Preventing Doomsday: x509 Certificates in Cloud Foundry
summary
Cloud Foundry deployments generate dozens to hundreds of x.509 credentials that can all expire within weeks of each other and trigger BOSH director failures, VM rebuilds and multi-hour outages. A monitoring service called doomsday dashboard scrapes TLS endpoints, Vault/CredHub/ops-manager scraping and public certs, shows a color-coded timeline, and sends alerts via Slack or Shout. Rotation still requires careful multi-step redeploys (often 2–3 CF/BOSH deploys) to avoid downtime, so doomsday prevents surprise outages but does not fully automate safe rotation.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:23Why use x509 certificates
- 1:04Why certificates expire
- 2:52Consequences of expired certs
- 4:38Cloud Foundry internal certs
- 6:48Bosh director cert issues
- 9:17Mitigating certificate expiration
- 11:47Current rotation practices
- 13:14Introducing Doomsday project
- 15:43How Doomsday tracks certs
- 17:52Doomsday notifications
- 19:20Q&A session
related talks
13mBOSH & SSL Certificates - Rotating Certificates Smoothly
29mKeys, Certs and Vault: From DevSecOps to Post-Quantum
22mKeynote: Cloud Native Security: Rotate, Repair, Repave
31mPractical TLS Advice for Large Infrastructure
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
13mTen Ways to Doom Your DevSecOps
31mA Developer’s Perspective on Cloud Foundry Operations: One Month in the Trenches
35mEnhancing Cloud Foundry Application Security with Vault