Updated on 2025-11-28 GMT+08:00

Applying for a Certificate

Function

This API is used to apply for a certificate.

Debugging

You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

  • If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
  • If you are using identity policy-based authorization, the following identity policy-based permissions are required.

    Action

    Access Level

    Resource Type (*: required)

    Condition Key

    Alias

    Dependencies

    pca:ca:issueCert

    Write

    ca *

    -

    -

    -

    -

    • g:EnterpriseProjectId

    • g:RequestTag/<tag-key>

    • g:TagKeys

    • pca:CommonName

URI

POST /v1/private-certificates

Request Parameters

Table 1 Request header parameters

Parameter

Mandatory

Type

Description

X-Auth-Token

Yes

String

User token. For details, see [Obtaining a User Token] (https://support.huaweicloud.com/intl/en-us/api-iam/iam_30_0001.html).

Table 2 Request body parameters

Parameter

Mandatory

Type

Description

issuer_id

Yes

String

ID of the parent CA.

Minimum: 36

Maximum: 36

key_algorithm

No

String

Key algorithm. If this parameter is not specified, the key algorithm of the CA is used by default. The options are as follows:

  • RSA2048: RSA algorithm with the key length of 2048 bits

  • RSA4096: RSA algorithm with the key length of 4096 bits

  • EC256: Elliptic Curve Digital Signature Algorithm (ECDSA) with the key length of 256 bits

  • EC384: Elliptic Curve Digital Signature Algorithm (ECDSA) with the key length of 384 bits

  • SM2: Elliptic curve algorithm (signature hash algorithm SM3) issued by China State Cryptography Administration, with the key length of 256 bits (Chinese mainland website)

signature_algorithm

No

String

Signature hash algorithm. If this parameter is not specified, the signature hash algorithm of the CA is used by default. The options are as follows:

  • SHA256

  • SHA384

  • SHA512

  • SM3 (Chinese mainland website)

distinguished_name

Yes

CertDistinguishedName object

Certificate name. For details, see data structure for the CertDistinguishedName field.

validity

Yes

Validity object

Certificate validity. For details, see data structure for the Validity field.

key_usages

No

Array of strings

Key usage. For details, see [4.2.1.3] in RFC 5280 (https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3)

  • digitalSignature: used as digital signatures.

  • nonRepudiation: used for non-repudiation

  • keyEncipherment: used to encrypt key data.

  • dataEncipherment: used to encrypt data.

  • keyAgreement: used for key negotiation

  • keyCertSign: used to issue a certificate.

  • cRLSign: used to issue the revocation list.

  • encipherOnly: used only for encryption.

  • decipherOnly: used only for decryption.

subject_alternative_names

No

Array of SubjectAlternativeName objects

Alternative name for the subject. For details, see data structure of the SubjectAlternativeName field.

  • Array size: [0, 20]

Array Length: 0 - 20

extended_key_usage

No

ExtendedKeyUsage object

Extended key usage. For details, see data structure for the ExtendedKeyUsage field.

customized_extension

No

CustomizedExtension object

Customized extension information. For details, see data structure for the CustomizedExtension field.

enterprise_project_id

No

String

Enterprise project ID. If the enterprise project function is not enabled, you do not need to set this parameter. If the enterprise project function is enabled, you can set this parameter when querying a resource. If this parameter is not specified, the system searches for the required resource in all the enterprise projects that you have permissions for. In this case, the value of enterprise_project_id is all. The parameter value must meet one of the following requirements:

Is all

Is 0

Matches the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$.

Table 3 CertDistinguishedName

Parameter

Mandatory

Type

Description

common_name

Yes

String

Common name (CN) of a certificate. The value can contain a maximum of 64 characters, including only letters, digits, spaces, Chinese characters, hyphens (-), underscores (_), periods (.), commas (,), and asterisks (*).

Minimum: 1

Maximum: 64

country

No

String

Country code. The value is a string of two characters and can contain only letters. If this parameter is not specified, the value of the parent CA is inherited by default.

Minimum: 2

Maximum: 2

state

No

String

Name of a province or city. The value can contain a maximum of 128 characters, including only letters, digits, Chinese characters, spaces, hyphens (-), underscores (_), periods (.), and commas (,). If this parameter is not specified, the value of the parent CA is inherited by default.

