Venafi

---
name: venafi
description: "Expert agent for Venafi / CyberArk Machine Identity Security. Covers TLS Protect (on-prem + cloud), CodeSign Protect, SSH Protect, certificate lifecycle management, machine identity policy, SPIFFE/SPIRE integration, and CyberArk acquisition context. WHEN: \"Venafi\", \"TLS Protect\", \"CodeSign Protect\", \"machine identity\", \"Venafi Trust Protection Platform\", \"Venafi Cloud\", \"Venafi Firefly\", \"certificate discovery\", \"MSSP\", \"certificate policy enforcement\"."
license: MIT
---

# Venafi / CyberArk Machine Identity Security

This skill covers Venafi machine identity management products, now part of CyberArk following the October 2024 acquisition. It has deep knowledge of TLS Protect, CodeSign Protect, SSH Protect, and the broader machine identity lifecycle.

> **Acquisition context**: CyberArk acquired Venafi in October 2024 for $1.54B. Venafi products continue under the CyberArk Machine Identity Security brand. Existing Venafi customers maintain their products; integration with CyberArk PAM is being deepened.

## How to Approach Tasks

1. **Identify the product**: TLS Protect (TPP or Cloud), CodeSign Protect, SSH Protect, Venafi Firefly, or the Venafi as a Service (VaaS) platform.
2. **Identify deployment model**: TLS Protect Platform (on-premises TPP), TLS Protect Cloud, or TLS Protect Datacenter.
3. **Classify the request**: Discovery, policy, issuance, renewal, revocation, integration, or reporting.

## Product Portfolio

### TLS Protect

Certificate lifecycle management for TLS/X.509 certificates.

**Deployment options**:
- **TLS Protect Platform (TPP)**: On-premises or IaaS; full control; suits regulated environments
- **TLS Protect Cloud**: SaaS; managed infrastructure; integrates with cloud-native tools
- **TLS Protect Datacenter**: For air-gapped / high-security environments

**Core capabilities**:
- **Discovery**: Continuously scan networks, cloud environments, code repositories for certificates
- **Inventory**: Single pane of glass for all certificates regardless of issuing CA
- **Policy**: Enforce key length, algorithm, validity period, issuing CA requirements
- **Automation**: Automate issuance, renewal, and provisioning to endpoints
- **Integration**: 300+ integrations (F5, A10, NetScaler, IIS, nginx, Apache, Kubernetes, Terraform, Ansible)

### CodeSign Protect

Manage code signing certificate lifecycle:
- Control who can sign code and with which certificates
- Enforce signing policies (no personal certificates for production signing)
- Audit all signing events
- HSM integration for key protection
- Integrates with build pipelines (Jenkins, GitHub Actions, Azure DevOps)

### SSH Protect

Manage SSH keys and certificates:
- Discover all SSH keys across infrastructure
- Identify unmanaged, orphaned, or overly permissive SSH keys
- Issue SSH certificates (short-lived via OpenSSH CA or step-ca integration)
- Enforce SSH access policies

### Venafi Firefly

Cloud-native, lightweight machine identity service:
- Designed for Kubernetes and service mesh environments
- Issues SPIFFE SVIDs (X.509 and JWT)
- SPIRE-compatible
- Extremely fast issuance (milliseconds) for short-lived workload identities
- Backed by Venafi policy engine

---

## TLS Protect Platform (TPP) Architecture

```
Venafi TPP
├── Venafi Platform Server (web UI + API)
├── Trust Protection Platform Database (SQL Server)
├── Policy Engine (certificate policies, CA connectors)
├── Discovery Engine (network scanner)
├── Certificate Authority Connectors
│   ├── Microsoft AD CS
│   ├── DigiCert
│   ├── Entrust
│   ├── Let's Encrypt (ACME)
│   ├── HashiCorp Vault PKI
│   └── ... (many more)
└── Adaptable CA / Adaptable App drivers (extensible)
```

### Policy Zones

Policy zones define rules for certificate issuance. Applications request certificates from a policy zone, which enforces:

```
Policy Zone: "Production-TLS"
  Allowed Key Types: RSA 2048+, ECDSA P-256+
  Max Validity: 90 days
  Issuing CA: DigiCert OV
  Allowed Domains: *.example.com, *.api.example.com
  Require Manual Approval: No
  Subject Policy:
    Organization: Must be "Example Corp"
    Country: Must be "US"
```

### Venafi API

```bash
# Authenticate (get API key)
curl -X POST https://tpp.example.com/vedauth/authorize \
    -H "Content-Type: application/json" \
    -d '{"Username":"svc-venafi","Password":"password"}'
# Returns: APIKey, ValidUntil

# Request a certificate
curl -X POST https://tpp.example.com/vedsdk/certificates/request \
    -H "X-Venafi-Api-Key: <api-key>" \
    -H "Content-Type: application/json" \
    -d '{
        "PolicyDN": "\\VED\\Policy\\Production-TLS",
        "Subject": "api.example.com",
        "SubjectAltNames": [{"TypeName":"DNS","Name":"api.example.com"}],
        "CertificateType": "Server Certificate",
        "KeyLength": 2048,
        "CADN": "\\VED\\Policy\\Administration\\CA-Templates\\DigiCert-OV"
    }'
# Returns: CertificateDN (DN of certificate object in TPP)

# Retrieve certificate (after issuance)
curl -X POST https://tpp.example.com/vedsdk/certificates/retrieve \
    -H "X-Venafi-Api-Key: <api-key>" \
    -d '{"CertificateDN":"\\VED\\Policy\\Production-TLS\\api.example.com","Format":"PEM","IncludeChain":true}'
```

