Venafi / CyberArk Certificate Manager

How It Works

The Venafi connector enumerates every certificate in your Venafi-managed inventory, assesses each for PQC readiness, and emits one quantum_readiness event per certificate. No scanning agent or Venafi SDK is required — the connector uses only standard net/http.

🔑

Authenticate

VaaS: tppl-api-key header. TPP: POST /vedauth/authorize with client_id=tychon-scanner → bearer token for all subsequent calls.

📋

Paginate

VaaS: GET /outagedetection/v1/certificates?limit=100&offset=N. TPP: GET /vedsdk/certificates?Limit=100&Offset=N&Recursive=1. Both paginate until all certs retrieved.

🛡️

Assess

Each certificate is evaluated against OMB M-23-02 and CNSA 2.0 criteria. RSA < 4096 and ECDSA < P-384 are flagged pqc_vulnerable: true.

Mode Auto-Detection

The scanner automatically selects VaaS or TPP mode based on credentials stored in config.enc. If an API key is present, VaaS mode is used. If a URL + username/password is present, TPP mode is used. Both can be configured simultaneously for environments with both deployment types.

Deployment Modes

VaaS

TLS Protect Cloud (SaaS)

Formerly Venafi-as-a-Service, now CyberArk Certificate Manager. Hosted at api.venafi.cloud.

API key from VaaS Settings → API Keys
No on-premises infrastructure required
Authentication via tppl-api-key header
Certificate metadata without raw PEM

TPP

Trust Protection Platform (On-Prem)

Venafi TrustPoint / TLS Protect. Requires a self-hosted TPP v21.4+ server with REST API enabled.

OAuth2 bearer token via /vedauth/authorize
Requires client_id=tychon-scanner registered in TPP
Policy folder (zone) scoping supported
Internal CA certificate supported via -venafi-cacert

Prerequisites

VaaS (CyberArk Certificate Manager SaaS)

Generate an API Key

Log in to https://ui.venafi.cloud → Settings → API Keys → Generate API Key. The key is a UUID format and has a configurable expiration. Copy it — it is only shown once.

Verify API access

The scanner verifies credentials by calling GET https://api.venafi.cloud/v1/useraccounts before paginating. Ensure your API key has at least Certificate:Read scope.

TPP (Trust Protection Platform On-Premises)

Required: OAuth Client Registration

Before the scanner can authenticate to TPP, a Venafi administrator must register the tychon-scanner client in TPP's OAuth application configuration. This is a one-time setup step.

In the Venafi Platform UI or via the WebSDK API, add a new OAuth application:

{
  "Name": "TYCHON PQC Scanner",
  "ClientId": "tychon-scanner",
  "Scope": "certificate:read",
  "GrantType": "password",
  "Description": "TYCHON PQC Scanner certificate inventory connector"
}

Alternatively, run: POST /vedauth/OAuthApplicationManagement/create with the above payload using an admin token.

Create a service account with Certificate:Read permission

Create a dedicated Venafi local user (e.g. svc_tychon) or use an AD service account. Grant Certificate:Read on \VED\Policy. No write permissions are required.

Confirm token auth endpoint is accessible

The token-based auth API (/vedauth/authorize) is available from TPP v19.3+. If you are on an older version, upgrade before using this connector.

# Quick test — should return HTTP 200 with access_token
curl -s -X POST https://tpp.corp.com/vedauth/authorize \
  -H 'Content-Type: application/json' \
  -d '{"username":"svc_tychon","password":"","client_id":"tychon-scanner","scope":"certificate:read"}' \
  | python3 -m json.tool

Token TTL

Default Venafi TPP token TTL is 1 hour. For large inventories (tens of thousands of certs) where the scan may exceed this window, re-run the scan — the connector re-authenticates each time it starts.

Configuration Flags

All credentials are stored in the encrypted config.enc file. Pass them once with -config and they persist for all future scans.

Flag	Mode	Stored	Description
-config-venafi-apikey	VaaS	✓ config.enc	Venafi VaaS API key (UUID format). Activates VaaS mode when set.
-config-venafi-url	TPP	✓ config.enc	TPP base URL, e.g. `https://tpp.corp.com`. Activates TPP mode when set.
-config-venafi-user	TPP	✓ config.enc	TPP service account username or UPN (e.g. `svc_tychon@corp.com`).
-config-venafi-pass	TPP	✓ config.enc	TPP service account password. Never passed on the command line after initial storage.
-config-venafi-zone	TPP	✓ config.enc	TPP policy folder to scope the search (e.g. `\VED\Policy\Certificates`). Defaults to `\VED\Policy` (all certs).
-venafi-cacert	TPP	runtime only	Path to PEM CA certificate for TPP TLS verification when TPP uses an internal CA.
-insecure	Both	runtime only	Skip TLS certificate verification. Use only for lab/dev TPP instances with self-signed certs.

