Venafi TLS Protect Cloud integration

Overview

The Venafi TLS Protect Cloud tool manages TLS/SSL certificates through Venafi’s cloud platform. Supports two resources: (1) Certificate — delete, download (PEM/DER certificate or JKS/PKCS12/PEM keystore with encrypted passphrases), get details, get many (with subject filter), and renew. (2) Certificate Request — create (with server-side CSR generation or user-provided CSR), get details, get many. Certificate download produces binary data (PEM files, DER files, or keystore archives). Uses API key authentication via the tppl-api-key header. Supports US and EU regions.

Node Type

Action (Binary) — handles file/binary data operations

Input / Output

Direction	Port(s)
Input	Input
Output	Output, Error

Credentials

This tool requires Venafi TLS Protect Cloud credentials. See the Credentials Guide for setup instructions.

Resources

Resource	Value
Certificate	certificate
Certificate Request	certificateRequest

Operations

Operation	Value	Description
Delete	delete	Delete a certificate
Download	download	Download a certificate
Get	get	Retrieve a certificate
Get Many	getMany	Retrieve many certificates
Renew	renew	Renew a certificate
Create	create	Create a new certificate request

delete, download and renew exist only on Certificate. Certificate Request offers create, get and getMany.

Parameters

Certificate: Download

Parameter	Type	Required	Default	Description
Certificate ID	string	Yes	—	The ID of the certificate to download. Supports expressions.
Download Item	options	No	certificate	Whether to download the certificate itself or a keystore with the private key.
				Options: certificate (the certificate file, PEM or DER), keystore (certificate plus private key)
Keystore Type	options	No	PEM	The format of the keystore to export. (shown when Download Item is keystore)
				Options: JKS (Java KeyStore), PKCS12 (PKCS#12, .p12), PEM (PEM with private key)
Certificate Label	string	Yes	—	A label for the certificate within the keystore. (shown when Download Item is keystore)
Private Key Passphrase	string	Yes	—	Passphrase to protect the private key. Will be encrypted before sending to the API. (shown when Download Item is keystore)
Keystore Passphrase	string	Yes	—	Passphrase for the JKS keystore. Will be encrypted before sending to the API. (shown when Download Item is keystore and Keystore Type is JKS)
Binary Property	string	Yes	data	Name of the binary property to write the downloaded certificate/keystore to. Names are case-sensitive — see the upstream node’s Binary Data panel for the exact names to use.
Options (options)	collection	No	{}	Download formatting options.
— Chain Order	options	No	ROOT_FIRST	The order of the certificate chain in the download.
				Options: EE_FIRST (end-entity certificate first), EE_ONLY (end-entity certificate only), ROOT_FIRST (root certificate first)
— Format	options	No	PEM	The format of the downloaded certificate (applies to certificate download, not keystore).
				Options: PEM, DER

Certificate: Get

Parameter	Type	Required	Default	Description
Certificate ID	string	Yes	—	The ID of the certificate. Supports expressions.

Certificate: Delete

Parameter	Type	Required	Default	Description
Certificate ID	string	Yes	—	The ID of the certificate. Supports expressions.

Certificate: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)
Filters	collection	No	{}	Narrows the certificate list.
— Subject	string	No	—	Filter certificates by subject.

Certificate: Renew

Parameter	Type	Required	Default	Description
Application ID	string	Yes	—	The ID of the application. Find this in the Venafi Cloud console under Applications. Supports expressions.
Certificate Issuing Template ID	string	Yes	—	The ID of the certificate issuing template. Available under the application details in Venafi Cloud.
Existing Certificate ID	string	Yes	—	The ID of the existing certificate to renew. Supports expressions.
Certificate Signing Request	string	Yes	—	The PEM-encoded PKCS#10 CSR for the renewal. Supports expressions.
Options (renewOptions)	collection	No	{}	Renewal options.
— Validity Period	options	No	P1Y	How long the renewed certificate should be valid.
				Options: P1Y (1 year), P10D (10 days), PT12H (12 hours)

Certificate Request: Create

Parameter	Type	Required	Default	Description
Application ID	string	Yes	—	The ID of the application. Find this in the Venafi Cloud console under Applications. Supports expressions.
Certificate Issuing Template ID	string	Yes	—	The ID of the certificate issuing template. Available under the application details in Venafi Cloud.
Generate CSR	boolean	No	false	Whether to have Venafi generate the CSR server-side. If false, you must provide a CSR.
Common Name	string	Yes	—	The Common Name (CN) for the certificate subject. Supports expressions. (shown when Generate CSR is true)
Additional Fields	collection	No	{}	Subject and key details for the server-generated CSR. (shown when Generate CSR is true)
— Key Type	options	No	RSA	The encryption algorithm for the public key.
				Options: EC (elliptic curve), RSA
— Key Curve	options	No	ED25519	The elliptic curve to use (only relevant for EC key type).
				Options: ED25519 (EdDSA), P256, P384, P521, UNKNOWN
— Key Length	number	No	2048	The number of bits for key generation (only relevant for RSA key type).
— Organization	string	No	—	The (O) organization name for the certificate subject.
— Organizational Units	string	No	—	Comma-separated list of (OU) organizational unit names.
— City / Locality	string	No	—	The (L) city or locality for the certificate subject.
— State	string	No	—	The (ST) state or province for the certificate subject.
— Country	string	No	—	The (C) 2-letter country code for the certificate subject.
— DNS Subject Alt Names	string	No	—	Comma-separated list of DNS Subject Alternative Names (SANs).
Certificate Signing Request	string	No	—	The PEM-encoded PKCS#10 CSR. Required when Generate CSR is false. Supports expressions. (shown when Generate CSR is false)
Options (createOptions)	collection	No	{}	Issuance options.
— Validity Period	string	No	P1Y	How long the issued certificate should be valid. Use ISO 8601 duration format (e.g. P1Y for 1 year, P10D for 10 days, PT12H for 12 hours).