Minimum: 1

Maximum: 128

locality

No

String

Region name. The value can contain a maximum of 128 characters, including only letters, digits, Chinese characters, spaces, hyphens (-), underscores (_), periods (.), and commas (,). If this parameter is not specified, the value of the parent CA is inherited by default.

Minimum: 1

Maximum: 128

organization

No

String

Organization name. The value can contain a maximum of 64 characters, including only letters, digits, Chinese characters, spaces, hyphens (-), underscores (_), periods (.), and commas (,). If this parameter is not specified, the value of the parent CA is inherited by default.

Minimum: 1

Maximum: 64

organizational_unit

No

String

Organization unit name. The value can contain a maximum of 64 characters, including only letters, digits, Chinese characters, spaces, hyphens (-), underscores (_), periods (.), and commas (,). If this parameter is not specified, the value of the parent CA is inherited by default.

Minimum: 1

Maximum: 64

Table 4 Validity

Parameter

Mandatory

Type

Description

type

Yes

String

Validity period type, which is mandatory. The options are as follows:

  • YEAR: by the year (12 months)

  • MONTH:by the month (31 days)

  • DAY: by the day

  • HOUR: by the hour

value

Yes

Integer

The certificate validity period. The value of this parameter varies depending on the value of type:

  • Root CAs: The validity period is less than or equal to 30 years.

  • Subordinate CAs and private certificates: The validity period is less than or equal to 20 years.

start_from

No

Integer

Start time. The options are as follows:

  • The format is a timestamp in milliseconds. For example, 1645146939688 indicates 2022-02-18 09:15:39.

  • The start time can begin no more than five minutes earlier than the current time. It means the value of start_from must be larger than the value of current_time minus 5 minutes.

Table 5 SubjectAlternativeName

Parameter

Mandatory

Type

Description

type

Yes

String

Type of the alternative name. Currently, only DNS, IP, EMAIL, URI, and UPN are allowed.

  • DNS

  • IP

  • EMAIL

  • URI

  • UPN

value

Yes

String

Value of the corresponding alternative name type.

  • DNS type. The length cannot exceed 253 characters.

  • IP type. The length cannot exceed 39 characters. IPv4 and IPv6 are supported.

  • EMAIL type. The length cannot exceed 256 characters.

  • URI type. The length cannot exceed 253 characters.

  • UPN type. The length cannot exceed 256 characters.

Table 6 ExtendedKeyUsage

Parameter

Mandatory

Type

Description

server_auth

No

Boolean

Server authentication. The OID is 1.3.6.1.5.5.7.3.1.

  • true

  • false

NOTE:

Enable this enhanced key usage for the server certificate. The default value is false.

Default: false

client_auth

No

Boolean

Client authentication. The OID is 1.3.6.1.5.5.7.3.2

  • true

  • false

NOTE:

Enable this enhanced key usage for the client certificate. The default value is false.

Default: false

code_signing

No

Boolean

Signing of downloadable executable code client authentication. The OID is 1.3.6.1.5.5.7.3.3.

  • true

  • false

NOTE:

The default value is false.

Default: false

email_protection

No

Boolean

Email protection. The OID is 1.3.6.1.5.5.7.3.4.

  • true

  • false

NOTE:

The default value is false.

Default: false

time_stamping

No

Boolean

Binding the hash of an object to a time. The OID is 1.3.6.1.5.5.7.3.8

  • true

  • false

NOTE:

The default value is false.

Default: false

smart_card_logon

No

Boolean

Smart card login. The OID is 1.3.6.1.4.1.311.20.2.2.

  • true

  • false

Active Directory login. The default value is false.

Default: false

Table 7 CustomizedExtension

Parameter

Mandatory

Type

Description

object_identifier

No

String

Object identifier

NOTE:

The value of this parameter must be a dot-decimal notation string that complies with the ASN1 specifications, for example, 1.3.6.1.4.1.2011.4.99.

Minimum: 1

Maximum: 64

value

No

String

Custom attribute content.

