Issuing a Certificate with a CSR
Function
This API is used to issue a certificate with a CSR. The constraints are as follows:
-
When type is set to INTERMEDIATE_CA, the created subordinate CA certificate has the following restrictions:
-
It does not use the CA quota. The certificate is not returned when the CA list is queried.
-
Only the following two APIs can be used to obtain the information:
-
Cannot be used to issue a certificate. The key is kept by the user.
-
It uses the private certificate quota. When the private certificate list is queried, the certificate is returned.
-
The usage of other private certificates is the same as that of other private certificates, except that the key information is not exported (the key information is kept by the user.).
Obtaining certificate details: GET /v1/private-certificate-authorities/{ca_id}
Exporting a certificate: POST /v1/private-certificate-authorities/{ca_id}/export
certificate_id returned by this API indicates ca_id of the subordinate CA.
Note: Use \r\n or \n to replace the newline characters to convert the CSR into a string. For details, see the example request. Note: The organization information, public key algorithm, and public key content of a certificate are included in the CSR file and cannot be obtained through APIs.
Debugging
You can debug this API through automatic authentication in API Explorer or use the SDK sample code generated by API Explorer.
Authorization Information
Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.
- If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
- If you are using identity policy-based authorization, the following identity policy-based permissions are required.
URI
POST /v1/private-certificates/csr
Request Parameters
|
Parameter |
Mandatory |
Type |
Description |
|---|---|---|---|
|
X-Auth-Token |
Yes |
String |
User token. For details, see [Obtaining a User Token] (https://support.huaweicloud.com/intl/en-us/api-iam/iam_30_0001.html). |
|
Parameter |
Mandatory |
Type |
Description |
|---|---|---|---|
|
issuer_id |
Yes |
String |
ID of the parent CA. Minimum: 36 Maximum: 36 |
|
csr |
Yes |
String |
Certificate signature request. Use \r\n or \n to replace the newline characters in the CSR. The replacement is not required if this API is requested through the console. Maximum: 5120 |
|
validity |
Yes |
Validity object |
Certificate validity. For details, see data structure for the Validity field. |
|
type |
No |
String |
Certificate type. This parameter is used to distinguish subordinate CA certificates from private certificates. |
|
path_length |
No |
Integer |
Path length. This parameter is valid only when a subordinate CA is issued. Minimum: 0 Maximum: 6 |
|
subject_alternative_names |
No |
Array of SubjectAlternativeName objects |
The alternative name for the subject (This parameter is reserved and ignored at the backend). For details, see data structure for the SubjectAlternativeName field. Array Length: 0 - 20 |
|
enterprise_project_id |
No |
String |
Enterprise project ID. If the enterprise project function is not enabled, you do not need to set this parameter. If the enterprise project function is enabled, you can set this parameter when querying a resource. If this parameter is not specified, the system searches for the required resource in all the enterprise projects that you have permissions for. In this case, the value of enterprise_project_id is all. The parameter value must meet one of the following requirements: Is all Is 0 Matches the regular expression ^[0-9a-z]{8}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{12}$. |
|
Parameter |
Mandatory |
Type |
Description |
|---|---|---|---|
|
type |
Yes |
String |
Validity period type, which is mandatory. The options are as follows: |
|
value |
Yes |
Integer |
The certificate validity period. The value of this parameter varies depending on the value of type: |
|
start_from |
No |
Integer |
Start time. The options are as follows: |
Response Parameters
Status code: 200
|
Parameter |
Type |
Description |
|---|---|---|
|
certificate_id |
String |
ID of the certificate being issued. Minimum: 36 Maximum: 36 |
Status code: 400
|
Parameter |
Type |
Description |
|---|---|---|
|
error_code |
String |
Error code Minimum: 3 Maximum: 36 |
|
error_msg |
String |
Error message Minimum: 0 Maximum: 1024 |
Status code: 401
|
Parameter |
Type |
Description |
|---|---|---|
|
error_code |
String |
Error code Minimum: 3 Maximum: 36 |
|
error_msg |
String |
Error message Minimum: 0 Maximum: 1024 |
Status code: 403
|
Parameter |
Type |
Description |
|---|---|---|
|
error_code |
String |
Error code Minimum: 3 Maximum: 36 |
|
error_msg |
String |
Error message Minimum: 0 Maximum: 1024 |
Status code: 404
|
Parameter |
Type |
Description |
|---|---|---|
|
error_code |
String |
Error code Minimum: 3 Maximum: 36 |
|
error_msg |
String |
Error message Minimum: 0 Maximum: 1024 |
Status code: 500
|
Parameter |
Type |
Description |
|---|---|---|
|
error_code |
String |
Error code Minimum: 3 Maximum: 36 |
|
error_msg |
String |
Error message Minimum: 0 Maximum: 1024 |
Example Requests
When you use this API to issue a certificate via CSR, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.
