Issuing certificates

1. Create a CSR. The only mandatory attribute is the Common Name.

   For an example of CSR creation with OpenSSL, see Issuing a mTLS certificate with a CSR.

2. POST the CSR content to the URI/{tenantId}/.well-known/est/simpleenroll endpoint with the following headers:

   • Content-Type must be application/pkcs10,

   • Content-Transfer-Encoding must be base64.

   NOTE
   The PKI supports CSR content with or without PEM PKCS#10 headers/footers, and with or without line breaks.

    

   If the operation is successful, the response, Content-Type : application/pkcs7-mime, is a base64 string in PEM style (line breaks every 76 characters), containing the issued certificate in PKCS#7.

   If it fails, the response if Content-Type : application/json and contains an error JSON object.

   NOTE
   PKCS#7 is a widely supported cryptographic message syntax mandated by the EST protocol. It allows to return in a compact way multiple certificates, e.g., the whole certificate chain, in addition to the newly issued certificate, and also other metadata if necessary.

For more information on the API routes, see the API Documentation.

The PKI allows generating a CSR before the final common name is known.

If the Common Name specified in the CSR is not suitable, you can override it by adding the x-override-cn header in the /simpleenroll API call. The certificate issued will contain the Common Name specified in the header.

The Common Name in the x-override-cn header must:

• be a non-empty string when the header is defined,

• have less than 64 characters,

• contain only these characters:

  ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_.~!#$''"()*+,/:;=?@[] %

  and/or the following percent-encoding characters:

  %20%21%22%23%24%25%27%28%29%2A%2B%2C%2F%3A%3B%3D%3F%40%5B%5D

For more information on the API routes, see the API Documentation.