Venafi TPP - Export Certificate

Octopus.Script exported 2021-08-18 by harrisonmeister belongs to ‘Venafi’ category.

This step template will authenticate against a Venafi TPP instance using an existing OAuth access token, and export a certificate using its Distinguished Name (DN). This is the absolute path to the certificate in the TPP instance.

This is achieved using the VenafiPS PowerShell module’s Export-VenafiCertificate function.


Options:

  • Provide the distinguished name (DN) path to the certificate.
  • Choose from the following export formats:
    • Base64
    • Base64 (PKCS #8)
    • DER
    • JKS
    • PKCS #7
    • PKCS #12
  • Optional - Provide a custom output path.
  • Optional - Provide a custom output filename. If not supplied, the filename will automatically be taken from the response.
  • Optional - Include the full certificate chain in the export.
  • Optional - Friendly name (Label or alias) to use. Permitted with Base64 and PKCS #12 formats. Required when format is JKS.
  • Optional - Include the private key in the export.
  • Optional - Provide a password to be used for the exported private key.
  • Optional - store the export certificate response in JSON format in an Octopus sensitive output variable. This output variable can then be used in additional deployment or runbook steps.
  • Optional - on successful completion, you can revoke the access token used.

Required:

  • The VenafiPS PowerShell module installed on the deployment target or worker. If the module can’t be found, the step will attempt to download a version from the PowerShell gallery.
  • PowerShell 5 or greater.

Notes:

  • Tested on Octopus 2021.2.
  • Tested with VenafiPS 3.1.5.
  • Tested with both Windows PowerShell and PowerShell Core on Linux.

Parameters

When steps based on the template are included in a project’s deployment process, the parameters below can be set.

Venafi TPP Server

Venafi.TPP.ExportCert.Server =

Required: The URL of the Venafi TPP instance you want to export a certificate from.

For example: https://mytppserver.example.com.

Venafi TPP Access Token

Venafi.TPP.ExportCert.AccessToken =

Required: The access token to authenticate against the TPP instance.

Venafi TPP Certificate Path

Venafi.TPP.ExportCert.DNPath =

Required: The Distinguished Name (DN) of the certificate you wish to export. This is the absolute path to the certificate in the TPP instance, separated by \.

Certificate Export Format

Venafi.TPP.ExportCert.Format =

Required: The certificate export format. Valid options are:

  • Base64
  • Base64 (PKCS #8)
  • DER
  • JKS
  • PKCS #7
  • PKCS #12

Certificate output folder (Optional)

Venafi.TPP.ExportCert.OutPath =

Optional: The folder path to save the certificate to. The folder must exist if this value is specified.

Certificate output filename (Optional)

Venafi.TPP.ExportCert.OutFileName =

Optional: The filename to save the exported certificate as. This value is used when the Venafi.TPP.ExportCert.OutPath parameter is set.

If not specified, the TPP filename will be used.

Include certificate chain (Optional)

Venafi.TPP.ExportCert.IncludeChain = False

Optional: Include the certificate chain with the exported certificate. Not supported with DER or JKS format. Default: False.

Friendly Name (Optional)

Venafi.TPP.ExportCert.FriendlyName =

Optional: Label or alias to use. Permitted with Base64 and PKCS #12 formats. Required when Format is JKS.

Include Private Key (Optional)

Venafi.TPP.ExportCert.IncludePrivateKey = False

Optional: Include the private key in the certificate export. If this is selected, the Venafi.TPP.Export.PrivateKeyPassword must also be provided. Default: False.

Private Key password (Optional)

Venafi.TPP.ExportCert.PrivateKeyPassword =

Optional: The password required to include the private key. Not supported with DER or PKCS #7 formats. You must adhere to the following rules:

  • Password is at least 12 characters.
  • Comprised of at least three of the following:
    • Uppercase alphabetic letters
    • Lowercase alphabetic letters
    • Numeric characters
    • Special characters

Certificate output variable name (Optional)

Venafi.TPP.ExportCert.OutputVariableName =

Optional: Create an output variable with the certificate details returned from the export call. The certificate details will be stored in JSON format.

Revoke access token on completion?

Venafi.TPP.ExportCert.RevokeTokenOnCompletion = False

Should the access token used be revoked once the step has been completed successfully? Default: False.

Script body

Steps based on this template will execute the following PowerShell script.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$ErrorActionPreference = 'Stop'

# Variables
$Server = $OctopusParameters["Venafi.TPP.ExportCert.Server"]
$Token = $OctopusParameters["Venafi.TPP.ExportCert.AccessToken"]
$Path = $OctopusParameters["Venafi.TPP.ExportCert.DNPath"]
$Format = $OctopusParameters["Venafi.TPP.ExportCert.Format"]
$OutPath = $OctopusParameters["Venafi.TPP.ExportCert.OutPath"]
$OutFileName = $OctopusParameters["Venafi.TPP.ExportCert.OutFileName"]

# Optional
$IncludeChain = $OctopusParameters["Venafi.TPP.ExportCert.IncludeChain"]
$FriendlyName = $OctopusParameters["Venafi.TPP.ExportCert.FriendlyName"]
$IncludePrivateKey = $OctopusParameters["Venafi.TPP.ExportCert.IncludePrivateKey"]
$PrivateKeyPassword = $OctopusParameters["Venafi.TPP.ExportCert.PrivateKeyPassword"]
$OutputVariableName = $OctopusParameters["Venafi.TPP.ExportCert.OutputVariableName"]
$RevokeToken = $OctopusParameters["Venafi.TPP.ExportCert.RevokeTokenOnCompletion"]

