PUT Certificate Authority

A Boolean that sets whether management interactions with the certificate authority via Keyfactor Command should be done in the context of the user making the request (true). If set to false, these interactions are done in the context of the service account under which the Keyfactor Command application pool is running unless ExplicitCredentials is true.

A string indicating the forest root name or DNS domain name for the certificate authority (e.g. keyexample.com).

A Boolean that sets whether certificate enrollments made through Keyfactor Command for this CA must include at least one DNS SAN (true) or not (false). In the Keyfactor Command Management Portal, this causes the CN entered in PFX enrollment to automatically be replicated as a SAN, which the user can either change or accept. For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate if this is set.

The default is false.

An integer that sets the type(s) of enrollment that are allowed through Keyfactor Command for the certificate authority. Show allowed enrollment types.

This value is 0 by default.

A Boolean that sets whether to add a checkbox on the enrollment pages to force users to agree to a custom set of terms before enrolling (true) or not (false). The default is false.

An object indicating the password information to use for authentication along with the ExplicitUser if ExplicitCredentials is True.

Supported methods to store secret information are:

• Store the secret information in the Keyfactor secrets table.

  A Keyfactor secret is a user-defined username or password that is encrypted and stored securely in the Keyfactor Command database.

• Load the secret information from a PAM provider.

  See Privileged Access Management (PAM) for more information.

Due to its sensitive nature, this value is not returned in responses.

An array of strings indicating Keyfactor Command security roles that are allowed to enroll for certificates via Keyfactor Command for this CA. For example:

"AllowedRequesters": [
   "Power Users",
   "Read Only"
]

The allowed requesters option is used to select Keyfactor Command security roles that a user must belong to in order to successfully enroll for certificates in Keyfactor Command via this CA.

This is used for EJBCA CAs and Microsoft CAs where integrated authentication is not supported. Integrated authentication is generally supported for Microsoft CAs, Keyfactor CA gateways, or Keyfactor CA management gateways on servers joined to the local Active Directory forest in which Keyfactor Command is installed and any Active Directory forests in a two-way trust with this forest. Since Keyfactor Command cannot make use of the access control model of the CA itself to determine which users can enroll for certificates at either a template or CA level without using integrated authentication, this setting replaces that functionality. This setting is similar to setting request certificates for the selected security roles at the CA level on a Microsoft CA.

In addition to granting permissions at the CA level, you need to enable the UseAllowedRequesters option to grant permissions on a template-by-template basis (see PUT Templates).

The values set here are only considered if UseAllowedRequesters is set to true.

An object indicating the schedule for the incremental synchronization of this certificate authority.

Prior to Command v11, it was possible to create a Keyfactor schedule via the API that was impossible to display via the Management Portal schedule picker. For example, an interval that is not on the interval dropdown (e.g., every 107 minutes). Now, the API will also not allow interval values to be saved that cannot be represented in the Management Portal. Previously saved schedules that don't meet these restrictions can still be parsed and used, but not edited and re-saved, as a result errors may be encountered on re-saving invalid schedules that were created via the API.

Show schedule details.

"Interval": {
   "Minutes": 60
}

"Daily": {
   "Time": "2023-11-25T23:30:00Z"
}

"Weekly": {
   "Days": [
      "Monday",
      "Wednesday",
      "Friday"
   ],
   "Time": "2023-11-27T17:30:00Z"
}

An integer indicating the type of CA:

• 0—DCOM
• 1—HTTPS

An object containing information about the client certificate used to provide authentication to the EJBCA CA. This certificate is used to authenticate to the EJBCA database for synchronization, enrollment and management of certificates.

The syntax is the same as for AuthCertificatePassword with the SecretValue. The SecretValue is set to a string containing the base-64-encoded representation of the certificate with private key (in PKCS#12 format) that will be used to authenticate to the EJBCA CA. For example:

{
   "SecretValue": "MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCA+[truncated for display]gQUwRndGMbmlkmwIOuC0MbOY1EyDpACAwGQAAAA"
}

Due to its sensitive nature, this value is not returned in this format in responses.

