Create Certificate REST Service

Use Create Certificate REST Service to create a certificate and a public and private key pair. The newly created certificate is stored in an existing keystore.

Operation
POST
URL
https://<host>:<port>/SKLM/rest/v1/certificates

By default, Guardium® Key Lifecycle Manager server listens to the secure port 9443 (HTTPS) for communication. During IBM® Security Guardium Key Lifecycle Manager installation, you can modify this default port.

Request

Request Parameters
Parameter Description
host Specify the IP address or host name of the IBM Security Guardium Key Lifecycle Manager server.
port Specify the port number on which the IBM Security Guardium Key Lifecycle Manager server listens for requests.
Request Headers
Header name Value
Content-Type application/json
Accept application/json
Authorization SKLMAuth userAuthId=<authIdValue>
Accept-Language Any valid locale that is supported by IBM Security Guardium Key Lifecycle Manager. For example: en or de
Request body

JSON Object with the following specification:

JSON property name Description
type Required. Specify the certificate type. The supported certificate type is Self-signed.

The subject name and issuer name of the certificate are same.

alias Required. Specify a unique name for the certificate. The name is not case-sensitive. For example, if you specify MY Cert1, the value is stored as my cert1. Do not use:
  • The value that begins with 3 alphabetic characters followed by 18 numeric characters, such as aaa000000000000000002. IBM Security Guardium Key Lifecycle Manager uses this format to generate a key group with symmetric keys.
  • Forward slash (/) or backslash (\) characters in the value.
cn Required. Specify a common name for the certificate that you want to create.
ou Specify the organizational unit name.
o Specify the organizational name.
country Specify the country name. Indicate the name as a two-letter country code.
usage Required. Specify the target application usage with the following values:
3592
Specifies the 3592 device group.
DS8000®
Specifies the DS8000 device group.
GPFS
Specifies the IBM Spectrum® Scale (previously known as GPFS) device group.
PEER_TO_PEER
Specifies the PEER_TO_PEER device group.
GENERIC
Specifies a device family that uses the Key Management Interoperability Protocol to interact with IBM Security Guardium Key Lifecycle Manager. The GENERIC device group enables management of KMIP objects.
TLSCLIENT
Specifies the client-side certificate that is used in secure communication by using Secure Socket Layer protocol to authenticate the client device.
TLSSERVER
Specifies the server-side certificate that is used in secure communication by using Secure Socket Layer protocol.
userdevicegroup
Specifies a user-defined group that is based on a supported device family.
validity Required. Specify the days during which the certificate is valid. The interval can range from 1 day to 9000 days.
algorithm Required. Specify any of the following cryptographic algorithms that the certificate can use.
  • RSA
  • ECDSA

Response

Response Headers
Header name Value and description
Status Code
200 OK
The request was successful. The response body contains the requested representation.
400 Bad Request
The authentication information was not provided in the correct format.
401 Unauthorized
The authentication credentials were missing or incorrect.
404 Not Found Error
The processing of the request fails.
500 Internal Server Error
The processing of the request fails because of an unexpected condition on the server.
Content-Type application/json
Content-Language Locale for the response message.
Success response body

JSON object with the following specification:

JSON property name Description
status Returns the status to indicate the certificate creation.
Error Response Body

JSON object with the following specification.

JSON property name Description
code Returns the application error code.
message Returns a message that describes the error.

Examples

Service request to create a certificate
POST https://localhost:<port>/SKLM/rest/v1/certificates
Content-Type: application/json
Accept : application/json
Authorization: SKLMAuth userAuthId=139aeh34567m
Accept-Language : en
{"type":"selfsigned","alias":"sklmCertificate","cn":"sklm","ou":"sales",
"o":"myCompanyName","usage":"3592","country":"US","validity":"999",
"algorithm": "RSA"  }
Success response
Status Code : 200 OK
Content-Language: en
{"Status":"Created a key pair and self-signed certificate: sklmCertificate"}
Error response
Status Code : 400 Bad Request
Content-Language: en
{"code":"CTGKM6002E","message":"CTGKM6002E Bad Request: Invalid user 
authentication ID or invalid request format."}
Status Code : 500 Internal Server Error
Content-Language: en
{"code":"CTGKM0540E","message":"CTGKM0540E Certificate with alias 
sklmCertificate already exists in keystore."}