Skip to main content

Issue Certificate

The RA Profile serves as a single point of the particular certificate management service. The RA Profile is used to perform operations on top of the certificates.

This page covers immediate issuance — the Request now request type. The Add Certificate form also offers Pre-register, which registers a certificate to be issued later using a challenge secret. See Register Certificate for that flow.

Issue new certificate using the API​

New Certificate can be issued using the Client Operations API. There may be some Attributes associated with the issuance of the Certificate. These Attributes represent requirements of some certification authority technology. We can get the list of Attributes for issuing of the Certificate using the following request:

curl -X GET \
  --cacert [ca-cert] \
  --cert [client-cert] \
  --cert-type [type] \
  -H "Accept: application/json" \
  https://[domain]:[port]/api/v2/operations/authorities/e045a12a-e114-45ed-90b8-bac7e750e803/raProfiles/166b5cf5-63f2-11ec-90d6-0242ac120003/attributes/issue
  #https://[domain]:[port]/api/v2/operations/authorities/{authorityUuid}/raProfiles/{raProfileUuid}/attributes/issue

This returns the list of applicable attributes to issue Certificate using the RA Profile service, such as:

[] // empty array of Attributes

Knowing the attributes, we can issue Certificate. The endpoint accepts two shapes of the request body:

  • Uploaded CSR — provide the CSR as request. The CSR is validated against the resolved request-attribute set of the RA Profile, in strict or lenient mode — see External CSR validation.
  • Platform-built request — provide the request-attribute values as csrAttributes together with tokenProfileUuid and keyUuid. The platform builds and signs the CSR from the selected platform key.

The following request issues a Certificate with an uploaded CSR:

curl -X POST \
  --cacert [ca-cert] \
  --cert [client-cert] \
  --cert-type [type] \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  --data '
  {
    "request": "MIICzTCCAbcCAQAwWjFYMAgGA1UEAwwBeDANBgkqhkiG9w0BCQETADAHBgNVBAsTADAHBgNVBAoTADAHBgNVBAkTADAHBgNVBAcTADAHBgNVBAgTADAHBgNVBBETADAHBgNVBAYTADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANJ2sKsyNhQWrF3QTgJnL9GO8g4WEiJjlY6Cp6Q5dhUrjv6i2m0pL9uFovopbXkPCW8UuDda5ws79PRhRHEPhuPwdTy/UMXLYoiTnjAYP5jalp4UQ/di7tT5BBUxPPzGAMNWVw0IEKlgJnw67xqYP3nbY9u3LEcbBxfAadLR7RVQNJebyRVXLIWstWGMtuVoDcT+I8pdoLEuSlJE2RXiyPXZSvlm8m2qs5912zNbrA3Mi8b/jU/H+lbS5RZ/sphIhrgWpBH4nq8g95VYwcBNhhmcpyUDeeLDHhWpJwlx8p+g+At6u/PMnEvPfnlQ9MZaFTc6PWTKtGAE+lv0803TZjUCAwEAAaAwMC4GCSqGSIb3DQEJDjEhMB8wHQYDVR0OBBYEFEWyex+1M1ZaTYBL0ERQAnBSnld2MAsGCSqGSIb3DQEBCwOCAQEAWO1hjH5f0BPOnR0zmmmf8riNQGwTs+/ySCn5oMQjzoyNDHOB95ZdhYih7UM5u5LKJxEvrX2AJxeAttYsCZhjwkmUutzg6cWqhmpKTHVeRWpqD00u/FBy6hpUdhRCi4FEYIXTkjFnMzrp+M7bQmjuDKgFVO4NMwophKCJoJifh8JE1Fz2jmO/mixLyUAgFIAuC1Odxakx6wyQnwfwX3Xi2zQtHC/bTH2u8XqpPD+epWUqKK5P02vk2kPq2y6e1BpNl6vdvS6Qy73/qX34vIfwf3guJhp99oESmW4TkR3ccT1Dbv9JJCZoyvJ6RSUi+skz4IGQ6YqVDoRp+qREpW+Dlw==",
    "attributes": []
  }' \
  https://[domain]:[port]/api/v2/operations/authorities/e045a12a-e114-45ed-90b8-bac7e750e803/raProfiles/166b5cf5-63f2-11ec-90d6-0242ac120003/certificates
  #https://[domain]:[port]/api/v2/operations/authorities/{authorityUuid}/raProfiles/{raProfileUuid}/certificates

The issuance request is accepted and queued; it runs asynchronously, so the response returns only the certificate's uuid — the certificateData field is left empty and the signed certificate is not returned here:

{
  "certificateData": "",
  "uuid": "1a90cc6c-76e0-48cb-a027-e52a84c071c2"
}

Poll the certificate detail for that uuid until its state becomes Issued, then read the signed certificate from the detail response.

Upload existing certificate​

Upload the existing certificate to the platform.

  1. Click Certificates in the left menu
  2. Click Upload Certificate (upload symbol )
  3. Upload the certificate (CRT file)
  4. Click Submit to upload the certificate to the platform

Create new certificate​

Select the correct RA Profile and issue a new Certificate:

  1. Click Certificates in the left menu
  2. Click Add Certificate (plus symbol )
  3. Keep the request type Request now — the certificate request is submitted to the authority immediately
  4. Select the RA Profile: ADCS-WebServer
  5. Choose the Key Source:
    • External — upload your own certificate request (CSR file)
    • Existing Key — the platform builds and signs the request from a platform key: select the Token Profile and the Key, and fill the Signature Attributes tab. For a hybrid certificate, switch on Include Alternative Key, select the Alternative Token Profile and Alternative Key, and fill the Alternative Signature Attributes tab.
  6. With Existing Key, fill the Request Attributes tab — its values define the content of the certificate request
  7. Fill the Connector Attributes and Custom Attributes tabs, if needed
  8. Click Create

The Certificate has been created.

Request attributes

The Request Attributes tab shows the resolved set for the selected RA Profile. The tab title carries a red * when any attribute is required. Mapped fields show a badge next to the label — such as → Subject CN — indicating where the value lands in the certificate. See Request Attribute for the concept.

External CSR validation

With the External key source, the uploaded CSR is validated against the profile's resolved request-attribute set, in strict or lenient mode — see External CSR validation. Violations appear in the red Compliance errors panel on the form.