Meet Ottr: a serverless Public Key Infrastructure framework

Rotating certificates across thousands of network devices without installing software agents usually forces a terrible choice: drown in manual ticket approvals or rely on insecure enrollment protocols. Airbnb automates thousands of daily certificate rotations completely agentlessly through a serverless framework on AWS. 👇

Network infrastructure like firewalls and load balancers cannot run local software agents to manage X.509 certificates. Teams historically handled this with heavy manual overhead—generating key pairs, submitting CSRs, waiting on manual security approvals, and uploading certificates by hand—or relied on legacy enrollment protocols like SCEP and CMP.

Airbnb built Ottr, an open-source PKI framework that automates the full certificate rotation lifecycle remotely without local agents or long-lived servers.

A synchronizer Lambda aggregates host metadata across data centers and AWS into DynamoDB.

A scheduled CloudWatch event triggers a router Lambda to scan DynamoDB for hosts due for rotation. The router sends eligible host data to AWS Step Functions, which orchestrates parallel execution by spinning up targeted ECS containers.

The ECS container opens a remote connection to the host using SSH, an API, or AWS SSM Agent. It commands the target host to generate a new private key and Certificate Signing Request locally. Because the key is created on the device itself, private keys never leave the host.

The container pulls only the CSR back onto its local filesystem. An embedded ACME client (`acme.sh`) binds the organization's credentials and submits the CSR to an ACME-compliant Certificate Authority, like Let's Encrypt or a private CA.

Once the CA returns the signed certificate, the container uploads the full chain back to the host and restarts the target service. If any container task fails, a handler Lambda routes the failure details and a CloudWatch log link directly to Slack.

The entire system provisions over 100 AWS resources using modular Terraform scripts. It eliminates manual security approval bottlenecks, scales to thousands of daily rotations, and runs without permanent infrastructure to patch or maintain.