> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Venafi TPP CA

> Learn how to issue and manage certificates using a self-hosted Venafi Trust Protection Platform (TPP) instance with Infisical.

Issue and manage certificates using a self-hosted Venafi Trust Protection Platform (TPP) instance as an external CA, with support for airgapped environments via Infisical Gateway.

## Prerequisites

* A [Venafi TPP Connection](https://infisical.com/docs/integrations/app-connections/venafi-tpp.md) configured in your organization
* A policy folder in your TPP instance configured with an appropriate CA template
* Network connectivity from Infisical (or an Infisical Gateway) to the TPP server

## Setting up Venafi TPP as an external CA

**1. Navigate to External Certificate Authorities**

In **Certificate Manager**, go to **Certificate Authorities** and scroll to the **External Certificate Authorities** section.

**2. Create New Venafi TPP CA**

Select **Create CA** and configure:

* **Type**: Choose **Venafi TPP**
* **Name**: A friendly name for this CA (e.g., "Production TPP CA")
* **Status**: Set to **Active** to enable certificate issuance
* **Venafi TPP Connection**: Select your TPP connection from the dropdown
* **Policy DN**: The policy folder path in TPP where certificates will be managed (e.g., `\VED\Policy\Certificates\WebServers`)

> [!NOTE]
>
> The Policy DN must point to an existing policy folder in your TPP instance. The policy folder
> determines which CA template is used for signing, what subject fields are allowed, and other
> certificate constraints. Make sure the policy folder is configured to allow certificate requests
> from the credentials used in your TPP connection.

**3. Certificate Authority Created**

Your Venafi TPP CA is now ready. You can use it with certificate profiles to issue certificates.

## Issuing certificates

Once your Venafi TPP CA is set up, you can issue certificates by creating a profile, attaching it to an Application, and configuring enrollment:

**1. Create a Certificate Profile**

Go to **Certificate Manager → Certificate Profiles** and create a new profile:

* Set the **Certificate Authority** to your Venafi TPP CA
* Select a **Certificate Policy**
* Configure default certificate attributes (TTL, key algorithm, etc.)

**2. Create an Application and configure enrollment**

Go to **Certificate Manager → Applications** and create an Application (or use an existing one):

* Attach the profile you created
* Add an enrollment method (e.g., API) for the profile
* Assign team members who need to issue certificates

**3. Issue a Certificate**

In your Application, go to the **Certificate Requests** tab and select **Request**:

* Select the profile linked to your Venafi TPP CA
* Fill in the certificate details (common name, SANs, TTL)
* Click **Submit**

The certificate request is submitted to TPP asynchronously. Infisical will authenticate with TPP, submit the CSR to the configured policy folder, and retrieve the signed certificate.

> [!NOTE]
>
> Certificate issuance is asynchronous. Infisical will poll TPP for the signed certificate for
> up to \~5 minutes. Ensure your TPP policy folder is configured for automatic approval.

**4. Certificate Issued**

Your certificate has been issued by the TPP server and is ready for use.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.