Building Integrations
Introduction
Machine identity integrations connect Venafi's products with external systems for managing certificates, code signing, SSH keys, and more. This section provides guidance on building integrations for your own environment.
Important: You do NOT need to contribute your integration to the public marketplace. Build what you need for your organization, and only package it for public distribution if you want to share with the broader community.
Start With What You're Targeting
The product you're integrating with determines what you build. Start in the section for your target product.
| If you're targeting | You'll build | Start here |
|---|---|---|
| Next-Gen Trust Security (NGTS) | CA Connector, Machine Connector, REST API, VCert | Building for Next-Gen Trust Security |
| Certificate Manager SaaS (formerly TLS Protect Cloud) | CA Connector, Machine Connector, REST or GraphQL API, VCert | Building for Certificate Manager SaaS |
| Certificate Manager Self-Hosted (formerly TLS Protect Datacenter/TPP) | Adaptable Framework driver (PowerShell), WebSDK API, VCert, VenafiPS | Building for Certificate Manager Self-Hosted |
Already have a Certificate Manager SaaS integration and want to add NGTS? Most of your code carries over — see Adding NGTS Support to Your Integration. Self-Hosted is a separate codebase; it does not share a build model with the cloud platforms.
Connectors vs. Adaptable Drivers
This is the first fork most developers hit. The two are not alternatives you choose between on preference — each targets different products.
| Connectors (CA / Machine) | Adaptable Framework drivers | |
|---|---|---|
| Language | Go | PowerShell |
| Deployment | Container image, pulled and run by a VSatellite | Script on the Certificate Manager Self-Hosted server |
| Products | Next-Gen Trust Security, Certificate Manager SaaS | Certificate Manager Self-Hosted |
| Distribution | Production-grade, built for public distribution | Well suited to internal use |
| Discovery | Full discovery support | Limited |
| Tooling | Manifest editor, VenProxy simulator, framework validation | Test directly in the WebAdmin UI |
| Learn more | CA Connector Framework, Machine Connector Framework | Adaptable Framework, Adaptable App Drivers |
Which Approach Do I Need?
Once you know your product, pick the approach that matches what you're trying to do:
| Use Case | Recommended Approach | Products |
|---|---|---|
| Deploy certificates to a new device type | Machine Connector Framework | NGTS, Certificate Manager SaaS |
| Connect to a new Certificate Authority | CA Connector Framework | NGTS, Certificate Manager SaaS |
| Deploy certificates to an application on Self-Hosted | Adaptable App Driver | Certificate Manager Self-Hosted |
| Issue from a CA on Self-Hosted | Adaptable CA Driver | Certificate Manager Self-Hosted |
| Automate certificate operations in scripts | VCert SDK or REST API | All three |
| Automate from PowerShell | VenafiPS | Certificate Manager SaaS, Self-Hosted |
| Prototype and test quickly | VCert SDK or REST API | All three |
| Build a production-grade connector for public distribution | CA / Machine Connector Framework | NGTS, Certificate Manager SaaS |
Product Differences at a Glance
Connectors, REST API, and VCert integrations can target more than one product, but authentication and resource grouping differ in ways that affect your code.
| Aspect | Next-Gen Trust Security | Certificate Manager SaaS | Certificate Manager Self-Hosted |
|---|---|---|---|
| Authentication | OAuth 2.0 Client Credentials — Strata service account, or NGTS built-in account via Workload Identity Federation (Bearer token) | API key (tppl-api-key header) | OAuth 2.0 or API key, depending on server configuration |
| Base URL | https://api.strata.paloaltonetworks.com/ngts | https://api.venafi.cloud (region-specific) | Your own server (WebSDK) |
| Grouping / ownership | Certificates owned by a Tenant Service Group (TSG) and grouped with tags; Applications removed | Applications group certificates and dictate access | Policy folders |
| Access control | TSGs plus built-in or custom roles, managed in Strata Cloud Manager | Teams | Identity and permissions on policy folders |
| Primary build path | CA / Machine Connector (Go, containerized) | CA / Machine Connector (Go, containerized) | Adaptable Framework driver (PowerShell) |
Development Workflow
- Choose your product using the table above, and open that product's section
- Review the framework documentation for your chosen approach
- Set up your development environment following the framework guide
- Implement your integration using provided templates and patterns
- Test locally using simulation tools (VenProxy for connectors, the WebAdmin UI for Adaptable drivers)
- Deploy to your environment for production use
Best Practices
Review Integration Best Practices for:
- Error handling patterns
- Logging standards
- Testing strategies
- Security considerations
- Performance optimization
Getting Help
- Framework Documentation: See individual framework guides for detailed implementation guidance
- GitHub Issues: Report bugs or request features
- Support: cybr-mis.support@paloaltonetworks.com