Request Certificate
venafi_tpp.request_certificate
ActionBusiness appsconnection required
Calls the Venafi TLS Protect Datacenter API with the connection's credentials.
Enroll a new certificate in a policy folder on the platform.
Connection
- Required
- Yes — the node will not save without one
- Auth type
- Custom
- Providers
- Venafi TLS Protect Datacenter
- Secret shape
- {"username": "…", "password": "…"} or {"access_token": "…"}
- Config it needs
- base_url, client_id, scope
- Resolved by
- config.connection_id, else node.connection_id
Configuration
11 fields, 1 required. A dotted path is a nested object and name[] an array of objects — the editor renders the same tree.
| Field | Type | Required | Default | Constraints | Example |
|---|---|---|---|---|---|
policy_dn Distinguished Name of the policy folder the new certificate belongs in. | string | Yes | — | — | \VED\Policy\Certificates |
subject Common Name for the certificate's subject, such as the host name it will be installed on. | string | No | — | — | www.acme.com |
object_name Name for the Certificate object itself; Venafi uses the subject when this is left blank. | string | No | — | — | www.acme.com |
pkcs10 A certificate signing request to enroll instead of having the platform generate the key pair, in base64 PKCS #10 form. | string | No | — | — | -----BEGIN CERTIFICATE REQUEST----- MIIB... -----END CERTIFICATE REQUEST----- |
ca_dn Distinguished Name of the certificate authority template to enroll against, when the policy folder does not already name one. | string | No | — | — | \VED\Policy\Administration\CA Templates\Acme Issuing CA |
certificate_type What the certificate is for, when the platform should not infer it. | string | No | — | one of "Auto", "Code Signing", "Device", "Server", "User" | — |
key_algorithm Key algorithm for a platform-generated key pair. | string | No | — | one of "RSA", "ECC" | — |
management_type How far the platform manages this certificate: enrollment only, full provisioning, monitoring, or unassigned. | string | No | — | one of "Enrollment", "Provisioning", "Monitoring", "Unassigned" | — |
subject_alt_names Subject alternative names, each an object with a TypeName and a Name, such as {"TypeName": "DNS", "Name": "api.acme.com"}. | array | No | — | array of object | — |
disable_automatic_renewal Stop the platform renewing this certificate on its own schedule. | boolean | No | false | — | — |
work_to_do_timeout Seconds to wait for the certificate authority before answering. Left at 0 the platform queues the work and answers straight away. | number | No | 0 | 0–120 | — |
- At least one of subject, object_name must be set.
Example configuration
Every value below is the contract’s own example or default — nothing invented.
{
"ca_dn": "\\VED\\Policy\\Administration\\CA Templates\\Acme Issuing CA",
"disable_automatic_renewal": false,
"object_name": "www.acme.com",
"pkcs10": "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...\n-----END CERTIFICATE REQUEST-----",
"policy_dn": "\\VED\\Policy\\Certificates",
"subject": "www.acme.com",
"work_to_do_timeout": 0
}Output
One shape.
result
| Field | Type | Example |
|---|---|---|
CertificateDN Distinguished Name of the new certificate. | string | — |
Guid GUID of the new Certificate object. | string | — |
CertificateData The certificate, base64 encoded in the chosen format. | string | — |
Filename The filename Venafi suggests for that data. | string | — |
Format The format the data is in, with its MIME type. | string | — |
Error Venafi's status message when the request was queued rather than issued. | string | — |
{
"CertificateDN": "",
"CertificateData": "",
"Error": "",
"Filename": "",
"Format": "",
"Guid": ""
}Notes
- A 202 means the certificate authority has not answered yet; read the certificate later with venafi_tpp.retrieve_certificate.
- Either a 'subject' or an 'object_name' is required; the node refuses the call before it is made when both are missing.
Related Venafi TLS Protect Datacenter nodes
See Request Certificate run in a workflow.
In a technical demo we add the Venafi TLS Protect Datacenter connection, drop the node on the canvas and let Workflow Health pre-flight it before the first real run.