> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Venafi TPP connection

> Learn how to configure a Venafi Trust Protection Platform (TPP) Connection for Infisical.

Connect Infisical to a self-hosted Venafi Trust Protection Platform (TPP) instance to use it as an external CA for certificate issuance and management.

## Prerequisites

* A self-hosted [Venafi Trust Protection Platform](https://venafi.com/) instance (on-premises or private cloud)
* An API Integration registered in your TPP instance with OAuth enabled
* A TPP user account with `certificate:manage,discover,revoke` and `configuration` scope privileges
* Network connectivity from Infisical to the TPP server (or an Infisical Gateway for airgapped environments)

> [!NOTE]
>
> To register an API Integration in Venafi TPP, navigate to **API** > **API Integrations** in the TPP web console
> and create a new integration with a Client ID. This Client ID is required when setting up the connection in Infisical.

## Connection setup

**1. Navigate to App Connections**

In Certificate Manager, navigate to the **App Connections** tab on the **Settings** page.

![App Connections Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png)

**2. Add Connection**

Select the **Venafi TPP** option from the connection options modal.

**3. Configure Connection Details**

Configure the following fields:

* **Name**: A friendly name for this connection (e.g., "Production TPP")
* **Method**: The authentication method. Currently only **OAuth** is supported.
* **Gateway** *(optional)*: Select an Infisical Gateway if your TPP instance is in an airgapped network without direct internet access.
* **TPP URL**: The HTTPS URL of your Venafi TPP instance (e.g., `https://tpp.example.com`). Must use HTTPS.
* **Client ID**: The OAuth Client ID from your TPP API Integration.
* **Username**: The TPP user account. Supports formats: `DOMAIN\username`, `username@domain.com`, or local usernames.
* **Password**: The password for the TPP user account.

Click **Connect to Venafi TPP** to validate your credentials and create the connection.

> [!NOTE]
>
> Infisical validates the credentials by authenticating with the TPP OAuth endpoint during connection creation.
> If validation fails, verify that:
>
> * The TPP URL is correct and reachable
> * The Client ID matches an API Integration registered in TPP
> * The username and password are correct
> * The API Integration has the required scopes enabled

**4. Connection Created**

Your **Venafi TPP Connection** is now available for use as an external CA in your Infisical certificate management projects.

## Gateway support

For Venafi TPP instances running in airgapped or isolated networks, you can route the connection through an [Infisical Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md). Select the appropriate gateway when creating the connection to enable Infisical to reach your TPP server through a secure tunnel.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.