-
Notifications
You must be signed in to change notification settings - Fork 64
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #461 from Venafi/VC-32719/certificate-provision
VCert SDK support for Certificate Provisioning
- Loading branch information
Showing
22 changed files
with
5,368 additions
and
149 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "log" | ||
| "os" | ||
|
|
||
| "github.com/Venafi/vcert/v5" | ||
| "github.com/Venafi/vcert/v5/pkg/endpoint" | ||
| "github.com/Venafi/vcert/v5/pkg/venafi/cloud" | ||
| ) | ||
|
|
||
| const ( | ||
| vcpURL = "VCP_URL" | ||
| vcpZone = "VCP_ZONE" | ||
| vcpApiKey = "CLOUD_APIKEY" | ||
| envVarNotSet = "environment variable not set: %s" | ||
|
|
||
| name = "example-provisioning" | ||
| ) | ||
|
|
||
| func main() { | ||
|
|
||
| // URL can be nil if using production TLSPC | ||
| url := os.Getenv(vcpURL) | ||
|
|
||
| zone, found := os.LookupEnv(vcpZone) | ||
| if !found { | ||
| log.Fatalf(envVarNotSet, vcpZone) | ||
| } | ||
|
|
||
| config := &vcert.Config{ | ||
| ConnectorType: endpoint.ConnectorTypeCloud, | ||
| BaseUrl: url, | ||
| Zone: zone, | ||
| Credentials: &endpoint.Authentication{APIKey: os.Getenv(vcpApiKey)}, | ||
| } | ||
|
|
||
| connector, err := vcert.NewClient(config) | ||
| if err != nil { | ||
| log.Fatalf("error creating client: %s", err.Error()) | ||
| } | ||
|
|
||
| certificateID := "<insert Certificate ID here>" | ||
| keystoreID := "<insert Keystore ID here>" | ||
| certName := "<insert google cert name>" // e.g. test2-venafi-com | ||
|
|
||
| // The ID is the Certificate name for Google, hence we send it as name | ||
| optionsGcp := &cloud.CloudProvisioningGCPOptions{ | ||
| ID: &certName, | ||
| } | ||
|
|
||
| optionsInput := endpoint.ProvisioningOptions(optionsGcp) | ||
|
|
||
| // Example for Azure Options | ||
| //optionsAzure := &cloud.CloudProvisioningAzureOptions{ | ||
| // Name: &certName, | ||
| //} | ||
| // | ||
| //optionsInput := endpoint.ProvisioningOptions(optionsAzure) | ||
|
|
||
| req := &endpoint.ProvisioningRequest{ | ||
| CertificateID: &certificateID, | ||
| KeystoreID: &keystoreID, | ||
| } | ||
|
|
||
| certMetaData, err := connector.ProvisionCertificate(req, &optionsInput) | ||
| if err != nil { | ||
| log.Fatalf("error provisioning: %s", err.Error()) | ||
| } | ||
|
|
||
| // Example to get values from other keystores machine identities metadata | ||
| //log.Printf("Certificate AWS Metadata ARN:\n%v", certMetaData.GetAWSCertificateMetadata().GetARN()) | ||
| //log.Printf("Certificate Azure Metadata ID:\n%v", certMetaData.GetAzureCertificateMetadata().GetID()) | ||
| //log.Printf("Certificate Azure Metadata Name:\n%v", certMetaData.GetAzureCertificateMetadata().GetName()) | ||
| //log.Printf("Certificate Azure Metadata Version:\n%v", certMetaData.GetAzureCertificateMetadata().GetVersion()) | ||
| log.Printf("Certificate GCP Metadata ID:\n%v", certMetaData.GetGCPCertificateMetadata().GetID()) | ||
| log.Printf("Certificate GCP Metadata Name:\n%v", certMetaData.GetGCPCertificateMetadata().GetName()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "crypto/x509/pkix" | ||
| "log" | ||
| "os" | ||
|
|
||
| "github.com/Venafi/vcert/v5" | ||
| "github.com/Venafi/vcert/v5/pkg/certificate" | ||
| "github.com/Venafi/vcert/v5/pkg/endpoint" | ||
| "github.com/Venafi/vcert/v5/pkg/venafi/cloud" | ||
| ) | ||
|
|
||
| const ( | ||
| vcpURL = "VCP_URL" | ||
| vcpZone = "VCP_ZONE" | ||
