Import Operations

Import existing certificates into Horizon from local files or third-party systems.

Import operations bring certificates into Horizon without discovery metadata. This is most useful during initial Horizon setup when migrating certificates from an existing PKI database or third-party system.

Local import

From PEM files

Place certificates as PEM files in a folder (use sub-folders to avoid file-system limits), then run:

horizon-cli localimport --campaign=<campaign-name> --path=/path/to/certificates --source=<source-name>

By default CA certificates are skipped. To include them:

horizon-cli localimport --campaign=<campaign-name> --path=/path/to/certificates --source=<source-name> --enable-ca-import

From PKCS#12 files (with private keys)

horizon-cli localimport --campaign=<campaign-name> --path=/path/to/certificates --source=<source-name> --pfx-password=<pkcs12-password>

All PKCS#12 files in the folder must share the same password.

From a CSV file

The CSV must contain a column named certificate. Supported encoding formats:

Format	Description
`DERBase64`	DER (binary) Base64-encoded (default)
`DERHex`	DER (binary) hex-string-encoded
`PEM`	PEM format (with or without header/footer)

horizon-cli localimport --campaign=<campaign-name> --csv /path/to/file.csv --csv-separator ";"

To attach technical metadata from a CSV column (for example pki_connector):

horizon-cli localimport --campaign=<campaign-name> --csv /path/to/file.csv --csv-separator ";" --csv-metadata pki_connector

Supported metadata fields: pki_connector, certeurope_id, digicert_id, digicert_order_id, entrust_id, fcms_id, gsatlas_id, metapki_id.

Network import

All network import commands only import certificates in issued/valid state. Revoked certificates are skipped unless otherwise noted.

DigiCert CertCentral

horizon-cli netimport digicert --campaign=<campaign-name> --digicert-api-key=<api-key>

AWS ACM

horizon-cli netimport aws-acm \
  --campaign=<campaign-name> \
  --aws-region=<region> \
  --access-key-id=<access-key-id> \
  --secret-access-key=<secret-access-key>

AWS Role Assumption is supported via --assume-role-arn=<arn>.

Azure Key Vault

horizon-cli netimport akv \
  --campaign=<campaign-name> \
  --vault-name=<vault-short-name> \
  --azure-tenant=<tenant-name> \
  --client-id=<client-app-id> \
  --client-secret=<client-app-secret>

Certificates in pending state are not imported.

F5 BIG-IP

horizon-cli netimport bigip \
  --campaign=<campaign-name> \
  --hostname=<f5-hostname> \
  --login=<login> \
  --password=<password>

Requires an administrator account on the F5 BIG-IP instance.

To also manage the imported certificates as Horizon-managed certificates (enabling renewal and revocation via triggers):

horizon-cli netimport bigip \
  --campaign=<campaign-name> \
  --connector=<horizon-f5-connector-name> \
  --hostname=<f5-hostname> \
  --login=<login> \
  --password=<password>

Additional F5 options:

Option	Description
`--login-provider`	Login provider for TACACS authentication
`--partition`	F5 partition to retrieve certificates from
`--merge-third-party`	Fine tracking across SSL profiles (requires Horizon >= 2.7.18)
`--as-3`	Enable AS3 compatibility
`--filter-globs`	Filter certificates by JSON path glob in the AS3 configuration

Akamai CPS

horizon-cli netimport akamai \
  --campaign=<campaign-name> \
  --host=<akamai-hostname> \
  --client-secret=<client-secret> \
  --client-token=<client-token> \
  --access-token=<access-token>

Gandi

horizon-cli netimport gandi --campaign=<campaign-name> --access-token=<access-token>

HashiCorp Vault

horizon-cli netimport vault \
  --campaign=<campaign-name> \
  --token=<token> \
  --secrets-engines pki

The service account requires the following Vault policy:

path "<engine>/certs/*" {
  capabilities = ["read", "list"]
}

Token and AppRole authentication are supported. For other auth methods, retrieve a token via the Vault API first.

Nameshield

horizon-cli netimport nameshield --campaign=<campaign-name> --token=<token>

PaloAlto Panorama

horizon-cli netimport panorama \
  --campaign=<campaign-name> \
  --api-key=<api-key> \
  --hostname <panorama-host>

Required Panorama permission: XML API: Configuration.

By default, only certificates from Panorama itself (internal config and templates) are scanned. To also scan each managed device, add --scan-devices (requires the Operational Requests permission as well).

Import Operations

On this page