Minimum: 1

Maximum: 64

Response Parameters

Status code: 200

Table 8 Response body parameters

Parameter

Type

Description

certificate_id

String

ID of the certificate being issued.

Minimum: 36

Maximum: 36

Status code: 400

Table 9 Response body parameters

Parameter

Type

Description

error_code

String

Error code

Minimum: 3

Maximum: 36

error_msg

String

Error message

Minimum: 0

Maximum: 1024

Status code: 401

Table 10 Response body parameters

Parameter

Type

Description

error_code

String

Error code

Minimum: 3

Maximum: 36

error_msg

String

Error message

Minimum: 0

Maximum: 1024

Status code: 403

Table 11 Response body parameters

Parameter

Type

Description

error_code

String

Error code

Minimum: 3

Maximum: 36

error_msg

String

Error message

Minimum: 0

Maximum: 1024

Status code: 404

Table 12 Response body parameters

Parameter

Type

Description

error_code

String

Error code

Minimum: 3

Maximum: 36

error_msg

String

Error message

Minimum: 0

Maximum: 1024

Status code: 500

Table 13 Response body parameters

Parameter

Type

Description

error_code

String

Error code

Minimum: 3

Maximum: 36

error_msg

String

Error message

Minimum: 0

Maximum: 1024

Example Requests

When you call this API, a token with the permission to use this API is mandatory for the X-Auth-Token field.

POST https://ccm.cn-north-4.myhuaweicloud.com/v1/private-certificates

{
  "key_algorithm" : "RSA2048",
  "distinguished_name" : {
    "country" : "CN",
    "state" : "Sichuan",
    "locality" : "Chengdu",
    "organization" : "Huawei",
    "organizational_unit" : "CloudBU",
    "common_name" : "TestCert"
  },
  "subject_alternative_names" : [ {
    "type" : "IP",
    "value" : "156.127.116.38"
  } ],
  "signature_algorithm" : "SHA256",
  "validity" : {
    "type" : "YEAR",
    "value" : 3
  },
  "issuer_id" : "2cb2878b-6cd1-460d-bd25-afe655159bdc",
  "key_usages" : [ "digitalSignature", "nonRepudiation" ]
}

Example Responses

Status code: 200

Request succeeded.

{
  "certificate_id" : "ae9a326a-b61e-4446-854d-cda30ffe31f5"
}

Status code: 400

Invalid request parameters.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 401

Token required for the requested page.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 403

Authentication failed.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 404

No resources available or found.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 500

Internal service error.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

SDK Sample Code

The SDK sample code is as follows.

Java

When you call this API, a token with the permission to use this API is mandatory for the X-Auth-Token field.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.GlobalCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.ccm.v1.region.CcmRegion;
import com.huaweicloud.sdk.ccm.v1.*;
import com.huaweicloud.sdk.ccm.v1.model.*;

import java.util.List;
import java.util.ArrayList;

public class CreateCertificateSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");

        ICredential auth = new GlobalCredentials()
                .withAk(ak)
                .withSk(sk);

        CcmClient client = CcmClient.newBuilder()
                .withCredential(auth)
                .withRegion(CcmRegion.valueOf("<YOUR REGION>"))
                .build();
        CreateCertificateRequest request = new CreateCertificateRequest();
        CreateCertificateRequestBody body = new CreateCertificateRequestBody();
        List<SubjectAlternativeName> listbodySubjectAlternativeNames = new ArrayList<>();
        listbodySubjectAlternativeNames.add(
            new SubjectAlternativeName()
                .withType("IP")
                .withValue("156.127.116.38")
        );
        List<String> listbodyKeyUsages = new ArrayList<>();
        listbodyKeyUsages.add("digitalSignature");
        listbodyKeyUsages.add("nonRepudiation");
        Validity validitybody = new Validity();
        validitybody.withType("YEAR")
            .withValue(3);
        CertDistinguishedName distinguishedNamebody = new CertDistinguishedName();
        distinguishedNamebody.withCommonName("TestCert")
            .withCountry("CN")
            .withState("Sichuan")
            .withLocality("Chengdu")
            .withOrganization("Huawei")
            .withOrganizationalUnit("CloudBU");
        body.withSubjectAlternativeNames(listbodySubjectAlternativeNames);
        body.withKeyUsages(listbodyKeyUsages);
        body.withValidity(validitybody);
        body.withDistinguishedName(distinguishedNamebody);
        body.withSignatureAlgorithm("SHA256");
        body.withKeyAlgorithm("RSA2048");
        body.withIssuerId("2cb2878b-6cd1-460d-bd25-afe655159bdc");
        request.withBody(body);
        try {
            CreateCertificateResponse response = client.createCertificate(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