Certificate Request: Get

Parameter	Type	Required	Default	Description
Certificate Request ID	string	Yes	—	The ID of the certificate request. Supports expressions.

Certificate Request: Get Many

Parameter	Type	Required	Default	Description
Return All	boolean	No	false	Whether to return all results or only up to a given limit.
Limit	number	No	50	Max number of results to return. (shown when Return All is false)

All Operations

Parameter	Type	Required	Default	Description
Max Concurrency	number	No	10	Maximum number of items to process concurrently.

Output Data

The Venafi record is merged onto the top level of the item JSON; anything already on the item passes through, and existing binary data is forwarded.

Operation	Output
Certificate download	One item carrying the file itself on the binary property you named, plus certificateId, downloadItem, fileName and fileSize on the JSON. The file name comes from Venafi’s content-disposition header, falling back to certificate.pem / certificate.der or keystore.jks / keystore.p12 / keystore.pem, and the MIME type is detected from that name and the bytes
Certificate get	One item carrying the certificate record
Certificate getMany	Fans out — one item per certificate
Certificate delete	One item per deleted certificate record Venafi returns
Certificate renew	One item per certificate request Venafi created for the renewal
Certificate Request create	One item per certificate request Venafi created
Certificate Request get	One item carrying the certificate request record
Certificate Request getMany	Fans out — one item per certificate request

With Return All on, the node follows Venafi’s Next link until the list is exhausted.

Keystore downloads encrypt both passphrases before they leave the workflow: the node reads the certificate’s data-encryption key hash, fetches the matching public key from Venafi and seals each passphrase against it. A certificate without that key hash cannot be exported as a keystore and fails the item with an explicit message.

Example Configuration

Download a certificate as PEM, root first:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "certificate",
    "binaryPropertyName": "data",
    "options": {
      "chainOrder": "ROOT_FIRST",
      "format": "PEM"
    }
  }
}

Download a PKCS12 keystore:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "keystore",
    "keystoreType": "PKCS12",
    "certificateLabel": "My Certificate",
    "privateKeyPassphrase": "myPrivateKeyPass",
    "binaryPropertyName": "keystoreData"
  }
}

Download a JKS keystore — JKS also needs the keystore passphrase:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "download",
    "certificateId": "cert-123456",
    "downloadItem": "keystore",
    "keystoreType": "JKS",
    "certificateLabel": "My Certificate",
    "privateKeyPassphrase": "myPrivateKeyPass",
    "keystorePassphrase": "myKeystorePass",
    "binaryPropertyName": "keystoreData"
  }
}

Look up one certificate:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "get",
    "certificateId": "cert-123456"
  }
}

List certificates by subject — one output item per certificate:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "getMany",
    "returnAll": false,
    "limit": 50,
    "filters": {
      "subject": "CN=example.com"
    }
  }
}

Renew a certificate with a CSR from the item:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificate",
    "operation": "renew",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "existingCertificateId": "cert-123456",
    "certificateSigningRequest": "{{ $json.csr }}",
    "renewOptions": {
      "validityPeriod": "P1Y"
    }
  }
}

Request a new certificate and let Venafi generate the CSR:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "create",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "generateCsr": true,
    "commonName": "www.example.com",
    "additionalFields": {
      "keyType": "RSA",
      "keyLength": 2048,
      "organization": "Example Corp",
      "organizationalUnits": "IT Department",
      "locality": "San Francisco",
      "state": "California",
      "country": "US",
      "dnsNames": "www.example.com,example.com"
    },
    "createOptions": {
      "validityPeriod": "P1Y"
    }
  }
}

Request a new certificate with your own CSR:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "create",
    "applicationId": "app-123456",
    "certificateIssuingTemplateId": "template-789012",
    "generateCsr": false,
    "certificateSigningRequest": "{{ $json.csr }}",
    "createOptions": {
      "validityPeriod": "P2Y"
    }
  }
}

Check on a request you submitted earlier:

{
  "type": "venafi",
  "parameters": {
    "resource": "certificateRequest",
    "operation": "get",
    "certificateRequestId": "{{ $json.id }}"
  }
}

Error Handling

Mode	Behavior
stop	Halts workflow on first error
continue	Skips failed items, passes successful ones through
errorPort	Routes failed items to Error output port

Tips

This tool manages certificates and certificate requests using the Venafi TLS Protect Cloud service. It is ideal for operations like downloading certificate files, creating new certificate requests, renewing existing certificates, or retrieving details about many certificates. The tool produces certificate files in various formats, including PEM, DER, JKS, and PKCS12, or details about certificate requests and certificates.

Common Patterns

Certificate request workflow — create the request with a server-generated CSR, poll the request with Certificate Request → Get until it is issued, then download the certificate.

Keystore export workflow — set Download Item to keystore, choose the Keystore Type your application needs, supply the passphrases, and write the result to a binary property that a following node (upload, write to file, email attachment) can pick up.