Migrate an existing External Certificate Authority

Migrate an existing External Certificate Authority based on its name

Path parameters

name

string required

Body required

application/json

The private keys to associate with the external CA

privateKey

object (Signer Private Key) required

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

altPrivateKey

object (Signer Private Key)

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

Responses

200 The migrated Certificate Authority

string (Internal ID) required

Object internal ID

type

string required

The type of Certificate Authority

Value managed

enroll

boolean required

If true, this Certificate Authority can emit certificates

enforceKeyUnicity

boolean required

If true, each enrollment request must have a unique key

name

string required

The name of the Certificate Authority

trustedForClientAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for client authentication on Stream

trustedForServerAuthentication

boolean required

If true, certificates emitted by this Certificate Authority can be used for server authentication by Stream

privateKey

object (Signer Private Key) required

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

certificate

object (Certificate)

string required

The certificate's distinguished name

dnElements

array of object (DN Element) required

The distinguished name, with each element being an object

Array [

type

string required

The DN element type

Enum CN UID SERIALNUMBER SURNAME GIVENNAME unstructuredAddress unstructuredName E OU organizationIdentifier UniqueIdentifier STREET ST L O C DC

value

string required

The DN Element value

]

issuerDn

string required

The DN of this certificate's issuer

serial

string required

This certificate's serial number

notBefore

integer required

This certificate's start of validity

notAfter

integer required

This certificate's end of validity

keyType

string required

This certificate's keytype

signingAlgorithm

string required

Ths certificate's signing algorithm

pem

string required

PEM encoded certificate

certificateThumbprint

string required

The SHA-256 thumbprint of this certificate

certificateSHAOneThumbprint

string required

The SHA-1 thumbprint of this certificate

publicKeyThumbprint

string required

The thumbprint of the public key of this certificate

keyUsages

array of string required

This certificate's Key Usages

isKeyUsagesCritical

boolean required

If true, the Key Usages extension of this certificate is critical

extendedKeyUsages

array of string required

This certificate's Extended Key Usages

isExtendedKeyUsagesCritical

boolean required

If true, the Extended Key Usages extension of this certificate is critical

selfSigned

boolean required

If true, this certificate is self-signed

subjectKeyIdentifier

string

The subject key identifier of this certificate

authorityKeyIdentifier

string

The authority key identifier of this certificate

sans

array of objects (SAN Element)

List of this certificate's SANs

Array [

sanType

string required

The type of SAN

Enum RFC822NAME DNSNAME URI IPADDRESS OTHERNAME_UPN OTHERNAME_GUID REGISTERED_ID

value

string required

The value of the SAN

]

basicConstraints

object

This certificate's Basic Constraints

isCa

boolean required

If true, this certificate is a Certificate Authority certificate

pathLen

integer

The maximum number of intermediate certificates that may follow this certificate in a certification path

extensions

array of objects (Certificate Extension Element)

This certificate's Microsoft specific extensions

Array [

type

string required

The type of the extension

Enum ms_sid ms_template ms_template_v2

value

string

The value of the extension. Not setting this value means the extension should not be in the certificate

]

crldps

array of string

This certificate's CRL Distribution Points

aias

object

This certificate's Authority Information Access

crt

array of string

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

policies

array of objects (Certificate Policy)

This certificate's Certificate Policies

Array [

oid

string required

Object Identifier of the policy

cpsUrls

array of string

URIs to the Certification Practice Statement documents of this policy

userNotices

array of objects (User Notice)

The user notices of this policy

]

string

This Certificate Authority's Distinguished Name

queue

string

The queue to apply on this Certificate Authority's operations

crldps

array of string

The urls of this Certificate Authority's CRL Distribution Points

aia

object (Authority Information Access)

AIAs to add to the certificate

certificate

array of string

List of URIs on which the Certificate Authority certificate can be found

ocsp

array of string

List of URIs on which the OCSP Responder of the Certificate Authority can be accessed

policy

array of objects (Certificate Policy)

This Certificate Authority's Certificate Policies

Array [

oid

string required

Object Identifier of the Policy

cpsPointer

string

URI to a Certification Practice Statement document

organization

string

Organization of the user notice

noticeNumbers

array of integer

Notice numbers of the policy

explicitText

string

The text of the user notice

]

qcStatement

object (Qualified Certificate Statements)

The Qualified Certificate Statements to add to the emitted certificates

eTSIQCCompliance

boolean required

If true, the certificate is a Qualified Certificate

eTSIQCSSCD

boolean required

If true, the private key of the certificate resides in a Secure Signature Creation Device

eTSIRetentionPeriod

integer required

This indicates the duration of the retention period of material information in years

eTSIQCType

string (QC Type) required

The type of document a qualified certificate can sign

Enum ESIGN ESEAL WEB NONE

eTSIPDS

object

The PKI Disclosure Statements URI for a specified language

property name*

string

additional property

eTSITransactionLimit

object (Transaction Limit Statement)

