POST Certificate Stores Approve

The POST /CertificateStores/Approve method is used to approve one or more certificate stores currently in the pending state—having been discovered using the certificate store discover option (see PUT Certificate Stores Discovery Job). If more than one certificate store is included in the array, all stores must be of the same store type (e.g. Java keystore). This endpointClosed An endpoint is a URL that enables the API to gain access to resources on a server. returns 204 with no content upon success.

Tip:  The following permissions (see Security Overview) are required to use this feature:

CertificateStoreManagement: Modify

Permissions for certificate stores can be set at either the global or certificate store container level. See Container Permissions in the Keyfactor Command Reference Guide for more information about global vs container permissions.

Table 273: POST Certificate Stores Approve Input Parameters

Name In Description
Id Body

Required. The GUID of the pending certificate store.

Use the GET /CertificateStores method (see GET Certificate Stores) with a query of "Approved -eq false" to retrieve a list of all your unapproved certificate stores to determine the GUID of the store.
ContainerId Body

An integer that identifies the container in which the certificate store should be placed on approval. Use the GET /CertificateStores/Containers method (see GET Certificate Store Containers) to retrieve a list of your defined certificate store containers to determine the container ID to use.
CertStoreType Body Required. An integer indicating the ID of the certificate store type, as defined in Keyfactor Command, for this certificate store. (0-Javakeystore,2-PEMFile, 3-F5SSLProfiles,4-IISRoots, 5-NetScaler, 6-IISPersonal, 7-F5WebServer, 8-IISRevoked, 9-F5WebServerREST, 10-F5SSLProfilesREST, 11-F5CABundlesREST, 100-AmazonWebServices, 101-FileTransferProtocol)
Properties Body

Required*. Some types of certificate stores have additional properties that are stored in this parameterClosed A parameter or argument is a value that is passed into a function in an application.. The data is stored in a series of, typically, key value pairs that define the property name and value (see GET Certificate Store Types for more information).

When reading this field, the values are returned as simple key value pairs, with the values being individual values. When writing, the values are specified as objects, though they are typically single values.

For example, on a GET request for a PEM store configured with a separate private keyClosed Private keys are used in cryptography (symmetric and asymmetric) to encrypt or sign content. In asymmetric cryptography, they are used together in a key pair with a public key. The private or secret key is retained by the key's creator, making it highly secure., the contents of this field might be:

"{
  \"privateKeyPath\":\"/opt/app/mystore.key\",
  \"separatePrivateKey\":\"true\"
}"

However, the syntax used when updating the properties sets the value as a key value pair using value as the key. For example, on a POST or PUT request for a PEM store configured with a separate private key, the contents of this field might be:

"{
  \"privateKeyPath\":{\"value\":\"/opt/app/mystore.key\"},
  \"separatePrivateKey\":{\"value\":\"true\"}
}"

This field is required for certificate store types that store additional properties in this parameter.
Password Body

Required. An array indicating the source for and details of the credential information Keyfactor Command will use to access the certificates in a specific certificate store (the store password). This is different from credential information Keyfactor Command uses to access a certificate store server as a whole. The former (this setting) is typically used for Java keystores; the latter is typically used for certificates stores on NetScaler and F5 devices and set at the server level, not the certificate store level (see POST Certificate Stores Server).

Certificate stores that require credentials support up to three possible credential options:

  • Use no store password.
    This option is supported for Java keystores that would normally require a password, but can be configured with the no password option (see Value, below).

  • Store the credential information in the Keyfactor secrets table.
    A Keyfactor secret is a user-defined password that is encrypted and stored securely in the Keyfactor Command database.

  • Load the credential information from a PAM provider.
    See Privileged Access Management (PAM) in the Keyfactor Command Reference Guide and PAM Providers for more information.

ClosedShow password details.

This field is required for Java keystores.
Tip:  For code examples, see the Keyfactor API Endpoint Utility. To find the embedded web copy of this utility, click the help icon () at the top of the Keyfactor Command Management Portal page next to the Log Out button.