

 

5.    Benchmark Tool  

 
What Problem Does It Solve?  
Administrators of Venafi CodeSign Protect sometimes need the ability to benchmark capacity and performance requirements for their code signing stakeholders. Without a benchmarking tool, this is difficult to achieve.  
 
How Does it Work?  
Venafi CodeSign Protect introduces the capability for customers to be able to measure latency and performance of all necessary code signing operations.  
 
What’s the Benefit?  
Performance – This benchmarking capability enables customers to perform better capacity planning, performance tuning, and increase their confidence in their deployment configurations.  

Additional CodeSign Protect Capabilities – See the technical release notes and upgrade considerations article for more detail on these capabilities as well as other new Venafi Platform.  

 

Ecosystem Partner Updates  

 
While separate from the Venafi 21.1 release, several Venafi Ecosystem Partners have recently introduced products and updates that might complement your current use of the Venafi Platform and products.  
 
These include:  
 
Citrix ADM  


Citrix and Venafi now offer an out-of-the-box, tightly integrated solution that enables Citrix ADM to fully automate requests and renewals of keys and certificates from TPP, securing machine identities across ADCs and prevent certificate-related downtime and outages. Learn more  
 
F5 Silverline  


HTTPS encryption is more prevalent than ever but can be difficult to scale. F5 Silverline and Venafi have teamed up to make it easy to automate the use of enterprise-compliant machine identities for application teams. Learn more  
 
Gigamon GigaVue-OS

  
This Gigamon/Venafi integration provides intelligent orchestration and management of machine identities for Gigamon appliance web management interfaces. Learn more  
 
Connector for Venafi & Jira Service Management (JSM)  


Available on the Atlassian Marketplace, the Connector for Venafi & JSM is an out-of-the-box integration that automates Venafi and Jira workflows to give your teams a self-service certificate management tool that ensures your machine identities stay secured. Learn more  

 

get-started-overlay close-overlay cross icon
get-started-overlay close-overlay cross icon
Venafi Risk assessment Form Image

Sign up for Venafi Cloud


Venafi Cloud manages and protects certificates



* Please fill in this field Please enter valid email address
* Please fill in this field Password must be
At least 8 characters long
At least one digit
At last one lowercase letter
At least one uppercase letter
At least one special character
(@%+^!#$?:,(){}[]~`-_)
* Please fill in this field
* Please fill in this field
* Please fill in this field
*

End User License Agreement needs to be viewed and accepted



Already have an account? Login Here

×
get-started-overlay close-overlay cross icon

How can we help you?

Thank you!

Venafi will reach out to you within 24 hours. If you need an immediate answer please use our chat to get a live person.

In the meantime, please explore more of our solutions

Explore Solutions

learn more

Email Us a Question

learn more

Chat With Us

learn more