ADadyen
Client certificates - company level

Generate a client certificate

Changed on

Generates a client certificate for secure communication with Adyen using mutual TLS (mTLS). Provide a certificate signing request (CSR). Adyen signs it and returns the client certificate.

The CSR must be generated by a key pair that meets the following criteria:

  • Key ownership: the CSR must be signed by the associated private key.
  • Key type: RSA with a minimum key size of 2048 bits, or ECC with a minimum key size of 224 bits.

A company account can have a maximum of 10 valid client certificates at a time.

The subject distinguished name (subjectDN) of the issued certificate is constructed by Adyen from the path companyId and the request apiCredential. The subject in your CSR is not used. The returned subjectDN has the format UID={apiCredential}-Company.{companyId},CN={apiCredential}-Company.{companyId},O=Company.{companyId}.

To make this request, your API credential must have the following roles:

  • Management API - Client certificates read and write
post/companies/{companyId}/clientCertificates

Request

  • Base URL
    https://management-live.adyen.com
  • URL
    https://management-live.adyen.com/companies/{companyId}/clientCertificates
  • Auth
    • HTTP basic
    • or API key in header X-API-Key

Path parameters

companyIdstring required

The unique identifier of the company account.

Request body

apiCredentialstring required

The API Credential that you want to use this certificate with, in the format 'ws_@Company.'. NOTE: You must assign the DN on that specified API credential with the one from the generated client certificate. Accomplish this either through the Customer Area API Credential page or the PATCH endpoint for apiCredentials

certificateSigningRequeststring required

Certificate signing request. Must be a Base64-encoded DER string. Only the public key is enrolled; see the enroll operation for subject handling.

Response

Created - Client certificate was generated successfully.

caChainstring[] required

Certificate chain with intermediates and Management Certificate Authority Root which excludes the signed client certificate leaf

idstring required

The unique identifier of the client certificate

leafstring byte required

Signed client certificate as a Base64-encoded DER string

serialNumberstring required

Serial number of client certificate

subjectDNstring required

Subject DN (Distinguished Name) of client certificate. Server-generated from companyId and apiCredential; see the enroll operation for details.

Changes