Skip to main content

Certificate operations using vCert and a service account

This guide shows how to use vCert with a Next-Gen Trust Security (NGTS) service account to authenticate and perform certificate operations such as issuing and renewing certificates. NGTS uses OAuth 2.0 client-credentials authentication: you obtain an access token from your service account's credentials, then use it for certificate operations.

Before you begin​

  • vCert installed on your host (available for Linux, Windows, and macOS — download here).
  • The NGTS API reachable from your system: https://api.strata.paloaltonetworks.com/ngts.
  • A registered Strata/NGTS service account granted permission to manage certificates. See the Palo Alto Networks service account documentation. From the service account, note its Client ID, Client Secret, Token URL, and Scope.
  • A Certificate Issuing Template configured for your tenant, and its API alias (used as the vCert zone).
note

The scope is formatted as tsg_id:<TSG_ID>, where <TSG_ID> is a 10-digit Tenant Service Group ID. This can be any TSG the service account is authorized for, including a sub-TSG — not just the TSG it was created under.

Step 1: Obtain an access token​

Use the getcred action with your service account credentials to obtain an OAuth2 access token:

vcert getcred -p ngts \
  --token-url '{TOKEN_URL}' \
  --client-id '{CLIENT_ID}' \
  --client-secret '{CLIENT_SECRET}' \
  --scope 'tsg_id:{TSG_ID}'

From the response, copy the access_token value. Refer to it as {NGTS_TOKEN} in the following steps.

tip

You can supply these values with environment variables instead of flags: VCERT_TOKEN_URL, VCERT_CLIENT_ID, VCERT_CLIENT_SECRET, and VCERT_SCOPE. The obtained token can be supplied to later commands with VCERT_TOKEN.

Step 2: Issue a certificate​

Use enroll with your access token, specifying the issuing template name as the zone (-z):

vcert enroll -p ngts \
  -t '{NGTS_TOKEN}' \
  -z '{ISSUING_TEMPLATE}' \
  --cn '{CERT_CN}'

Specify additional request details with optional parameters such as --san-dns, --key-type, and --key-size. Run vcert enroll -h to see all options.

Step 3: Renew a certificate​

vcert renew -p ngts \
  -t '{NGTS_TOKEN}' \
  --thumbprint '{CERT_THUMBPRINT}'

You can also renew by request (pickup) ID with --id.

More vCert operations​

vCert supports additional NGTS operations, including certificate retrieval (pickup), revocation (revoke), retirement (retire), provisioning to cloud keystores (provisioning cloudkeystore), and applying or viewing certificate policy (setpolicy / getpolicy). For the full command reference and required NGTS permissions per command, see the vCert CLI for NGTS documentation.