id
string (Internal ID)
required
The type of Certificate Authority
Value
managed
If true, this Certificate Authority can emit certificates
enforceKeyUnicity
boolean
required
If true, each enrollment request must have a unique key
The name of the Certificate Authority
trustedForClientAuthentication
boolean
required
If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream
trustedForServerAuthentication
boolean
required
If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream
privateKey
object (Signer Private Key)
required +
This signer's private key
The Keystore in which the key is stored
The name of the key in the keystore
hashAlgorithm
string (Hash Algorithm)
The Hash Algorithm to use when signing with this key
Enum
SHA1
SHA224
SHA256
SHA384
SHA512
SHA3_224
SHA3_256
SHA3_384
SHA3_512
For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm
certificate
object (Certificate)
+
The certificate's distinguished name
dnElements
array of object (DN Element)
required +
The distinguished name, with each element being an object
Array [
Enum
CN
UID
SERIALNUMBER
SURNAME
GIVENNAME
unstructuredAddress
unstructuredName
E
OU
organizationIdentifier
UniqueIdentifier
STREET
ST
L
O
C
DC
]
The DN of this certificate's issuer
This certificate's serial number
notBefore
integer
required
This certificate's start of validity
notAfter
integer
required
This certificate's end of validity
This certificate's keytype
signingAlgorithm
string
required
Ths certificate's signing algorithm
certificateThumbprint
string
required
The SHA-256 thumbprint of this certificate
certificateSHAOneThumbprint
string
required
The SHA-1 thumbprint of this certificate
publicKeyThumbprint
string
required
The thumbprint of the public key of this certificate
keyUsages
array of string
required
This certificate's Key Usages
isKeyUsagesCritical
boolean
required
If true, the Key Usages extension of this certificate is critical
extendedKeyUsages
array of string
required
This certificate's Extended Key Usages
isExtendedKeyUsagesCritical
boolean
required
If true, the Extended Key Usages extension of this certificate is critical
selfSigned
boolean
required
If true, this certificate is self-signed
subjectKeyIdentifier
string
The subject key identifier of this certificate
authorityKeyIdentifier
string
The authority key identifier of this certificate
sans
array of objects (SAN Element)
+
List of this certificate's SANs
Array [
Enum
RFC822NAME
DNSNAME
URI
IPADDRESS
OTHERNAME_UPN
OTHERNAME_GUID
REGISTERED_ID
]
basicConstraints
object
+
This certificate's Basic Constraints
If true, this certificate is a Certificate Authority certificate
The maximum number of intermediate certificates that may follow this certificate in a certification path
extensions
array of objects (Certificate Extension Element)
+
This certificate's Microsoft specific extensions
Array [
The type of the extension
Enum
ms_sid
ms_template
ms_template_v2
The value of the extension. Not setting this value means the extension should not be in the certificate
]
This certificate's CRL Distribution Points
This certificate's Authority Information Access
List of URIs on which the Certificate Authority certificate can be found
List of URIs on which the OCSP Responder of the Certificate Authority can be accessed
policies
array of objects (Certificate Policy)
+
This certificate's Certificate Policies
Array [
Object Identifier of the policy
URIs to the Certification Practice Statement documents of this policy
userNotices
array of objects (User Notice)
+
The user notices of this policy
Array [
noticeNumbers
array of integer
The notice numbers of the user notice
The text of the user notice
The organization of the user notice
]
]
This Certificate Authority's Distinguished Name
The queue to apply on this Certificate Authority's operations
The urls of this Certificate Authority's CRL Distribution Points
aia
object (Authority Information Access)
+
AIAs to add to the certificate
certificate
array of string
List of URIs on which the Certificate Authority certificate can be found
List of URIs on which the OCSP Responder of the Certificate Authority can be accessed
policy
array of objects (Certificate Policy)
+
This Certificate Authority's Certificate Policies
Array [
Object Identifier of the Policy
URI to a Certification Practice Statement document
Organization of the user notice
noticeNumbers
array of integer
Notice numbers of the policy
The text of the user notice
]
qcStatement
