API / Venafi Interview questions
Explain the sequence of events when a CI/CD pipeline requests a certificate through VCert?
The pattern is designed so a build job can get a fresh, short-lived certificate without a human touching the process or a long-lived credential sitting in the pipeline's secrets store.
The pipeline holds only a scoped client credential, not a certificate itself, so there's nothing long-lived to leak from the pipeline's secrets store. VCert exchanges that credential for a short-lived token, submits the certificate request, and the policy folder or zone validates it exactly the same way it would validate a request submitted through the web console.
Once the CA signs it, the certificate flows back through the same chain to the build workspace, where the job writes it to disk and uses it immediately — often for a container image being built or a workload about to be deployed — and because the whole thing happened via API calls, it's fully scriptable and repeatable on every single build without any manual step.
More Related questions...
