GET Certificate Authority

A string containing a query to limit the results (e.g. field1 -eq value1 AND field2 -gt value2). The default is to return all records. Fields available for querying through the API for the most part match those that appear in the Keyfactor Command Management Portal search dropdowns for the same feature. For querying guidelines, refer to: Certificate Search Page. The query fields supported for this endpoint are:

An array of strings indicating Keyfactor Command security roles that are allowed to enroll for certificates via Keyfactor Command for this CA.

For example:

"AllowedRequesters": [
   "Power Users",
   "Read Only"
]

The allowed requesters option is used to select Keyfactor Command security roles that a user must belong to in order to successfully enroll for certificates in Keyfactor Command via this CA.

This option is supported only for standalone CAs.

The values set here are only considered if UseAllowedRequesters is set to true.

An object indicating the password for the certificate (see AuthCertificate) to use to authenticate to the HTTPS CA.

Due to its sensitive nature, this value is not returned in responses.

A Boolean indicating whether the certificate cleanup job is enabled for the CA (true) or not (false). The default is true.

The certificate cleanup task periodically removes expired certificates from the database. Once removed, these certificates will not be re-imported during a standard CA synchronization unless certificate cleanup is later disabled. CA synchronization tasks use the certificate cleanup settings to determine whether a certificate is eligible for cleanup and exclude such certificates from import.

Certificate cleanup settings can be configured at three levels:

• Certificate Template Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this template. These cleanup tasks are processed first.

• Certificate Authority (CA) Record: If configured, overrides the system-wide settings when processing certificate cleanup tasks for certificates associated with this CA but not associated with any template. These cleanup tasks are processed second.

• System-Wide: Applies to all certificate authorities and templates in the system. These values are used when processing certificate cleanup tasks for certificates associated with neither a CA nor a template and when no overrides are set at the CA or template level. These cleanup tasks are processed last.

  Note:  For manually imported certificates without an associated template (e.g., from a standalone CA), system-wide cleanup settings will be applied even if the CA exists in Keyfactor Command. This occurs because Keyfactor Command cannot reliably associate such certificates with the correct CA.

For HTTPS CAs, this is an object indicating the secret for the client used to authenticate to the HTTPS CA when OAuth authentication is selected.

Due to its sensitive nature, this value is not returned in responses.

A string indicating the name of the connector pool to use when using the CA Connector Client to connect to the CA.

A Boolean that sets whether enrollment to the certificate authority via Keyfactor Command should be done in the context of the user making the request (true). If set to false, enrollment is done in the context of the service account under which the Keyfactor Command Management Portal and Keyfactor API application pools are running unless ExplicitCredentials is true.

A string indicating the forest root name or DNS domain name for the certificate authority (e.g. keyexample.com).

An object indicating the schedule for the incremental synchronization of this certificate authority.

Prior to Command v11, it was possible to create a Keyfactor schedule via the API that was impossible to display via the Management Portal schedule picker. For example, an interval that is not on the interval dropdown (e.g., every 107 minutes). Now, the API will also not allow interval values to be saved that cannot be represented in the Management Portal. Previously saved schedules that don't meet these restrictions can still be parsed and used, but not edited and re-saved, as a result errors may be encountered on re-saving invalid schedules that were created via the API.

Show schedule details.

"Interval": {
   "Minutes": 60
}

"Daily": {
   "Time": "2023-11-25T23:30:00Z"
}

"Weekly": {
   "Days": [
      "Monday",
      "Wednesday",
      "Friday"
   ],
   "Time": "2023-11-27T17:30:00Z"
}

A Boolean that sets whether a renewal and reissue requests against an EJBCA CA will create a new end entity for the new certificate (true) or attempt to associate the new certificate with the existing end entity (false). The default is false.

This value must be set to true for CA records created for the Keyfactor AnyCA Gateway REST to allow renewal and reissue enrollments to succeed.

A Boolean that sets whether to add a checkbox on the enrollment pages to force users to agree to a custom set of terms before enrolling (true) or not (false). The default is false.