--- title: DevOps Credential Hygiene: How to Eliminate CI/CD... description: A guide on eliminating static DevOps secrets—SSH keys, API tokens, long-lived certificates—by adopting short-lived certificates and workload identity via... canonical: https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport | daily.dev og:description: A guide on eliminating static DevOps secrets—SSH keys, API tokens, long-lived certificates—by adopting short-lived certificates and workload identity via... og:url: https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p og:image: https://api.daily.dev/og/posts/8EKZh706p.png og:image:alt: DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport **[Teleport](https://daily.dev/sources/teleport)** · 11 min read · 0 upvotes · 0 comments ## Summary A guide on eliminating static DevOps secrets—SSH keys, API tokens, long-lived certificates—by adopting short-lived certificates and workload identity via Teleport. It contrasts a 'before' pattern using embedded API keys and long-lived mTLS certs with an 'after' pattern using Teleport's Machine ID (MWI) and SPIFFE-based X.509 SVIDs issued at runtime through the tbot agent. It also covers Teleport's five-phase CA rotation process (standby, init, update_clients, update_servers, standby) for zero-downtime trust anchor renewal, and explains how short-lived credentials limit blast radius for CI/CD jobs, automation scripts, and AI agents. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the difference between long-lived and short-lived certificates for DevOps workloads? Long-lived certificates reduce renewal frequency and operational overhead but expand the exploitation window if a private key is compromised, letting an attacker impersonate a client for the certificate's entire lifespan. Short-lived certificates shrink that blast radius, keep certificate revocation lists smaller, and require reliable automated renewal to work safely. _Compare credential lifetime trade-offs before locking in a DevOps secrets strategy on daily.dev._ ### How does Teleport eliminate API keys in CI/CD pipelines? Teleport issues short-lived X.509 SVID certificates, valid for around one hour, tied to workload identities at runtime instead of static API keys. A tbot agent runs alongside each workload, authenticates via the platform's own identity (AWS IAM role, GCP Service Account, Kubernetes ServiceAccount), and continuously renews certificates before they expire, so no API key is stored in code or environment variables. _Track workload-identity approaches like this while designing secretless CI/CD pipelines on daily.dev._ ### What are the phases of Teleport's certificate authority rotation process? Teleport's CA rotation runs through five phases: standby (steady state), init (new CA generated but inactive), update_clients (new certs issued while old CA is still trusted), update_servers (servers present new-CA certificates while accepting either), and back to standby (old CA retired). This allows zero-downtime renewal of a cluster's trust anchors without breaking existing sessions. _Follow structured rotation models like this when planning zero-downtime trust migrations on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [Why short-lived systems need stronger identity governance](https://daily.dev/posts/why-short-lived-systems-need-stronger-identity-governance-2mp3kjrvi) · CSO Online · 0 upvotes · 0 comments --- Tags: [#cicd](https://daily.dev/tags/cicd), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport","url":"https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p"},"datePublished":"2026-08-23T12:23:01.851Z","dateModified":"2026-08-23T12:53:36.380Z","description":"A guide on eliminating static DevOps secrets—SSH keys, API tokens, long-lived certificates—by adopting short-lived certificates and workload identity via...","image":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","thumbnailUrl":"https://media.daily.dev/image/upload/s--VDukGCjf--/f_auto/v1722860399/public/Placeholder%2002","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cicd,secrets-management","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"DevOps Credential Hygiene: How to Eliminate CI/CD Secrets with Teleport"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/devops-credential-hygiene-how-to-eliminate-ci-cd-secrets-with-teleport-8ekzh706p#faq","mainEntity":[{"@type":"Question","name":"What is the difference between long-lived and short-lived certificates for DevOps workloads?","acceptedAnswer":{"@type":"Answer","text":"Long-lived certificates reduce renewal frequency and operational overhead but expand the exploitation window if a private key is compromised, letting an attacker impersonate a client for the certificate's entire lifespan. Short-lived certificates shrink that blast radius, keep certificate revocation lists smaller, and require reliable automated renewal to work safely. Compare credential lifetime trade-offs before locking in a DevOps secrets strategy on daily.dev."}},{"@type":"Question","name":"How does Teleport eliminate API keys in CI/CD pipelines?","acceptedAnswer":{"@type":"Answer","text":"Teleport issues short-lived X.509 SVID certificates, valid for around one hour, tied to workload identities at runtime instead of static API keys. A tbot agent runs alongside each workload, authenticates via the platform's own identity (AWS IAM role, GCP Service Account, Kubernetes ServiceAccount), and continuously renews certificates before they expire, so no API key is stored in code or environment variables. Track workload-identity approaches like this while designing secretless CI/CD pipelines on daily.dev."}},{"@type":"Question","name":"What are the phases of Teleport's certificate authority rotation process?","acceptedAnswer":{"@type":"Answer","text":"Teleport's CA rotation runs through five phases: standby (steady state), init (new CA generated but inactive), update_clients (new certs issued while old CA is still trusted), update_servers (servers present new-CA certificates while accepting either), and back to standby (old CA retired). This allows zero-downtime renewal of a cluster's trust anchors without breaking existing sessions. Follow structured rotation models like this when planning zero-downtime trust migrations on daily.dev."}}]} ```