POST CSR Generation Generate

The POST /CSRGeneration/Generate method is used to generate and configure a CSRClosed A CSR or certificate signing request is a block of encoded text that is submitted to a CA when enrolling for a certificate. When you generate a CSR within Keyfactor Command, the matching private key for it is stored in Keyfactor Command in encrypted format and will be married with the certificate once returned from the CA.. This method returns HTTP 200 OK on a success with a message body containing the text of the CSR file created.

This method generates a private keyClosed Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure. and stores it in the Keyfactor Command database. When you use the CSR resulting from this method to enroll for a certificate through Keyfactor Command (see POST Enrollment CSR), the resulting certificate is married together with the stored private key and may then be download with private key (see POST Certificates Recover).

Tip:  The following permissions (see Security Overview) are required to use this feature:

CertificateEnrollment: CsrGeneration

Note:  This endpointClosed An endpoint is a URL that enables the API to gain access to resources on a server. no longer includes the CSRFilePath return value in the response from the APIClosed A set of functions to allow creation of applications. Keyfactor offers the Keyfactor API, which allows third-party software to integrate with the advanced certificate enrollment and management features of Keyfactor Command. call. Code separate from the API should be used to handle receipt of the CSR and placement on the file system.

Table 306: POST CSR Generation Generate Input Parameters

Name In Description
Subject Body

Required. A string containing the subject name for the certificate using X.500 format for the full distinguished name (DNClosed A distinguished name (DN) is the name that uniquely identifies an object in a directory. In the context of Keyfactor Command, this directory is generally Active Directory. A DN is made up of attribute=value pairs, separated by commas. Any of the attributes defined in the directory schema can be used to make up a DN.). For example:

"Subject": "CN=websrvr14.keyexample.com,OU=IT,O=\"Key Example, Inc.\",L=Independence,ST=OH,C=US"

ClosedShow subject name fields.

KeyType Body

Required. A string indicating the desired key encryption of the certificate. Accepted key types are:
KeyLength Body

Required. An integer indicating the desired key sizeClosed The key size or key length is the number of bits in a key used by a cryptographic algorithm. of the certificate. Accepted key sizes are:

  • 256

  • 384

  • 521

  • 2048

  • 4096

  • 8192
TemplateClosed A certificate template defines the policies and rules that a CA uses when a request for a certificate is received. Body A string indicating the desired template to be used for the certificate to be requested with the CSR. The template must have been configured in Keyfactor Command to support CSR generation. This field is optional.
Tip:  Although you can include a template in your CSR, template handling in CSRs is future functionality, and the template will not be parsed back out of the CSR. Instead, submit a template directly with your CSR enrollment (see POST Enrollment CSR).
SANs Body

An array of key/value pairs that represent the elements for Keyfactor Command to use when generating the subject alternative nameClosed The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common. (SANClosed The subject alternative name (SAN) is an extension to the X.509 specification that allows you to specify additional values when enrolling for a digital certificate. A variety of SAN formats are supported, with DNS name being the most common.) for the certificate requested by the CSR. ClosedShow SAN key values.

For example:

"SANs": {
   "dns": [
      "dnssan1.keyexample.com",
      "dnssan2.keyexample.com",
      "dnssan3.keyexample.com"
   ],
   "ip4": [
      "192.168.2.73"
   ]
}

Table 307: POST CSR Generation Generate Response Data

Name Description
CSR The text of the CSR in PEMClosed A PEM format certificate file is a base64-encoded certificate. Since it's presented in ASCII, you can open it in any text editor. PEM certificates always begin and end with entries like ---- BEGIN CERTIFICATE---- and ----END CERTIFICATE----. PEM certificates can contain a single certificate or a full certifiate chain and may contain a private key. Usually, extensions of .cer and .crt are certificate files with no private key, .key is a separate private key file, and .pem is both a certificate and private key. format.