Upload CA certificate

POST

/api/v1/ca-certificates

curl --request POST \
  --url http://localhost:3000/api/v1/ca-certificates \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "name": "Production Root CA", "certificate": "-----BEGIN CERTIFICATE-----\nMIIBkTCC...\n-----END CERTIFICATE-----", "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIB...\n-----END PRIVATE KEY-----", "passphrase": "my-secret-passphrase", "isRoot": false, "isDefault": false }'

• Development
• Production

Upload a new CA certificate and private key. The private key will be encrypted at rest.

Authorizations

• api-key
• bearer

Request Body ^required

Media type application/json

object

name

required

Human-readable name for the CA certificate

string

<= 255 characters

Example

Production Root CA

certificate

required

PEM-encoded CA certificate

string

Example

-----BEGIN CERTIFICATE-----
MIIBkTCC...
-----END CERTIFICATE-----

privateKey

required

PEM-encoded private key (will be encrypted at rest)

string

Example

-----BEGIN PRIVATE KEY-----
MIIEvQIB...
-----END PRIVATE KEY-----

passphrase

Passphrase for encrypted private keys (PKCS#8 or legacy PEM encryption)

string

Example

my-secret-passphrase

isRoot

Whether this is a root CA certificate

boolean

Example

true

isDefault

Set as the default signing CA for new device certificates

boolean

Example

false

Responses

201

CA certificate uploaded successfully

Media type application/json

object

id

required

Unique CA certificate identifier (UUID)

string format: uuid

name

required

Human-readable name for the CA certificate

string

fingerprint

required

SHA-256 fingerprint of the certificate

string

isRoot

required

Whether this is a root CA certificate

boolean

isDefault

required

Whether this is the default signing CA

boolean

notBefore

required

Certificate validity start date

string format: date-time

notAfter

required

Certificate validity end date (expiration)

string format: date-time

retiredAt

Date when the CA certificate was retired

string format: date-time

createdAt

required

Timestamp when the CA certificate was created

string format: date-time

subject

Full subject distinguished name

string

issuer

Full issuer distinguished name

string

serialNumber

Certificate serial number (hex)

string

keyAlgorithm

Public key algorithm and size

string

signatureAlgorithm

Signature algorithm

string

subjectAltNames

Subject Alternative Names

Array<string>

certificate

PEM-encoded public certificate (safe to share)

string

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Production Root CA",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "isRoot": true,
  "isDefault": true,
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2034-01-01T00:00:00Z",
  "retiredAt": "2024-06-01T00:00:00Z",
  "createdAt": "2024-01-01T00:00:00Z",
  "subject": "CN=Root CA, O=logiccloud, C=US",
  "issuer": "CN=Root CA, O=logiccloud, C=US",
  "serialNumber": "01:AB:CD:EF",
  "keyAlgorithm": "RSA-4096",
  "signatureAlgorithm": "SHA256withRSA",
  "subjectAltNames": [
    "DNS:example.com",
    "IP:192.168.1.1"
  ],
  "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

400

Bad Request - Invalid certificate or private key format

401

Unauthorized - Invalid or missing authentication

403

Forbidden - Insufficient permissions (admin only)

409

Conflict - CA certificate with same fingerprint already exists