Credential Security

All credentials are encrypted at rest using AES-256-GCM + PBKDF2 in config.enc. The TPP password is never stored in plaintext and is never passed as a command-line flag after the initial -config call.

Quick Start Examples

VaaS CyberArk Certificate Manager SaaS

# Store API key once
./build/certscanner -config \
  -config-venafi-apikey "3db703cd-a875-4a8f-a55f-0b7051acbb0e"

# Run PKI scan — enumerates all certs in your VaaS account
./build/certscanner -scan-pki -outputformat flatndjson \
  -output venafi_certs.ndjson

# Verify output — certs will have venafi-cloud:// source paths
grep "venafi-cloud://" venafi_certs.ndjson | wc -l

TPP Trust Protection Platform (On-Premises)

# Store TPP credentials once
./build/certscanner -config \
  -config-venafi-url "https://tpp.corp.com" \
  -config-venafi-user "svc_tychon@corp.com" \
  -config-venafi-pass "ServiceAccount_Password_Here"

# Run PKI scan — authenticates via /vedauth/authorize, enumerates all certs
./build/certscanner -scan-pki -outputformat flatndjson \
  -output tpp_certs.ndjson

# Verify output — certs will have venafi-tpp:// source paths
grep "venafi-tpp://" tpp_certs.ndjson | wc -l

TPP TPP with Internal CA and Policy Folder Scoping

# Store creds with zone scoping
./build/certscanner -config \
  -config-venafi-url "https://tpp.corp.com" \
  -config-venafi-user "svc_tychon@corp.com" \
  -config-venafi-pass "ServiceAccount_Password_Here" \
  -config-venafi-zone "\VED\Policy\Certificates\Production"

# Run with internal CA cert (no -insecure needed)
./build/certscanner -scan-pki \
  -venafi-cacert /etc/ssl/certs/corp-internal-ca.pem \
  -outputformat flatndjson \
  -output tpp_production.ndjson

Send to Elasticsearch

# Configure both PKI and Elasticsearch credentials together in encrypted config.
./build/certscanner -scan-pki -posttoelastic

VaaS — Detailed Setup

Navigate to https://ui.venafi.cloud and log in with your CyberArk / Venafi account.

Generate an API Key

Go to Settings → API Keys → Generate API Key. Set an appropriate expiration (90 days minimum recommended for production use). Copy the key immediately — it is shown only once.

The API key is in UUID format (e.g. 3db703cd-a875-4a8f-a55f-0b7051acbb0e). It grants access to all certificates in your VaaS account — treat it as a high-value credential.

Store the API key and run

./build/certscanner -config -config-venafi-apikey "YOUR-API-KEY-HERE"
./build/certscanner -scan-pki -outputformat flatndjson -output vaas_scan.ndjson

VaaS API Endpoints Used

Endpoint	Method	Purpose
/v1/useraccounts	GET	Credential verification before paginating
/outagedetection/v1/certificates	GET	Certificate inventory (paginated, limit=100 per page)

SHA-256 Fingerprint Note

The VaaS API returns only SHA-1 fingerprints. The scanner derives a stable synthetic SHA-256 fingerprint from sha256(cert_id + ":" + sha1_fingerprint). This is deterministic across runs because the VaaS cert ID is a UUID assigned by VaaS to that certificate record and never changes.

TPP — Detailed Setup

An admin must register client_id=tychon-scanner in TPP before any scans can authenticate. See Prerequisites above for the full registration payload.

Store TPP credentials

./build/certscanner -config \
  -config-venafi-url "https://tpp.corp.com" \
  -config-venafi-user "svc_tychon@corp.com" \
  -config-venafi-pass "ServiceAccount_Password_Here"

Run the scan

./build/certscanner -scan-pki -outputformat flatndjson -output tpp_scan.ndjson

The connector will authenticate, paginate through /vedsdk/certificates starting from the configured zone, and emit one event per certificate.

