_This open source project is community-supported. To report a problem or share an idea, use
Issues; and if you have a suggestion for fixing the issue, please include those details, too.
In addition, use Pull Requests to contribute actual bug fixes or proposed enhancements.
We welcome and appreciate all contributions. Got questions or want to discuss something with our team?
Join us on Slack!_
VCert is a Go library, SDK, and command line utility designed to simplify key generation and enrollment of machine identities (also known as SSL/TLS certificates and keys) that comply with enterprise security policy by using the Venafi Trust Protection Platform or Venafi Control Plane or Venafi Firefly.
See VCert CLI for Venafi Trust Protection Platform or VCert CLI for Venafi Control Plane or VCert CLI for Venafi Firefly to get started with the command line utility.
VCert releases are tested using the latest version of Trust Protection Platform. General functionality of the latest VCert release should be compatible with Trust Protection Platform 17.3 or higher. Custom Fields and Instance Tracking require TPP 18.2 or higher, and Token Authentication requires TPP 20.1 or higher.
Configure your Go environment according to https://golang.org/doc/install.
Verify that GOPATH environment variable is set correctly
Download the source code:
go get github.com/Venafi/vcert/v5
or pre Go 1.13
git clone https://github.com/Venafi/vcert.git $GOPATH/src/github.com/Venafi/vcert/v5
Go 1.11 with go modules enabled or go 1.13 and up make sure to clone outside of $GOPATH/src
git clone https://github.com/Venafi/vcert.git
Build the command line utilities for Linux, macOS, and Windows:
make build
For code samples of programmatic use, please review the files in examples folder.
main.go
file, make the following import declarations:
import (
"github.com/Venafi/vcert/v5"
"github.com/Venafi/vcert/v5/pkg/certificate"
"github.com/Venafi/vcert/v5/pkg/endpoint"
)
&vcert.Config
that specifies the Venafi connection details. Solutions are
typically designed to get those details from a secrets vault, .ini file, environment variables, or command line parameters.NewClient
method of the vcert class with the configuration object.&certificate.Request
.GenerateRequest
method of the client.RequestCertificate
method of the client.RetrieveCertificate
method of the client.vcert.Config
method NewListener
with list of domains as arguments.
For example ("test.example.com:8443", "example.com")
net.Listener
as argument to built-in http.Serve
or other https servers. Samples are in a state where you can build/execute them using the following commands (after setting the environment variables discussed later):
go build -o cli ./example
go test -v ./example -run TestRequestCertificate
View
, Read
, Write
, Create
,
Revoke
(for the revoke action), and Private Key Read
(for the pickup action when CSR is service generated)The requirement for the CA Template to be assigned by policy follows a long-standing Venafi best practice which also met our design objective to keep the certificate request process simple for VCert users. If you require the ability to specify the CA Template with the request you can use the TPP REST APIs but please be advised this goes against Venafi recommendations.
Unit tests:
make test
Integration tests for Trust Protection Platform and Venafi Control Plane require access to those products. Environment
variables are used to specify required settings including credentials. The Venafi Control Plane API key and zone value
fragments (i.e. Application Name
\Issuing Template API Alias
) are readily available in the web interface.
export TPP_URL=https://tpp.venafi.example/vedsdk
export TPP_USER=tpp-user
export TPP_PASSWORD=tpp-password
export TPP_ZONE='some\suggested_policy'
export TPP_ZONE_RESTRICTED='some\locked_policy'
export TPP_ZONE_ECDSA='some\ecdsa_policy'
make tpp_test
export CLOUD_URL=https://api.venafi.cloud/v1
export CLOUD_APIKEY=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
export CLOUD_ZONE='My Application\Permissive CIT'
export CLOUD_ZONE_RESTRICTED='Your Application\Restrictive CIT'
make cloud_test
Command line utility tests make use of Cucumber & Aruba feature files.
To run tests for all features in parallel:
make cucumber
To run tests only for a specific feature:
make cucumber FEATURE=./features/basic/version.feature
Available features are:
basic
config
enroll
format
gencsr
renew
revoke
When run, these tests will be executed in their own Docker container using the Ruby version of Cucumber.
The completed test run will report on the number of test scenarios and steps that passed, failed, or were skipped.
For detailed explanations about the playbook and how it is build please check here: Readme Playbook
Venafi welcomes contributions from the developer community.
git clone git@github.com:youracct/vcert.git
git checkout -b your-branch-name
git commit -am 'Added some cool functionality'
git push origin your-branch-name
Copyright © Venafi, Inc. All rights reserved.
VCert is licensed under the Apache License, Version 2.0. See LICENSE for the full license text.
Please direct questions/comments to opensource@venafi.com.