# Validation
if ([string]::IsNullOrWhiteSpace($Server)) {
    throw "Required parameter Venafi.TPP.ExportCert.Server not specified"
}
if ([string]::IsNullOrWhiteSpace($Token)) {
    throw "Required parameter Venafi.TPP.ExportCert.AccessToken not specified"
}
if ([string]::IsNullOrWhiteSpace($Path)) {
    throw "Required parameter Venafi.TPP.ExportCert.DNPath not specified"
}
else {
    if ($Path.Contains("\") -eq $False) {
        throw "At least one '\' is required for the Venafi.TPP.ExportCert.DNPath value"
    }
}
if ([string]::IsNullOrWhiteSpace($Format)) {
    throw "Required parameter Venafi.TPP.ExportCert.Format not specified"
}
else {
    if ($Format -eq "JKS") {
        if ([string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {
            throw "Export format is JKS, and parameter Venafi.TPP.ExportCert.PrivateKeyPassword required but not set!"
        }
    }
}
# Conditional validation
if (-not [string]::IsNullOrWhiteSpace($OutPath)) {
    if (-not (Test-Path $OutPath -PathType Container)) {
        throw "Optional parameter Venafi.TPP.ExportCert.OutPath specified but does not exist!"
    }
}
if ($IncludePrivateKey -eq $True) {
    if ([string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {
        throw "IncludePrivateKey set to true, but parameter Venafi.TPP.ExportCert.PrivateKeyPassword not specified"
    }
}

$SecureToken = ConvertTo-SecureString $Token -AsPlainText -Force
[PSCredential]$AccessToken = New-Object System.Management.Automation.PsCredential("token", $SecureToken)

# Clean-up
$Server = $Server.TrimEnd('/')

# Required Modules
function Get-NugetPackageProviderNotInstalled {
    # See if the nuget package provider has been installed
    return ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))
}

# Check to see if the package provider has been installed
if ((Get-NugetPackageProviderNotInstalled) -ne $false) {
    Write-Host "Nuget package provider not found, installing ..."    
    Install-PackageProvider -Name Nuget -Force -Scope CurrentUser
}

Write-Host "Checking for required VenafiPS module ..."
$required_venafips_version = 3.1.5
$module_available = Get-Module -ListAvailable -Name VenafiPS | Where-Object { $_.Version -ge $required_venafips_version }
if (-not ($module_available)) {
    Write-Host "Installing VenafiPS module ..."
    Install-Module -Name VenafiPS -MinimumVersion 3.1.5 -Scope CurrentUser -Force
}
else {
    $first_match = $module_available | Select-Object -First 1 
    Write-Host "Found version: $($first_match.Version)"
}

Write-Host "Importing VenafiPS module ..."
Import-Module VenafiPS

$StepName = $OctopusParameters["Octopus.Step.Name"]

Write-Verbose "Venafi.TPP.ExportCert.Server: $Server"
Write-Verbose "Venafi.TPP.ExportCert.AccessToken: ********"
Write-Verbose "Venafi.TPP.ExportCert.DNPath: $Path"
Write-Verbose "Venafi.TPP.ExportCert.Format: $Format"
Write-Verbose "Venafi.TPP.ExportCert.OutPath: $OutPath"
Write-Verbose "Venafi.TPP.ExportCert.OutFileName: $OutFileName"
Write-Verbose "Venafi.TPP.ExportCert.IncludeChain: $IncludeChain"
Write-Verbose "Venafi.TPP.ExportCert.FriendlyName: $FriendlyName"
Write-Verbose "Venafi.TPP.ExportCert.IncludePrivateKey: $IncludePrivateKey"
Write-Verbose "Venafi.TPP.ExportCert.PrivateKeyPassword: ********"
Write-Verbose "Venafi.TPP.ExportCert.CertDetails.OutputVariableName: $OutputVariableName"
Write-Verbose "Venafi.TPP.ExportCert.RevokeTokenOnCompletion: $RevokeTokenOnCompletion"
Write-Verbose "Step Name: $StepName"

Write-Host "Requesting new session from $Server"
New-VenafiSession -Server $Server -AccessToken $AccessToken

# Export certificate
$ExportCert_Params = @{
    CertificateId = $Path;
    Format        = $Format;
}

# Optional IncludeChain field
if ($IncludeChain -eq $True) {
    if ($Format -eq "JKS") {
        Write-Warning "The IncludeChain parameter is not supported with JKS export format, ignoring."
    }
    else {
        $ExportCert_Params.IncludeChain = $True
    }
}

# Optional FriendlyName field
if (-not [string]::IsNullOrWhiteSpace($FriendlyName)) {
    $ExportCert_Params.FriendlyName = $FriendlyName
}

if (-not [string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {
    $SecurePrivateKeyPassword = ConvertTo-SecureString $PrivateKeyPassword -AsPlainText -Force
    if ($Format -eq "JKS") {
        $ExportCert_Params.KeystorePassword = $SecurePrivateKeyPassword      
    }
    elseif ($IncludePrivateKey -eq $True) {
        $ExportCert_Params.PrivateKeyPassword = $SecurePrivateKeyPassword    
        $ExportCert_Params.IncludePrivateKey = $True
    }
}

$ExportCertificateResponse = ((Export-VenafiCertificate @ExportCert_Params) 6> $null)

if ($null -eq $ExportCertificateResponse -or $null -eq $ExportCertificateResponse.CertificateData) {
    Write-Warning "No certificate data returned for path: $Path`nCheck the path value represents a certificate, and not a folder."
}
else {
    Write-Highlight "Successfully retrieved certificate data to export for path: $Path"
    
    if ([string]::IsNullOrWhiteSpace($OutPath) -eq $False) {
        $Filename = $ExportCertificateResponse.Filename
        if ([string]::IsNullOrWhiteSpace($OutFileName) -eq $False) {
            $Filename = $OutFileName
        }
        $outFile = Join-Path -Path $OutPath -ChildPath ($Filename.Trim('"'))
        $bytes = [Convert]::FromBase64String($ExportCertificateResponse.CertificateData)
        [IO.File]::WriteAllBytes($outFile, $bytes)
        Write-Host ('Saved {0} with format {1}' -f $outFile, $ExportCertificateResponse.Format)
    }
    if ([string]::IsNullOrWhiteSpace($OutputVariableName) -eq $False) {
        $CertificateJson = $ExportCertificateResponse | ConvertTo-Json -Compress -Depth 10 
        Set-OctopusVariable -Name $OutputVariableName -Value $CertificateJson -Sensitive
        Write-Highlight "Created sensitive output variable: ##{Octopus.Action[$StepName].Output.$OutputVariableName}"
    }
}

if ($RevokeToken -eq $true) {
    # Revoke TPP access token
    Write-Host "Revoking access token with $Server"
    Revoke-TppToken -AuthServer $Server -AccessToken $AccessToken -Force
}

Provided under the Apache License version 2.0.

