Who is the Company

A large coffeehouse chain with over 30,000+ stores worldwide.

The Challenge

The client used load balancing infrastructure based on F5/VF5 virtual machines to route API requests to respective backend pool members. As these API requests are authenticated using SSL (Secure Sockets Layer) certificates, the company needed to keep these SSL certificates updated at all times.

The company used a manual process to monitor, download, renew, and deploy every certificate. This process was labor-intensive and technically demanding. Each certificate renewal and installation involved multiple steps that were prone to error and significantly added to the maintenance cost.

The company wanted to automate the entire certification renewal and deployment process to prevent potential disruptions caused by human error and enforce compliance while reducing its overall ownership cost. 

In brief, the company wanted:

  • Guaranteed and timely certificate renewal: Currently the company was constantly concerned that a certificate might not be renewed on time, causing disruption when API requests were rejected. Company management wanted to gain peace of mind, secure in the knowledge that their certificates would be renewed in a timely manner.
  • All-encompassing certificate distribution: The company was looking for a way to distribute certificates to all virtual servers via its F5 infrastructure.

The Solution

Our DevOps team introduced automation using Python to minimize manual intervention and iron out any scope for error.

Jenkins is a platform expressly designed to handle the continuous integration and continuous delivery (CI/CD) of software applications. Our team adapted a Jenkins job to perform CI/CD on SSL certificate management. The automation scripting performs certificate renewal, deployment, and profile updates on respective F5 servers only after checking the certificate expiration date.

The solution is broken down into three stages, driven by a Jenkins job. In the first stage, the certificate is downloaded from Venafi and stored in a local system. The expiration date of this certificate is compared with the current system date and time. If the certificate is due to expire within 20 days, the script moves to the next stage.

In the next stage, the automated process renews the identified certificate by making a call to the Venafi APIs. A third stage deploys the renewed certificate to the appropriate F5 server. The newly installed certificate and associated keys are then stored in a secure SSL profile database.

Highlights of the solution include:

  • Automated SSL certificate expiration monitoring: Our team modified a Jenkins job to continuously monitor all F5 servers for certificate expiration.
  • Securely managed machine identities: We chose to use Venafi, a hosted service that provides secure lifecycle management of each F5 server’s identity and its SSL certificates.
  • A powerful scripting engine: Our team used the Python programming language to do the heavy lifting. Python is widely available, well documented, and is supported by an active developer community.

Business Impact

  • Frees company resources: The solution reduced manual efforts by automating all manual tasks. Company resources previously involved in manual SSL certificate management are now free to pursue more meaningful tasks.
  • Flawless API access: The certificate renewal process is now faster and more reliable. API requests are no longer rejected due to SSL authentication errors. The solution significantly reduced the rejection rate for API requests.
  • Guaranteed 24x7 secure web access: The automation eliminates chances of missing renewals for the soon-to-expire certificates, resulting in guaranteed secure web access.
  • Grants peace of mind: The automation process runs continuously without errors, providing the company freedom to focus on other important tasks.

Technologies Used

Venafi: Offers trusted machine identity management for both physical and virtual servers
F5: Provides web app and API security across a multi-cloud infrastructure
Python: A powerful and versatile scripting language
Jenkins:An open-source CI/CD tool

Related Capabilities

Utilize Actionable Insights from Multiple Data Hubs to Gain More Customers and Boost Sales

Unlock the power of the data insights buried deep within your diverse systems across the organization. We empower businesses to effectively collect, beautifully visualize, critically analyze, and intelligently interpret data to support organizational goals. Our team ensures good returns on the big data technology investments with the effective use of the latest data and analytics tools.

Do you have a similar project in mind?

Enter your email address to start the conversation