Book a demo

Request Certificate

venafi_cloud.request_certificate
ActionBusiness appsconnection required

Calls the Venafi TLS Protect Cloud API with the connection's credentials.

Ask Venafi to issue a certificate under an application and template.

Ask about Venafi TLS Protect CloudAll Venafi TLS Protect Cloud nodesProvider API docs ↗

Connection

Required
Yes — the node will not save without one
Auth type
API key
Providers
Venafi TLS Protect Cloud
Secret shape
the API key, or {"api_key": "…"}
Config it needs
region, base_url
Resolved by
config.connection_id, else node.connection_id

Configuration

6 fields, 2 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.

FieldTypeRequiredDefaultConstraintsExample
application_id
The application to request under; venafi_cloud.list_applications emits it as 'id'.
stringYes——45d06980-ae82-11eb-9702-4fa2482840bf
certificate_issuing_template_id
The issuing template to request against; venafi_cloud.list_issuing_templates emits it.
stringYes——51cb8340-a993-11ea-8a4f-3f9fa45442b2
csr
A certificate signing request in PEM form, when you generated the key yourself.
stringNo——-----BEGIN CERTIFICATE REQUEST----- MIICYzCCAUsCAQAwHjEcMBoGA1UEAwwTd3d3LmV4YW1wbGUuY29tLmludg== -----END CERTIFICATE REQUEST-----
csr_attributes
Subject and SAN attributes for Venafi to generate the key and CSR itself.
objectNo——{"commonName":"www.example.com","organization":"Acme","subjectAlternativeNamesByType":{"dnsNames":["www.example.com"]}}
validity_period
How long the certificate should be valid, as an ISO-8601 period such as P1Y, P90D or PT12H.
stringNo——P1Y
certificate_owner_user_id
The Venafi user to record as the certificate's owner.
stringNo——cef746f0-28f6-11eb-b879-87373a818312
  • At least one of csr, csr_attributes must be set.

Example configuration

Every value below is the contract’s own example or default — nothing invented.

{
  "application_id": "45d06980-ae82-11eb-9702-4fa2482840bf",
  "certificate_issuing_template_id": "51cb8340-a993-11ea-8a4f-3f9fa45442b2",
  "certificate_owner_user_id": "cef746f0-28f6-11eb-b879-87373a818312",
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICYzCCAUsCAQAwHjEcMBoGA1UEAwwTd3d3LmV4YW1wbGUuY29tLmludg==\n-----END CERTIFICATE REQUEST-----\n",
  "csr_attributes": {
    "commonName": "www.example.com",
    "organization": "Acme",
    "subjectAlternativeNamesByType": {
      "dnsNames": [
        "www.example.com"
      ]
    }
  },
  "validity_period": "P1Y"
}

Output

One shape.

result

FieldTypeExample
id
The certificate-request id, which the status node takes.
string—
status
Where the request starts, usually 'NEW' or 'PENDING'.
string—
certificate_ids
Issued certificate ids, empty until ISSUED.
array—
subject_dn
The subject distinguished name Venafi recorded.
string—
certificate_requests
Every request object Venafi returned.
array—
count
How many request objects Venafi returned.
number—
{
  "certificate_ids": [],
  "certificate_requests": [],
  "count": 0,
  "id": "",
  "status": "",
  "subject_dn": ""
}

Notes

  • Supply 'csr' when you generated the key, or 'csr_attributes' to let Venafi generate it — the choice sets isVaaSGenerated, and both together are refused.
  • Statuses run NEW, PENDING, REQUESTED, ISSUED, REJECTED, CANCELLED — a request is not a certificate until it reaches ISSUED.

Related Venafi TLS Protect Cloud nodes

See Request Certificate run in a workflow.

In a technical demo we add the Venafi TLS Protect Cloud connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.

Book a technical demoTalk to sales