POST https://ccm.cn-north-4.myhuaweicloud.com/v1/private-certificates/csr
{
"csr" : "-----BEGIN CERTIFICATE REQUEST-----\\nMIICyTCCAbECAQAwXjELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB3NpY2hhdW4xEDAO\\nBgNVBAcTB2NoZW5nZHUxCzAJBgNVBAoTAkhXMQswCQYDVQQLEwJJVDERMA8GA1UE\\nAxMIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ4q5z\\nxqK/L/FC9x2jESeUW5GB6zS5rVxT0WLTCTv9d1LtWBLsRIinATYTYiP1pNo4/pBq\\nHlM3IiUDkc896CJerYlNzOIjTaV4GjCZvPrxSHU5toJvIDflBsY+gnzbT1ol/y0r\\n3yb9dx7eeF5rPR+U8RTw+Ov/ZNRb+0CY30hrXMdrWjp5dtLGTlr5EFYxlKNOPCkR\\n+6BGyJnC9PWSuqwsykFbgMRkcBaNAxa59dRhMF50pvx2Vs929vFrMi+ofDELUOqz\\n1vyjaEA3pn3AGJGXZgrGNbSfz12ixgGLes4cQD21GCIAWgnBQ7b1ru2V8ImUfyh0\\nyvTEyHJTuFbQ+257AgMBAAGgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdEQQMMAqC\\nCHRlc3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBKfjZuYsz4s0wb1POIWn41eiAB\\np53qb63QKWILN9z8dLktcdSl3lPfcfPZpXv++QPtn3LR9rJKBawusk6SPXbvOGgS\\n5J+6eM8kVW2O3gHFgoaMcPYVtiO7ekG6o25qx6+Rj84wbFdmpOiCc8AwrLEBwzYV\\np1zaprWQu6PxBulkYPa3FLcntDdi7B67r0YTpxVvo1K7vHYFboDvPz7xG57QIFIM\\nwGd1OegariMT3N8gBOzLZc+jqLpxgo4xoNqBHMo6DEmKLdWdzU4ljpuGK9had99k\\nvQ5vft/Qra3v1uq2lOm/G92b0uA9Y1t2bMHobtAnuXL0HmY9XcLdzpC3f8h8\\n-----END CERTIFICATE REQUEST-----",
"validity" : {
"type" : "YEAR",
"value" : 3
},
"issuer_id" : "2cb2878b-6cd1-460d-bd25-afe655159bdc"
}
Example Responses
Status code: 200
Request succeeded.
{
"certificate_id" : "e3e10fc6-5dff-4a70-9cb5-320d258a6215"
}
Status code: 400
Invalid request parameters.
{
"error_code" : "PCA.XXX",
"error_msg" : "XXX"
}
Status code: 401
Token required for the requested page.
{
"error_code" : "PCA.XXX",
"error_msg" : "XXX"
}
Status code: 403
Authentication failed.
{
"error_code" : "PCA.XXX",
"error_msg" : "XXX"
}
Status code: 404
No resources available or found.
{
"error_code" : "PCA.XXX",
"error_msg" : "XXX"
}
Status code: 500
Internal service error.
{
"error_code" : "PCA.XXX",
"error_msg" : "XXX"
}
SDK Sample Code
The SDK sample code is as follows.