Report an issue

To use this template in Octopus Deploy, copy the JSON below and paste it into the Library → Step templates → Import dialog.

{
  "Id": "2417aab5-6d84-4e0d-bc86-b2255bd4028a",
  "Name": "Venafi TPP - Export Certificate",
  "Description": "This step template will authenticate against a Venafi TPP instance using an existing OAuth access token, and export a certificate using its Distinguished Name (DN). This is the absolute path to the certificate in the TPP instance.\n\nThis is achieved using the VenafiPS PowerShell module's [Export-VenafiCertificate](https://venafips.readthedocs.io/en/latest/functions/Export-VenafiCertificate/) function.\n\n---\n\n**Options:**\n\n- Provide the distinguished name (DN) path to the certificate.\n- Choose from the following export formats:\n  - `Base64`\n  - `Base64 (PKCS #8)`\n  - `DER`\n  - `JKS`\n  - `PKCS #7`\n  - `PKCS #12` \n- *Optional* - Provide a custom output path.\n- *Optional* - Provide a custom output filename. If not supplied, the filename will automatically be taken from the response.\n- *Optional* - Include the full certificate chain in the export.\n- *Optional* - Friendly name (Label or alias) to use. Permitted with `Base64` and `PKCS #12` formats. Required when format is `JKS`.\n- *Optional* - Include the private key in the export.\n- *Optional* - Provide a password to be used for the exported private key.\n- *Optional* - store the export certificate response in `JSON` format in an [Octopus sensitive output variable](https://octopus.com/docs/projects/variables/output-variables#sensitive-output-variables). This output variable can then be used in additional deployment or runbook steps.\n- *Optional* - on successful completion, you can revoke the access token used.\n\n---\n\n**Required:** \n- The `VenafiPS` PowerShell module installed on the deployment target or worker. If the module can't be found, the step will attempt to download a version from the [PowerShell gallery](https://www.powershellgallery.com/packages/VenafiPS).\n- PowerShell `5` or greater.\n\nNotes:\n\n- Tested on Octopus `2021.2`.\n- Tested with VenafiPS `3.1.5`.\n- Tested with both Windows PowerShell and PowerShell Core on Linux.",
  "Version": 3,
  "ExportedAt": "2021-08-18T15:22:55.551Z",
  "ActionType": "Octopus.Script",
  "Author": "harrisonmeister",
  "Packages": [],
  "Parameters": [
    {
      "Id": "56ef4967-37f5-40a0-a66e-f3fa589b6467",
      "Name": "Venafi.TPP.ExportCert.Server",
      "Label": "Venafi TPP Server",
      "HelpText": "*Required*: The URL of the Venafi TPP instance you want to export a certificate from.\n\nFor example: `https://mytppserver.example.com`.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "49bcdbbb-3674-4901-8bf6-164e5e4bc395",
      "Name": "Venafi.TPP.ExportCert.AccessToken",
      "Label": "Venafi TPP Access Token",
      "HelpText": "*Required*: The access token to authenticate against the TPP instance.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "Sensitive"
      }
    },
    {
      "Id": "e3156852-4ba9-4dc0-8d39-5a93c52b1910",
      "Name": "Venafi.TPP.ExportCert.DNPath",
      "Label": "Venafi TPP Certificate Path",
      "HelpText": "*Required*: The Distinguished Name (DN) of the certificate you wish to export. This is the absolute path to the certificate in the TPP instance, separated by `\\`.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "4f9f4d4b-d686-4d00-aa93-af35b7df320b",
      "Name": "Venafi.TPP.ExportCert.Format",
      "Label": "Certificate Export Format",
      "HelpText": "*Required*: The certificate export format. Valid options are:\n\n- `Base64`\n- `Base64 (PKCS #8)`\n- `DER`\n- `JKS`\n- `PKCS #7`\n- `PKCS #12` ",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "Select",
        "Octopus.SelectOptions": "Base64|Base64\nBase64 (PKCS #8)|Base64 (PKCS #8)\nDER|DER\nJKS|JKS\nPKCS #7|PKCS #7\nPKCS #12|PKCS #12"
