/create-pki-cert-issuer

post

https://api.akeyless.io/create-pki-cert-issuer

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

allow-any-name

boolean

If set, clients can request certificates for any CN

allow-copy-ext-from-csr

boolean

If set, will allow copying the extra extensions from the csr file (if given)

allow-subdomains

boolean

If set, clients can request certificates for subdomains of the allowed domains

allowed-domains

string

A list of the allowed domains that clients can request to be included in
the certificate (in a comma-delimited list)

allowed-extra-extensions

string

A json string containing the allowed extra extensions for the pki cert issuer

allowed-ip-sans

string

A list of the allowed CIDRs for ips that clients can request to be included in the certificate as part of the IP Subject Alternative Names (in a comma-delimited list)

allowed-uri-sans

string

A list of the allowed URIs that clients can request to be included in
the certificate as part of the URI Subject Alternative Names (in a
comma-delimited list)

auto-renew

boolean

Automatically renew certificates before expiration

basic-constraints

string

Defines the X.509 Basic Constraints extension for certificates issued by this PKI issuer template

ca-target

string

The name of an existing CA target to attach this PKI Certificate Issuer to, required in Public CA mode

client-flag

boolean

If set, certificates will be flagged for client auth use

code-signing-flag

boolean

If set, certificates will be flagged for code signing use

country

string

A comma-separated list of countries that will be set in the issued certificate

create-private-crl

boolean

Set this to allow the issuer will expose a CRL endpoint in the Gateway

create-private-ocsp

boolean

Set this to enable an OCSP endpoint in the Gateway and include its URL in AIA

create-public-crl

boolean

Set this to allow the cert issuer will expose a public CRL endpoint

create-public-ocsp

boolean

Set this to enable a public OCSP endpoint and include its URL in AIA (served by UAM and includes account id)

critical-key-usage

string

Defaults to true

Mark key usage as critical [true/false]

delete_protection

string

Protection from accidental deletion of this object [true/false]

description

string

Description of the object

destination-path

string

A path in which to save generated certificates

disable-wildcards

boolean

If set, generation of wildcard certificates will be disabled.

enable-acme

boolean

If set, the cert issuer will support the acme protocol

expiration-event-in

array of strings

How many days before the expiration of the certificate would you like to be notified.

expiration-event-in

gw-cluster-url

string

The GW cluster URL to issue the certificate from. Required in Public CA mode, to allow CRLs on private CA, or to enable ACME

is-ca

boolean

If set, the basic constraints extension will be added to certificate

item-custom-fields

object

Additional custom fields to associate with the item

json

boolean

Defaults to false

Set output format to JSON

key-usage

string

Defaults to DigitalSignature,KeyAgreement,KeyEncipherment

key-usage

locality

string

A comma-separated list of localities that will be set in the issued certificate

max-path-len

int64

Defaults to -1

The maximum path length for the generated certificate. -1, means unlimited

metadata

string

Deprecated - use description

name

string

required

PKI certificate issuer name

not-enforce-hostnames

boolean

If set, any names are allowed for CN and SANs in the certificate and not
only a valid host name

not-require-cn

boolean

If set, clients can request certificates without a CN

ocsp-ttl

string

OCSP NextUpdate window for OCSP responses (min 10m). Supports s,m,h,d suffix.

organizational-units

string

A comma-separated list of organizational units (OU) that will be set in
the issued certificate

organizations

string

A comma-separated list of organizations (O) that will be set in the
issued certificate

postal-code

string

A comma-separated list of postal codes that will be set in the issued certificate

protect-certificates

boolean

Whether to protect generated certificates from deletion

province

string

A comma-separated list of provinces that will be set in the issued certificate

scheduled-renew

int64

Number of days before expiration to renew certificates

server-flag

boolean

If set, certificates will be flagged for server auth use

signer-key-name

string

A key to sign the certificate with, required in Private CA mode

split-certificate-chain

boolean

If set, separates the leaf certificate from the certificate chain.

street-address

string

A comma-separated list of street addresses that will be set in the issued certificate

tag

array of strings

List of the tags attached to this key

tag

token

string

Authentication token (see /auth and /configure)

ttl

string

required

The maximum requested Time To Live for issued certificates, in seconds. In case of Public CA, this is based on the CA target's supported maximum TTLs. Not supported for Let's Encrypt, which always uses the CA default lifetime (about 90 days).

uid-token

string

The universal identity token, Required only for universal_identity authentication

Responses

Language

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200createPKICertIssuerResponse wraps response body.

defaulterrorResponse wraps any error to return it as a JSON object with one "error" field.