GET Certificate Stores ID
The GET /CertificateStores/{id} method is used to return details for the certificate store with the specified ID. This method returns HTTP 200 OK on a success with a message body containing certificate store details.
Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions in the Keyfactor Command Reference Guide for more information about global vs container permissions.
Table 257: GET Certificate Stores {id} Input Parameters
| Name | In | Description |
|---|---|---|
| id | Path | Required. A string indicating the GUID of the certificate store within Keyfactor Command. |
Table 258: GET Certificate Stores {id} Response Data
| Name | Description |
|---|---|
| Id | A string indicating the GUID of the certificate store within Keyfactor Command. This ID is automatically set by Keyfactor Command. |
| ContainerId | An integer indicating the ID of the certificate store's associated certificate store container, if applicable (see GET Certificate Store Containers). |
| ClientMachine | The string value of the client machine. The value for this will vary depending on the certificate store type. For example, for a Java keystore or an F5 device, it is the hostname The unique identifier that serves as name of a computer. It is sometimes presented as a fully qualified domain name (e.g. servername.keyexample.com) and sometimes just as a short name (e.g. servername). of the machine on which the store is located, but for an Amazon Web Services store, it is the FQDN of the Keyfactor Command Windows Orchestrator The Windows Orchestrator, one of Keyfactor's suite of orchestrators, is used to manage synchronization of certificate authorities in remote forests, run SSL discovery and management tasks, and interact with Windows servers as well as F5 devices, NetScaler devices, Amazon Web Services (AWS) resources, and FTP capable devices, for certificate management. In addition, the AnyAgent capability of the Windows Orchestrator allows it to be extended to create custom certificate store types and management capabilities regardless of source platform or location.. See Adding or Modifying a Certificate Store in the Keyfactor Command Reference Guide for more information. |
| Storepath | A string indicating the path to the certificate store on the target. The format for this path will vary depending on the certificate store type. For example, for a Java keystore, this will be a file path (e.g. /opt/myapp/store.jks), but for an F5 device, this will be a partition name on the device (e.g. Common). See Adding or Modifying a Certificate Store in the Keyfactor Command Reference Guide for more information. |
| CertStoreInventoryJobId | A string indicating the GUID that identifies the inventory job for the certificate store in the Keyfactor Command database. This will be null if an inventory schedule is not set for the certificate store. |
| CertStoreType | An integer indicating the ID of the certificate store type, as defined in Keyfactor Command, for this certificate store. (0-Javakeystore,2-PEMFile, 3-F5SSLProfiles,4-IISRoots, 5-NetScaler, 6-IISPersonal, 7-F5WebServer, 8-IISRevoked, 9-F5WebServerREST, 10-F5SSLProfilesREST, 11-F5CABundlesREST, 100-AmazonWebServices, 101-FileTransferProtocol) |
| Approved | A Boolean that indicates whether a certificate store is approved (true) or not (false). If a certificate store is approved, it can be used and updated. A certificate store that has been discovered using the discover feature but not yet marked as approved will be false here. |
| CreateIfMissing | A Boolean that indicates whether a new certificate store should be created with the information provided (true) or not (false). This option is only valid for Java keystores and any custom certificate store types you have defined to support this functionality. |
| Properties |
Some types of certificate stores have additional properties that are stored in this parameter As of Keyfactor Command v10, this parameter is used to store certificate store server usernames, server passwords, and the UseSSL flag. Built-in certificate stores that typically require configuration of certificate store server parameters include NetScaler and F5 stores. The legacy methods for managing certificate store server credentials have been deprecated but are retained for backwards compatiblity. For more information, see POST Certificate Stores Server. When reading this field, the values are returned as simple key value pairs, with the values being individual values. When writing, the values are specified as objects, though they are typically single values. For example, on a GET request for a PEM store configured with a separate private key "{
However, the syntax used when updating the properties sets the value as a key value pair using value as the key. For example, on a POST or PUT request for a PEM store configured with a separate private key, the contents of this field might be: "{
An example server properties parameter POST for an FTP or NetScaler store would contain: "{
\"ServerUsername\":{\"value\":{\"SecretValue\":\"User_Name\"}},
\"ServerPassword\":{\"value\":{\"SecretValue\":\"Password\"}},
\"ServerUseSsl\":{\"value\":\"true\"}
}"
An example server properties parameter POST for an FTP or NetScaler store with the username and password stored as PAM secrets would contain (where the Provider value—1 in this example—is the Id value from GET PAM Providers): "{
\"ServerUsername\":{\"value\":{\"Provider\":\"1\",\"Parameters\":{\"SecretId\":\"User_Name\"}}},
\"ServerPassword\":{\"value\":{\"Provider\":\"1\",\"Parameters\":{\"SecretId\":\"Password\"}}},
\"ServerUseSsl\":{\"value\":\"true\"}
}"
Note: There are three standard properties that are used for any built-in certificate store types that require server credentials (e.g. F5):
These replace the separate certificate store server records that existed in previous versions of Keyfactor Command. For legacy support, if credentials are not provided through store properties during creation or editing of a certificate store, Keyfactor Command will attempt to find a certificate store server record and copy the credentials from it into the store properties for future use. Tip: Built-in stores that make use of this field include:
|
| AgentId | A string indicating the Keyfactor Command GUID of the orchestrator Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. for this store. |
| AgentAssigned | A Boolean that indicates whether there is an orchestrator assigned to this certificate store (true) or not (false). |
| ContainerName | A string indicating the name of the certificate store's associated container, if applicable. |
| InventorySchedule |
The inventory schedule for this certificate store. |
| ReenrollmentStatus |
An array that indicates whether the certificate store can use the re-enrollment |
| SetNewPasswordAllowed | A Boolean that indicates whether the store password can be changed (true) or not (false). |
| Password |
An array indicating the source for and details of the credential information Keyfactor Command will use to access the certificates in a specific certificate store (the store password). This is different from credential information Keyfactor Command uses to access a certificate store server as a whole. The former (this setting) is typically used for Java keystores; the latter is typically used for certificates stores on NetScaler and F5 devices and set at the server level, not the certificate store level (see POST Certificate Stores Server). Certificate stores that require credentials support up to three possible credential options:
Note: Secret data is stored in the secrets table or a PAM provider and is not returned in responses.
|
