Consume a challenge

Consume a one-time WebRA challenge and enroll the certificate it authorizes.

This endpoint requires no authentication: presenting a valid challenge is the authorization. The challenge is single-use and time-limited, and is bound to the profile it was issued on. A challenge that is expired, already consumed, or submitted on another profile is rejected.

The enrollment is always synchronous.

Body required

application/json

The challenge to consume

profile

string required

The WebRA profile name the challenge was issued on

challenge

string required

The one-time challenge that authorizes this enrollment

template

object (WebRA Challenge Submit Request Template) required

The user-data that will be used to generate the certificate

csr

string

The certificate signing request to enroll, in decentralized mode. Mutually exclusive with keyType

keyType

string (Keytype)

The type of key that will be generated, in centralized mode. Mutually exclusive with csr

subject

array of objects (IndexedDNElement)

List of DN elements that will be used to build the certificate's Distinguished Name. Only accepted if the profile's certificate template is empty

Array [

element

string required

The element type and index. Indexes start at 1! Available elements are: cn, e, ou, st, l, o, c, dc, uid, serialNumber, surname, givenName, unstructuredAddress, unstructuredName, organizationIdentifier, uniqueIdentifier, street, description, t

value

string | null

The element value

]

sans

array of objects (SAN Element)

List of SAN elements that will be used to build the certificate's Subject Alternative Name. Only accepted if the profile's certificate template is empty

Array [

type

string | null required

SAN type

Enum RFC822NAME DNSNAME URI IPADDRESS OTHERNAME_UPN OTHERNAME_GUID REGISTERED_ID

value

array of string | null

SAN value

]

extensions

array of objects (Certificate Extension)

List of extension elements that will be used to build the certificate's extensions. Only accepted if the profile's certificate template is empty

Array [

type

string required

The type of the extension element

Enum ms_sid ms_template ms_template_v2

value

string | null

The value of the extension element

]

metadata

array of objects (Certificate Metadata)

List of metadata elements to set on the certificate. Only the automation_policy metadata may be set here, and only to a policy authorized on the profile

Array [

metadata

string required

Technical metadata related to the certificate

Enum pki_connector previous_certificate_id renewed_certificate_id automation_policy gs_order_id metapki_id digicert_id entrust_id scep_transid fcms_id gsatlas_id certeurope_id digicert_order_id

value

string | null

The value of the metadata element

]

Responses

201 Challenge consumed and certificate enrolled

certificate

string required

The certificate that was enrolled (PEM)

pkcs12

string

The generated PKCS#12, only returned in centralized mode. It is encrypted with the submitted challenge as its password, in DER Base64 format.

400 Invalid request

403 Forbidden action

500 Internal server error

post

/api/v1/challenge/submit

{

"profile": "webra_centralized" ,

"challenge": "8ChpvJvNSTaMxxlP" ,

"template":

{ ... }

}