Sign in
pki

Create a CA issuer: evaluation root, Hikyo-signed or offline-signed intermediate, or imported CA.

Changed on

The CA private key is generated in Hikyo or supplied once as protected input (import), sealed under the instance key, and never returned by any route. An intermediate without parent is created pending with a CSR for an offline root to sign.

post/api/v1/instance/pki/issuers

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /api/v1/instance/pki/issuers
  • Auth: HTTP bearer

Request body

mode'root' | 'intermediate' | 'import' required
namestring required

An issuer or profile name.

common_namestring
organizationstring
key_algorithm'ecdsa-p256' | 'ecdsa-p384' | 'rsa-3072' | 'rsa-4096'
ttl_secondsinteger
parentstring

An issuer or profile name.

crl_distribution_urlstring
private_key_pemstring

Import only. Protected input, sealed on arrival and never returned.

certificate_pemstring
chain_pemstring

Response

The created version.

idstring required

A prefixed UUIDv7, e.g. org_0198….

namestring required

An issuer or profile name.

versioninteger required
kind'root' | 'intermediate' required
origin'generated' | 'imported' required
parent_idstring nullable
state'pending' | 'active' | 'retiring' | 'retired' | 'revoked' required
key_algorithmstring required
key_fingerprintstring required

sha256:<base64url> of the SubjectPublicKeyInfo.

certificate_pemstring nullable
csr_pemstring nullable

The CSR of a pending version, for an offline root to sign.

chain_pemstring nullable
subject_cnstring required
subject_orgstring nullable
not_beforestring date-time nullable
not_afterstring date-time nullable
crl_distribution_urlstring nullable
restore_holdboolean required

True after a restore until the issuer is reconciled; no issuance while held.

issued_countinteger required
crl_numberinteger required
crl_this_updatestring date-time nullable
crl_next_updatestring date-time nullable
created_atstring date-time required
updated_atstring date-time required

Changes

  • 54b2780eec85Revision changes
    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

    • info

      added the optional property / to the response with the status

  • 88a397a3514cRevision changes
    • info

      endpoint added