Java
When you use this API to issue a certificate via CSR, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 |
package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.GlobalCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.ccm.v1.region.CcmRegion; import com.huaweicloud.sdk.ccm.v1.*; import com.huaweicloud.sdk.ccm.v1.model.*; public class CreateCertificateByCsrSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); ICredential auth = new GlobalCredentials() .withAk(ak) .withSk(sk); CcmClient client = CcmClient.newBuilder() .withCredential(auth) .withRegion(CcmRegion.valueOf("<YOUR REGION>")) .build(); CreateCertificateByCsrRequest request = new CreateCertificateByCsrRequest(); CreateCertificateByCsrRequestBody body = new CreateCertificateByCsrRequestBody(); Validity validitybody = new Validity(); validitybody.withType("YEAR") .withValue(3); body.withValidity(validitybody); body.withCsr("-----BEGIN CERTIFICATE REQUEST-----\nMIICyTCCAbECAQAwXjELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB3NpY2hhdW4xEDAO\nBgNVBAcTB2NoZW5nZHUxCzAJBgNVBAoTAkhXMQswCQYDVQQLEwJJVDERMA8GA1UE\nAxMIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ4q5z\nxqK/L/FC9x2jESeUW5GB6zS5rVxT0WLTCTv9d1LtWBLsRIinATYTYiP1pNo4/pBq\nHlM3IiUDkc896CJerYlNzOIjTaV4GjCZvPrxSHU5toJvIDflBsY+gnzbT1ol/y0r\n3yb9dx7eeF5rPR+U8RTw+Ov/ZNRb+0CY30hrXMdrWjp5dtLGTlr5EFYxlKNOPCkR\n+6BGyJnC9PWSuqwsykFbgMRkcBaNAxa59dRhMF50pvx2Vs929vFrMi+ofDELUOqz\n1vyjaEA3pn3AGJGXZgrGNbSfz12ixgGLes4cQD21GCIAWgnBQ7b1ru2V8ImUfyh0\nyvTEyHJTuFbQ+257AgMBAAGgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdEQQMMAqC\nCHRlc3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBKfjZuYsz4s0wb1POIWn41eiAB\np53qb63QKWILN9z8dLktcdSl3lPfcfPZpXv++QPtn3LR9rJKBawusk6SPXbvOGgS\n5J+6eM8kVW2O3gHFgoaMcPYVtiO7ekG6o25qx6+Rj84wbFdmpOiCc8AwrLEBwzYV\np1zaprWQu6PxBulkYPa3FLcntDdi7B67r0YTpxVvo1K7vHYFboDvPz7xG57QIFIM\nwGd1OegariMT3N8gBOzLZc+jqLpxgo4xoNqBHMo6DEmKLdWdzU4ljpuGK9had99k\nvQ5vft/Qra3v1uq2lOm/G92b0uA9Y1t2bMHobtAnuXL0HmY9XcLdzpC3f8h8\n-----END CERTIFICATE REQUEST-----"); body.withIssuerId("2cb2878b-6cd1-460d-bd25-afe655159bdc"); request.withBody(body); try { CreateCertificateByCsrResponse response = client.createCertificateByCsr(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
Python
When you use this API to issue a certificate via CSR, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 |
# coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import GlobalCredentials from huaweicloudsdkccm.v1.region.ccm_region import CcmRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkccm.v1 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] credentials = GlobalCredentials(ak, sk) client = CcmClient.new_builder() \ .with_credentials(credentials) \ .with_region(CcmRegion.value_of("<YOUR REGION>")) \ .build() try: request = CreateCertificateByCsrRequest() validitybody = Validity( type="YEAR", value=3 ) request.body = CreateCertificateByCsrRequestBody( validity=validitybody, csr="-----BEGIN CERTIFICATE