Creating a CA

Function

This API is used to create a CA. If you wish to:

Create a root CA, configure mandatory parameters based on the parameter description.
Create a subordinate CA and activate its certificate, configure mandatory parameters based on the parameter description.
Create a subordinate CA, but not want to activate its certificate, exclude one of the following parameters in the request body: issuer_id, signature_algorithm, and validity.

URI

POST /v1/private-certificate-authorities

Request Parameters

**Table 1** Request header parameters
Parameter	Mandatory	Type	Description
X-Auth-Token	Yes	String	User token. The token can be obtained by calling the token API of IAM. The value of X-Auth-Token in the response header is the user token.

**Table 2** Request body parameters
Parameter	Mandatory	Type	Description
type	Yes	String	Type of the CA you want to create: ROOT: a root CA SUBORDINATE: a subordinate CA
distinguished_name	Yes	DistinguishedName object	Certificate name. For details, see data structure for the DistinguishedName field.
key_algorithm	Yes	String	Key algorithm. The options are as follows: RSA2048: RSA algorithm with the key length of 2048 bits RSA4096: RSA algorithm with the key length of 4096 bits EC256: Elliptic Curve Digital Signature Algorithm (ECDSA) with the key length of 256 bits EC384: Elliptic Curve Digital Signature Algorithm (ECDSA) with the key length of 384 bits
validity	No	Validity object	Validity period of a certificate. The options are as follows: If you want to create a root CA, this parameter is mandatory. If you want to create a subordinate CA and activate it, this parameter is mandatory. If you want to create a subordinate CA but not activate it immediately, this parameter is not required. You can specify this parameter when activating the subordinate CA. NOTE: For details, see data structure description of the Validity field.
issuer_id	No	String	ID of the parent CA. The options are as follows: If you want to create a root CA, this parameter is not required because a root CA is a self-signed certificate and does not have a parent CA. If you want to create a subordinate CA and activate it, this parameter is mandatory. If you want to create a subordinate CA but not activate it immediately, this parameter is not required. You can specify this parameter when activating the subordinate CA. Minimum: 36 Maximum: 36
path_length	No	Integer	Length of the CA certificate path. The options are as follows: If you want to create a root CA, this parameter is not required by default. This means CA path length is not limited and you can expand the CA hierarchies. To limit the CA hierarchies, you can specify this parameter when creating a subordinate CA. If you want to create a subordinate CA and activate it, specify this parameter based on your need. Default value: 0 If you want to create a subordinate CA but not need to activate it, this parameter is not required. You can specify this parameter when you activate the subordinate CA. Minimum: 0 Maximum: 6
signature_algorithm	No	String	Signature hash algorithm. There are three scenarios: If you want to create a root CA, this parameter is mandatory. If you want to create a subordinate CA and activate it, this parameter is mandatory. If you want to create a subordinate CA but not activate it immediately, this parameter is not required. You can specify this parameter when activating the subordinate CA. The options are as follows: SHA256 SHA384 SHA512
key_usages	No	Array of strings	Key usage. For details, see 4.2.1.3 in RFC 5280. digitalSignature: The key can be used as a digital signature. nonRepudiation: The key can be used for non-repudiation. keyEncipherment: The key can be for key encryption. dataEncipherment: The key can be used for data encryption. keyAgreement: The key can be used for key negotiation. keyCertSign: The key can issue a certificate. cRLSign: The key can issue a certificate revocation list (CRL). encipherOnly: The key is used only for encryption. decipherOnly: The key is used only for decryption. NOTE: The default values are as follows: Root CA certificates: [digitalSignature, keyCertSign, cRLSign], which cannot be changed. The value you specified is ignored. Subordinate CA certificates: [digitalSignature, keyCertSign, cRLSign], which can be customized.
crl_configuration	No	CrlConfiguration object	Certificate CRL. For details, see data structure for the CrlConfiguration field.