      }
    },
    {
      "Id": "7f7dc0f5-275e-4d32-a758-c942c9535bbc",
      "Name": "Venafi.TPP.ExportCert.OutPath",
      "Label": "Certificate output folder (Optional)",
      "HelpText": "*Optional*: The folder path to save the certificate to. The folder must exist if this value is specified.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "48df6311-3eba-49b6-8adb-03b7d9eac8b4",
      "Name": "Venafi.TPP.ExportCert.OutFileName",
      "Label": "Certificate output filename (Optional)",
      "HelpText": "*Optional*: The filename to save the exported certificate as. This value is used when the `Venafi.TPP.ExportCert.OutPath` parameter is set. \n\nIf not specified, the TPP filename will be used.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "309d30de-79b6-4461-8a54-1698aedd5822",
      "Name": "Venafi.TPP.ExportCert.IncludeChain",
      "Label": "Include certificate chain (Optional)",
      "HelpText": "*Optional*: Include the certificate chain with the exported certificate. Not supported with `DER` or `JKS` format. Default: `False`.",
      "DefaultValue": "False",
      "DisplaySettings": {
        "Octopus.ControlType": "Checkbox"
      }
    },
    {
      "Id": "71fecac3-25c4-4161-9135-94815a485f03",
      "Name": "Venafi.TPP.ExportCert.FriendlyName",
      "Label": "Friendly Name (Optional)",
      "HelpText": "*Optional*: Label or alias to use. Permitted with `Base64` and `PKCS #12` formats. Required when Format is `JKS`. ",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "2aaedf1d-be93-4df4-856c-c69650db452a",
      "Name": "Venafi.TPP.ExportCert.IncludePrivateKey",
      "Label": "Include Private Key (Optional)",
      "HelpText": "*Optional*: Include the private key in the certificate export. If this is selected, the `Venafi.TPP.Export.PrivateKeyPassword` must also be provided. Default: `False`.",
      "DefaultValue": "False",
      "DisplaySettings": {
        "Octopus.ControlType": "Checkbox"
      }
    },
    {
      "Id": "2d168360-bcbf-4bdc-833d-a9c182e98a47",
      "Name": "Venafi.TPP.ExportCert.PrivateKeyPassword",
      "Label": "Private Key password (Optional)",
      "HelpText": "*Optional*: The password required to include the private key. Not supported with `DER` or `PKCS #7` formats.  You must adhere to the following rules: \n\n- Password is at least 12 characters. \n- Comprised of at least three of the following: \n  - Uppercase alphabetic letters \n  - Lowercase alphabetic letters \n  - Numeric characters \n  - Special characters",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "Sensitive"
      }
    },
    {
      "Id": "84f92dd5-064b-47e5-bb11-3dd0faacfeb4",
      "Name": "Venafi.TPP.ExportCert.OutputVariableName",
      "Label": "Certificate output variable name (Optional)",
      "HelpText": "*Optional*: Create an output variable with the certificate details returned from the export call. The certificate details will be stored in `JSON` format.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "606acdfe-641a-47f2-a4ea-56559477ea0c",
      "Name": "Venafi.TPP.ExportCert.RevokeTokenOnCompletion",
      "Label": "Revoke access token on completion?",
      "HelpText": "Should the access token used be revoked once the step has been completed successfully? Default: `False`.",
      "DefaultValue": "False",
      "DisplaySettings": {
        "Octopus.ControlType": "Checkbox"
      }
    }
  ],
  "Properties": {
    "Octopus.Action.Script.ScriptSource": "Inline",
    "Octopus.Action.Script.Syntax": "PowerShell",