REQUEST-----\nMIICyTCCAbECAQAwXjELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB3NpY2hhdW4xEDAO\nBgNVBAcTB2NoZW5nZHUxCzAJBgNVBAoTAkhXMQswCQYDVQQLEwJJVDERMA8GA1UE\nAxMIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ4q5z\nxqK/L/FC9x2jESeUW5GB6zS5rVxT0WLTCTv9d1LtWBLsRIinATYTYiP1pNo4/pBq\nHlM3IiUDkc896CJerYlNzOIjTaV4GjCZvPrxSHU5toJvIDflBsY+gnzbT1ol/y0r\n3yb9dx7eeF5rPR+U8RTw+Ov/ZNRb+0CY30hrXMdrWjp5dtLGTlr5EFYxlKNOPCkR\n+6BGyJnC9PWSuqwsykFbgMRkcBaNAxa59dRhMF50pvx2Vs929vFrMi+ofDELUOqz\n1vyjaEA3pn3AGJGXZgrGNbSfz12ixgGLes4cQD21GCIAWgnBQ7b1ru2V8ImUfyh0\nyvTEyHJTuFbQ+257AgMBAAGgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdEQQMMAqC\nCHRlc3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBKfjZuYsz4s0wb1POIWn41eiAB\np53qb63QKWILN9z8dLktcdSl3lPfcfPZpXv++QPtn3LR9rJKBawusk6SPXbvOGgS\n5J+6eM8kVW2O3gHFgoaMcPYVtiO7ekG6o25qx6+Rj84wbFdmpOiCc8AwrLEBwzYV\np1zaprWQu6PxBulkYPa3FLcntDdi7B67r0YTpxVvo1K7vHYFboDvPz7xG57QIFIM\nwGd1OegariMT3N8gBOzLZc+jqLpxgo4xoNqBHMo6DEmKLdWdzU4ljpuGK9had99k\nvQ5vft/Qra3v1uq2lOm/G92b0uA9Y1t2bMHobtAnuXL0HmY9XcLdzpC3f8h8\n-----END CERTIFICATE REQUEST-----", issuer_id="2cb2878b-6cd1-460d-bd25-afe655159bdc" ) response = client.create_certificate_by_csr(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
Go
When you use this API to issue a certificate via CSR, a token is required in the X-Auth-Token field in the request header. The token must have the permission to access the API.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 |
package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/global" ccm "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/ccm/v1/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") auth := global.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). Build() client := ccm.NewCcmClient( ccm.CcmClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). Build()) request := &model.CreateCertificateByCsrRequest{} validitybody := &model.Validity{ Type: "YEAR", Value: int32(3), } request.Body = &model.CreateCertificateByCsrRequestBody{ Validity: validitybody, Csr: "-----BEGIN CERTIFICATE REQUEST-----\nMIICyTCCAbECAQAwXjELMAkGA1UEBhMCQ04xEDAOBgNVBAgTB3NpY2hhdW4xEDAO\nBgNVBAcTB2NoZW5nZHUxCzAJBgNVBAoTAkhXMQswCQYDVQQLEwJJVDERMA8GA1UE\nAxMIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCZ4q5z\nxqK/L/FC9x2jESeUW5GB6zS5rVxT0WLTCTv9d1LtWBLsRIinATYTYiP1pNo4/pBq\nHlM3IiUDkc896CJerYlNzOIjTaV4GjCZvPrxSHU5toJvIDflBsY+gnzbT1ol/y0r\n3yb9dx7eeF5rPR+U8RTw+Ov/ZNRb+0CY30hrXMdrWjp5dtLGTlr5EFYxlKNOPCkR\n+6BGyJnC9PWSuqwsykFbgMRkcBaNAxa59dRhMF50pvx2Vs929vFrMi+ofDELUOqz\n1vyjaEA3pn3AGJGXZgrGNbSfz12ixgGLes4cQD21GCIAWgnBQ7b1ru2V8ImUfyh0\nyvTEyHJTuFbQ+257AgMBAAGgJjAkBgkqhkiG9w0BCQ4xFzAVMBMGA1UdEQQMMAqC\nCHRlc3QuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBKfjZuYsz4s0wb1POIWn41eiAB\np53qb63QKWILN9z8dLktcdSl3lPfcfPZpXv++QPtn3LR9rJKBawusk6SPXbvOGgS\n5J+6eM8kVW2O3gHFgoaMcPYVtiO7ekG6o25qx6+Rj84wbFdmpOiCc8AwrLEBwzYV\np1zaprWQu6PxBulkYPa3FLcntDdi7B67r0YTpxVvo1K7vHYFboDvPz7xG57QIFIM\nwGd1OegariMT3N8gBOzLZc+jqLpxgo4xoNqBHMo6DEmKLdWdzU4ljpuGK9had99k\nvQ5vft/Qra3v1uq2lOm/G92b0uA9Y1t2bMHobtAnuXL0HmY9XcLdzpC3f8h8\n-----END CERTIFICATE REQUEST-----", IssuerId: "2cb2878b-6cd1-460d-bd25-afe655159bdc", } response, err := client.CreateCertificateByCsr(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
More
For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.
Status Codes
|
Status Code |
Description |
|---|---|
|
200 |
Request succeeded. |
|
400 |
Invalid request parameters. |
|
401 |
Token required for the requested page. |
|
403 |
Authentication failed. |
|
404 |
No resources available or found. |
|
500 |
Internal service error. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot