<!-- BusyBot node reference — https://busybot.net/tools/venafi/ -->

> Node: Venafi TLS Protect Cloud (`venafi`) · Action (binary) · v1
> Category: Utility · Credentials: Venafi TLS Protect Cloud (`venafiTlsProtectCloudApi`)
> Updated: 2026-08-16

# Venafi TLS Protect Cloud

> Manage and download TLS certificates via Venafi Cloud

## Overview

The Venafi TLS Protect Cloud tool manages TLS/SSL certificates through Venafi's cloud platform. Supports two resources: (1) Certificate — delete, download (PEM/DER certificate or JKS/PKCS12/PEM keystore with encrypted passphrases), get details, get many (with subject filter), and renew. (2) Certificate Request — create (with server-side CSR generation or user-provided CSR), get details, get many. Certificate download produces binary data (PEM files, DER files, or keystore archives). Uses API key authentication via the tppl-api-key header. Supports US and EU regions.

**Category:** Utility  
**Tool Name:** `venafi`  
**Version:** 1

**Appearance:** Icon: `lucide-ShieldCheck` | Color: `#BE1E2D`

## Node Type

**Action (Binary)** — handles file/binary data operations

## Input / Output

| Direction | Port(s) |
|-----------|--------|
| Input | `Input` |
| Output | `Output`, `Error` |

## Credentials

This tool requires **Venafi TLS Protect Cloud** credentials.
See the [Credentials Guide](https://busybot.net/credentials/venafi-tls-protect-cloud-api/) for setup instructions.

### Resources

| Resource | Value |
|----------|-------|
| Certificate | `certificate` |
| Certificate Request | `certificateRequest` |

### Operations

| Operation | Value | Description |
|-----------|-------|-------------|
| Delete | `delete` | Delete a certificate |
| Download | `download` | Download a certificate |
| Get | `get` | Retrieve a certificate |
| Get Many | `getMany` | Retrieve many certificates |
| Renew | `renew` | Renew a certificate |
| Create | `create` | Create a new certificate request |

`delete`, `download` and `renew` exist only on Certificate. Certificate Request offers `create`, `get` and `getMany`.

### Parameters

#### Certificate: Download

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate ID | `string` | Yes | — | The ID of the certificate to download. Supports expressions. |
| Download Item | `options` | No | `certificate` | Whether to download the certificate itself or a keystore with the private key. |
| | | | | Options: `certificate` (the certificate file, PEM or DER), `keystore` (certificate plus private key) |
| Keystore Type | `options` | No | `PEM` | The format of the keystore to export. _(shown when Download Item is `keystore`)_ |
| | | | | Options: `JKS` (Java KeyStore), `PKCS12` (PKCS#12, .p12), `PEM` (PEM with private key) |
| Certificate Label | `string` | Yes | — | A label for the certificate within the keystore. _(shown when Download Item is `keystore`)_ |
| Private Key Passphrase | `string` | Yes | — | Passphrase to protect the private key. Will be encrypted before sending to the API. _(shown when Download Item is `keystore`)_ |
| Keystore Passphrase | `string` | Yes | — | Passphrase for the JKS keystore. Will be encrypted before sending to the API. _(shown when Download Item is `keystore` and Keystore Type is `JKS`)_ |
| Binary Property | `string` | Yes | `data` | Name of the binary property to write the downloaded certificate/keystore to. Names are case-sensitive — see the upstream node's Binary Data panel for the exact names to use. |
| Options (`options`) | `collection` | No | `{}` | Download formatting options. |
| — Chain Order | `options` | No | `ROOT_FIRST` | The order of the certificate chain in the download. |
| | | | | Options: `EE_FIRST` (end-entity certificate first), `EE_ONLY` (end-entity certificate only), `ROOT_FIRST` (root certificate first) |
| — Format | `options` | No | `PEM` | The format of the downloaded certificate (applies to certificate download, not keystore). |
| | | | | Options: `PEM`, `DER` |

#### Certificate: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate ID | `string` | Yes | — | The ID of the certificate. Supports expressions. |

