PUT Certificate Stores Assign Container

The PUT /CertificateStores/AssignContainer method is used to assign one or more certificate stores to a container. This method returns HTTP 200 OK on a success with the certificate stores that were just assigned to a container.

If you are creating a new container and assigning stores to it in one action, you should include the following fields:

  • NewContainerName
  • NewContainerType
  • KeystoreIds

If you are assigning stores to an already existing container, you should include the following fields:

  • CertStoreContainerId
  • KeystoreIds
Tip:  The following permissions (see Security Overview) are required to use this feature:

CertificateStoreManagement: Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions in the Keyfactor Command Reference Guide for more information about global vs container permissions.

Table 269: PUT Certificate Stores Assign Container Input Parameters

Name In Description
CertStoreContainerId Body

Required*. An integer that identifies the container into which you want to place the certificate store or stores.

One of the following is required:

  • CertStoreContainerId

  • NewContainerName and NewContainerType
KeystoreIds Body

Required. An array of certificate store GUIDs for the stores you want to place into the container.
NewContainerName Body

Required*. A string that sets the name of the container if you would like to create a new container while assigning store(s) to it.

One of the following is required:

  • CertStoreContainerId

  • NewContainerName and NewContainerType
NewContainerType Body

Required*. An integer for the container type if you would like to create a new container while assigning store(s) to it. Container types match certificate store types.

Use the GET /CertificateStoreTypes method with a query (e.g. storetype -eq 7) or GET /CertificateStoreTypes/{id} method to determine what a particular certificate store type ID maps to. For example, type 2 maps to PEM File and type 10 maps to F5 SSL Profiles REST.

One of the following is required:

  • CertStoreContainerId

  • NewContainerName and NewContainerType

Table 270: PUT Certificate Stores Assign Container Response Data

Name Description
Id A string indicating the GUID of the certificate store within Keyfactor Command. This ID is automatically set by Keyfactor Command.
ContainerId An integer indicating the ID of the certificate store's associated certificate store container, if applicable (see GET Certificate Store Containers).
ClientMachine The string value of the client machine. The value for this will vary depending on the certificate store type. For example, for a Java keystore or an F5 device, it is the hostnameClosed The unique identifier that serves as name of a computer. It is sometimes presented as a fully qualified domain name (e.g. servername.keyexample.com) and sometimes just as a short name (e.g. servername). of the machine on which the store is located, but for an Amazon Web Services store, it is the FQDN of the Keyfactor Command Windows OrchestratorClosed The Windows Orchestrator, one of Keyfactor's suite of orchestrators, is used to manage synchronization of certificate authorities in remote forests, run SSL discovery and management tasks, and interact with Windows servers as well as F5 devices, NetScaler devices, Amazon Web Services (AWS) resources, and FTP capable devices, for certificate management. In addition, the AnyAgent capability of the Windows Orchestrator allows it to be extended to create custom certificate store types and management capabilities regardless of source platform or location.. See Adding or Modifying a Certificate Store in the Keyfactor Command Reference Guide for more information.
Storepath A string indicating the path to the certificate store on the target. The format for this path will vary depending on the certificate store type. For example, for a Java keystore, this will be a file path (e.g. /opt/myapp/store.jks), but for an F5 device, this will be a partition name on the device (e.g. Common). See Adding or Modifying a Certificate Store in the Keyfactor Command Reference Guide for more information.
CertStoreInventoryJobId A string indicating the GUID that identifies the inventory job for the certificate store in the Keyfactor Command database. This will be null if an inventory schedule is not set for the certificate store.
CertStoreType An integer indicating the ID of the certificate store type, as defined in Keyfactor Command, for this certificate store. (0-Javakeystore,2-PEMFile, 3-F5SSLProfiles,4-IISRoots, 5-NetScaler, 6-IISPersonal, 7-F5WebServer, 8-IISRevoked, 9-F5WebServerREST, 10-F5SSLProfilesREST, 11-F5CABundlesREST, 100-AmazonWebServices, 101-FileTransferProtocol)
Approved A Boolean that indicates whether a certificate store is approved (true) or not (false). If a certificate store is approved, it can be used and updated. A certificate store that has been discovered using the discover feature but not yet marked as approved will be false here.
CreateIfMissing A Boolean that indicates whether a new certificate store should be created with the information provided (true) or not (false). This option is only valid for Java keystores and any custom certificate store types you have defined to support this functionality.
Properties

