The GET /CertificateStores operation returns a list of all certificate stores defined in Keyfactor Command. The results include both approved certificates stores and certificates stores found on discovery but not yet approved. Query parameters support filtering using defined criteria, control over pagination by specifying the page number and return limit, and customization of sorting based on specified fields and order. On success, the operation returns HTTP 200 OK with details about the certificate stores.
Permissions for certificate stores can be set at the system-wide level or certificate store application level. See Application Permissions for more information.
In permission strings, # represents a specific resource identifier. In /certificate_stores/ permission strings it refers to a certificate store application ID (for example, containerId).
Table 402: GET Certificate Stores Input Parameters
| Name | In | Description |
|---|---|---|
| QueryString | Query |
A string containing a query to limit the results (for example, field1 -eq value1 AND field2 -gt value2). The default is to return all records.
Tip: Use the following query to limit the results to only active certificate stores and not include discovery results:
approved -eq true |
| PageReturned | Query | An integer that specifies how many multiples of the returnLimit to skip and offset by before returning results, to enable paging. The default is 1. |
| ReturnLimit | Query | An integer that specifies how many results to return per page. The default is 50. Very large values can result in long processing time. |
| SortField | Query |
A string containing the property by which the results should be sorted. Fields available for sorting through the API include:
Available sort fields are affected by the query provided in QueryString. The default sort field is ClientMachine. |
| SortAscending | Query |
An integer that sets the sort order on the returned results. A value of 0 sorts results in ascending order while a value of 1 sorts results in descending order. The default is ascending. |
Table 403: GET Certificate Stores Response Data
| Name |
Description |
|---|---|
| Agent Assigned | A Boolean that indicates whether there is an orchestrator assigned to this certificate store (True or False). |
| AgentId | A string indicating the Keyfactor Command GUID of the orchestrator for this store. |
| Approved | A Boolean that indicates whether a certificate store is approved (True or False). If a certificate store is approved, it can be used and updated. A certificate store that has been discovered using the discover feature but not yet marked as approved will be false here. |
| Cert Store Inventory JobId | A string indicating the GUID that identifies the inventory job for the certificate store in the Keyfactor Command database. This will be null if an inventory schedule is not set for the certificate store. |
| Cert Store Type | An integer indicating the ID of the certificate store type, as defined in Keyfactor Command, for this certificate store. If you're using the Keyfactor Universal Orchestrator with the custom extensions, you will have added certificate store types numbered 102 and above. If you are using the deprecated Java Agent, the built-in certificates store types are: (0-Javakeystore, 2-PEMFile). |
| ChainOptions |
A string indicating how the certificate chain is included when installing a certificate in the store. The options are:
When root certificates are included, the specific roots used to build the chain may be determined by the certificate store configuration. |
| ClientMachine |
A string containing the client machine name. The value for this will vary depending on the certificate store type. Typically, it is the hostname of the machine on which the store is located, but this may vary. See Add or Modify a Certificate Store for more information. |
| Container Name | A string indicating the name of the certificate store's associated application, if applicable. |
| ContainerId | An integer indicating the ID of the certificate store's associated certificate store application, if applicable (see GET Applications). |
| Create If Missing | A Boolean that indicates whether a new certificate store should be created with the information provided (True or False). This option is only valid for Java keyStores and any custom certificate store types you have defined to support this functionality. |
| DisplayName | A string indicating the name of the certificate store as it will display in the Management Portal. This value includes the client machine and the store path. |
| Id | A string indicating the GUID of the certificate store within Keyfactor Command. This ID is automatically set by Keyfactor Command. |
| Inventory Schedule |
An object indicating the inventory schedule for this certificate store. |
| MirroringEnabled | A Boolean that indicates whether the store should be populated with root CA certificates from a trust bundle (True or False). |
| OrchestratorPool |
An object containing the information for the orchestrator pool that will handle jobs for this store.
|
| Password |
Note: Secret data is stored in the secrets table or a PAM provider and is not returned in responses.
|
| Properties |
The Properties parameter is a string that contains a JSON object of key-value pairs defining additional certificate store properties. Each value is itself a serialized JSON object. Because the entire structure is passed as a string, the inner JSON must be escaped (for example, using \" for double quotes and \\ for backslashes) so it is treated as a literal string during transmission and processing. Newer certificate store types use this stringified JSON format for both input and output. Legacy certificate store types may return output as simple key-value pairs, where values are not serialized JSON objects, although input is typically still provided in the stringified JSON format. Note: There are three standard properties that are used for certificate store types that require server credentials (for example, F5):
These are created automatically in the certificate store type record when the NeedsServer option is set to True. ServerUsername and ServerPassword then must be populated in certificate store records for these types. These replace the separate certificate store server records that existed in previous versions of Keyfactor Command. For legacy support, if credentials are not provided through store properties during creation or editing of a certificate store, Keyfactor Command will attempt to find a certificate store server record and copy the credentials from it into the store properties for future use. |
| Reenrollment Status |
An object that indicates whether the certificate store can use the re-enrollment function with accompanying data about the re-enrollment job. |
| Set New Password Allowed |
A Boolean that indicates whether the store requires a password AND whether the user has modify permissions on the store within Keyfactor Command (True or False). |
| Storepath | A string indicating the path to the certificate store on the target. The format for this path will vary depending on the certificate store type. For example, for a Java KeyStore, this will be a file path (for example, /opt/myapp/store.jks), but for an F5 device, this will be a partition name on the device (for example, Common). See Add or Modify a Certificate Store for more information. The maximum number of characters supported in this field is 722. |
| TrustBundleId | An integer that indicates the Keyfactor Command reference ID of the trust bundle configured to mirror to the certificate store. |
An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. Reference and Utility, which allows you to call API operations and view results. It is primarily intended for validation, testing, and workflow A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development, and also serves as an interactive supplement to this API documentation. You can access it from the help menu (
) in the Management Portal.Was this page helpful? Provide Feedback