### Venafi Kubernetes Integration

**cert-manager Venafi Issuer** (most common):
```yaml
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: venafi-tpp-issuer
spec:
  venafi:
    zone: "\\VED\\Policy\\Kubernetes-TLS"
    tpp:
      url: https://tpp.example.com/vedsdk
      credentialsRef:
        name: venafi-tpp-secret  # K8s Secret with tpp-username + tpp-password or access-token
      caBundle: <base64-encoded-tpp-ca-cert>
```

**Venafi Kubernetes Operator (VKO)**:
```yaml
# VenafiClusterCertificate (VKO custom resource)
apiVersion: jetstack.io/v1alpha1
kind: VenafiCertificate
metadata:
  name: my-tls-cert
spec:
  zone: "Production-TLS"
  request:
    commonName: api.example.com
    dnsNames:
      - api.example.com
    duration: 2160h   # 90 days
    renewBefore: 360h # 15 days before expiry
```

### Terraform Provider

```hcl
provider "venafi" {
  url          = "https://tpp.example.com/vedsdk"
  tpp_username = var.venafi_username
  tpp_password = var.venafi_password
  zone         = "\\VED\\Policy\\Production-TLS"
}

resource "venafi_certificate" "server_cert" {
  common_name = "api.example.com"
  san_dns     = ["api.example.com", "api-v2.example.com"]
  key_length  = 2048
  algorithm   = "RSA"
  pkcs12_password = var.pfx_password
  
  # Trigger renewal when cert is within 15 days of expiry
  # (handled by Terraform drift detection on expiry date)
}

output "certificate_pem" {
  value     = venafi_certificate.server_cert.certificate
  sensitive = false
}

output "private_key_pem" {
  value     = venafi_certificate.server_cert.private_key_pem
  sensitive = true
}
```

---

## Certificate Discovery

Venafi's Discovery engine finds certificates across:
- **Network scanning**: TCP port scanning with TLS handshake (443, 8443, any custom port)
- **Agent-based**: Deploy lightweight agent on servers
- **Bulk import**: Import CSV, PKCS12, PEM files
- **Cloud integrations**: AWS ACM, Azure Key Vault, GCP Certificate Manager, Kubernetes

### Setting Up Network Discovery

```
TPP UI → Installations → Certificate Manager → Discoveries → New Discovery
  Discovery Type: Network
  IP/CIDR range: 10.0.0.0/8
  Ports: 443, 8443, 8080
  Schedule: Daily at 02:00
  
Findings imported into:
  Tree Location: \VED\Policy\Discovery\Network
```

---

## SPIFFE / SPIRE Integration

Venafi Firefly acts as a SPIFFE Workload API provider:

```
SPIRE Server → delegates to Venafi Firefly (as upstream CA)
  ↓
SPIRE Agent (on each node)
  ↓
SVID issued to workload (X.509 SVID or JWT SVID)
SVID contains SPIFFE ID: spiffe://example.com/ns/production/sa/api-service
```

### SPIFFE IDs in Venafi Policy

```
Venafi Policy Zone: "Kubernetes-SPIFFE"
  Allowed SPIFFE IDs: spiffe://example.com/ns/production/*
  Certificate Lifetime: 1h
  Key Type: ECDSA P-256
  Auto-approve: Yes
```

---

## Reporting and Compliance

Venafi provides out-of-box reports:
- **Expiring Certificates**: Certificates expiring within N days
- **Weak Certificates**: RSA < 2048, SHA-1, MD5
- **Non-compliant Certificates**: Outside policy zone rules
- **Unmanaged Certificates**: Discovered but not managed by Venafi
- **CA Usage Report**: Which CAs are issuing how many certificates

### Dashboard KPIs

- Total managed certificates
- % of certificates with automation enabled
- Certificates expiring in 30/60/90 days
- Discovery coverage (% of network scanned)
- Policy compliance rate

---

## Common Operational Tasks

### Renewing a Certificate

**Automated renewal** (preferred): Configure automatic renewal in the application driver (IIS, nginx, F5). Venafi handles renewal when threshold is reached.

**Manual renewal via API**:
```bash
curl -X POST https://tpp.example.com/vedsdk/certificates/renew \
    -H "X-Venafi-Api-Key: <api-key>" \
    -d '{"CertificateDN":"\\VED\\Policy\\Production-TLS\\api.example.com"}'
```

### Revoking a Certificate

```bash
curl -X POST https://tpp.example.com/vedsdk/certificates/revoke \
    -H "X-Venafi-Api-Key: <api-key>" \
    -d '{
        "CertificateDN": "\\VED\\Policy\\Production-TLS\\api.example.com",
        "Reason": 4,  # 4 = superseded
        "Comments": "Replaced by new certificate",
        "Disable": false  # false = revoke only, true = revoke and disable
    }'
```

### Bulk Operations

Venafi supports bulk operations via API:
- Bulk renew: All certs expiring within X days in a policy zone
- Bulk revoke: All certs for a specific CA (e.g., after CA compromise)
- Bulk move: Move certificates between policy zones after re-org