| vcpApiKey = "CLOUD_APIKEY" | ||
| envVarNotSet = "environment variable not set: %s" | ||
|
|
||
| name = "example-provisioning" | ||
| ) | ||
|
|
||
| func main() { | ||
|
|
||
| // URL can be nil if using production TLSPC | ||
| url := os.Getenv(vcpURL) | ||
|
|
||
| zone, found := os.LookupEnv(vcpZone) | ||
| if !found { | ||
| log.Fatalf(envVarNotSet, vcpZone) | ||
| } | ||
|
|
||
| config := &vcert.Config{ | ||
| ConnectorType: endpoint.ConnectorTypeCloud, | ||
| BaseUrl: url, | ||
| Zone: zone, | ||
| Credentials: &endpoint.Authentication{APIKey: os.Getenv(vcpApiKey)}, | ||
| } | ||
|
|
||
| connector, err := vcert.NewClient(config) | ||
| if err != nil { | ||
| log.Fatalf("error creating client: %s", err.Error()) | ||
| } | ||
|
|
||
| request := &certificate.Request{ | ||
| Subject: pkix.Name{ | ||
| CommonName: "common.name.venafi.example.com", | ||
| Organization: []string{"Venafi.com"}, | ||
| OrganizationalUnit: []string{"Integration Team"}, | ||
| Locality: []string{"Salt Lake"}, | ||
| Province: []string{"Salt Lake"}, | ||
| Country: []string{"US"}, | ||
| }, | ||
| DNSNames: []string{"www.client.venafi.example.com", "ww1.client.venafi.example.com"}, | ||
| CsrOrigin: certificate.ServiceGeneratedCSR, | ||
| KeyType: certificate.KeyTypeRSA, | ||
| KeyLength: certificate.DefaultRSAlength, | ||
| } | ||
|
|
||
| err = connector.GenerateRequest(nil, request) | ||
| if err != nil { | ||
| log.Fatalf("could not generate certificate request: %s", err) | ||
| } | ||
|
|
||
| requestID, err := connector.RequestCertificate(request) | ||
| if err != nil { | ||
| log.Fatalf("could not submit certificate request: %s", err) | ||
| } | ||
| log.Printf("Successfully submitted certificate request. Will pickup certificate by ID %s", requestID) | ||
|
|
||
| keystoreID := "<insert Keystore ID here>" | ||
| certName := "<insert cert name>" // e.g. test2-venafi-com | ||
|
|
||
| // The ID is the Certificate name for Google, hence we send it as name | ||
| optionsGcp := &cloud.CloudProvisioningGCPOptions{ | ||
| ID: &certName, | ||
| } | ||
|
|
||
| // Example for Azure Options | ||
| // optionsAzure := &cloud.CloudProvisioningAzureOptions{ | ||
| // Name: &certName, | ||
| // } | ||
| // | ||
| // optionsInput := endpoint.ProvisioningOptions(optionsAzure) | ||
|
|
||
| optionsInput := endpoint.ProvisioningOptions(optionsGcp) | ||
|
|
||
| req := &endpoint.ProvisioningRequest{ | ||
| KeystoreID: &keystoreID, | ||
| PickupID: &requestID, | ||
| } | ||
|
|
||
| certMetaData, err := connector.ProvisionCertificate(req, &optionsInput) | ||
| if err != nil { | ||
| log.Fatalf("error provisioning: %s", err.Error()) | ||
| } | ||
|
|
||
| // Example to get values from other keystores machine identities metadata | ||
| //log.Printf("Certificate AWS Metadata ARN:\n%v", certMetaData.GetAWSCertificateMetadata().GetARN()) | ||
| //log.Printf("Certificate Azure Metadata ID:\n%v", certMetaData.GetAzureCertificateMetadata().GetID()) | ||
| //log.Printf("Certificate Azure Metadata Name:\n%v", certMetaData.GetAzureCertificateMetadata().GetName()) | ||
| //log.Printf("Certificate Azure Metadata Version:\n%v", certMetaData.GetAzureCertificateMetadata().GetVersion()) | ||
| log.Printf("Certificate GCP Metadata ID:\n%v", certMetaData.GetGCPCertificateMetadata().GetID()) | ||
| log.Printf("Certificate GCP Metadata Name:\n%v", certMetaData.GetGCPCertificateMetadata().GetName()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.