POST Enrollment PFX

Required^*. A string that sets the name of the certificate authority that will be used to enroll against if there is more than one available with the provided template name. The certificate authority name can either be provided in hostname\\logical name format or as just the logical name. For example:

If no certificate authority is provided, one will be chosen at random from the certificate authorities available for enrollment with the provided Template.

This field is optional unless the enrollment is being done against a standalone CA, in which case it is required.

A string indicating the elliptic curve for the requested key.

ECC curves may be specified using the well-known OIDs for ECC algorithms. Well-known OIDs include:

• 1.2.840.10045.3.1.7 = P-256/ prime256v1/ secp256r1

• 1.3.132.0.34 = P-384/secp384r1

• 1.3.132.0.35 = P-521/secp521r1

A Boolean that sets whether to include the certificate chain in the response (true) or not (false). The default is true.

A Boolean that sets whether to deploy the certificate to certificate stores (true) or not (false). The default is true.

The RenewalCertificateId parameter is used in conjunction with InstallIntoExistingCertificateStores parameter to make the determination as to distribution of the certificate to certificate stores. If InstallIntoExistingCertificateStores is true, the certificate will be distributed to certificate stores that the certificate identified in RenewalCertificateId is found in.

A string indicating the algorithm for the request. Supported values are:

• RSA

• ECC

• Ed448

• Ed25519

Required. A string that sets the password used to encrypt the contents of the PFX file. The minimum password length is controlled by the Password Length application setting. The default is 12. See Application Settings: Enrollment Tab for more information.

An array of objects indicating the certificate stores to which the certificate should be distributed. Show store details.

"Properties": {
   "NetscalerVserver":"MyVirtualServerName"
}

An object that contains the elements for Keyfactor Command to use when generating the subject alternative name (SAN) for the certificate requested by the CSR, each of which is supplied as an array of strings. Show SAN key values.

For example:

"SANs": {
   "dns": [
      "dnssan1.keyexample.com",
      "dnssan2.keyexample.com",
      "dnssan3.keyexample.com"
   ],
   "ip": [
      "192.168.2.73"
   ]
}

An object containing information about the certificate that was requested. Show certificate information details.

$b64 = Get-Content 'C:\path\to\source\file'
$targetFile = 'C:\path\to\target\file'

$bytes = [Convert]::FromBase64String($b64)[IO.File]::WriteAllBytes($targetFile, $bytes)

Required^*. A string that sets the name of the certificate authority that will be used to enroll against if there is more than one available with the provided template name. The certificate authority name can either be provided in hostname\\logical name format or as just the logical name. For example:

If no certificate authority is provided, one will be chosen at random from the certificate authorities available for enrollment with the provided Template.

This field is optional unless the enrollment is being done against a standalone CA, in which case it is required.

Required^*. A string that sets a custom friendly name for the certificate.

This field is required if the Require Custom Friendly Name application setting is set to true (the default is false). See Application Settings: Enrollment Tab for more information.

A Boolean that sets whether to include the certificate chain in the response (true) or not (false). The default is true.

A Boolean that sets whether to include the subject header in the response (true) or not (false). The default is true if not included in the request. Only applicable when PEM format is selected. When set to false, the first line in the PEM file that contains the certificates subject information is removed. When set to true, the first line in the PEM file that contains the certificates subject information is included.

Works with Include Chain option where it will remove the subject header, when set to false, for each of the certificates returned in the chain. It also works with Include Private Key option enabled.

An object that set the values for the metadata fields that will be associated with the certificate once it is in Keyfactor Command. The key is the field name and the value is the value for the field. For example:

"Metadata": {
   "AppOwnerFirstName": "William",  // This is a String field.
   "AppOwnerLastName": "Smith",
   "AppOwnerEmailAddress": "william.smith@keyexample.com",
   "BusinessCritical": "true",      // This is a Boolean field.
   "BusinessUnit": "E-Business",    // This is a Multiple Choice field with a pre-defined value.
   "Notes": "Here are some notes.", // This is a BigText field.
   "SiteCode": 3,                   // This is an integer field.
   "TicketResolutionDate": "2021-07-23"   // This is a Date field in yyyy-mm-dd format.
}

See Certificate Metadata for more information.

A Boolean that sets whether to populate the information in the subject from Active Directory (true) or not (false). The default is false.

An object that contains the elements for Keyfactor Command to use when generating the subject alternative name (SAN) for the certificate requested by the CSR, each of which is supplied as an array of strings. Show SAN key values.

For example:

"SANs": {
   "dns": [
      "dnssan1.keyexample.com",
      "dnssan2.keyexample.com",
      "dnssan3.keyexample.com"
   ],
   "ip4": [
      "192.168.2.73"
   ]
}

Required^*. A string that sets the name of the certificate template that should be used to issue the certificate. The template short name should be used.

This field is required unless the enrollment is being done against a standalone CA.