OPopenziti
Current API Session
Enroll
Extend Enrollment

Allows the current identity to recieve a new certificate associated with a certificate based authenticator

Changed on

This endpoint only functions for certificates issued by the controller. 3rd party certificates are not handled. Allows an identity to extend its certificate's expiration date by using its current and valid client certificate to submit a CSR. This CSR may be passed in using a new private key, thus allowing private key rotation. The response from this endpoint is a new client certificate which the client must be verified via the /authenticators/{id}/extend-verify endpoint. After verification is completion any new connections must be made with new certificate. Prior to verification the old client certificate remains active.

post/current-identity/authenticators/{id}/extend

Request

Path parameters

idstring required

The id of the requested resource

Request body

clientCertCsrstring required

Response

A response containg the identity's new certificate

Example response

{
  "data": {
    "ca": "ca",
    "clientCert": "clientCert"
  },
  "meta": {
    "apiEnrollmentVersion": "apiEnrollmentVersion",
    "apiVersion": "apiVersion",
    "filterableFields": [
      "filterableFields",
      "filterableFields"
    ],
    "pagination": {
      "limit": 0.8008281904610115,
      "offset": 6.027456183070403,
      "totalCount": 1.4658129805029452
    }
  }
}

Changes

  • cce2800c1357Revision changes
    • warning

      the optional response header WWW-Authenticate removed for the status 200

    • warning

      the optional response header WWW-Authenticate removed for the status 401