**Table 3** DistinguishedName
Parameter	Mandatory	Type	Description
common_name	Yes	String	Common certificate name (CN). Minimum: 1 Maximum: 64
country	Yes	String	Country code, which must comply with the regular expression "[A-Za-z]{2}". Minimum: 2 Maximum: 2
state	Yes	String	State or city name. Minimum: 1 Maximum: 128
locality	Yes	String	Country/Region. Minimum: 1 Maximum: 128
organization	Yes	String	Organization name. Minimum: 1 Maximum: 64
organizational_unit	Yes	String	Organization Unit (OU). Minimum: 1 Maximum: 64

**Table 4** Validity
Parameter	Mandatory	Type	Description
type	Yes	String	Validity period type, which is mandatory. The options are as follows: YEAR: Year (12 months) MONTH: Month (31 days) DAY: Day HOUR: Hour
value	Yes	Integer	The certificate validity period. The value of this parameter varies depending on the value of type: Root CA certificates: no longer than 30 years Subordinate CA or private certificates: no longer than 20 years
start_from	No	Integer	Start time. The options are as follows: The value is a timestamp in milliseconds. For example, 1645146939688 indicates 2022-02-18 09:15:39. The value of start_from cannot be earlier than the result of the value of current_time minus 5 minutes.

**Table 5** CrlConfiguration
Parameter	Mandatory	Type	Description
enabled	Yes	Boolean	Whether to enable the gray release function of CRL. true false
crl_name	No	String	Name of the certificate revocation list. NOTE: If you do not specify this parameter, the system uses the ID of the parent CA that issues the current certificate by default.
obs_bucket_name	No	String	OBS bucket name. NOTE: To enable the CRL release function: This parameter is mandatory. You must have created an agency to authorize the PCA service to access OBS. For details, see Certificate Revocation > Checking the Agency Permission and Certificate Revocation > Creating an Agency in this document. The specified OBS bucket must exist. Otherwise, an error will be reported.
valid_days	No	Integer	CRL update interval, in days. This parameter is mandatory when the CRL release function is enabled. Minimum: 7 Maximum: 30

Response Parameters

Status code: 200

**Table 6** Response body parameters
Parameter	Type	Description
ca_id	String	ID of the CA certificate being issued. Minimum: 36 Maximum: 36

Status code: 400

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Error code Minimum: 3 Maximum: 36
error_msg	String	Error message Minimum: 0 Maximum: 1024

Status code: 401

**Table 8** Response body parameters
Parameter	Type	Description
error_code	String	Error code Minimum: 3 Maximum: 36
error_msg	String	Error message Minimum: 0 Maximum: 1024

Status code: 403

**Table 9** Response body parameters
Parameter	Type	Description
error_code	String	Error code Minimum: 3 Maximum: 36
error_msg	String	Error message Minimum: 0 Maximum: 1024

Status code: 404

**Table 10** Response body parameters
Parameter	Type	Description
error_code	String	Error code Minimum: 3 Maximum: 36
error_msg	String	Error message Minimum: 0 Maximum: 1024

Status code: 500

**Table 11** Response body parameters
Parameter	Type	Description
error_code	String	Error code Minimum: 3 Maximum: 36
error_msg	String	Error message Minimum: 0 Maximum: 1024

Example Requests

When you use this API to create a CA certificate, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.

POST https://ccm.ae-ad-1.myhuaweicloud.com/v1/private-certificate-authorities

{
  "type" : "ROOT",
  "key_algorithm" : "RSA4096",
  "signature_algorithm" : "SHA512",
  "distinguished_name" : {
    "country" : "your country abbreviation",
    "state" : "your state",
    "locality" : "your locality",
    "organization" : "your organization",
    "organizational_unit" : "your unit",
    "common_name" : "your CN"
  },
  "validity" : {
    "type" : "YEAR",
    "value" : 3
  },
  "crl_configuration" : {
    "enabled" : false,
    "obs_bucket_name" : "demoBucket",
    "valid_days" : 8
  }
}

Example Responses

Status code: 200

Request succeeded.

{
  "ca_id" : "66504812-fedc-414a-9b7c-4c1836398524"
}

Status code: 400

Invalid request parameters.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 401

Token required for the requested page.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 403

Authentication failed.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 404

No resources available or found.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status code: 500

Internal service error.

{
  "error_code" : "PCA.XXX",
  "error_msg" : "XXX"
}

Status Codes

Status Code	Description
200	Request succeeded.
400	Invalid request parameters.
401	Token required for the requested page.
403	Authentication failed.
404	No resources available or found.
500	Internal service error.