venafi-connector-ca 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +95 -0
- package/bundle.mjs +32660 -0
- package/package.json +43 -0
package/README.md
ADDED
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
# venafi-connector-ca
|
|
2
|
+
|
|
3
|
+
An MCP (Model Context Protocol) server that provides CA connector-specific knowledge, templates, and tools for building **Venafi TLS Protect Cloud CA connectors**.
|
|
4
|
+
|
|
5
|
+
Use this with Claude Code or any MCP-compatible AI assistant to get expert guidance on Certificate Authority integrations — issuance flows, certificate import, revocation, and all the gotchas.
|
|
6
|
+
|
|
7
|
+
## What's Inside
|
|
8
|
+
|
|
9
|
+
| Tool | Description |
|
|
10
|
+
|---|---|
|
|
11
|
+
| `get_ca_manifest` | Complete CA connector manifest.json template with all domain schemas |
|
|
12
|
+
| `get_ca_domain_types` | Go domain types: Connection, Product, Order, Certificate, Import, Revocation |
|
|
13
|
+
| `get_ca_endpoints` | Handler and service interface templates for all 8 endpoints |
|
|
14
|
+
| `get_ca_best_practices` | Lessons learned from building the DigiCert ONE CA connector |
|
|
15
|
+
| `get_rest_client_pattern` | REST client with auth header, retry on 429, URL normalization |
|
|
16
|
+
| `get_cert_issuance_pattern` | Synchronous and asynchronous issuance flows |
|
|
17
|
+
| `get_cert_import_pattern` | Paginated certificate import with string cursors |
|
|
18
|
+
| `get_csr_parsing_pattern` | CSR attribute extraction and certificate parsing utilities |
|
|
19
|
+
|
|
20
|
+
### 8 CA Connector Endpoints
|
|
21
|
+
|
|
22
|
+
| Endpoint | Purpose |
|
|
23
|
+
|---|---|
|
|
24
|
+
| `testConnection` | Validate API credentials against the CA |
|
|
25
|
+
| `getOptions` | List available certificate profiles/products |
|
|
26
|
+
| `validateProduct` | Validate product configuration before issuance |
|
|
27
|
+
| `requestCertificate` | Submit CSR to the CA for certificate issuance |
|
|
28
|
+
| `checkOrder` | Poll status of pending certificate request |
|
|
29
|
+
| `checkCertificate` | Retrieve issued certificate by identifier |
|
|
30
|
+
| `importCertificates` | Paginated import of existing certificates |
|
|
31
|
+
| `revokeCertificate` | Revoke a certificate |
|
|
32
|
+
|
|
33
|
+
### Key Patterns
|
|
34
|
+
|
|
35
|
+
- **Synchronous issuance**: Certificate returned immediately (auto-approved CAs)
|
|
36
|
+
- **Asynchronous issuance**: Return pending status, poll via checkOrder/checkCertificate
|
|
37
|
+
- **Paginated import**: Offset-based pagination with string cursors, expired cert filtering
|
|
38
|
+
- **Rate limiting**: HTTP 429 retry with Retry-After header handling
|
|
39
|
+
- **CSR parsing**: Subject DN + SAN extraction from PKCS#10 requests
|
|
40
|
+
- **Certificate output**: Base64-encoded DER (no PEM headers) for Venafi
|
|
41
|
+
|
|
42
|
+
## Setup
|
|
43
|
+
|
|
44
|
+
### Claude Code
|
|
45
|
+
|
|
46
|
+
Add to your project's `.claude/settings.json`:
|
|
47
|
+
|
|
48
|
+
```json
|
|
49
|
+
{
|
|
50
|
+
"mcpServers": {
|
|
51
|
+
"venafi-connector-ca": {
|
|
52
|
+
"command": "npx",
|
|
53
|
+
"args": ["-y", "venafi-connector-ca"]
|
|
54
|
+
}
|
|
55
|
+
}
|
|
56
|
+
}
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
Best used alongside the core MCP:
|
|
60
|
+
|
|
61
|
+
```json
|
|
62
|
+
{
|
|
63
|
+
"mcpServers": {
|
|
64
|
+
"venafi-connector-core": {
|
|
65
|
+
"command": "npx",
|
|
66
|
+
"args": ["-y", "venafi-connector-core"]
|
|
67
|
+
},
|
|
68
|
+
"venafi-connector-ca": {
|
|
69
|
+
"command": "npx",
|
|
70
|
+
"args": ["-y", "venafi-connector-ca"]
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
}
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
## Built From Experience
|
|
77
|
+
|
|
78
|
+
Knowledge extracted from building the **DigiCert ONE CA connector**, covering:
|
|
79
|
+
|
|
80
|
+
- REST API client with `x-api-key` authentication
|
|
81
|
+
- Synchronous certificate issuance (auto-approve)
|
|
82
|
+
- Paginated certificate import with offset/limit
|
|
83
|
+
- Certificate revocation with reason code mapping
|
|
84
|
+
- CSR format handling (PEM with headers)
|
|
85
|
+
- Rate limit handling and retry logic
|
|
86
|
+
- Product options mapping from CA profiles
|
|
87
|
+
|
|
88
|
+
## Related Packages
|
|
89
|
+
|
|
90
|
+
- [`venafi-connector-core`](https://www.npmjs.com/package/venafi-connector-core) — Shared architecture, templates, deployment, troubleshooting
|
|
91
|
+
- [`venafi-connector-machine`](https://www.npmjs.com/package/venafi-connector-machine) — Machine connector endpoints, SSH/REST client patterns
|
|
92
|
+
|
|
93
|
+
## License
|
|
94
|
+
|
|
95
|
+
Apache-2.0
|