DigiCert Inc., a provider of TLS/SSL, IoT and PKI solutions, has introduced Secure Software Manager, a modern way to automate and manage PKI security across CI/CD pipelines. Secure Software Manager makes it easy for enterprises to integrate secure key management for code signing into their development processes while delegating cryptographic operations, signing activities and management in a controlled and auditable way.
The drive for agility leaves today’s product engineering organizations exposed to internal threats and hackers. Stolen code signing certificates and their associated keys have led to many high-profile attacks, where these keys have been used to sign malware and commit fraud. DevOps teams need signing solutions that fit within their workflows and make signing keys easily accessible when pushing code, but many orchestration tools do not include key protection.
Secure Software Manager removes the burden on engineers for cryptographic asset protection, enabling them to sign with confidence and freeing them to do what they do best: develop and deploy software quickly and efficiently. It provides:
- command line tools that easily integrate with CI/CD systems
- automatic signing of packages, binaries and containers on every merge to master when authorized
- RESTful APIs for custom integrations
- simultaneous signing of Docker containers and software code, adding trust to every step of process
Using Secure Software Manager reduces the risk of key theft and misuse by strengthening security around key accessibility and storage. Hash signing lets developers protect intellectual property, as no files are uploaded to the cloud.
Additionally, IT organizations must comply with a variety of rapidly changing regulations that require robust key protections across increasingly dynamic and orchestrated environments. They also require full reporting and auditing capabilities to ensure compliance. Secure Software Manager enables:
- secure private key management in hardware security module (HSM) and offline mode for keys when not signing
- flexible deployment via SaaS or on a public or private datacenter
- centralized user management with flexible, role-based permissions and single sign-on (SSO)
- audit trail of signing activity for forensics and full accountability
“Secure Software Manager meets customers where they need to be, whether on-premises, in the cloud, or in hybrid environments through the DigiCert ONE platform,” said Senior Vice President of Product Brian Trzupek. “Our customers can enjoy complete automation or tailor the solution to support the degree of functions they require and be assured of seamless integration with their familiar CI/CD tools and processes.”
Beyond authenticating devices for the IoT and enterprise networks with certificates issued from DigiCert ONE managers, organizations can secure code and firmware. This includes enabling secure over-the-air updates throughout the lifetime of the device, using Secure Software Manager.
Secure Software Manager is built on DigiCert ONE, a PKI management platform built with a new architecture and software to be the PKI infrastructure service for today’s modern cloud-native challenges. Released in 2020, DigiCert ONE offers multiple management solutions and is designed for all PKI use cases. Its flexibility allows it to be deployed on-premises, in-country or in the cloud to meet stringent requirements, custom integrations and airgap needs. It also deploys extremely high volumes of certificates quickly using robust and highly scalable infrastructure. DigiCert ONE delivers end-to-end centralized user and device certificate management, a modern approach to PKI to provide trust across Kubernetes clusters and dynamic IT architectures.
