1. Home
  2. /
  3. Use cases
  4. /
  5. Issue certificates for Container environments

Issue certificates for Container environments

In a containerized environment, certificates and mTLS are critical in securing your infrastructure. Our guides take you through the step-by-step process of implementing a trusted certificate-issuing process to meet your security needs, leveraging cert-manager, Istio, HashiCorpVault, and CSR API as vital security tools.

hero-sub-2

Challenge

Both short-lived and longer-lived certificates are required to balance security

Certificates and mTLS are critical for securing communication in a containerized environment. They help ensure that the communication is secure, authenticated, and compliant. In addition, in many cases, both short-lived (ephemeral) and longer-lived certificates are required to balance the security and operational needs of the infrastructure.

Ephemeral certificates ensure that workload-to-workload communication between containers or microservices within a cluster is secure. These certificates are designed to be renewed frequently, every few minutes, hours, or days. Longer-lived certificates typically provide trust and authentication between infrastructure components, such as load balancers, API gateways, or Kubernetes controllers.

A well-designed PKI system should be able to handle both types of certificates and manage their lifecycle efficiently.

arrow

Solution

Consistency across the containerized application environment

EJBCA PKI supports cert-manager and securing service meshes via Istio and generic TLS, providing engineers with tools to secure their containerized applications. Today, you can try:

  • Automated issuance of certificates for Kubernetes applications with cert-manager and EJBCA PKI
  • Use EJBCA PKI with HashiCorp Vault
  • Issuing certificates from EJBCA for Istio's mutual mTLS
  • Certificates for TLS and mTLS, manually or via REST

EJBCA centralizes certificate management, providing a single control point for issuance, revocation, and renewal. This consistency and security extends across the entire containerized application environment, reducing the risk of security incidents and data breaches.

Tutorials

EJBCA logo website
DevOps
Get started
2024-01-18

Use EJBCA PKI with HashiCorp Vault

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
EJBCA
EJBCA logo website
REST
2023-06-18

Automated certificate issuing via EJBCA REST

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
PYTHON / POSTMAN
EJBCA logo website
DevOps
2023-05-11

Issue certs to Istio service mesh

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
ISTIO
EJBCA logo website
DevOps
Get started
TLS & mTLS
2023-05-11

Certificate management in Kubernetes with cert-manager and EJBCA

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
CERT MANAGER
DevOps
IoT
TLS & mTLS
2023-02-06

Client TLS certificates for mTLS, manual issuance

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
mTLS
EJBCA logo website
DevOps
IoT
TLS & mTLS
2023-02-06

Server TLS certificates, manual issuance

{At sit et cras neque etiam cursus vulputate tempor enim. Quisque suspendisse nunc massa eleifend est ultrices. Facilisi ut a augue pellentesque quam nibh. Sit nisl.|=##=|162821}
mTLS

Get inspired

Stay up to date with the latest news and blog articles, and find out about upcoming events related to EJBCA.

Keyfactor Blog
DevOps
Implementing Cryptography
Industrial Cybersecurity & IoT
Installation & Deployment
Post-Quantum Cryptography
Signing
Blog
Ejbca
Signserver
18 April, 2024

Navigating HSM Options for EJBCA PKI: A Guide for Product Engineers and Owners

In the rapidly evolving landscape of digital security and regulations, select...
Keyfactor Blog
DevOps
Implementing Cryptography
Industrial Cybersecurity & IoT
Installation & Deployment
Post-Quantum Cryptography
Signing
Blog
Ejbca
Signserver
11 April, 2024

Enhancing Security and Efficiency: The Role of HSMs in PKI and Signing Solutions

Using a hardware security module (HSM) with your Public Key Infrastructure (P...
EJBCA PQC Test lab
Tech Update
Ejbca
Signserver
28 March, 2024

With open source we can create better technology

In this video, our open-source advocates David Hook and Tomas Gustavsson delv...

Related open-source projects