Anchor builds an effortless X.509 certificate service with Fastly KV Store

The challenge

In a world of heightened information security, where even the U.S. White House talks about zero trust, software developers increasingly recognize the need to encrypt data in transit between services. But setting up back-end encryption is a difficult and high-maintenance problem for development teams to do themselves. Anchor makes it easy through an edge-based service that encrypts applications and infrastructure effortlessly, putting developers in control without having to rely on a security or operations team to do it for them.

Customers depend on Anchor to deliver performant, highly available, and secure certificate services used by their apps and infrastructure, so Anchor’s choice of vendor for its own serverless compute infrastructure was critical to the company’s success. As a young company, Anchor needed to scale rapidly and create a solid infrastructure for growth. Specifically, they wanted to build their service on top of an edge-based key-value (KV) object store service with the programmability, performance and availability needed to deliver effortless encryption on behalf of customers. Besides Fastly, Anchor considered several object store services vendors—big ones and smaller niche providers—but found them all lacking needed capabilities.

The solution

Fastly Compute, formerly called Compute@Edge, enables Anchor to leverage Fastly's high-speed, global-edge network while injecting its own business logic into a custom caching layer to provide an innovative encryption service for developers. The Fastly KV Store provides Anchor with global, durable storage backed by the power of the Fastly platform. This empowers the company’s developers to create powerful applications without having to fetch data from a central cloud.

Custom authentication logic

“Although we considered many object service providers, we really liked the Fastly KV Store because it is integrated with Fastly Compute,” says Ben Burkert, CTO at Anchor. “We were able to put our own authentication layer and logic in the Fastly caching layer in front of the KV Store, which we use to serve packages on behalf of our customers.”

Fastly’s architecture enables Anchor to place access control and grant logic in its own SaaS application. “We get high availability for objects and packages in the KV Store, while retaining control over security by putting all the access control in our own product,” Burkert explains.

Developer-friendly tooling and support

“Fastly is more developer friendly than other vendors, and the Compute platform is even better for developers than in the past,” Burkert says. Using development systems that work locally and look like production systems is important to Burkert. “It's really nice that the developer tooling works locally so we can build our caching layer on our development systems and have high assurance that it will work the same when we deploy it to production,” he says. “The capability to simulate production in our development environment is a huge differentiator for Fastly,” he adds.

A good testing environment enables Anchor to innovate. “We’re not afraid to introduce changes to the edge layer because, with Fastly, we can write tests that hit the entire stack at once—the edge layer, and our SaaS and back-end encryption layer. Those tests provide high-quality assurance that our solution is secure and does what it is supposed to,” he says.

Burket’s team customized the Fastly command-line interface (CLI) toolchain and integrated it with Anchor’s SaaS, collaborating with Fastly in the process. “Fastly has a great codebase and developer support. The Fastly support team really cares, and it shows in the tools and support that Fastly provides. When we raise issues, Fastly takes us seriously and addresses them quickly,” he says.

Performant, available and secure

Anchor’s customers rely on the company’s core infrastructure to run their own services. Issues can arise quickly if Anchor’s service is not performant and highly available. For example, X.509 certificates become unavailable if critical resources are not available from the cache. “Only with Fastly can we build the caching layer that differentiates our service,” Burkert says. “As a young company, we really appreciate that Fastly is there for us and delivers what it says.”

Key takeaway

As Anchor focuses on building a developer-friendly encryption solution, Burkert recognizes and values the developer-friendly approach that permeates everything Fastly does. From caching to edge computing to object storage, Fastly Compute and KV Store deliver the flexibility, high availability, global scale and helpful support that Anchor needs to build an effortless encryption service for developers.