Bring Your Own CLM: Keyfactor Command Joins the Thales Imperva SSL Integration Center

In August we introduced the Thales Imperva SSL Integration Center with one idea behind it: the certificate platform you already run should be able to deliver certificates to the applications Imperva protects, with nobody copying files between consoles. DigiCert Trust Lifecycle Manager was the first integration, and we said it would not be the last. Today, Keyfactor Command joins the SSL Integration Center. Teams that run Keyfactor Command can now inventory, deploy, renew and remove the custom SSL/TLS certificates on their Thales Imperva Cloud WAF sites from Command, bringing automated certificate management to every site behind Imperva.

The timing matters. The CA/Browser Forum has voted (Ballot SC-081v3) to cut the maximum TLS certificate lifespan to 47 days by March 2029, with the first cut in force since March 2026, a change we looked at in our piece on shortened renewal periods. A renewal that comes around once a year today will come around every few weeks, and Keyfactor’s own research shows how little slack most teams have. In Keyfactor’s Digital Trust Digest: The Automation Edition, 86% of companies had at least one outage caused by expired or mismanaged certificates in the past year, and only 17% of practitioners reported complete, real-time visibility across all of their certificates.

Source: Keyfactor, Digital Trust Digest: The Automation Edition (September 2025), a Wakefield Research survey of 450 PKI and certificate management practitioners at companies with at least 1,000 employees in North America and Europe.

Why Keyfactor Command for Imperva certificates

Keyfactor Command gives PKI, security and platform teams one place to see, govern and automate certificates from any CA, across clouds and environments. It finds certificates through CA synchronization, network scanning and agent-based or agentless discovery. It enforces role-based permissions, approvals and workflows. And it uses Keyfactor Orchestrators to automate renewal, provisioning and installation.

For teams that have standardized on Command, the custom certificates on websites behind Imperva belong in the same inventory, under the same policies, as everything else. The integration puts them there. Command stays the system of record that decides which certificate each site carries and when it renews, and the SSL Integration Center is the route that delivers it to the applications Imperva protects.

How the Keyfactor Command integration with Imperva works

The integration runs through the Keyfactor Universal Orchestrator, which runs on Windows or Linux servers or in Linux containers, and an Imperva extension that Keyfactor builds and supports.

1. Connect your Imperva account. Create an Imperva API key with the Manage SSL Certificates entitlement, add the Imperva extension from the Keyfactor Integrations Catalog to your Universal Orchestrator, and create an Imperva certificate store in Command with your API ID and key.
2. See your Imperva certificates in Command. The orchestrator inventories the custom certificates on your Imperva sites on a regular schedule, so they sit in the same inventory as every other certificate you manage.
3. Add, renew or remove from Command. Deploy a certificate to an Imperva site, renew it or remove it from Command, by hand or automatically through Command’s workflow engine.
4. Bring new sites under management. A site with no custom certificate yet does not appear in the inventory, so run a one-time add job in Command with the site’s domain as the alias. From then on, it is part of your inventory.

What automated certificate management means for your team

• One inventory that includes Imperva. Custom certificates on your Imperva sites show up in Command next to the rest of your estate, with their expiry dates in view.
• Renewals at the pace of 47-day certificates. Renewal and deployment to Imperva can run through Command’s workflows, so a shorter lifespan means more renewals for Command to run, and fewer tickets for your team.
• Your CA, your policies. Certificates come from whichever CA you govern in Command, under the approvals and role-based permissions you have already set.
• Credentials under control. The Imperva API ID and key are stored with the certificate store in Command, and can be retrieved from a supported privileged access management (PAM) provider.
• Ready for post-quantum certificates. The integration supports PQC-capable hybrid certificates, so your move to post-quantum certificates can run through the same workflow.
• Built and supported by Keyfactor. The Imperva extension is a production integration that Keyfactor maintains and supports, with its documentation on GitHub.

Thales-managed or customer-managed: still your choice

Nothing changes for organizations that prefer Thales-managed certificates, which take provisioning, renewal, monitoring and deployment off your hands in one move. The SSL Integration Center is for teams whose compliance requirements, PKI investments or governance policies mean they keep their own CA and CLM. With DigiCert Trust Lifecycle Manager and now Keyfactor Command, more of those teams can automate without changing how they govern.

A CLM integration ecosystem that keeps growing

Each CLM platform added to the SSL Integration Center is one more certificate workflow that reaches your applications without a person in the renewal loop, and further CLM integrations are in progress. The Integration Center works alongside Thales’s own SSL management capabilities, including certificate visibility, site coverage monitoring, notifications and real-time SSL health monitoring.

Keyfactor is also a Thales Technology Alliance partner, with integrations that pair Keyfactor’s platforms with Thales Luna HSMs for high-assurance key storage. Beyond certificates, the Imperva Technology Alliance Program connects Imperva to the SIEM, ITSM, API gateway, scanner and cloud tools enterprises already run.

Forty-seven days will arrive on schedule. With Keyfactor Command and the SSL Integration Center, so will every renewal on your Imperva sites.

Get started with Keyfactor Command and Imperva

If you are a Thales Imperva Cloud WAF customer running Keyfactor Command, you can connect your Imperva sites today. Imperva’s documentation on automating custom certificate management walks through both the Imperva and Keyfactor sides of the setup. The Imperva extension’s README on GitHub covers creating the certificate store type and the store itself, and you will find the extension in the Keyfactor Integrations Catalog.

The post Bring Your Own CLM: Keyfactor Command Joins the Thales Imperva SSL Integration Center appeared first on Blog.