GET Certificate Stores ID

The GET /CertificateStores/{id} method is used to return details for the certificate store with the specified ID. This method returns HTTP 200 OK on a success with a message body containing certificate store details.

Tip:  The following permissions (see Security Roles and Claims) are required to use this feature:
/certificate_stores/read/
OR
/certificate_stores/read/#/ (where # is a reference to a specific certificate store container ID)

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions for more information about global vs container permissions.

Table 401: GET Certificate Stores {id} Input Parameters

Name In Description
id Path

Required. A string indicating the GUID of the certificate store within Keyfactor Command.

Use the GET /CertificateStore method (see GET Certificate Stores) to retrieve a list of all the certificate stores to determine the certificate store GUID.

Table 402: GET Certificate Stores {id} Response Data

Name Description
Agent Assigned A Boolean that indicates whether there is an orchestrator assigned to this certificate store (true) or not (false).
AgentId A string indicating the Keyfactor Command GUID of the orchestrator for this store.
Approved A Boolean that indicates whether a certificate store is approved (true) or not (false). If a certificate store is approved, it can be used and updated. A certificate store that has been discovered using the discover feature but not yet marked as approved will be false here.
Cert Store Inventory JobId A string indicating the GUID that identifies the inventory job for the certificate store in the Keyfactor Command database. This will be null if an inventory schedule is not set for the certificate store.
Cert Store Type An integer indicating the ID of the certificate store type, as defined in Keyfactor Command, for this certificate store. Built-in certificates store types are: (0-Javakeystore, 2-PEMFile, 3-F5SSLProfiles,4-IISRoots, 5-NetScaler, 6-IISPersonal, 7-F5WebServer, 8-IISRevoked, 9-F5WebServerREST, 10-F5SSLProfilesREST, 11-F5CABundlesREST, 100-AmazonWebServices, 101-FileTransferProtocol). Any custom extensions for the Keyfactor Universal Orchestrator you add will have certificate store types numbered 102+.
ClientMachine

A string containing the client machine name. The value for this will vary depending on the certificate store type. Typically, it is the hostname of the machine on which the store is located, but this may vary. See Adding or Modifying a Certificate Store for more information.
Container Name A string indicating the name of the certificate store's associated container, if applicable.
ContainerId An integer indicating the ID of the certificate store's associated certificate store container, if applicable (see GET Certificate Store Containers).
Create If Missing A Boolean that indicates whether a new certificate store should be created with the information provided (true) or not (false). This option is only valid for Java keystores and any custom certificate store types you have defined to support this functionality.
DisplayName A string indicating the name of the certificate store as it will display in the Management Portal. This value includes the client machine and the store path.
Id A string indicating the GUID of the certificate store within Keyfactor Command. This ID is automatically set by Keyfactor Command.
Inventory Schedule

An object indicating the inventory schedule for this certificate store. ClosedShow schedule details.
Password

An object indicating the source for and details of the credential information Keyfactor Command will use to access the certificates in a specific certificate store (the store password). This is different from credential information Keyfactor Command uses to access a certificate store server as a whole. The former (this setting) is typically used for Java keystores; the latter is typically used for certificates stores on Citrix NetScaler and F5 devices and set at the server level, not the certificate store level (see POST Certificate Stores).

Certificate stores that require credentials support up to three possible credential options:

  • Use no store password.

    This option is supported for Java keystores that would normally require a password, but can be configured with the no password option (see Value, below).

  • Store the credential information in the Keyfactor secrets table.

    A Keyfactor secret is a user-defined password that is encrypted and stored securely in the Keyfactor Command database.

  • Load the credential information from a PAM provider.

    See Privileged Access Management (PAM) and PAM Providers for more information.

ClosedShow password details.

Name

Description
Instance Guid A string indicating the Keyfactor Command reference GUID for the secret provider. If you are using a secret provider with a GUID ID, this will be used. This value is automatically set by Keyfactor Command.
InstanceId An integer indicating the Keyfactor Command reference ID for the secret provider. If you are using a secret provider with an integer ID, this will be used. This value is automatically set by Keyfactor Command.
IsManaged A Boolean indicating whether the credentials for the store are managed by a PAM provider (true) or stored in the Keyfactor secrets table (false). This value is automatically set by Keyfactor Command.

Provider Type Parameter Values

An array of objects containing the values for the PAM provider types specified by ProviderTypeParams. ClosedShow PAM provider type parameter value details.
ProviderId

An integer indicating the Keyfactor Command reference ID for the PAM provider.
Secret Type Guid A string indicating the Keyfactor Command reference GUID for the type of credentials. This value is automatically set by Keyfactor Command.
Secret Value

A string—submitted as an object—indicating a password to be stored as a Keyfactor secret.

Tip:  To set the no password option on a store, submit the password with a null value. For example:
Copy
"Password": {
   "SecretValue": {null}
}

To set the value to a string to be stored in the Keyfactor secrets table, include the password in quotes. For example:

Copy
"Password": {
   "SecretValue": "MyVerySecurePassword"
}
Note:  Secret data is stored in the secrets table or a PAM provider and is not returned in responses.
Properties

For the most part, the properties parameter is a stringified JSON object that contains key-value pairs defining additional properties for the certificate store, where the values are serialized JSON objects. The entire JSON structure for the properties parameter is held as a string. Inside this string, the inner JSON structure is escaped (using \" for double quotes and \\ for backslashes) to ensure that it's treated as a literal string when transmitted or processed.

Newer certificate store types use the stringified JSON object format for both input and output values. Legacy certificate store types may return output as simple key-value pairs, with the values being individual values, while input is typically in the stringified JSON object format.

Note:  There are three standard properties that are used for certificate store types that require server credentials (e.g. F5):
  • ServerUsername
  • ServerPassword

  • ServerUseSsl

These are created automatically in the certificate store type record when the NeedsServer option is set to true. ServerUsername and ServerPassword then must be populated in certificate store records for these types.

These replace the separate certificate store server records that existed in previous versions of Keyfactor Command.

For legacy support, if credentials are not provided through store properties during creation or editing of a certificate store, Keyfactor Command will attempt to find a certificate store server record and copy the credentials from it into the store properties for future use.
Reenrollment Status

An object that indicates whether the certificate store can use the re-enrollment function with accompanying data about the re-enrollment job. ClosedShow reenrollment status details.
Set New Password Allowed

A Boolean that indicates whether the store requires a password AND whether the user has modify permissions on the store within Keyfactor Command (true) or not (false).
Storepath A string indicating the path to the certificate store on the target. The format for this path will vary depending on the certificate store type. For example, for a Java keystore, this will be a file path (e.g. /opt/myapp/store.jks), but for an F5 device, this will be a partition name on the device (e.g. Common). See Adding or Modifying a Certificate Store for more information. The maximum number of characters supported in this field is 722.
Tip:  See the Keyfactor API Reference and Utility which provides a utility through which the Keyfactor APIClosed An API is a set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. endpoints can be called and results returned. It is intended to be used primarily for validation, testing and workflowClosed A workflow is a series of steps necessary to complete a process. In Keyfactor Command, it refers to the workflow builder, which allows you to automate event-driven tasks such as when a certificate is requested, revoked or found in a certificate store. development. It also serves secondarily as documentation for the API. The link to the Keyfactor API Reference and Utility is in the dropdown from the help icon () at the top of the Management Portal page next to the Log Out button.