A Boolean that sets whether management interactions with the certificate authority via Keyfactor Command should be done in the context of the user making the request (true). If set to false, these interactions are done in the context of the service account under which the Keyfactor Command application pool is running unless ExplicitCredentials is true.

A string indicating the forest root name or DNS domain name for the certificate authority (e.g. keyexample.com).

A Boolean that sets whether certificate enrollments made through Keyfactor Command for this CA must include at least one DNS SAN (true) or not (false). In the Keyfactor Command Management Portal, this causes the CN entered in PFX enrollment to automatically be replicated as a SAN, which the user can either change or accept. For CSR enrollment, if the CSR does not have a SAN that matches the CN, one will automatically be added to the certificate if this is set.

The default is false.

An integer that sets the type(s) of enrollment that are allowed through Keyfactor Command for the certificate authority. Show allowed enrollment types.

This value is 0 by default.

A Boolean that sets whether to add a checkbox on the enrollment pages to force users to agree to a custom set of terms before enrolling (true) or not (false). The default is false.

An object indicating the password information to use for authentication along with the ExplicitUser if ExplicitCredentials is True.

Supported methods to store secret information are:

• Store the secret information in the Keyfactor secrets table.

  A Keyfactor secret is a user-defined username or password that is encrypted and stored securely in the Keyfactor Command database.

• Load the secret information from a PAM provider.

  See Privileged Access Management (PAM) for more information.

Due to its sensitive nature, this value is not returned in responses.

An array of strings indicating Keyfactor Command security roles that are allowed to enroll for certificates via Keyfactor Command for this CA. For example:

"AllowedRequesters": [
   "Power Users",
   "Read Only"
]

The allowed requesters option is used to select Keyfactor Command security roles that a user must belong to in order to successfully enroll for certificates in Keyfactor Command via this CA.

This is used for EJBCA CAs and Microsoft CAs where integrated authentication is not supported. Integrated authentication is generally supported for Microsoft CAs, Keyfactor CA gateways, or Keyfactor CA management gateways on servers joined to the local Active Directory forest in which Keyfactor Command is installed and any Active Directory forests in a two-way trust with this forest. Since Keyfactor Command cannot make use of the access control model of the CA itself to determine which users can enroll for certificates at either a template or CA level without using integrated authentication, this setting replaces that functionality. This setting is similar to setting request certificates for the selected security roles at the CA level on a Microsoft CA.

In addition to granting permissions at the CA level, you need to enable the UseAllowedRequesters option to grant permissions on a template-by-template basis (see PUT Templates).

The values set here are only considered if UseAllowedRequesters is set to true.

An object indicating the schedule for the incremental synchronization of this certificate authority.

Prior to Command v11, it was possible to create a Keyfactor schedule via the API that was impossible to display via the Management Portal schedule picker. For example, an interval that is not on the interval dropdown (e.g., every 107 minutes). Now, the API will also not allow interval values to be saved that cannot be represented in the Management Portal. Previously saved schedules that don't meet these restrictions can still be parsed and used, but not edited and re-saved, as a result errors may be encountered on re-saving invalid schedules that were created via the API.

Show schedule details.

"Interval": {
   "Minutes": 60
}

"Daily": {
   "Time": "2023-11-25T23:30:00Z"
}

"Weekly": {
   "Days": [
      "Monday",
      "Wednesday",
      "Friday"
   ],
   "Time": "2023-11-27T17:30:00Z"
}

An integer indicating the type of CA:

• 0—DCOM
• 1—HTTPS

An object containing information about the client certificate used to provide authentication to the EJBCA CA. This certificate is used to authenticate to the EJBCA database for synchronization, enrollment and management of certificates.

Show authentication certificate values.

"IssuedDN":    "CN=SuperAdmin,OU=IT,O="\Key Example, Inc.\",L=Independence,ST=OH,C=US"