Building for Certificate Manager Self-Hosted
Certificate Manager Self-Hosted (formerly TLS Protect Datacenter, and before that Trust Protection Platform/TPP) runs in your own datacenter. Integrations are built with the Adaptable Framework — PowerShell scripts that run directly on the Self-Hosted server.
The CA Connector and Machine Connector frameworks target the cloud platforms. They produce Go executables packaged as container images and pulled by a VSatellite, which Certificate Manager Self-Hosted does not use. If you're targeting Certificate Manager SaaS or Next-Gen Trust Security, see Connectors vs. Adaptable Drivers.
Adaptable Driver Types
The Adaptable Framework covers five driver types. Each is a PowerShell script implementing a defined set of functions that Certificate Manager Self-Hosted calls at the appropriate point in the certificate lifecycle.
| Driver type | Use it to |
|---|---|
| Adaptable App | Deploy and configure certificates on a target application or device |
| Adaptable CA | Issue certificates from a Certificate Authority that has no built-in driver |
| Adaptable Log | Forward platform log events to an external system |
| Adaptable Workflow | Insert custom approval or validation logic into a certificate workflow |
| Adaptable Bulk Provisioning | Provision certificates to many targets in a single operation |
Adaptable App is the most common type and is documented in full here: Adaptable App Drivers.
For the other four, start with the Adaptable Framework section, which covers the conventions all drivers share — hash tables, naming, credential handling, data validation, and logging — and links out to the per-type reference for each.
Other Build Paths
Not every integration needs a driver. For automation and scripting against an existing deployment:
| Approach | Use it to | Guide |
|---|---|---|
| WebSDK REST API | Automate certificate operations from any language | Certificate Manager Self-Hosted API |
| VCert SDK | Enroll, retrieve, and revoke certificates from Go, Python, Java, or .NET | VCert |
| VenafiPS | Automate from PowerShell | VenafiPS |
Prerequisites
Adaptable drivers run on the Certificate Manager Self-Hosted server itself, which means:
- PowerShell is the implementation language — no Go toolchain or container registry required.
- Scripts are installed under
C:\Program Files\Venafi\Scripts\in the subdirectory matching the driver type. - A script must be approved by saving the policy object in WebAdmin before it will execute, and re-approved after every edit.
- Anything the driver reaches must be reachable from the Self-Hosted server.
See the Adaptable Framework section for the full environment requirements.
Next Steps
- Adaptable App Drivers — a complete walkthrough of the most common driver type
- Integration Best Practices — error handling, logging, testing, and security patterns