Skip to main content

Certificate

property Certificate: string read write;

Example​

procedure ScriptEvent(var Value: variant);
begin
  Http.AuthType := fatNetsuiteOAuth;
  Http.GrantType := gtClientCredentials;
  Http.Certificate := 'C:\ProgramData\Velox\Secrets\netsuite-private-key.pem';
  Value := Http.Certificate;
end;

Usage​

Names the private-key file used to sign NetSuite OAuth client assertions, despite the property's certificate-oriented name.

Additional Technical Info​

Certificate defaults to an empty string and is consulted only by the NetSuite OAuth client-credentials path. Despite its name, the value is a filename from which Velox loads the private signing key. The matching public certificate is what an administrator uploads to NetSuite.

When the first NetSuite assertion is needed, the authenticator reads the entire file as ASCII and caches the resulting key text. It then creates a JWT with:

  • iss set to ClientId;
  • scope set to Scope;
  • aud fixed from Tenant as the NetSuite token endpoint;
  • issue time Now and expiry 59 minutes later;
  • kid set from Secret; and
  • an ES512 signature made with the cached file content.

The cache is not keyed by filename. Changing Certificate after the first assertion does not clear the cached key, and ClearAuthentication does not clear it either. Use a new TvxHTTP object after rotating or changing the key file.

The file is opened using the Velox process account and can therefore expose any readable file if the path is untrusted. Keep it outside script/source repositories, restrict its ACL to the service identity and administrators, and obtain the path from approved protected configuration. The key is retained as a managed string and is not explicitly zeroed. Missing, unreadable or malformed key material raises during authentication before the resource request.

This property does not configure the TLS client certificate used for HTTPS, and it does not repair the HTTP helper's absent server-certificate validation. It is solely NetSuite JWT signing material.

External references

Created 2026-07-15