Venafi TLS Protect Cloud

Permanently removes a TLS/SSL certificate from your Venafi TLS Protect Cloud inventory, revoking its tracked lifecycle.

Retrieves the certificate file (PEM, PFX, or JKS) from Venafi TLS Protect Cloud so the agent can deploy it to a server, load balancer, or secret store.

Fetches detailed metadata for a single certificate — including subject, SAN list, expiry date, issuing CA, and installation locations — so the agent can evaluate its current state.

Retrieves a filtered list of certificates from the Venafi inventory, supporting bulk reporting, expiry sweeps, and policy compliance audits across thousands of machine identities.

Triggers a renewal request for an existing certificate in Venafi, generating a new CSR against the original policy and kicking off the CA issuance workflow.

Submits a new certificate signing request to Venafi TLS Protect Cloud, applying the correct policy zone so the CA issues a certificate that matches your organization's security standards.

Returns a paginated inventory of all certificates in Venafi TLS Protect Cloud, optionally filtered by expiry window, policy zone, CN pattern, or issuing CA.

Initiates a new certificate issuance workflow in Venafi by submitting a fully-specified CSR, including key algorithm, key size, and validity period, to the designated policy zone.

Submits a revocation request to the issuing CA through Venafi, marking the certificate as untrusted and publishing the revocation to CRL and OCSP endpoints.

Grants approval for a pending certificate request in Venafi, advancing it through the issuance workflow when a human or automated policy gatekeeper has validated the request details.

Retrieves the current lifecycle status of a certificate — active, expired, revoked, pending renewal, or pending approval — so the agent can branch workflow logic accordingly.

Creates or updates a CA template in Venafi TLS Protect Cloud, defining the key algorithm, validity period, SAN requirements, and issuing CA for a class of certificates.

Returns all known installation locations for a certificate — hostnames, ports, and server types — giving the agent a complete map of where a certificate is deployed before renewal or revocation.

Updates custom metadata fields on a certificate record in Venafi — such as application owner, cost center, environment tag, or CMDB CI ID — without affecting the certificate itself.

Generates a compliance report showing which certificates in a policy zone violate current policy rules — mismatched key algorithms, excessive validity periods, or missing required SANs.

Fires when a TLS/SSL certificate's expiry date falls within a configurable look-ahead window (e.g. 30, 14, or 7 days), giving the agent time to act before an outage.

Fires the moment a TLS/SSL certificate passes its not-after timestamp, signalling an active outage risk that requires immediate triage.

Fires when Venafi TLS Protect Cloud records a successful certificate renewal, enabling downstream systems to ingest the new certificate without manual intervention.

Fires when Venafi TLS Protect Cloud's discovery engine finds a previously unknown TLS certificate or machine identity on the network, enabling the agent to assess and classify the rogue asset.

Fires when a certificate or machine identity breaches a configured policy rule — such as using a disallowed key algorithm, CA, or validity period — so the agent can enforce remediation.

Fires when a certificate request submitted to a CA is rejected or times out, giving the agent context to diagnose the failure and retry or escalate.

Fires when a pending revocation request clears the approval workflow, authorising the agent to complete teardown and propagate the revocation across dependent systems.