Some types of certificate stores have additional properties that are stored in this parameterClosed A parameter or argument is a value that is passed into a function in an application.. The data is stored in a series of, typically, key value pairs that define the property name and value (see GET Certificate Store Types for more information).

As of Keyfactor Command v10, this parameter is used to store certificate store server usernames, server passwords, and the UseSSL flag. Built-in certificate stores that typically require configuration of certificate store server parameters include NetScaler and F5 stores. The legacy methods for managing certificate store server credentials have been deprecated but are retained for backwards compatiblity. For more information, see POST Certificate Stores Server.

When reading this field, the values are returned as simple key value pairs, with the values being individual values. When writing, the values are specified as objects, though they are typically single values.

For example, on a GET request for a PEM store configured with a separate private keyClosed Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure., the contents of this field might be:

"{
  \"privateKeyPath\":\"/opt/app/mystore.key\",
  \"separatePrivateKey\":\"true\"
}"

However, the syntax used when updating the properties sets the value as a key value pair using value as the key. For example, on a POST or PUT request for a PEM store configured with a separate private key, the contents of this field might be:

"{
  \"privateKeyPath\":{\"value\":\"/opt/app/mystore.key\"},
  \"separatePrivateKey\":{\"value\":\"true\"}
}"

An example server properties parameter POST for an FTP or NetScaler store would contain:

"{
   \"ServerUsername\":{\"value\":{\"SecretValue\":\"User_Name\"}},
   \"ServerPassword\":{\"value\":{\"SecretValue\":\"Password\"}},
   \"ServerUseSsl\":{\"value\":\"true\"}
}"

An example server properties parameter POST for an FTP or NetScaler store with the username and password stored as PAM secrets would contain (where the Provider value—1 in this example—is the Id value from GET PAM Providers):

"{
   \"ServerUsername\":{\"value\":{\"Provider\":\"1\",\"Parameters\":{\"SecretId\":\"User_Name\"}}},
   \"ServerPassword\":{\"value\":{\"Provider\":\"1\",\"Parameters\":{\"SecretId\":\"Password\"}}},
   \"ServerUseSsl\":{\"value\":\"true\"}
}"
Note:  There are three standard properties that are used for any built-in certificate store types that require server credentials (e.g. F5):
  • ServerUsername
  • ServerPassword

  • ServerUseSsl

These replace the separate certificate store server records that existed in previous versions of Keyfactor Command. For legacy support, if credentials are not provided through store properties during creation or editing of a certificate store, Keyfactor Command will attempt to find a certificate store server record and copy the credentials from it into the store properties for future use.

Tip:  Built-in stores that make use of this field include:
AgentId A string indicating the Keyfactor Command GUID of the orchestratorClosed Keyfactor orchestrators perform a variety of functions, including managing certificate stores and SSH key stores. for this store.
AgentAssigned A Boolean that indicates whether there is an orchestrator assigned to this certificate store (true) or not (false).
ContainerName A string indicating the name of the certificate store's associated container, if applicable.
InventorySchedule

The inventory schedule for this certificate store. ClosedShow schedule details.
ReenrollmentStatus

An array that indicates whether the certificate store can use the re-enrollmentClosed Certificate enrollment refers to the process by which a user requests a digital certificate. The user must submit the request to a certificate authority (CA). function with accompanying data about the re-enrollment job. ClosedShow reenrollment status details.
SetNewPasswordAllowed A Boolean that indicates whether the store password can be changed (true) or not (false).
Password
Note:  Secret data is stored in the secrets table or a PAM provider and is not returned in responses.