TPP API Endpoints Used

Endpoint	Method	Purpose
/vedauth/authorize	POST	OAuth2 bearer token with `client_id=tychon-scanner`, `scope=certificate:read`
/vedsdk/certificates	GET	Certificate inventory (paginated, Limit=100 per page, Recursive=1)

Output Fields

Venafi certificates appear in the orphan_findings.filesystem_certificates array in the JSON report (or as quantum_readiness events in flat NDJSON). Source paths identify the origin platform.

Field	VaaS Value	TPP Value
source_file_path	venafi-cloud://{companyId}/certificates/{id}	venafi-tpp://{host}/vedsdk{DN}
certificate.sha256_fingerprint	Synthetic: sha256(cert_id + ":" + sha1)	Synthetic: sha256(DN + ":" + sha1)
certificate.sha1_fingerprint	VaaS API fingerprint field	TPP Thumbprint field
x509.signature_algorithm	Normalized from VaaS signatureAlgorithm	Inferred from key algorithm
x509.public_key_algorithm	RSA or ECDSA	RSA or ECDSA
x509.public_key_size	Key bits (RSA) or curve bits (EC)	Key bits (RSA) or curve bits (EC)
certificate.pqc_vulnerable	true if RSA < 4096 or EC < P-384
certificate.quantum_risk	critical / high / medium / low
certificate.migration_priority	critical / high / medium / low

Example: VaaS Certificate Event

{
  "event": { "action": "quantum_readiness", "dataset": "tychon.certs" },
  "source_file_path": "venafi-cloud://ab12cd34/certificates/7f3e2b1a-...",
  "x509": {
    "subject": { "common_name": "server.example.mil" },
    "issuer": { "common_name": "Example Corp CA" },
    "public_key_algorithm": "RSA",
    "public_key_size": 4096,
    "not_before": "2025-01-15T00:00:00Z",
    "not_after": "2026-01-15T00:00:00Z"
  },
  "certificate": {
    "sha1_fingerprint": "AA:BB:CC:...",
    "sha256_fingerprint": "A3B8C2...",
    "pqc_vulnerable": false,
    "quantum_risk": "medium",
    "migration_priority": "medium"
  }
}

PQC Assessment Logic

Every certificate from Venafi is assessed against OMB M-23-02 and CNSA 2.0 thresholds immediately after enumeration:

Algorithm	Key Size	pqc_vulnerable	quantum_risk
RSA	< 2048 bits	true	critical
RSA	2048 bits	true	high
RSA	3072–4095 bits	true	medium
RSA	≥ 4096 bits	false	medium
ECDSA	P-256 (256 bits)	true	high
ECDSA	P-384 (384 bits)	true	medium
ECDSA	P-521 (521 bits)	false	low

CNSA 2.0 Compliance

CNSA 2.0 requires RSA-4096 minimum and recommends EC P-521. Current ECDSA certs (even P-384) remain vulnerable to Shor's algorithm on quantum computers. RSA-4096 and EC P-521 are the last classical-crypto milestones before a full migration to ML-KEM and ML-DSA (Kyber/Dilithium).

Troubleshooting

VaaS: auth check returned HTTP 403

The api.venafi.cloud endpoint returned 403. Common causes:

API key expired — generate a new one in Settings → API Keys
API key was copied with leading/trailing whitespace — re-run -config -config-venafi-apikey with the exact UUID
API key doesn't have Certificate:Read scope — check key permissions

TPP: authentication failed: HTTP 400

The /vedauth/authorize request returned HTTP 400. This almost always means tychon-scanner is not registered as an OAuth client in TPP. Steps:

Ask your Venafi administrator to register the tychon-scanner client (see Prerequisites)
Verify with a manual curl call (see Prerequisites step 3)
Check TPP audit logs for the specific rejection reason

TPP: authentication failed: HTTP 401

Credentials are wrong. Check that username (full UPN or domain\user format) and password are correct. The service account must have been granted Certificate:Read on the policy folder.

TPP: TLS handshake error / x509: certificate signed by unknown authority

Your TPP server uses a certificate issued by an internal CA not in the OS trust store. Options:

Provide the CA cert: -venafi-cacert /path/to/internal-ca.pem
Lab only: -insecure (skips verification entirely)

venafi: no credentials configured — skipping

Neither a VaaS API key nor a TPP URL is set in config.enc. Run -config -config-venafi-apikey ... (VaaS) or -config -config-venafi-url ... (TPP) to configure credentials.

Zero certs returned from TPP

The configured zone may be empty or the service account may not have visibility into that folder. Try removing the zone (defaults to \VED\Policy) or setting it to the root: -config-venafi-zone "\VED\Policy".