#### Certificate: Delete

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate ID | `string` | Yes | — | The ID of the certificate. Supports expressions. |

#### Certificate: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |
| Filters | `collection` | No | `{}` | Narrows the certificate list. |
| — Subject | `string` | No | — | Filter certificates by subject. |

#### Certificate: Renew

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Application ID | `string` | Yes | — | The ID of the application. Find this in the Venafi Cloud console under Applications. Supports expressions. |
| Certificate Issuing Template ID | `string` | Yes | — | The ID of the certificate issuing template. Available under the application details in Venafi Cloud. |
| Existing Certificate ID | `string` | Yes | — | The ID of the existing certificate to renew. Supports expressions. |
| Certificate Signing Request | `string` | Yes | — | The PEM-encoded PKCS#10 CSR for the renewal. Supports expressions. |
| Options (`renewOptions`) | `collection` | No | `{}` | Renewal options. |
| — Validity Period | `options` | No | `P1Y` | How long the renewed certificate should be valid. |
| | | | | Options: `P1Y` (1 year), `P10D` (10 days), `PT12H` (12 hours) |

#### Certificate Request: Create

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Application ID | `string` | Yes | — | The ID of the application. Find this in the Venafi Cloud console under Applications. Supports expressions. |
| Certificate Issuing Template ID | `string` | Yes | — | The ID of the certificate issuing template. Available under the application details in Venafi Cloud. |
| Generate CSR | `boolean` | No | `false` | Whether to have Venafi generate the CSR server-side. If false, you must provide a CSR. |
| Common Name | `string` | Yes | — | The Common Name (CN) for the certificate subject. Supports expressions. _(shown when Generate CSR is `true`)_ |
| Additional Fields | `collection` | No | `{}` | Subject and key details for the server-generated CSR. _(shown when Generate CSR is `true`)_ |
| — Key Type | `options` | No | `RSA` | The encryption algorithm for the public key. |
| | | | | Options: `EC` (elliptic curve), `RSA` |
| — Key Curve | `options` | No | `ED25519` | The elliptic curve to use (only relevant for EC key type). |
| | | | | Options: `ED25519` (EdDSA), `P256`, `P384`, `P521`, `UNKNOWN` |
| — Key Length | `number` | No | `2048` | The number of bits for key generation (only relevant for RSA key type). |
| — Organization | `string` | No | — | The (O) organization name for the certificate subject. |
| — Organizational Units | `string` | No | — | Comma-separated list of (OU) organizational unit names. |
| — City / Locality | `string` | No | — | The (L) city or locality for the certificate subject. |
| — State | `string` | No | — | The (ST) state or province for the certificate subject. |
| — Country | `string` | No | — | The (C) 2-letter country code for the certificate subject. |
| — DNS Subject Alt Names | `string` | No | — | Comma-separated list of DNS Subject Alternative Names (SANs). |
| Certificate Signing Request | `string` | No | — | The PEM-encoded PKCS#10 CSR. Required when Generate CSR is false. Supports expressions. _(shown when Generate CSR is `false`)_ |
| Options (`createOptions`) | `collection` | No | `{}` | Issuance options. |
| — Validity Period | `string` | No | `P1Y` | How long the issued certificate should be valid. Use ISO 8601 duration format (e.g. P1Y for 1 year, P10D for 10 days, PT12H for 12 hours). |

#### Certificate Request: Get

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Certificate Request ID | `string` | Yes | — | The ID of the certificate request. Supports expressions. |

#### Certificate Request: Get Many

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Return All | `boolean` | No | `false` | Whether to return all results or only up to a given limit. |
| Limit | `number` | No | `50` | Max number of results to return. _(shown when Return All is `false`)_ |

#### All Operations

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| Max Concurrency | `number` | No | `10` | Maximum number of items to process concurrently. |

## Output Data

The Venafi record is merged onto the top level of the item JSON; anything already on the item passes through, and existing binary data is forwarded.