This indicates the limits of the transactions the certificate is qualified for. The maximum amount is calculated by: valueLimit * 10^(valueLimitExp)

valueLimit

integer required

The maximum amount this certificate is qualified for simplified to the lowest power of 10

valueLimitExp

integer required

The exponent of the power of 10 to multiply with valueLimit to get the maximum amount

currencyCode

string required

The ISO-4217 currency code for this limit

eTSILegislation

array of string

The alpha-2 ISO-3166 country codes where the certificate is qualified

overridePermissions

object (Override Permissions)

This indicates which properties can be overriden in the enrollment request

boolean

If true, the Key Usages can be redefined in the enrollment request

eku

boolean

If true, the Extended Key Usages can be redefined in the enrollment request

emptyExtensions

boolean

If true, the Empty Extensions can be redefined in the enrollment request

crldps

boolean

If true, the CRL Distribution Points can be redefined in the enrollment request

aia

boolean

If true, the Authority Information Access can be redefined in the enrollment request

policy

boolean

If true, the Certificate Policy can be redefined in the enrollment request

pathlen

boolean

If true, the length of the certification path can be redefined in the enrollment request

lifetime

boolean

If true, the certificate's lifetime can be redefined in the enrollment request

backdate

boolean

If true, the certificate's backdate can be redefined in the enrollment request

checkPoP

boolean

If true, the need to check the proof of possession can be redefined in the enrollment request

extraCsrExtensions

boolean

If true, the list of extensions copied as is from the CSR can be redefined in the enrollment request

crlPolicy

object (CRL Generation Policy)

Define how to generate the CRL fot his Certificate Authority

validity

string required

The duration of the CRL's validity

eidas

boolean required

If true, the CRL will be EIDAS compliant

hardGeneration

string

The CRL will be generated at each period

lazyGeneration

string

The CRL will be checked at each period and generated if a new entry was added

triggers

object (TriggersManagedCertificateAuthority)

Triggers that apply on events on this CA

onCRLGeneration

array of string

Name of the triggers to execute when this CA's CRL are generated (manually or via cron)

onCRLGenerationError

array of string

Name of the triggers to execute when an error occurs when this CA's CRL are generated (manually or via cron)

onCRLGenerationRecover

array of string

Name of the triggers to execute when this CA's CRL are successfully generated when the last status was error

onCRLSync

array of string

Name of the triggers to execute when this CA's CRL are synced

onCRLSyncError

array of string

Name of the triggers to execute when this CA's CRL fail

onCRLExpiration

array of string

Name of the triggers to execute when this CA's CRL expire

onCAExpiration

array of string

Name of the triggers to execute when this CA expires

description

string

revoked

boolean

If true, the Certificate Authority is revoked

revocationDate

string

The revocation date of this Certificate Authority

revocationReason

string (Revocation Reason)

The revocation reason of this Certificate Authority

Enum unspecified keyCompromise cACompromise affiliationChanged superseded cessationOfOperation

enableOCSP

boolean

Enable OCSP on this CA

ocspSigner

string

Name of the OCSP signer associated with this CA

compromised

boolean

Define this CA as compromised for OCSP responses

archiveCutoff

object (Archive Cutoff)

OCSP Archive Cutoff configuration

mode

string required

Archive cutoff mode. issuer uses the CA's expiration date and retention uses the retentionPeriod defined below

Enum issuer retention

retentionPeriod

string

retention mode: The time during which the certificate will be kept in retention after expiration

ocspResponseMinimalDuration

string

altPrivateKey

object (Signer Private Key)

This signer's private key

keystore

string required

The Keystore in which the key is stored

name

string required

The name of the key in the keystore

hashAlgorithm

string (Hash Algorithm)

The Hash Algorithm to use when signing with this key

Enum SHA1 SHA224 SHA256 SHA384 SHA512 SHA3_224 SHA3_256 SHA3_384 SHA3_512

usePSS

boolean

For RSA Keys in PKCS11 Keystores only: use the PSS signature algorithm

400 Bad Request

401 Unauthorized request

403 Forbidden action

404 Not Found

500 Internal Server error

patch

/api/v1/cas/{name}

{

"privateKey":

{ ... } ,

"altPrivateKey":

{ ... }

}

{

"id": "6448d56b310000400063f014" ,

"certificate":

{ ... } ,

"type": "managed" ,

"enroll": true ,

"dn": "CN=MyCA,O=EVERTRUST,C=FR" ,

"queue": "Slow-queue" ,

"enforceKeyUnicity": true ,

"crldps":

[ ... ] ,

"aia":

{ ... } ,

"policy":

[ ... ] ,

"qcStatement":

{ ... } ,

"overridePermissions":

{ ... } ,

"crlPolicy":

{ ... } ,

"triggers":

{ ... } ,

"name": "MyCA" ,

"description": "string" ,

"trustedForClientAuthentication": true ,

"trustedForServerAuthentication": true ,

"revoked": false ,

"revocationDate": "2026-11-10T17:28:10.527Z" ,

"revocationReason": "unspecified" ,

"enableOCSP": true ,

"ocspSigner": "string" ,

"compromised": true ,

"archiveCutoff":

{ ... } ,

"ocspResponseMinimalDuration": "30 seconds" ,

"altPrivateKey":

{ ... } ,

"privateKey":

{ ... }

}