Issuing a Certificate with a CSR

Function

This API is used to issue a certificate with a CSR. The constraints are as follows:

1. The default parameters are as follows:

2. When type is set to INTERMEDIATE_CA, the created subordinate CA certificate has the following restrictions:

• Default CA parameters:

  • keyUsage: can be set to digitalSignature, keyCertSign, or cRLSign. The parameters in the CSR are preferentially used.

  • SignatureHashAlgorithm: SHA384

  • PathLength: 0 (customizable)

• Private certificate parameters:

  • keyUsage: can be set to digitalSignature keyAgreement. The parameter in the CSR is preferentially used.

  • SignatureHashAlgorithm: SHA384

• It does not use the CA quota. The certificate is not returned when the CA list is queried.

• Only the following two APIs can be used to obtain the information:

• Cannot be used to issue a certificate. The key is kept by the user.

• It uses the private certificate quota. When the private certificate list is queried, the certificate is returned.

• The usage of other private certificates is the same as that of other private certificates, except that the key information is not exported (the key information is kept by the user.).

Obtaining certificate details: GET /v1/private-certificate-authorities/{ca_id}

Exporting a certificate: POST /v1/private-certificate-authorities/{ca_id}/export

certificate_id returned by this API indicates ca_id of the subordinate CA.

1. If type is set to ENTITY_CERT, the created private certificate has the following features:

Note: Use \r\n or \n to replace the newline characters to convert the CSR into a string. For details, see the example request. Note: The organization information, public key algorithm, and public key content of a certificate are included in the CSR file and cannot be obtained through APIs.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

• If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
• If you are using identity policy-based authorization, the following identity policy-based permissions are required.

  Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
  pca:ca:issueCertByCsr	Write	ca *	-	pca:ca:issueCertThroughCSR	-
  		-	g:EnterpriseProjectId g:RequestTag/<tag-key> g:TagKeys pca:CommonName

URI

POST /v1/private-certificates/csr

Request Parameters

Response Parameters

Status code: 200

Status code: 400

Status code: 401

Status code: 403

Status code: 404

Status code: 500

Example Requests

When you use this API to issue a certificate via CSR, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.

POST https://ccm.cn-north-4.myhuaweicloud.com/v1/private-certificates/csr

{
  "csr" : "-----BEGIN CERTIFICATE REQUEST-----\\nMIICyTCCAbECAQAwXjELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB3NpY2hhdW4xEDAO\\nBgNVBAcTB2NoZW5nZHUxCzAJBgNVBAoTAkhXMQswCQYDVQQLEwJJVDERMA8GA1UE\\nAxMIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ4q5z\\nxqK/L/FC9x2jESeUW5GB6zS5rVxT0WLTCTv9d1LtWBLsRIinATYTYiP1pNo4/pBq\\nHlM3IiUDkc896CJerYlNzOIjTaV4GjCZvPrxSHU5toJvIDflBsY+gnzbT1ol/y0r\\n3yb9dx7eeF5rPR+U8RTw+Ov/ZNRb+0CY30hrXMdrWjp5dtLGTlr5EFYxlKNOPCkR\\n+6BGyJnC9PWSuqwsykFbgMRkcBaNAxa59dRhMF50pvx2Vs929vFrMi+ofDELUOqz\\n1vyjaEA3pn3AGJGXZgrGNbSfz12ixgGLes4cQD21GCIAWgnBQ7b1ru2V8ImUfyh0\\nyvTEyHJTuFbQ+257AgMBAAGgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdEQQMMAqC\\nCHRlc3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBKfjZuYsz4s0wb1POIWn41eiAB\\np53qb63QKWILN9z8dLktcdSl3lPfcfPZpXv++QPtn3LR9rJKBawusk6SPXbvOGgS\\n5J+6eM8kVW2O3gHFgoaMcPYVtiO7ekG6o25qx6+Rj84wbFdmpOiCc8AwrLEBwzYV\\np1zaprWQu6PxBulkYPa3FLcntDdi7B67r0YTpxVvo1K7vHYFboDvPz7xG57QIFIM\\nwGd1OegariMT3N8gBOzLZc+jqLpxgo4xoNqBHMo6DEmKLdWdzU4ljpuGK9had99k\\nvQ5vft/Qra3v1uq2lOm/G92b0uA9Y1t2bMHobtAnuXL0HmY9XcLdzpC3f8h8\\n-----END CERTIFICATE REQUEST-----",
  "validity" : {
    "type" : "YEAR",
    "value" : 3
  },
  "issuer_id" : "2cb2878b-6cd1-460d-bd25-afe655159bdc"
}

Example Responses

Status code: 200

Request succeeded.

{
  "certificate_id" : "e3e10fc6-5dff-4a70-9cb5-320d258a6215"
}

Status code: 400

Invalid request parameters.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 401

Token required for the requested page.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 403

Authentication failed.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 404

No resources available or found.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 500

Internal service error.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status Codes

Error Codes

See Error Codes.