| Operation | Output |
|-----------|--------|
| Certificate `download` | **One item** carrying the file itself on the binary property you named, plus `certificateId`, `downloadItem`, `fileName` and `fileSize` on the JSON. The file name comes from Venafi's `content-disposition` header, falling back to `certificate.pem` / `certificate.der` or `keystore.jks` / `keystore.p12` / `keystore.pem`, and the MIME type is detected from that name and the bytes |
| Certificate `get` | One item carrying the certificate record |
| Certificate `getMany` | **Fans out** — one item per certificate |
| Certificate `delete` | One item per deleted certificate record Venafi returns |
| Certificate `renew` | One item per certificate request Venafi created for the renewal |
| Certificate Request `create` | One item per certificate request Venafi created |
| Certificate Request `get` | One item carrying the certificate request record |
| Certificate Request `getMany` | **Fans out** — one item per certificate request |

With **Return All** on, the node follows Venafi's `Next` link until the list is exhausted.

Keystore downloads encrypt both passphrases before they leave the workflow: the node reads the certificate's data-encryption key hash, fetches the matching public key from Venafi and seals each passphrase against it. A certificate without that key hash cannot be exported as a keystore and fails the item with an explicit message.

## Usage Examples

- Download a TLS certificate as PEM
- Download a PKCS12 keystore for a certificate
- Create a certificate request with server-generated CSR
- Renew an expiring certificate
- List all certificates with a specific subject

## Example Configuration

Download a certificate as PEM, root first:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "certificate",
    "binaryPropertyName": "data",
    "options": {
      "chainOrder": "ROOT_FIRST",
      "format": "PEM"
    }
  }
}
```

Download a PKCS12 keystore:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "keystore",
    "keystoreType": "PKCS12",
    "certificateLabel": "My Certificate",
    "privateKeyPassphrase": "myPrivateKeyPass",
    "binaryPropertyName": "keystoreData"
  }
}
```

Download a JKS keystore — JKS also needs the keystore passphrase:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "keystore",
    "keystoreType": "JKS",
    "certificateLabel": "My Certificate",
    "privateKeyPassphrase": "myPrivateKeyPass",
    "keystorePassphrase": "myKeystorePass",
    "binaryPropertyName": "keystoreData"
  }
}
```

Look up one certificate:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "get",
    "certificateId": "cert-123456"
  }
}
```

List certificates by subject — one output item per certificate:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "getMany",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "subject": "CN=example.com"
    }
  }
}
```

Renew a certificate with a CSR from the item:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "renew",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "existingCertificateId": "cert-123456",
    "certificateSigningRequest": "{{ $json.csr }}",
    "renewOptions": {
      "validityPeriod": "P1Y"
    }
  }
}
```

Request a new certificate and let Venafi generate the CSR:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "create",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "generateCsr": true,
    "commonName": "www.example.com",
    "additionalFields": {
      "keyType": "RSA",
      "keyLength": 2048,
      "organization": "Example Corp",
      "organizationalUnits": "IT Department",
      "locality": "San Francisco",
      "state": "California",
      "country": "US",
      "dnsNames": "www.example.com,example.com"
    },
    "createOptions": {
      "validityPeriod": "P1Y"
    }
  }
}
```

Request a new certificate with your own CSR:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "create",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "generateCsr": false,
    "certificateSigningRequest": "{{ $json.csr }}",
    "createOptions": {
      "validityPeriod": "P2Y"
    }
  }
}
```

Check on a request you submitted earlier:

```json
{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "get",
    "certificateRequestId": "{{ $json.id }}"
  }
}
```

### Error Handling

| Mode | Behavior |
|------|----------|
| **stop** | Halts workflow on first error |
| **continue** | Skips failed items, passes successful ones through |
| **errorPort** | Routes failed items to Error output port |

## Tips

Manage Venafi TLS Protect Cloud certificates: download certificate/keystore files, create/renew certificate requests, and list/delete certificates.

### Common Patterns

**Certificate request workflow** — create the request with a server-generated CSR, poll the request with Certificate Request → Get until it is issued, then download the certificate.

**Keystore export workflow** — set Download Item to `keystore`, choose the Keystore Type your application needs, supply the passphrases, and write the result to a binary property that a following node (upload, write to file, email attachment) can pick up.