Building for Certificate Manager SaaS
Certificate Manager SaaS (formerly TLS Protect Cloud) is the multi-tenant, cloud-hosted platform for machine identity management. Integrations run either as connectors — Go web services packaged as containers and executed by a VSatellite inside your network — or as direct API clients.
Choose Your Build Path
| Approach | Use it to | Guide |
|---|---|---|
| CA Connector | Issue certificates from a third-party Certificate Authority | CA Connector Framework |
| Machine Connector | Deploy and configure certificates on servers, load balancers, and network devices | Machine Connector Framework |
| REST API | Automate certificate operations from any language | Certificate Manager SaaS API |
| GraphQL API | Query certificate inventory and relationships in a single round trip | GraphQL API |
| VCert SDK | Enroll, retrieve, and revoke certificates from Go, Python, Java, or .NET | VCert |
| VenafiPS | Automate from PowerShell | VenafiPS |
Not sure whether you need a connector or a driver? See Connectors vs. Adaptable Drivers. Connectors are the path for Certificate Manager SaaS; PowerShell Adaptable drivers apply only to Certificate Manager Self-Hosted.
Authentication
Certificate Manager SaaS APIs authenticate with an API key passed in the tppl-api-key header:
tppl-api-key: <your-api-key>
The base URL is region-specific, rooted at https://api.venafi.cloud. Use the URL for the region your tenant is provisioned in.
Concepts That Affect Your Integration
Three platform concepts shape how a Certificate Manager SaaS integration is structured:
- Applications — logical groupings of certificates. An Application is assigned Issuing Templates, and certificate requests are made for an Application. If your integration requests certificates, it needs to know which Application to request against.
- Teams — the access-control boundary. Users belong to Teams, and Teams are granted access to Applications and Issuing Templates.
- VSatellite — the customer-side agent that pulls and runs connector container images. Anything a connector reaches must be reachable from the VSatellite, not from the cloud.
Neither exists in Next-Gen Trust Security. If you intend to support both platforms, avoid hard-coding a dependency on Applications — see Adding NGTS Support.
Deploying Your Connector
Once your connector is built and pushed to a registry, see Managing connectors for your tenant for adding it to a Certificate Manager SaaS tenant.
Also Supporting NGTS?
Next-Gen Trust Security shares the same connector frameworks and much of the same certificate lifecycle, but differs in authentication and resource grouping. Two changes require code on your side: switching authentication and removing any dependency on Applications.
Next Steps
- Integration Best Practices — error handling, logging, testing, and security patterns