CertFix: solução para rotação automática de certificados mTLS para autenticação de microsserviços

Abstract

The adoption of microservices expands the attack surface and makes the protection of inter-service communication critical, for which mTLS (Mutual TLS) is one of the most robust mechanisms, as it provides mutual authentication and confidentiality. Its adoption, however, is hindered by certificate lifecycle management, for which manual processes are not scalable and are susceptible to failures, operational errors, and delays. This work developed and empirically evaluated CertFix, an automated mTLS certificate lifecycle management solution with an internal certification authority and a per-host embedded agent that exposes the rotation strategy as an explicit configuration element. The design separates two axes that are often conflated in practice: the algorithm, which orders certificate issuance and revocation operations, and the trigger, either scheduled or driven by a security event. The evaluation followed a controlled Latin square experiment replicated three times, with assignments made by service, over a real mesh of ten microservices under a load of 15 requests per second. The three campaigns totaled 4.4 hours of execution, 212,204 requests, 252 certificate rotations, and 27 fault injections, including the failure of the certification authority, which affected all configurations at the same instant. The gradual strategy sustained rotation without ever leaving the service without a valid credential: measured at the certification authority, coverage was continuous, with an exactly zero invalidity window in all 14 cells attributable to the strategy itself, out of the 18 in the design. The maintenance-window strategy failed in all 18 of its cells, event triggering in all 16 of its cells, and the manual procedure in 9 cells. The denominators differ because the cell whose gap was opened by the preceding strategy, in the discarded transition, is excluded from the strategy that inherited it. Under fault injection, measured against paired control windows without faults, the gap for the gradual strategy remained zero across the three scenarios, and it was the only strategy that retained rotations rather than completing them when the service was terminated, whereas neither of the two window-based strategies did so. The difference between the two orderings, however, is invisible in the metric that would naturally be used to evaluate them: rotation success rate assigned 100 % to all four strategies, 238 out of 238 rotations verified by serial-number matching, both to the strategy that never left the service uncovered and to those that did so in every measured cell. Thus, the central contribution is the empirical observation that the benefit of automation stems from the ordering between issuance and revocation, rather than from automation itself. It is a decision that established tools leave implicit, that conventional rotation metrics fail to reveal, and that the evaluated manual script, which follows the same order as the maintenance window, did not avoid either.