Automating PKI: Paddy Power Betfair's Journey with Vault
summary
Paddy Power Betfair automates TLS certificate issuance for a hybrid estate of ~21,000 VMs and ~4,000 certificates using Vault PKI with roles defined in version control. CI pipelines request leaf certs, auto inject keystores and truststores via Ansible and Chef modules, bind to load balancers and run a weekly job to sync public certs into AWS Certificate Manager. A Vault plugin manages HydrantID CA interactions and is open sourced. Certificate rollout time drops from one week to ~1 hour.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 1:06Context of PKI challenges
- 3:11Old manual certificate process
- 5:39Introducing Vault for PKI
- 8:30Tier 1 certificates and Vault plugin
- 10:55Cost savings and productivity gains
- 11:58Value of automation in PKI
- 12:40Final thoughts and Q&A
related talks
24mHow the Dynamic Duo of Vault and Puppet Tame SSL Certificates
27mAddressing the growing threat of non-human identities with PKI
51mRun modern PKI workflows with HCP Vault on AWS
26mCombining DevOps with PKI Compliance Using HashiCorp Vault & Consul
29mKeys, Certs and Vault: From DevSecOps to Post-Quantum
27mIntegrating Vault and Terraform with Enterprise Machine Identity Services
50mProtecting Machine Identities: USPTO and Certificate Automation
20mVault Automation with the HashiCorp Stack in OneMount