Creating custom post-processing scripts

DigiCert Trust Assistant exposes several useful metadata as environment variables. Use these values in your script to automate actions without user input.

A well-defined and consistent structure enhances the readability, maintainability, and debuggability of scripts. PowerShell and Bash scripts should be organized into the following logical sections:

The examples below show how environment variables and workflow logic can be used in both Windows PowerShell and macOS shell scripts.

PowerShell (Windows) example

# Custom Post-processing PowerShell script example
# Version
$ScriptVersion = "1.0.0"
# Log utility with timestamp
function Log {
  param(
    [string]$Message
    [string]$Level = "Info"
  )
  $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
  $formattedMessage = "[CustomScript.ps1] $timestamp - $Message"
  switch ($Level) {
    "Debug" { Write-Debug $formattedMessage }
    "Info"  { Write-Information $formattedMessage }
    "Error" { Write-Error $formattedMessage }
  }
}
# Prerequisites check
function Check-Prerequisites {
...
...
}
# ####################################################################
# Initialization and Environment Validation
# ####################################################################
$subject = $env:DCCERT_SUBJECT
$serial  = $env:DCCERT_SERIAL
if (-not $subject -or -not $serial) {
  Log -Message $($_.Exception.Message) -Level "Error"
}
# ####################################################################
# Main
# ####################################################################
try {
  Log -Message "Starting post-processing..."
  Check-Prerequisites
  Log -Message "Processing certificate for: $subject (Serial: $serial)"
  # Example action: Move or copy certificate file
  Copy-Item -Path $env:DCCERT_DER_PATH -Destination "C:\CertArchive\$serial.cer" -Force
  Log -Message "Completed successfully."
} catch {
  Log -Message $($_.Exception.Message) -Level "Error"
  throw $_.Exception.Message
}

Bash (macOS) example

#!/bin/bash
# Custom Post-processing shell script example
# Version
$Version="1.0.0"
# Log utility with timestamp
log() {
  echo "[CustomScript.sh] $(date '+%Y-%m-%d %H:%M:%S') - $1"
}
log "Starting post-processing..."
: "${DCCERT_SUBJECT:?Environment variable missing: DCCERT_SUBJECT}"
: "${DCCERT_SERIAL:?Environment variable missing: DCCERT_SERIAL}"
log "Subject: $DCCERT_SUBJECT"
log "Serial: $DCCERT_SERIAL"
# Example action: Save certificate copy
if [[ -n "${DCCERT_DER_PATH}" ]]; then
  cp "$DCCERT_DER_PATH" "/usr/local/certs/${DCCERT_SERIAL}.cer"
  log "Certificate archived successfully."
else
  log "Error: Certificate file missing or invalid path."
  exit 1
fi
log "Post-processing complete."
exit 0

Proper error handling ensures that post-processing scripts behave predictably and fail safely. Scripts must return clear and consistent results, enabling calling applications or services to display meaningful error messages to end users when issues occur.

if (-not (Test-Path $CertPath)) {
    throw "Certificate path not found: $CertPath"
}

if ! cp "$SOURCE" "$DEST"; then
  echo "Error: File copy failed." >&2
  exit 2
fi
exit 0

All script logs, including both standard output (stdout) and error output (stderr), are automatically captured and stored in the DigiCert Trust Assistant logs. Administrators can review these logs to verify whether post-processing scripts executed successfully or encountered errors. See Log management for more details.

Log -Message "Post-processing started for $env:DCCERT_SUBJECT"
# ... script logic ...
Log -Message "Post-processing completed successfully."

log "Post-processing started for $DCCERT_SUBJECT"
# ... script logic ...
log "Post-processing completed successfully."