    "Octopus.Action.Script.ScriptBody": "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n$ErrorActionPreference = 'Stop'\n\n# Variables\n$Server = $OctopusParameters[\"Venafi.TPP.ExportCert.Server\"]\n$Token = $OctopusParameters[\"Venafi.TPP.ExportCert.AccessToken\"]\n$Path = $OctopusParameters[\"Venafi.TPP.ExportCert.DNPath\"]\n$Format = $OctopusParameters[\"Venafi.TPP.ExportCert.Format\"]\n$OutPath = $OctopusParameters[\"Venafi.TPP.ExportCert.OutPath\"]\n$OutFileName = $OctopusParameters[\"Venafi.TPP.ExportCert.OutFileName\"]\n\n# Optional\n$IncludeChain = $OctopusParameters[\"Venafi.TPP.ExportCert.IncludeChain\"]\n$FriendlyName = $OctopusParameters[\"Venafi.TPP.ExportCert.FriendlyName\"]\n$IncludePrivateKey = $OctopusParameters[\"Venafi.TPP.ExportCert.IncludePrivateKey\"]\n$PrivateKeyPassword = $OctopusParameters[\"Venafi.TPP.ExportCert.PrivateKeyPassword\"]\n$OutputVariableName = $OctopusParameters[\"Venafi.TPP.ExportCert.OutputVariableName\"]\n$RevokeToken = $OctopusParameters[\"Venafi.TPP.ExportCert.RevokeTokenOnCompletion\"]\n\n# Validation\nif ([string]::IsNullOrWhiteSpace($Server)) {\n    throw \"Required parameter Venafi.TPP.ExportCert.Server not specified\"\n}\nif ([string]::IsNullOrWhiteSpace($Token)) {\n    throw \"Required parameter Venafi.TPP.ExportCert.AccessToken not specified\"\n}\nif ([string]::IsNullOrWhiteSpace($Path)) {\n    throw \"Required parameter Venafi.TPP.ExportCert.DNPath not specified\"\n}\nelse {\n    if ($Path.Contains(\"\\\") -eq $False) {\n        throw \"At least one '\\' is required for the Venafi.TPP.ExportCert.DNPath value\"\n    }\n}\nif ([string]::IsNullOrWhiteSpace($Format)) {\n    throw \"Required parameter Venafi.TPP.ExportCert.Format not specified\"\n}\nelse {\n    if ($Format -eq \"JKS\") {\n        if ([string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {\n            throw \"Export format is JKS, and parameter Venafi.TPP.ExportCert.PrivateKeyPassword required but not set!\"\n        }\n    }\n}\n# Conditional validation\nif (-not [string]::IsNullOrWhiteSpace($OutPath)) {\n    if (-not (Test-Path $OutPath -PathType Container)) {\n        throw \"Optional parameter Venafi.TPP.ExportCert.OutPath specified but does not exist!\"\n    }\n}\nif ($IncludePrivateKey -eq $True) {\n    if ([string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {\n        throw \"IncludePrivateKey set to true, but parameter Venafi.TPP.ExportCert.PrivateKeyPassword not specified\"\n    }\n}\n\n$SecureToken = ConvertTo-SecureString $Token -AsPlainText -Force\n[PSCredential]$AccessToken = New-Object System.Management.Automation.PsCredential(\"token\", $SecureToken)\n\n# Clean-up\n$Server = $Server.TrimEnd('/')\n\n# Required Modules\nfunction Get-NugetPackageProviderNotInstalled {\n    # See if the nuget package provider has been installed\n    return ($null -eq (Get-PackageProvider -ListAvailable -Name Nuget -ErrorAction SilentlyContinue))\n}\n\n# Check to see if the package provider has been installed\nif ((Get-NugetPackageProviderNotInstalled) -ne $false) {\n    Write-Host \"Nuget package provider not found, installing ...\"    \n    Install-PackageProvider -Name Nuget -Force -Scope CurrentUser\n}\n\nWrite-Host \"Checking for required VenafiPS module ...\"\n$required_venafips_version = 3.1.5\n$module_available = Get-Module -ListAvailable -Name VenafiPS | Where-Object { $_.Version -ge $required_venafips_version }\nif (-not ($module_available)) {\n    Write-Host \"Installing VenafiPS module ...\"\n    Install-Module -Name VenafiPS -MinimumVersion 3.1.5 -Scope CurrentUser -Force\n}\nelse {\n    $first_match = $module_available | Select-Object -First 1 \n    Write-Host \"Found version: $($first_match.Version)\"\n}\n\nWrite-Host \"Importing VenafiPS module ...