Python

When you call this API, a token with the permission to use this API is mandatory for the X-Auth-Token field.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import GlobalCredentials
from huaweicloudsdkccm.v1.region.ccm_region import CcmRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkccm.v1 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]

    credentials = GlobalCredentials(ak, sk)

    client = CcmClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(CcmRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = CreateCertificateRequest()
        listSubjectAlternativeNamesbody = [
            SubjectAlternativeName(
                type="IP",
                value="156.127.116.38"
            )
        ]
        listKeyUsagesbody = [
            "digitalSignature",
            "nonRepudiation"
        ]
        validitybody = Validity(
            type="YEAR",
            value=3
        )
        distinguishedNamebody = CertDistinguishedName(
            common_name="TestCert",
            country="CN",
            state="Sichuan",
            locality="Chengdu",
            organization="Huawei",
            organizational_unit="CloudBU"
        )
        request.body = CreateCertificateRequestBody(
            subject_alternative_names=listSubjectAlternativeNamesbody,
            key_usages=listKeyUsagesbody,
            validity=validitybody,
            distinguished_name=distinguishedNamebody,
            signature_algorithm="SHA256",
            key_algorithm="RSA2048",
            issuer_id="2cb2878b-6cd1-460d-bd25-afe655159bdc"
        )
        response = client.create_certificate(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

Go

When you call this API, a token with the permission to use this API is mandatory for the X-Auth-Token field.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global"
    ccm "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")

    auth := global.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        Build()

    client := ccm.NewCcmClient(
        ccm.CcmClientBuilder().
            WithRegion(region.ValueOf("<YOUR REGION>")).
            WithCredential(auth).
            Build())

    request := &model.CreateCertificateRequest{}
	var listSubjectAlternativeNamesbody = []model.SubjectAlternativeName{
        {
            Type: "IP",
            Value: "156.127.116.38",
        },
    }
	var listKeyUsagesbody = []string{
        "digitalSignature",
	    "nonRepudiation",
    }
	validitybody := &model.Validity{
		Type: "YEAR",
		Value: int32(3),
	}
	countryDistinguishedName:= "CN"
	stateDistinguishedName:= "Sichuan"
	localityDistinguishedName:= "Chengdu"
	organizationDistinguishedName:= "Huawei"
	organizationalUnitDistinguishedName:= "CloudBU"
	distinguishedNamebody := &model.CertDistinguishedName{
		CommonName: "TestCert",
		Country: &countryDistinguishedName,
		State: &stateDistinguishedName,
		Locality: &localityDistinguishedName,
		Organization: &organizationDistinguishedName,
		OrganizationalUnit: &organizationalUnitDistinguishedName,
	}
	signatureAlgorithmCreateCertificateRequestBody:= "SHA256"
	keyAlgorithmCreateCertificateRequestBody:= "RSA2048"
	request.Body = &model.CreateCertificateRequestBody{
		SubjectAlternativeNames: &listSubjectAlternativeNamesbody,
		KeyUsages: &listKeyUsagesbody,
		Validity: validitybody,
		DistinguishedName: distinguishedNamebody,
		SignatureAlgorithm: &signatureAlgorithmCreateCertificateRequestBody,
		KeyAlgorithm: &keyAlgorithmCreateCertificateRequestBody,
		IssuerId: "2cb2878b-6cd1-460d-bd25-afe655159bdc",
	}
	response, err := client.CreateCertificate(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

More

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

200

Request succeeded.

400

Invalid request parameters.

401

Token required for the requested page.

403

Authentication failed.

404

No resources available or found.

500

Internal service error.

Error Codes

See Error Codes.