Case Study

How a Global Financial Services Firm Is Closing Certificate Blind Spots With Itential

Manual X.509 renewals on F5 load balancers. Orphaned SSL certificates slipping past legacy tracking. A network automation team used Itential to bring certificate discovery, expiry reporting, and renewal into production – with a deeper Venafi-integrated workflow next on the roadmap.

Challenge

Certificates on F5 load balancers were tracked and renewed manually. Expirations risked outages, and certificates issued outside normal process could go untracked entirely — invisible to the team until something broke.

Solution

Itential automated F5 certificate expiry reporting, cross-checked in-use certificates against the firm’s Venafi inventory to surface orphaned certs, and built an end-to-end X.509 certificate renewal workflow.

icon showing a checkmark on lines of text or code

Impact

Three certificate-focused automations live in production on the same platform already running the team’s device onboarding and credential rotation – with deeper Venafi-integrated renewal now on the roadmap.

The Challenge

Certificate Tracking That Couldn’t Keep Up With the Network

The network infrastructure team at a global financial services firm manages a large fleet of network and security devices, including F5 load balancers that terminate SSL/TLS traffic across the environment. Every certificate on those devices has an expiration date, and every missed renewal is a potential outage.

The firm already used Venafi as its system of record for certificate management. But Venafi only knows about what it’s told to track – and certificates provisioned outside that process could exist on F5 devices without ever showing up in Venafi. That gap meant real exposure: certificates expiring unnoticed, or “orphaned” certificates nobody was actively managing, sitting on production load balancers.

Renewing an X.509 certificate on F5 meant manually recreating VIPs, pools, and pool members, updating DNS, and pushing the new certificate through – all by hand, per device, per certificate. For a team already running automation for device onboarding and credential rotation elsewhere in the network, doing certificate lifecycle work manually was the odd one out.

The Solution

Certificate Lifecycle Automation, Built in Three Connected Pieces

The team rolled out certificate lifecycle automation in three connected pieces, all running on F5:

F5 SSL Certificate Expiry Reporting

Automated reporting flags upcoming certificate expirations across F5 devices, replacing manual, spreadsheet-driven tracking.

Orphaned SSL Certificate Discovery

Certificates in active use on F5 are automatically compared against the firm’s Venafi inventory, surfacing untracked or orphaned certificates before they become an incident.

F5 X.509 Certificate Renewal

A single workflow handles VIP, pool, and pool member creation, DNS updates, and X.509 certificate renewal – turning a manual, multi-step process into one orchestrated run.

Certificate workflows sit alongside the team’s existing device onboarding and quarterly credential rotation automations, running on the same Itential platform they already trust.

Credential rotation runs about every three months. Today it’s still manual to trigger – we rotate the password, then kick off the workflow.

Network Infrastructure Lead

Global Financial Services Firm

Why Itential

Why They Chose Itential

The team was already an Itential customer, using the platform for device onboarding and periodic credential rotation across their network. Extending that same automation foundation to certificate lifecycle management was a natural next step rather than a new platform decision.

A Natural Extension of an Existing Automation Foundation

Explore the Platform

One Platform, Not a New Tool

Certificate automation was built on the same Itential instance already running the team’s device onboarding and credential rotation workflows, rather than standing up a separate point solution.

Cross-System Validation Against Venafi

Itential could compare what was actually running on F5 devices against the firm’s Venafi records, closing the visibility gap between “what Venafi knows about” and “what’s actually out there.”

End-to-End F5 Orchestration

Rather than automating just the certificate swap, the workflow handles the full chain: VIP, pool, and pool member creation, DNS updates, and certificate renewal together.

Built to Expand in Phases

The team shipped expiry reporting and orphaned-cert discovery first, then layered in full renewal automation – building toward a deeper Venafi-integrated workflow rather than trying to automate everything at once.

We’ve got our F5 certificate expiry report, and then we have our orphaned SSL discovery – comparing what’s running against Venafi.

Network Infrastructure Lead

Global Financial Services Firm

The Outcome

From Manual Toil to Automated Confidence

This program is still early – the automations were newly in production, so hard ROI metrics like time saved or incidents avoided weren’t yet being tracked.

Automated

Expiry Reporting

Manual, spreadsheet-driven certificate tracking replaced with continuous, automated expiry reporting on F5 load balancers.

Surfaced

Orphaned Certs

Orphaned and untracked SSL certificates – previously invisible between F5 and Venafi – are now systematically surfaced through automated comparison.

Orchestrated

Full X.509 Renewal

Full X.509 certificate renewal, including VIP/pool/member creation and DNS updates, now runs through an orchestrated Itential workflow instead of manual, per-device work.

Confidence from these automations has the team scoping a deeper, Venafi-integrated F5 certificate renewal workflow as the next phase.

What’s Next

Deepen the Certificate Renewal Integration

The team is now scoping tighter integration between Itential and Venafi for F5 certificate renewal – aiming to reduce the manual steps still involved in the current process and bring certificate lifecycle management further into an automated, governed workflow. It’s the same pattern the team has followed across their automation journey: start with visibility, automate the manual toil, then deepen the integration once the foundation is proven.

Keep Learning