object (Qualified Certificate Statements)
+
The Qualified Certificate Statements to add to the emitted certificates
eTSIQCCompliance
boolean
required
If true, the certificate is a Qualified Certificate
eTSIQCSSCD
boolean
required
If true, the private key of the certificate resides in a Secure Signature Creation Device
eTSIRetentionPeriod
integer
required
This indicates the duration of the retention period of material information in years
eTSIQCType
string (QC Type)
required
The type of document a qualified certificate can sign
Enum
ESIGN
ESEAL
WEB
NONE
The PKI Disclosure Statements URI for a specified language
eTSITransactionLimit
object (Transaction Limit Statement)
+
This indicates the limits of the transactions the certificate is qualified for. The maximum amount is calculated by: valueLimit * 10^(valueLimitExp)
valueLimit
integer
required
The maximum amount this certificate is qualified for simplified to the lowest power of 10
valueLimitExp
integer
required
The exponent of the power of 10 to multiply with valueLimit to get the maximum amount
currencyCode
string
required
The ISO-4217 currency code for this limit
eTSILegislation
array of string
The alpha-2 ISO-3166 country codes where the certificate is qualified
overridePermissions
object (Override Permissions)
+
This indicates which properties can be overriden in the enrollment request
If true, the Key Usages can be redefined in the enrollment request
If true, the Extended Key Usages can be redefined in the enrollment request
If true, the Empty Extensions can be redefined in the enrollment request
If true, the CRL Distribution Points can be redefined in the enrollment request
If true, the Authority Information Access can be redefined in the enrollment request
If true, the Certificate Policy can be redefined in the enrollment request
If true, the length of the certification path can be redefined in the enrollment request
If true, the certificate's lifetime can be redefined in the enrollment request
If true, the certificate's backdate can be redefined in the enrollment request
If true, the need to check the proof of possession can be redefined in the enrollment request
extraCsrExtensions
boolean
If true, the list of extensions copied as is from the CSR can be redefined in the enrollment request
crlPolicy
object (CRL Generation Policy)
+
Define how to generate the CRL fot his Certificate Authority
The duration of the CRL's validity
If true, the CRL will be EIDAS compliant
The CRL will be generated at each period
The CRL will be checked at each period and generated if a new entry was added
triggers
object (TriggersManagedCertificateAuthority)
+
Triggers that apply on events on this CA
onCRLGeneration
array of string
Name of the triggers to execute when this CA's CRL are generated (manually or via cron)
onCRLGenerationError
array of string
Name of the triggers to execute when an error occurs when this CA's CRL are generated (manually or via cron)
onCRLGenerationRecover
array of string
Name of the triggers to execute when this CA's CRL are successfully generated when the last status was error
onCRLSync
array of string
Name of the triggers to execute when this CA's CRL are synced
onCRLSyncError
array of string
Name of the triggers to execute when this CA's CRL fail
onCRLExpiration
array of string
Name of the triggers to execute when this CA's CRL expire
onCAExpiration
array of string
Name of the triggers to execute when this CA expires
If true, the Certificate Authority is revoked
The revocation date of this Certificate Authority
revocationReason
string (Revocation Reason)
The revocation reason of this Certificate Authority
Enum
unspecified
keyCompromise
cACompromise
affiliationChanged
superseded
cessationOfOperation
Name of the OCSP signer associated with this CA
Define this CA as compromised for OCSP responses
archiveCutoff
object (Archive Cutoff)
+
OCSP Archive Cutoff configuration
Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below
Enum
issuer
retention
retention mode: The time during which the certificate will be kept in retention after expiration
ocspResponseMinimalDuration
string
altPrivateKey
object (Signer Private Key)
+
This signer's private key
The Keystore in which the key is stored
The name of the key in the keystore
hashAlgorithm
string (Hash Algorithm)
The Hash Algorithm to use when signing with this key
Enum
SHA1
SHA224
SHA256
SHA384
SHA512
SHA3_224
SHA3_256
SHA3_384
SHA3_512
For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm