Register a new Certificate Authority

Body required

application/json

Certificate Authority to register

type

string required

The type of Certificate Authority

Value external

outdatedRevocationStatusPolicy

string required

Defined the behavior when the revocation information is not up to date. revoked considers all certificates to be revoked even if they were not revoked on the last know status. unknown considers their status as unknown, and lastavailablestatus will consider them revoked if they were revoked, and valid otherwise

Enum revoked unknown lastavailablestatus

name

string required

The name of the Certificate Authority

trustedForClientAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream

trustedForServerAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream

certificate

string

The certificate of the Certificate Authority

crlUrls

array of string

URLs on which to find this Certificate Authority's CRL

refresh

string

The refresh period of this Certificate Authority's CRL

timeout

string

HTTP Request timeouts to fetch this Certificate Authority's CRL

proxy

string

HTTP Proxy to access this Certificate Authority's CRL

triggers

object (TriggersExternalCertificateAuthority)

Triggers that apply on events on this CA

onCRLUpdate

array of string

Name of the triggers to execute when this CA's CRL are updated (manually or via fetch on URL)

onCRLUpdateError

array of string

Name of the triggers to execute when an error occurs when this CA's CRL are updated (manually or via fetch on URL)

onCRLUpdateRecover

array of string

Name of the triggers to execute when this CA's CRL are successfully updated when the last status was error

onCRLSync

array of string

Name of the triggers to execute when this CA's CRL are synced

onCRLSyncError

array of string

Name of the triggers to execute when this CA's CRL fail

onCRLExpiration

array of string

Name of the triggers to execute when this CA's CRL expire

onCAExpiration

array of string

Name of the triggers to execute when this CA expires

description

string

revoked

boolean

If true, the Certificate Authority is revoked

revocationDate

string

The revocation date of this Certificate Authority

revocationReason

string (Revocation Reason)

The revocation reason of this Certificate Authority

enableOCSP

boolean

Enable OCSP on this CA

ocspSigner

string

Name of the OCSP signer associated with this CA

compromised

boolean

Define this CA as compromised for OCSP responses

archiveCutoff

object (Archive Cutoff)

OCSP Archive Cutoff configuration

mode

string required

Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below

Enum issuer retention

retentionPeriod

string

retention mode: The time during which the certificate will be kept in retention after expiration

ocspResponseMinimalDuration

string

type

string required

The type of Certificate Authority

Value managed

enroll

boolean required

If true, this Certificate Authority can emit certificates

enforceKeyUnicity

boolean required

If true, each enrollment request must have a unique key

name

string required

The name of the Certificate Authority

trustedForClientAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream

trustedForServerAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream

privateKey

object (Signer Private Key) required

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

certificate

string

The certificate of the Certificate Authority

string

This Certificate Authority's Distinguished Name

queue

string

The queue to apply on this Certificate Authority's operations

crldps

array of string

The urls of this Certificate Authority's CRL Distribution Points

aia

object (Authority Information Access)

AIAs to add to the certificate

certificate

array of string

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

policy

array of objects (Certificate Policy)

This Certificate Authority's Certificate Policies

Array [

oid

string required

Object Identifier of the Policy

cpsPointer

string

URI to a Certification Practice Statement document

organization

string

Organization of the user notice. Introduced in 2.0.12

noticeNumbers

array of integer

Notice numbers of the policy. Introduced in 2.0.12

explicitText

string

The text of the user notice. Introduced in 2.0.12

]

qcStatement

object (Qualified Certificate Statements)

The Qualified Certificate Statements to add to the emitted certificates

eTSIQCCompliance

boolean required

If true, the certificate is a Qualified Certificate

eTSIQCSSCD

boolean required

If true, the private key of the certificate resides in a Secure Signature Creation Device

eTSIRetentionPeriod

integer required

This indicates the duration of the retention period of material information in years

eTSIQCType

object required

This indicates which type of document can be signed by the certificate. One of eseal, esign, web or none

eTSIPDS

object

The PKI Disclosure Statements URI for a specified language

eTSITransactionLimit

object (Transaction Limit Statement)

This indicates the limits of the transactions the certificate is qualified for. The maximum amount is calculated by: valueLimit * 10^(valueLimitExp)

eTSILegislation

array of string

The alpha-2 ISO-3166 country codes where the certificate is qualified

overridePermissions

object (Override Permissions)

This indicates which properties can be overriden in the enrollment request

boolean

If true, the Key Usages can be redefined in the enrollment request

eku

boolean

If true, the Extended Key Usages can be redefined in the enrollment request

emptyExtensions

boolean

If true, the Empty Extensions can be redefined in the enrollment request

crldps

boolean

If true, the CRL Distribution Points can be redefined in the enrollment request

aia

boolean

If true, the Authority Information Access can be redefined in the enrollment request

policy

boolean

If true, the Certificate Policy can be redefined in the enrollment request

pathlen

boolean

If true, the length of the certification path can be redefined in the enrollment request

lifetime

boolean

If true, the certificate's lifetime can be redefined in the enrollment request

backdate

boolean

If true, the certificate's backdate can be redefined in the enrollment request

checkPoP

boolean

If true, the need to check the proof of possession can be redefined in the enrollment request

crlPolicy

object (CRL Generation Policy)

Define how to generate the CRL fot his Certificate Authority

validity

string required

The duration of the CRL's validity

eidas

boolean required

If true, the CRL will be EIDAS compliant

hardGeneration

string

The CRL will be generated at each period

lazyGeneration

string

The CRL will be checked at each period and generated if a new entry was added

triggers

object (TriggersManagedCertificateAuthority)

Triggers that apply on events on this CA

onCRLGeneration

array of string

Name of the triggers to execute when this CA's CRL are generated (manually or via cron)

onCRLGenerationError

array of string

Name of the triggers to execute when an error occurs when this CA's CRL are generated (manually or via cron)

onCRLGenerationRecover

array of string

Name of the triggers to execute when this CA's CRL are successfully generated when the last status was error

onCRLSync

array of string

Name of the triggers to execute when this CA's CRL are synced

onCRLSyncError

array of string

Name of the triggers to execute when this CA's CRL fail

onCRLExpiration

array of string

Name of the triggers to execute when this CA's CRL expire

onCAExpiration

array of string

Name of the triggers to execute when this CA expires

description

string

revoked

boolean

If true, the Certificate Authority is revoked

revocationDate

string

The revocation date of this Certificate Authority

revocationReason

string (Revocation Reason)

The revocation reason of this Certificate Authority

enableOCSP

boolean

Enable OCSP on this CA

ocspSigner

string

Name of the OCSP signer associated with this CA

compromised

boolean

Define this CA as compromised for OCSP responses

archiveCutoff

object (Archive Cutoff)

OCSP Archive Cutoff configuration

mode

string required

Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below

Enum issuer retention

retentionPeriod

string

retention mode: The time during which the certificate will be kept in retention after expiration

ocspResponseMinimalDuration

string

altPrivateKey

object (Signer Private Key)

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

Responses

201 Certificate Authority successfully registered

string (Internal ID) required

Object internal ID

type

string required

The type of Certificate Authority

Value external

outdatedRevocationStatusPolicy

string required

Enum revoked unknown lastavailablestatus

name

string required

The name of the Certificate Authority

trustedForClientAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream

trustedForServerAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream

certificate

object (Certificate)

string required

The certificate's distinguished name

dnElements

array of object (DN Element) required

The distinguished name, with each element being an object

Array [

type

string required

The DN element type

Enum CN UID SERIALNUMBER SURNAME GIVENNAME unstructuredAddress unstructuredName E OU organizationIdentifier UniqueIdentifier STREET ST L O C DC

value

string required

The DN Element value

]

issuerDn

string required

The DN of this certificate's issuer

serial

string required

This certificate's serial number

notBefore

integer required

This certificate's start of validity

notAfter

integer required

This certificate's end of validity

keyType

string required

This certificate's keytype

signingAlgorithm

string required

Ths certificate's signing algorithm

pem

string required

PEM encoded certificate

subjectKeyIdentifier

string

The subject key identifier of this certificate

sans

array of objects (SAN Element)

List of this certificate's SANs

Array [

sanType

string required

The type of SAN

Enum RFC822NAME DNSNAME URI IPADDRESS OTHERNAME_UPN OTHERNAME_GUID REGISTERED_ID

value

string required

The value of the SAN

]

crldps

array of string

This certificate's CRL Distribution Points

aias

object

This certificate's Authority Information Access

crt

object

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

crlUrls

array of string

URLs on which to find this Certificate Authority's CRL

refresh

string

The refresh period of this Certificate Authority's CRL

timeout

string

HTTP Request timeouts to fetch this Certificate Authority's CRL

proxy

string

HTTP Proxy to access this Certificate Authority's CRL

triggers

object (TriggersExternalCertificateAuthority)

Triggers that apply on events on this CA

onCRLUpdate

array of string

Name of the triggers to execute when this CA's CRL are updated (manually or via fetch on URL)

onCRLUpdateError

array of string

Name of the triggers to execute when an error occurs when this CA's CRL are updated (manually or via fetch on URL)

onCRLUpdateRecover

array of string

Name of the triggers to execute when this CA's CRL are successfully updated when the last status was error

onCRLSync

array of string

Name of the triggers to execute when this CA's CRL are synced

onCRLSyncError

array of string

Name of the triggers to execute when this CA's CRL fail

onCRLExpiration

array of string

Name of the triggers to execute when this CA's CRL expire

onCAExpiration

array of string

Name of the triggers to execute when this CA expires

description

string

revoked

boolean

If true, the Certificate Authority is revoked

revocationDate

string

The revocation date of this Certificate Authority

revocationReason

string (Revocation Reason)

The revocation reason of this Certificate Authority

enableOCSP

boolean

Enable OCSP on this CA

ocspSigner

string

Name of the OCSP signer associated with this CA

compromised

boolean

Define this CA as compromised for OCSP responses

archiveCutoff

object (Archive Cutoff)

OCSP Archive Cutoff configuration

mode

string required

Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below

Enum issuer retention

retentionPeriod

string

retention mode: The time during which the certificate will be kept in retention after expiration

ocspResponseMinimalDuration

string

string (Internal ID) required

Object internal ID

type

string required

The type of Certificate Authority

Value managed

enroll

boolean required

If true, this Certificate Authority can emit certificates

enforceKeyUnicity

boolean required

If true, each enrollment request must have a unique key

name

string required

The name of the Certificate Authority

trustedForClientAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream

trustedForServerAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream

privateKey

object (Signer Private Key) required

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

certificate

object (Certificate)

string required

The certificate's distinguished name

dnElements

array of object (DN Element) required

The distinguished name, with each element being an object

Array [

type

string required

The DN element type

Enum CN UID SERIALNUMBER SURNAME GIVENNAME unstructuredAddress unstructuredName E OU organizationIdentifier UniqueIdentifier STREET ST L O C DC

value

string required

The DN Element value

]

issuerDn

string required

The DN of this certificate's issuer

serial

string required

This certificate's serial number

notBefore

integer required

This certificate's start of validity

notAfter

integer required

This certificate's end of validity

keyType

string required

This certificate's keytype

signingAlgorithm

string required

Ths certificate's signing algorithm

pem

string required

PEM encoded certificate

subjectKeyIdentifier

string

The subject key identifier of this certificate

sans

array of objects (SAN Element)

List of this certificate's SANs

Array [

sanType

string required

The type of SAN

Enum RFC822NAME DNSNAME URI IPADDRESS OTHERNAME_UPN OTHERNAME_GUID REGISTERED_ID

value

string required

The value of the SAN

]

crldps

array of string

This certificate's CRL Distribution Points

aias

object

This certificate's Authority Information Access

crt

object

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

string

This Certificate Authority's Distinguished Name

queue

string

The queue to apply on this Certificate Authority's operations

crldps

array of string

The urls of this Certificate Authority's CRL Distribution Points

aia

object (Authority Information Access)

AIAs to add to the certificate

certificate

array of string

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

policy

array of objects (Certificate Policy)

This Certificate Authority's Certificate Policies

Array [

oid

string required

Object Identifier of the Policy

cpsPointer

string

URI to a Certification Practice Statement document

organization

string

Organization of the user notice. Introduced in 2.0.12

noticeNumbers

array of integer

Notice numbers of the policy. Introduced in 2.0.12

explicitText

string

The text of the user notice. Introduced in 2.0.12

]

qcStatement

object (Qualified Certificate Statements)

The Qualified Certificate Statements to add to the emitted certificates

eTSIQCCompliance

boolean required

If true, the certificate is a Qualified Certificate

eTSIQCSSCD

boolean required

If true, the private key of the certificate resides in a Secure Signature Creation Device

eTSIRetentionPeriod

integer required

This indicates the duration of the retention period of material information in years

eTSIQCType

object required

This indicates which type of document can be signed by the certificate. One of eseal, esign, web or none

eTSIPDS

object

The PKI Disclosure Statements URI for a specified language

eTSITransactionLimit

object (Transaction Limit Statement)

This indicates the limits of the transactions the certificate is qualified for. The maximum amount is calculated by: valueLimit * 10^(valueLimitExp)

eTSILegislation

array of string

The alpha-2 ISO-3166 country codes where the certificate is qualified

overridePermissions

object (Override Permissions)

This indicates which properties can be overriden in the enrollment request

boolean

If true, the Key Usages can be redefined in the enrollment request

eku

boolean

If true, the Extended Key Usages can be redefined in the enrollment request

emptyExtensions

boolean

If true, the Empty Extensions can be redefined in the enrollment request

crldps

boolean

If true, the CRL Distribution Points can be redefined in the enrollment request

aia

boolean

If true, the Authority Information Access can be redefined in the enrollment request

policy

boolean

If true, the Certificate Policy can be redefined in the enrollment request

pathlen

boolean

If true, the length of the certification path can be redefined in the enrollment request

lifetime

boolean

If true, the certificate's lifetime can be redefined in the enrollment request

backdate

boolean

If true, the certificate's backdate can be redefined in the enrollment request

checkPoP

boolean

If true, the need to check the proof of possession can be redefined in the enrollment request

crlPolicy

object (CRL Generation Policy)

Define how to generate the CRL fot his Certificate Authority

validity

string required

The duration of the CRL's validity

eidas

boolean required

If true, the CRL will be EIDAS compliant

hardGeneration

string

The CRL will be generated at each period

lazyGeneration

string

The CRL will be checked at each period and generated if a new entry was added

triggers

object (TriggersManagedCertificateAuthority)

Triggers that apply on events on this CA

onCRLGeneration

array of string

Name of the triggers to execute when this CA's CRL are generated (manually or via cron)

onCRLGenerationError

array of string

Name of the triggers to execute when an error occurs when this CA's CRL are generated (manually or via cron)

onCRLGenerationRecover

array of string

Name of the triggers to execute when this CA's CRL are successfully generated when the last status was error

onCRLSync

array of string

Name of the triggers to execute when this CA's CRL are synced

onCRLSyncError

array of string

Name of the triggers to execute when this CA's CRL fail

onCRLExpiration

array of string

Name of the triggers to execute when this CA's CRL expire

onCAExpiration

array of string

Name of the triggers to execute when this CA expires

description

string

revoked

boolean

If true, the Certificate Authority is revoked

revocationDate

string

The revocation date of this Certificate Authority

revocationReason

string (Revocation Reason)

The revocation reason of this Certificate Authority

enableOCSP

boolean

Enable OCSP on this CA

ocspSigner

string

Name of the OCSP signer associated with this CA

compromised

boolean

Define this CA as compromised for OCSP responses

archiveCutoff

object (Archive Cutoff)

OCSP Archive Cutoff configuration

mode

string required

Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below

Enum issuer retention

retentionPeriod

string

retention mode: The time during which the certificate will be kept in retention after expiration

ocspResponseMinimalDuration

string

altPrivateKey

object (Signer Private Key)

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

400 Bad Request

401 Unauthorized request

403 Forbidden action

500 Internal Server error

post

/api/v1/cas

{

"certificate": "-----BEGIN CERTIFICATE----- ..." ,

"type": "managed" ,

"crlUrls":

[ ... ] ,

"refresh": "15 minutes" ,

"outdatedRevocationStatusPolicy": "revoked" ,

"timeout": "20 seconds" ,

"proxy": "string" ,

"triggers":

{ ... } ,

"name": "MyCA" ,

"description": "string" ,

"trustedForClientAuthentication": true ,

"trustedForServerAuthentication": true ,

"revoked": false ,

"revocationDate": "2026-08-14T16:38:15.824Z" ,

"revocationReason": "string" ,

"enableOCSP": true ,

"ocspSigner": "string" ,

"compromised": true ,

"archiveCutoff":

{ ... } ,

"ocspResponseMinimalDuration": "30 seconds"

}

{

"certificate": "-----BEGIN CERTIFICATE----- ..." ,

"type": "managed" ,

"enroll": true ,

"dn": "CN=MyCA,O=EVERTRUST,C=FR" ,

"queue": "Slow-queue" ,

"enforceKeyUnicity": true ,

"crldps":

[ ... ] ,

"aia":

{ ... } ,

"policy":

[ ... ] ,

"qcStatement":

{ ... } ,

"overridePermissions":

{ ... } ,

"crlPolicy":

{ ... } ,

"triggers":

{ ... } ,

"name": "MyCA" ,

"description": "string" ,

"trustedForClientAuthentication": true ,

"trustedForServerAuthentication": true ,

"revoked": false ,

"revocationDate": "2026-08-14T16:38:15.824Z" ,

"revocationReason": "string" ,

"enableOCSP": true ,

"ocspSigner": "string" ,

"compromised": true ,

"archiveCutoff":

{ ... } ,

"ocspResponseMinimalDuration": "30 seconds" ,

"altPrivateKey":

{ ... } ,

"privateKey":

{ ... }

}

{

"id": "6448d56b310000400063f014" ,

"certificate":

{ ... } ,

"type": "managed" ,

"crlUrls":

[ ... ] ,

"refresh": "15 minutes" ,

"outdatedRevocationStatusPolicy": "revoked" ,

"timeout": "20 seconds" ,

"proxy": "string" ,

"triggers":

{ ... } ,

"name": "MyCA" ,

"description": "string" ,

"trustedForClientAuthentication": true ,

"trustedForServerAuthentication": true ,

"revoked": false ,

"revocationDate": "2026-08-14T16:38:15.824Z" ,

"revocationReason": "string" ,

"enableOCSP": true ,

"ocspSigner": "string" ,

"compromised": true ,

"archiveCutoff":

{ ... } ,

"ocspResponseMinimalDuration": "30 seconds"

}

{

"id": "6448d56b310000400063f014" ,

"certificate":

{ ... } ,

"type": "managed" ,

"enroll": true ,

"dn": "CN=MyCA,O=EVERTRUST,C=FR" ,

"queue": "Slow-queue" ,

"enforceKeyUnicity": true ,

"crldps":

[ ... ] ,

"aia":

{ ... } ,

"policy":

[ ... ] ,

"qcStatement":

{ ... } ,

"overridePermissions":

{ ... } ,

"crlPolicy":

{ ... } ,

"triggers":

{ ... } ,

"name": "MyCA" ,

"description": "string" ,

"trustedForClientAuthentication": true ,

"trustedForServerAuthentication": true ,

"revoked": false ,

"revocationDate": "2026-08-14T16:38:15.824Z" ,

"revocationReason": "string" ,

"enableOCSP": true ,

"ocspSigner": "string" ,

"compromised": true ,

"archiveCutoff":

{ ... } ,

"ocspResponseMinimalDuration": "30 seconds" ,

"altPrivateKey":

{ ... } ,

"privateKey":

{ ... }

}