Generate self-signed CA certificate

POST

/api/v1/ca-certificates/generate

curl --request POST \
  --url http://localhost:3000/api/v1/ca-certificates/generate \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "name": "Development Root CA", "commonName": "logiccloud orchestrate Dev CA", "organization": "logiccloud", "country": "DE", "validityYears": 10, "isDefault": false }'

• Development
• Production

Generate a new self-signed CA certificate with RSA 4096 key pair. For development and testing only. In production, use a proper PKI.

Authorizations

• api-key
• bearer

Parameters

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Request Body^required

Media typeapplication/json

object

name

required

Human-readable name for the CA certificate

string

<= 255 characters

Example

Development Root CA

commonName

required

Common Name (CN) for the certificate subject

string

<= 255 characters

Example

logiccloud orchestrate Dev CA

organization

Organization (O) for the certificate subject

string

<= 255 characters

Example

logiccloud

country

Country code (C) for the certificate subject (2-letter ISO 3166-1 alpha-2)

string

<= 2 characters

Example

DE

validityYears

Validity period in years (1-30)

number

default: 10

Example

10

isDefault

Set as the default signing CA for new device certificates

boolean

Example

false

Responses

201

CA certificate generated successfully

Media typeapplication/json

object

id

required

Unique CA certificate identifier (UUID)

string format: uuid

name

required

Human-readable name for the CA certificate

string

fingerprint

required

SHA-256 fingerprint of the certificate

string

isRoot

required

Whether this is a root CA certificate

boolean

isDefault

required

Whether this is the default signing CA

boolean

notBefore

required

Certificate validity start date

string format: date-time

notAfter

required

Certificate validity end date (expiration)

string format: date-time

retiredAt

Date when the CA certificate was retired

string format: date-time

createdAt

required

Timestamp when the CA certificate was created

string format: date-time

subject

Full subject distinguished name

string

issuer

Full issuer distinguished name

string

serialNumber

Certificate serial number (hex)

string

keyAlgorithm

Public key algorithm and size

string

signatureAlgorithm

Signature algorithm

string

subjectAltNames

Subject Alternative Names

Array<string>

certificate

PEM-encoded public certificate (safe to share)

string

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Production Root CA",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "isRoot": true,
  "isDefault": true,
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2034-01-01T00:00:00Z",
  "retiredAt": "2024-06-01T00:00:00Z",
  "createdAt": "2024-01-01T00:00:00Z",
  "subject": "CN=Root CA, O=logiccloud, C=US",
  "issuer": "CN=Root CA, O=logiccloud, C=US",
  "serialNumber": "01:AB:CD:EF",
  "keyAlgorithm": "RSA-4096",
  "signatureAlgorithm": "SHA256withRSA",
  "subjectAltNames": [
    "DNS:example.com",
    "IP:192.168.1.1"
  ],
  "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

400

Bad Request - Invalid parameters

401

Unauthorized - Invalid or missing authentication

403

Forbidden - Insufficient permissions (admin only)

409

Conflict - CA certificate with same fingerprint already exists