certificate.create

Create a new Certificate

Certificates are classified under following types and the necessary keywords to be passed for create_type attribute to create the respective type of certificate

1. Imported Certificate - CERTIFICATE_CREATE_IMPORTED

2. Certificate Signing Request - CERTIFICATE_CREATE_CSR

3. Imported Certificate Signing Request - CERTIFICATE_CREATE_IMPORTED_CSR

4. ACME Certificate - CERTIFICATE_CREATE_ACME

By default, created CSRs use RSA keys. If an Elliptic Curve Key is desired, it can be specified with the key_type attribute. If the ec_curve attribute is not specified for the Elliptic Curve Key, then default to using “SECP384R1” curve.

A type is selected by the Certificate Service based on create_type. The rest of the values in data are validated accordingly and finally a certificate is made based on the selected type.

cert_extensions can be specified to set X509v3 extensions.

Type: object

Call parameters

Type: array
No Additional Items

Tuple Validation

Parameter 1: certificate_create

certificate_create

Type: object
No Additional Properties

name Required

Name

Type: string

Must be at least 1 characters long

Must be at most 120 characters long

create_type Required

Create Type

Type: enum (of string)

Must be one of:

• "CERTIFICATE_CREATE_IMPORTED"
• "CERTIFICATE_CREATE_CSR"
• "CERTIFICATE_CREATE_IMPORTED_CSR"
• "CERTIFICATE_CREATE_ACME"

add_to_trusted_store

Add To Trusted Store

Type: boolean Default: false

certificate

Certificate

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

privatekey

Privatekey

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

CSR

Csr

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

key_length

Key Length

Default: null

Any of

• Option 1
• Option 2

Type: enum (of integer)

Must be one of:

• 2048
• 4096

Type: null

key_type

Key Type

Type: enum (of string) Default: "RSA"

Must be one of:

• "RSA"
• "EC"

ec_curve

Ec Curve

Type: enum (of string) Default: "SECP384R1"

Must be one of:

• "SECP256R1"
• "SECP384R1"
• "SECP521R1"
• "ed25519"

passphrase

Passphrase

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

city

City

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

common

Common

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

country

Country

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

email

Email

Default: null

Any of

• Option 1
• Option 2

Type: stringFormat: email

Type: null

organization

Organization

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

organizational_unit

Organizational Unit

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

state

State

Default: null

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

digest_algorithm

Digest Algorithm

Type: enum (of string) Default: "SHA256"

Must be one of:

• "SHA224"
• "SHA256"
• "SHA384"
• "SHA512"

san

San

Type: array of string
No Additional Items

Each item of this array must be:

Type: string

Must be at least 1 characters long

cert_extensions

CertificateExtensions

Type: object
No Additional Properties

BasicConstraints

BasicConstraintsModel

Type: object

Default:

{ "ca": false, "enabled": false, "path_length": null, "extension_critical": false }

No Additional Properties

ca

Ca

Type: boolean Default: false

enabled

Enabled

Type: boolean Default: false

path_length

Path Length

Default: null

Any of

• Option 1
• Option 2

Type: integer

Type: null

extension_critical

Extension Critical

Type: boolean Default: false

ExtendedKeyUsage

ExtendedKeyUsageModel

Type: object

Default:

{ "usages": [], "enabled": false, "extension_critical": false }

No Additional Properties

usages

Usages

Type: array of enum (of string)
No Additional Items

Each item of this array must be:

Type: enum (of string)

Must be one of:

• "ANY_EXTENDED_KEY_USAGE"
• "CERTIFICATE_TRANSPARENCY"
• "CLIENT_AUTH"
• "CODE_SIGNING"
• "EMAIL_PROTECTION"
• "IPSEC_IKE"
• "KERBEROS_PKINIT_KDC"
• "OCSP_SIGNING"
• "SERVER_AUTH"
• "SMARTCARD_LOGON"
• "TIME_STAMPING"

enabled

Enabled

Type: boolean Default: false

extension_critical

Extension Critical

Type: boolean Default: false

KeyUsage

KeyUsageModel

Type: object

Default:

{ "enabled": false, "digital_signature": false, "content_commitment": false, "key_encipherment": false, "data_encipherment": false, "key_agreement": false, "key_cert_sign": false, "crl_sign": false, "encipher_only": false, "decipher_only": false, "extension_critical": false }

No Additional Properties

enabled

Enabled

Type: boolean Default: false

digital_signature

Digital Signature

Type: boolean Default: false

content_commitment

Content Commitment

Type: boolean Default: false

key_encipherment

Key Encipherment

Type: boolean Default: false

data_encipherment

Data Encipherment

Type: boolean Default: false

key_agreement

Key Agreement

Type: boolean Default: false

key_cert_sign

Key Cert Sign

Type: boolean Default: false

crl_sign

Crl Sign

Type: boolean Default: false

encipher_only

Encipher Only

Type: boolean Default: false

decipher_only

Decipher Only

Type: boolean Default: false

extension_critical

Extension Critical

Type: boolean Default: false

acme_directory_uri

Acme Directory Uri

Default: null

ACME directory URI to be used for ACME certificate creation.

