Sign in
Certificate Authorities (iam/v2)

Read a Certificate Authority

General Availability

Make a request to read a certificate authority.

get/iam/v2/certificate-authorities/{id}

Path parameters

idstring required

The unique identifier for the certificate authority.

Response

Certificate Authority.

api_version'iam/v2' required

APIVersion defines the schema version of this representation of a resource.

kind'CertificateAuthority' required

Kind defines the object this REST resource represents.

idstring required

ID is the "natural identifier" for an object within its scope/namespace; it is normally unique across time but not space. That is, you can assume that the ID will not be reclaimed and reused after an object is deleted ("time"); however, it may collide with IDs for other object kinds or objects of the same kind within a different scope/namespace ("space").

display_namestring required

The human-readable name of the certificate authority.

descriptionstring required

A description of the certificate authority.

fingerprintsstring[] required

The fingerprints for each certificate in the certificate chain. These are SHA-1 encoded strings that act as unique identifiers for the certificates in the chain.

expiration_datesstring[] required

The expiration dates of certificates in the chain.

serial_numbersstring[] required

The serial numbers for each certificate in the certificate chain.

certificate_chain_filenamestring required

The file name of the uploaded pem file for this certificate authority.

crl_sourcestring

The source specifies whether the Certificate Revocation List (CRL) is updated from either local file uploaded (LOCAL) or from url of CRL (URL).

crl_urlstring uri

The url from which to fetch the CRL for the certificate authority if crl_source is URL.

crl_updated_atstring date-time

The timestamp for when CRL was last updated.

statestring required

The current state of the certificate authority.

require_crl_on_client_certificateboolean required

Whether to require CRL validation on client certificates. If require_crl_on_client_certificate is true, then a CRL must be configured. At time of mTLS auth, if the client certificate is revoked in the CRL or the client issuer does not match the CRL issuer, certificate verification will fail even if TLS handshake is successful (OpenSSL -crl_check default behavior). If require_crl_on_client_certificate is false, this mTLS identity provider cannot configure a new CRL.

Example response

{
  "id": "dlz-f3a90de",
  "metadata": {
    "self": "https://api.confluent.cloud/iam/v2/certificate-authorities/op-12345",
    "resource_name": "crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/identity-provider=op-12345",
    "created_at": "2006-01-02T15:04:05-07:00",
    "updated_at": "2006-01-02T15:04:05-07:00",
    "deleted_at": "2006-01-02T15:04:05-07:00"
  },
  "display_name": "My Certificate Authority",
  "description": "Sample description text",
  "fingerprints": [
    "B1BC968BD4f49D622AA89A81F2150152A41D829C"
  ],
  "expiration_dates": [
    "2017-07-21T17:32:28Z"
  ],
  "serial_numbers": [
    "219C542DE8f6EC7177FA4EE8C3705797"
  ],
  "certificate_chain_filename": "certificate.pem",
  "crl_source": "LOCAL",
  "crl_updated_at": "2017-07-21T17:32:28Z",
  "state": "ENABLED",
  "require_crl_on_client_certificate": true
}

Changes

No recorded changes to this endpoint across all 1 revision of this API.