\"\nImport-Module VenafiPS\n\n$StepName = $OctopusParameters[\"Octopus.Step.Name\"]\n\nWrite-Verbose \"Venafi.TPP.ExportCert.Server: $Server\"\nWrite-Verbose \"Venafi.TPP.ExportCert.AccessToken: ********\"\nWrite-Verbose \"Venafi.TPP.ExportCert.DNPath: $Path\"\nWrite-Verbose \"Venafi.TPP.ExportCert.Format: $Format\"\nWrite-Verbose \"Venafi.TPP.ExportCert.OutPath: $OutPath\"\nWrite-Verbose \"Venafi.TPP.ExportCert.OutFileName: $OutFileName\"\nWrite-Verbose \"Venafi.TPP.ExportCert.IncludeChain: $IncludeChain\"\nWrite-Verbose \"Venafi.TPP.ExportCert.FriendlyName: $FriendlyName\"\nWrite-Verbose \"Venafi.TPP.ExportCert.IncludePrivateKey: $IncludePrivateKey\"\nWrite-Verbose \"Venafi.TPP.ExportCert.PrivateKeyPassword: ********\"\nWrite-Verbose \"Venafi.TPP.ExportCert.CertDetails.OutputVariableName: $OutputVariableName\"\nWrite-Verbose \"Venafi.TPP.ExportCert.RevokeTokenOnCompletion: $RevokeTokenOnCompletion\"\nWrite-Verbose \"Step Name: $StepName\"\n\nWrite-Host \"Requesting new session from $Server\"\nNew-VenafiSession -Server $Server -AccessToken $AccessToken\n\n# Export certificate\n$ExportCert_Params = @{\n    CertificateId = $Path;\n    Format        = $Format;\n}\n\n# Optional IncludeChain field\nif ($IncludeChain -eq $True) {\n    if ($Format -eq \"JKS\") {\n        Write-Warning \"The IncludeChain parameter is not supported with JKS export format, ignoring.\"\n    }\n    else {\n        $ExportCert_Params.IncludeChain = $True\n    }\n}\n\n# Optional FriendlyName field\nif (-not [string]::IsNullOrWhiteSpace($FriendlyName)) {\n    $ExportCert_Params.FriendlyName = $FriendlyName\n}\n\nif (-not [string]::IsNullOrWhiteSpace($PrivateKeyPassword)) {\n    $SecurePrivateKeyPassword = ConvertTo-SecureString $PrivateKeyPassword -AsPlainText -Force\n    if ($Format -eq \"JKS\") {\n        $ExportCert_Params.KeystorePassword = $SecurePrivateKeyPassword      \n    }\n    elseif ($IncludePrivateKey -eq $True) {\n        $ExportCert_Params.PrivateKeyPassword = $SecurePrivateKeyPassword    \n        $ExportCert_Params.IncludePrivateKey = $True\n    }\n}\n\n$ExportCertificateResponse = ((Export-VenafiCertificate @ExportCert_Params) 6> $null)\n\nif ($null -eq $ExportCertificateResponse -or $null -eq $ExportCertificateResponse.CertificateData) {\n    Write-Warning \"No certificate data returned for path: $Path`nCheck the path value represents a certificate, and not a folder.\"\n}\nelse {\n    Write-Highlight \"Successfully retrieved certificate data to export for path: $Path\"\n    \n    if ([string]::IsNullOrWhiteSpace($OutPath) -eq $False) {\n        $Filename = $ExportCertificateResponse.Filename\n        if ([string]::IsNullOrWhiteSpace($OutFileName) -eq $False) {\n            $Filename = $OutFileName\n        }\n        $outFile = Join-Path -Path $OutPath -ChildPath ($Filename.Trim('\"'))\n        $bytes = [Convert]::FromBase64String($ExportCertificateResponse.CertificateData)\n        [IO.File]::WriteAllBytes($outFile, $bytes)\n        Write-Host ('Saved {0} with format {1}' -f $outFile, $ExportCertificateResponse.Format)\n    }\n    if ([string]::IsNullOrWhiteSpace($OutputVariableName) -eq $False) {\n        $CertificateJson = $ExportCertificateResponse | ConvertTo-Json -Compress -Depth 10 \n        Set-OctopusVariable -Name $OutputVariableName -Value $CertificateJson -Sensitive\n        Write-Highlight \"Created sensitive output variable: ##{Octopus.Action[$StepName].Output.$OutputVariableName}\"\n    }\n}\n\nif ($RevokeToken -eq $true) {\n    # Revoke TPP access token\n    Write-Host \"Revoking access token with $Server\"\n    Revoke-TppToken -AuthServer $Server -AccessToken $AccessToken -Force\n}"
  },
  "Category": "Venafi",
  "HistoryUrl": "https://github.com/OctopusDeploy/Library/commits/master/step-templates//opt/buildagent/work/75443764cd38076d/step-templates/venafi-tpp-export-certificate.json",
  "Website": "/step-templates/2417aab5-6d84-4e0d-bc86-b2255bd4028a",
