POST Certificate Stores Reenrollment

The POST /CertificateStores/Reenrollment method is used to schedule an existing certificate store for reenrollment. The reenrollment method is available for:

This endpointClosed An endpoint is a URL that enables the API to gain access to resources on a server. returns 204 with no content upon success. Use the GET /OrchestratorJobs/JobHistory method to check on the progress of the job after submission (see GET Orchestrator Jobs Job History).

Tip:  The following permissions (see Security Overview) are required to use this feature:

CertificateEnrollment: EnrollCSR
CertificateStoreManagement: Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions in the Keyfactor Command Reference Guide for more information about global vs container permissions.

In addition, the either the user scheduling the reenrollment job or the user configured to provide authentication to the CAClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. (see Authorization Methods Tab in the Keyfactor Command Reference Guide) must have enrollmentClosed Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). permissions configured on the CA and templateClosed A certificate template defines the policies and rules that a CA uses when a request for a certificate is received..

Table 273: POST Certificates Stores Reenrollment Input Parameters

Name In Description
KeystoreId Body

Required. The GUID of the certificate store to schedule for reenrollment.

Use the GET /CertificateStores method (see GET Certificate Stores) to retrieve a list of your certificate stores to determine the GUID of the store.
SubjectName Body

Required. A string containing the reenrollment subject name using X.500 format. For example:

"SubjectName": "CN=websrvr14.keyexample.com,OU=IT,O=\"Key Example, Inc.\",L=Independence,ST=OH,C=US"
AgentGuid Body

Required. The GUID of the orchestrator that is registered with the certificate store.

Use the GET /CertificateStores method (see GET Certificate Stores) to retrieve a list of your certificate stores to determine the GUID of the orchestrator associated with the store.
Alias Body

Required. The alias of the certificate in the certificate store.
JobProperties Body An array of key/value pairs for the unique parameters defined for the certificate store type. The key is the name of the specific parameterClosed A parameter or argument is a value that is passed into a function in an application. from the certificate store type definition as returned in the JobProperties on the store type using the GET CertificateStoreTypes method and the value is the value that should be set for that parameter on a certificate in the certificate store. For example, for NetScaler, the key name that is optionally used to associate a certificate with a virtual server is NetscalerVserver and is returned by GET CertificateStoreTypes like so:
"JobProperties": [ "NetscalerVserver" ]

It can be seen in the Keyfactor Command Management Portal when editing the certificate store type in the field for Management Job Custom Fields.

The setting is referenced using the following format:

"JobProperties": [ {"NetscalerVserver":"MyVirtualServerName"} ]
Note:  The only built-in certificate store type that makes use of job properties that can be set on a certificate-by-certificate basis in the store is NetScaler, which does not support reenrollment. You may have custom certificate store types that make use of this functionality.
CertificateAuthority Body A string indicating the certificate authorityClosed A certificate authority (CA) is an entity that issues digital certificates. Within Keyfactor Command, a CA may be a Microsoft CA or a Keyfactor gateway to a cloud-based or remote CA. to which to direct the enrollment request. If this parameter is not provided, the value set in the Certificate Authority For Submitted CSRs application setting will be used (see Application Settings: Agents Tab in the Keyfactor Command Reference Guide).
CertificateTemplate Body A string indicating the certificate template to use for the enrollment request. If this parameter is not provided, the value set in the Template For Submitted CSRs application setting will be used (see Application Settings: Agents Tab in the Keyfactor Command Reference Guide).