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

csr_id

Csr Id

Default: null

CSR to be used for ACME certificate creation.

Any of

• Option 1
• Option 2

Type: integer

Type: null

tos

Tos

Default: null

Set this when creating an ACME certificate to accept terms of service of the ACME service.

Any of

• Option 1
• Option 2

Type: boolean

Type: null

dns_mapping

Dns Mapping

Type: object

A mapping of domain to ACME DNS Authenticator ID for each domain listed in SAN or common name of the CSR.

Additional Properties

Each additional property must conform to the following schema

Type: integer

renew_days

Renew Days

Type: integer Default: 10

Number of days before the certificate expiration date to attempt certificate renewal. If certificate renewal fails,
renewal will be reattempted every day until expiration.

Value must be greater or equal to 1 and lesser or equal to 30

Return value

CertificateEntry

Type: object
No Additional Properties

id Required

Id

Type: integer

type Required

Type

Type: integer

name Required

Name

Type: string

Must be at least 1 characters long

certificate Required

Certificate

Any of

• Option 1
• Option 2

Type: string

Type: null

privatekey Required

Privatekey

Any of

• Option 1
• Option 2

Type: string

Type: null

CSR Required

Csr

Any of

• Option 1
• Option 2

Type: string

Type: null

acme_uri Required

Acme Uri

Any of

• Option 1
• Option 2

Type: string

Type: null

domains_authenticators Required

Domains Authenticators

Any of

• Option 1
• Option 2

Type: object

Type: null

renew_days Required

Renew Days

Any of

• Option 1
• Option 2

Type: integer

Type: null

acme Required

Acme

Any of

• Option 1
• Option 2

Type: object

Type: null

add_to_trusted_store Required

Add To Trusted Store

Type: boolean

root_path Required

Root Path

Type: string

Must be at least 1 characters long

certificate_path Required

Certificate Path

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

privatekey_path Required

Privatekey Path

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

csr_path Required

Csr Path

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

cert_type Required

Cert Type

Type: string

Must be at least 1 characters long

cert_type_existing Required

Cert Type Existing

Type: boolean

cert_type_CSR Required

Cert Type Csr

Type: boolean

chain_list Required

Chain List

Type: array of string
No Additional Items

Each item of this array must be:

Type: string

key_length Required

Key Length

Any of

• Option 1
• Option 2

Type: integer

Type: null

key_type Required

Key Type

Any of

• Option 1
• Option 2

Type: string

Must be at least 1 characters long

Type: null

country Required

Country

Any of

• Option 1
• Option 2

Type: string

Type: null

state Required

State

Any of

• Option 1
• Option 2

Type: string

Type: null

city Required

City

Any of

• Option 1
• Option 2

Type: string

Type: null

organization Required

Organization

Any of

• Option 1
• Option 2

Type: string

Type: null

organizational_unit Required

Organizational Unit

Any of

• Option 1
• Option 2

Type: string

Type: null

common Required

Common

Any of

• Option 1
• Option 2

Type: string

Type: null

san Required

San

Any of

• Option 1
• Option 2

Type: array of string
No Additional Items

Each item of this array must be:

Type: string

Type: null

email Required

Email

Any of

• Option 1
• Option 2

Type: string

Type: null

DN Required

Dn

Any of

• Option 1
• Option 2

Type: string

Type: null

subject_name_hash Required

Subject Name Hash

Any of

• Option 1
• Option 2

Type: integer

Type: null

extensions Required

Extensions

Type: object

digest_algorithm Required

Digest Algorithm

Any of

• Option 1
• Option 2

Type: string

Type: null

lifetime Required

Lifetime

Any of

• Option 1
• Option 2

Type: integer

Type: null

from Required

From

Any of

• Option 1
• Option 2

Type: string

Type: null

until Required

Until

Any of

• Option 1
• Option 2

Type: string

Type: null

serial Required

Serial

Any of

• Option 1
• Option 2

Type: integer

Type: null

chain Required

Chain

Any of

• Option 1
• Option 2

Type: boolean

Type: null

fingerprint Required

Fingerprint

Any of

• Option 1
• Option 2

Type: string

Type: null

expired Required

Expired

Any of

• Option 1
• Option 2

Type: boolean

Type: null

parsed Required

Parsed

Type: boolean

Required roles: CERTIFICATE_WRITE