  "Logo": "iVBORw0KGgoAAAANSUhEUgAAAMgAAADICAYAAACtWK6eAAAW5ElEQVR4nOydbZQU1ZnHn6qGmW5gMd3Ikq6JCaFBlJmgMD0mDIirBo2SaSK4WRFw4zmwtHvO+k2/5DgI7jlr9JtfbA6ck+xRXnzDpSfiIrprYGGU6eFFZkBhmkBMV0vAbpgwdA/QVXtuTQ2BYbp7+tatulXVz++c+TTn3nqq6vn3vfdf92WUqqqAIMjwiLwDQBA7gwJBkBKgQBCkBCgQBCkBCgRBSoACQZASoEAQpAQoEAQpAQoEQUqAAkGQEqBAEKQEo3gHUDVkEl41J9cBwCQAuFXNJvyQk8cCwIQSP1QKAHwLPqlP8IezAHAOAM4IPikFgXDe4juoSgScrMiQnDxazSTuVHPyDMgm6tWcPA2ynSEAmExEwfhqRCynwN+YFHzSCfCHuwWfdFQIhI+BT7rC+FpVCwrEAGoqHlKziWbIyXNUuS0MADMBoJZzWP0A8IUgtSTAJ7UL/vA+oS6S5ByTY0GBVEImMVGR4w+rmcQCyHY+CAB1vEMaISnwN34iBMK7RCmyEwLhs7wDcgookDKoqfh0VY4vUuW2xQDQ5AJjg4xrOgSpZZsgRbYLdZGveAdkZ1Agw5FJSEoytkyV25br3SY3Q7pjb4qh6CYIhGXewdgNFMggOdmjpOIRNRlbBfn0gip0+K6CN7hLCEU3iHWROPikAu+A7AAKhIwrkrGoKrc9AwBB3uHYhLQgtbwuhqKxah+vVK1A1FR8mpKMPQ/ZzhU2cJ7sSj/4G98QQ9FXhLrICd7B8KDqBKL0xBrUZKwV8uklLhhwW4UC3uB7Qii6Tpwa7eIdjJVUj0AyiVChY+VayKeXojCoIULZ4mnauAYC4ar4tuJ+gWQS/kJX64uQ7VyNXSlmkK7Xek/DuhchoE2BcS3uFUhO9ijJ2DNqcv1aAAjwDselZITQ6jViKPq6W10vVwpE6Yk1qclYDPLp2bxjqQq8wQNCKBoVp0Y7eIfCGncJJCePK3SsfAmync/iOMNyFPA3vuZp2vgC+KSLvINhhWsEovTE5qvda34LAFN4x1LlnBTq1z4tTo3u5h0IC5wvkJw8Wm81nsNWwzaQ1uRVvTVx9NR7RwtETcVDSlfrVsinw7xjQYbBG0yIDeuecPJ0e8cKROlqfUxNriddqlt4x4KU5IIQWv202LDufd6B0OC8LklOFpSOlS+ryfXbUByO4Bbyrsg7I++OdzCV4qwWJCePL+x+lHSpHuEdCkKBN/ihZ/6OJ8An9fIOZaQ4RiBqKv4DJbHqAwCo5x0LYohuMbxhoVAXOc07kJHgiC6WmorPUhKr2lEcrqCevEvyTnkHMhJsLxClJ3a/kli1B9dquIogeafk3fIOpBy27mIpHSsXqXLb2wBQwzsWxBQuC1LLL8Wmjdt5B1IM27YgKI6qoIa8Y/KueQdSDFsKBMVRVdhaJLYTCIqjKrGtSGwlEDJoQ3FULQMisdnA3TaDdN3K3QMAY3nHgnClTwxvuFeoixzkHQjYRSBqKj5ZSazah1YuopMWwxuahbrIKd6B8BdITh5f+GjWPvwIiAyh2/PQwWbe01L4jkFysqDNrUJxIDdTr+UG5wmOXAWidLX+B048RIqSTz+i5QhHuHWxlCOtj6kntSnrCFISYcrqxeKP+Kwn4SIQbSVgYlUnrudARsgFMbyhkcfKROu7WDl5tLZMFsWBjJxbtJzJyaOtvrDlAtE2WMA15Eil5NNhLXcsxlKBKD2xe/XdRxCkcrKdz2k5ZCHWjUFy8rjCR7MO475ViEFOeh46eJdVm9NZ1oLozSOKAzHKFCu7WpYIROmJNenbgSKIcbKdz2o5ZQHmCyQne7SNpHl/tUfchKjlVE72mH4hsy+g9MSiuMs6wpx8eraWWyZj7iA9k/AX9izswfM5EJPIeO79YKqZh/iY2oJoJzuhOBDzCOg5ZhrmCSSTCOnHniGIeZAcI7lmEqZ1sQo7796sH5hpGwqKALu6RlGXb5xcgInjFaYxGeXI16MglbVuRvjPZtrwNANvcJPn4UPLzaiaPltKoPTEGiCf/icz6jaCR1Rh075xkDhJ96OwtFmF1l9cYB6XEf5+PMCv3xkHJ74x/4NveIoAP5tpwzM78+mlSk/sZTOOqDali6UmYy/Y1dZd1txPXTbe6YGLedOdxYqYdMtV+M/VvVD/PfNbESPPzmREPefYV8y6QjUVnwb59OOs62XFgoYcfPc7dLfd16/A9gM+5jEZxT+2AL/7l164+wfmiYQ8M/LsbEs+/biWe4xhLhAlGXverq0H6N2sJ+dcpi6/pd3yGdcjYpy3AL9bfQHm32FO/eSZkWdnY0Q999hWyrS2TGIiZDtXMK3TBB6/Jw81o+h+bZNnVPg8OYZ5TCyoHaXAa0/1wsK72SYyeVbkmdkeknskBxnCVCBKUvuyWcuyTjPwj70KP59F70Zt2mvPVgR0kfzmiV5Y0sTObSPPijwzB1Cr5yAz2AkkJ3tUue0ZZvWZzFPz6H8R/+eoAN9csK9ISFfo3/+xF5bPYyMSI8/KarQcZDhHi5lAlFQ84qSN36YH+zXbkoaCAvD2Z7ZvKOHXkV74t4eMdbfIMyLPykEE9VxkAjOBqMnYKlZ1WYUR2/Ktz2vgSsG2XsQ1/vWnF+C2CfQ/qDa2dovCMhfZvOFMQoJ8egGTuixkQUMO6gJ0jyBzUYEPD9vP8h3K4T954etvC1RlbW/tFoPkIslJBjARiJKMPWnWV3kzIX31pT8xYvnafxP6N/fSdwUdYO0WY5Sek4ZhIhBVbjNlHowVLLknD7Wj6cYih06rcDRl37HIub+Ohp1f0L1ix1i7RWCVk4YFoqbitwPAXSyC4cF3xlyFyGwDlu8+L9N4WPJeBxkn0bUAixodY+0W4y49Nw1hXCBy/BdG6+DN8rl5oJ2k8fuDIpy/ZL/eZUERYCul0yboz8TpsMhNBgJpW2y0Dt7c/t1+aArRSeTyVRW2ddivFfmk2wffnKdrGcmzIM/E6bDITWMCGfisb8nuEmazfC59QpDBOvnFthOb9tGPjYw8C5vRZHTqiSGBKKn4w3aemFgJD8ygt3z/nFFgz1f2sXx7ztRCR5Ju7EGeAXkWLkHUc5S+AiOF1WzCcd8+imHU8t1sI8t3c7sXaM1Z8gwcau0Oi9EcNfbrn+180FB5m2HE8t37FcDpc/xFcjHvge0Jui/n5N6XONjaHRaDOUotEDUVD5EW2cjF7YYRy1dRAbZ+xn+wvv2ADy5dprsHcu/kGbiMOj1XqaAXSCbRTFvWzhixfN/bPwryV/guyaVd0OUWa3c4jOQqfRcrL8+hLmtjjFi+f80r0MZxSW57zxhtQRcNbrF2h8VArtK3IHKbaw/BMWJzbm7n99Fw0176MZCLrN2bMJKrdAIZOAprJu1F7c4DM3LwPUrL90sZ4MAp68ci6fM18OkxurIus3aHYybt8W1UWaBmEnc6YWktLdrGDgbWQWw28JGOlnc+r9EWctHgNmt3GGr1nK0YOoHk5Bk05ZzEkqZ+8NXQjUV2HhG1mbRWcaUgwpbP6LpXrrR2h4E2Z+n6EdlEPVU5BzHed1Wb0UrD1YIKb39uXSuy45APzvehtVsSypylbUGYb9BlR5Y101u+Vi7JpV245WZrdyi0OUvZgnSatpu2nZg6qR9+PI1OIn+5oMAn3eYP1o+mauHwn9DaLQtlztL+xE2mLOc4VhiwP43MqB0pb+ylF6Gbrd1hoMrZygWSSZA3civNxZzIfXfQW76dJ1U4/o15Ijl/aRTsOEQXWxVYu0O5Vc/diqj46ao52VXzr8phxPJVTV6S+95+r7ZgiwZyTy63dm+CJndpfn4mUZRxNEYs37YDoilHJgwsqaUbnJN7ebypqrpXg1ScuzQCqZru1SBGLN/cZRW2JdjPz/rDlz5toRYN5F7IPVUhFedu5V2sTMJfaRk3YMTy3WrCkQm0X+sF/V6qEZrcrbwFyctjKy7jAoxYvn88q8K+E+xakdPnaqD9BN34gdwDuZeqhCJ3abpYEyjKuAIjlq+RHQ6Hsrndqy3QosHIPbiAinOXRiCu2KSBhgdmXILbJtDd/h+OAaSyxpfk5q944P0Ouin13wuImm1dxVT88qo22WlZPpduYwfyi/8Wpet0PdsP+LSFWTRUo7VrFBRIhSwO52BMDd1je2d/DfRfNfbIt1IuyPLVCJpdjVQGzduy1znIFjPOW4BFYbrjBM73GTsyofOPPm1BFg1VbO0agkYgdNnhIp6am6O2fDfvo+9mbaIsW83WrlGwi0XB5ImXofl2Ookc+VqFI19XPv3kL72jYVcX3euqamvXIDRPnN3xqQ7GyExYmlm+7+6v1RZi0VDl1u71VJy7NAL5lqKM6/iHO+kt3w8Pi/DtxZF/Xb9SEKnnXaG1ewMV527lb9gr9VVcxqXQWr4DRyaMvBX5uMsLZ3vR2jUMRe5WLBAhEM5WWsatGLF83/p85EcmbG6n+wqP1u6N0OQuzds9R1HGlRixfFMZBT49Vt7yPf5NLSRO0h+jhtbuDVScuzQCOUNRxrUYs3zLtwxvUi6pRWt3WCrO3cq7WD4pVWkZN2PE8m0/oZY8MuFi3qOdgUgDWrs3Q5O7lT/9QDiP3awbWTGPfknuu/uLC+T3h7zagiuqmNDaHco5PXcrgvZD4SnKcq7kvjsuwQ8n0rUi2zqK759F/kfDbRNEbeYxcgNUOUsnEH9jkqqci1k29wpVuUyfAnu+unmc0XOmVvvqTgOt/exqKHOWSiCCTzpBU87NLJqdg7G1dL838c6bPxrGD9C1HmNqRM1+Rm6ENmcpW5BwN1U5FzPOW4DFTXSW6qdfinCp/8ZJ0jsO061jXxQuaLEgQ6DMWdoW5ChNObezrDkPIsVQpP+KCp9++TfLt+vPXu07SaUIuu2M3AxtztIJJBA+Rt4rTVk384NbL8Pc6XRlP+7620Ko//6CrvVovl3QbGfkJvr1nK0Yui6WTyIj0iNUZV0O7QB595ejrrlZH3fRjT+qbK/dSvhCz9mKoV4PIkgtHbRl3cz86XSWb1+/AodO18Cps7Vw+lzlY4jbJojaDGPkZgSpJUFbln7BlFdqpy7rcmgt373Ha+D/jtOtOUdrtwQGcpW+BQmE99GWdTu0lm/HSRH2Hq98/IHWbmmM5Cq9QOoiSQDAeVnDQGv5dqcETSSVgtZuSVJ6rlJhbE26v/ETQ+VdDI3l239F1cYilYDWbhkM5qghgQj+8C4j5d2MEcu3EtDaLY3RHDUkELEushM3cSjOr+4133ZFa7ckip6j1BjrYgXCZ8nY0lAdLqZ5Wg5Ck2iXU5UHrd2ydOg5So3hfbEEqWWb0TrczLJm87o/aO2WhkVuMhBI5L+M1uFmFs3Ow9952e/Ph9ZueVjkpnGB1EWOA8Bho/W4lTG1BVhyD/uNE9DaLcthPTcNweSnTZBa3mRRj1tZOidHNcu3GGjtlodVTjIRiBiKbgYA3F+mCN+fcAXm38FOIfPuALR2S3NVz0nDsOkcB8IyeIP4TaQEK+ax24IHB+dlILlIcpIBzEaPQii6gVVdboSV5fvDiYI2YxgpDstcZCYQsS4SB4A0q/rcCAvLl3amcBWR1nORCez8R59UEKSW15nV50KMWr5ja0VtpjBSHC0HfRIze4+pQS+GojFcilsco5bv4qaraO2Wpl/PQWaw/YIVCJ8Ff+MbTOt0GbSWLymDe+2WgeSewaklQ2H+iVcMRV/BCYzF+f6EK3DfnZUrZO70gRnCSFEUT8O6l1lXylwgQl3kBHiD77Ku1038M8UsX7R2y0ByLhBmvuOnKYd4CqHoS9iKFOfHoUsw7bsjb0XQ2i2Louccc0wRiDg12gXe4BYz6nYLldi1aO2WwRvcouWcCZh2DLSnaeMadLSKs2h2Dsb7yrciaO2WpV/PNVMw75x00h/0N643rX6H4x1dgMfvKW/ZorVbBpJjJow9BjFPIKQVaVj3IgBkzLyGk3myzMYOaO2WJaPnmGmYKhAIhLPClNWtpl7DwdT5L8P9M4r/H63d0mi5ZfKpy+YKZGDAHgNv8IDZ13EqK+YVFwBauyXwBg9ouWUypgtEm6MVikbR9h2eYpYvWrslUbScYjjnqhjmC2SgFekAf+NrVlzLiQxn46K1WwJ/42taTlmAJQKBAdv3BQA4adX1nMRQyxet3ZKc1HPJEiwTCPiki0L92l9hV+tmhlq+aO0WRdFyyCddtOqC1glkoKu1B/yNr1p5TacwaPmSv+W4IcPw+Btf1XLIQiwVCAx2tbxB6gNN3Eqd/zL8tEHVNnf4/gQcf9yEN5iwsms1iKCqdGdxG0FNxUNKYlUnANxi+cVtzP6TY0BRVPjJVGxBhnBBDG9oNHKMAS2WtyCgny0iTFn9NI9r25l7plxCcQwDyRUe4gBeAtEu/KN17wtSy294XR9xBiRHSK5wuz6PLtY1crJQ2P3oB5BPP8IvCMS2eIMfeubvWAg+iVuS8hUIaCIZX/ho1j4AqOcbCGIzuj0PHWwGn9TLMwhuXaxr+KReMbzh57inFnIdaS0nOIsDbCGQgUH7KTG8YSEA9PGOBeFOH8kFkhO8AwG7CAQGRHJQqF/bAgA4hbV6uUxygOQC70AGsY1AYOBL+/8KUssvUSRVyWXy7kkO8A7kemwlEILYtHE7iqTqGBBH08btvAMZiu0EAiiSasO24gC7CgRQJNWCrcUBtvgOUgalJ3a/2r2mDQDG8o4FYUofGZDbbcwxFNsLBAYmN85SEqs+AIAg71gQJqR1K9c2blUxbNvFuh7yIMXwhjkA0M07FsQw3eRdOkEc4JQW5Bo5eXxh96Nbce6WQxmYW/WEHb6QjxRHtCDX8Em9nvk7FuIsYOdB3pk+8dAx4gDHtSDXoXS1PqYm1/8WF13ZngtCaPXTYgO/KetGcKxAYHBlYlcr6XKFeceCDIM3mBAb1j3Ba7ETCxwtEI2cPLrQsfIlyHY+57guo3tRwN/4qraG3Cc5eoG98wWio/TE5qvda0iXawrvWKqck0L92qfFqdHdvANhgWsEopGTx+mtybPYmlgOaTVe01sNy/atMht3CURH6Yk1qclYDPLp2bxjqQq8wQNCKBq1ajtQK3GlQDRyskdJxp5Rk+vXAkCAdzguJSOEVq8RQ1Gmh/fbCfcKZJBMwl/oan0Rsp2rAaCWdzguoR/8jeu1w2tMPp+DN+4XyCCZRKjQsXIt5NNLcXxCjQLe4BbtTEATjz2zE9UjEB2lJ9agJmOtkE8vQaGMGCKM94RQdJ1Zp8nalaoTyCBqKj5NScaeh2znCux6FYV0pd4QQ9FXhLrICd7B8KBqBXKNTGKikoxFVbntGZxOf420ILW8LoaiMQiEz/IOhicokEFyskdJxSNqMrYK8ukFADCKd0gWcxW8wV1CKLpBrIvE3epKVQoKZDgyCUlJxpapcttyAJjJOxyT+UKQWt4UQ9FNEAjLvIOxGyiQMqip+HRVji9S5bbFANDkgoG9AgAdgtSyTZAi24W6yFe8A7IzKJBKIOMVOf6wmkksgGzngwBQxzukEZICf+MnQiC8S5QiO6t9XFEJKBADqKl4SM0mmiEnz1HltrDeHePtiPXr3aYE+KR2wR/e5+Tp5rxBgbAkJ49WM4k71Zw8A7KJejUnT4NsZwgAJgPArYyvdg4AToG/MSn4pBPgD3cLPumoEAgfc/oUczuBArGKTMKr5mTSJZtExKJmE37IyWMBYEKJcQ0ZL3wLPqlP8GtTOogozgg+KQWBcN7iO6hKUCAIUgKnOzIIYiooEAQpAQoEQUqAAkGQEqBAEKQEKBAEKQEKBEFKgAJBkBKgQBCkBCgQBCkBCgRBSvD/AQAA//+xJXvHUpp9ZwAAAABJRU5ErkJggg==",
  "$Meta": {
    "Type": "ActionTemplate"
  }
}

History

Page updated on Wednesday, August 18, 2021