Renew CA certificate

POST

/api/v1/ca-certificates/{id}/renew

curl --request POST \
  --url http://localhost:3000/api/v1/ca-certificates/550e8400-e29b-41d4-a716-446655440000/renew \
  --header 'Content-Type: application/json' \
  --header 'X-API-Key: <X-API-Key>' \
  --data '{ "validityDays": 365 }'

• Development
• Production

Re-issues the CA certificate with the same subject and key pair, a new serial number and a new validity period (now + validityDays), signed the way the original was (by itself when self-signed, otherwise by its parent CA). The stored certificate, fingerprint and validity dates are replaced by those of the new certificate.

Authorizations

• api-key
• bearer

Parameters

Path Parameters

id

required

string format: uuid

Example

550e8400-e29b-41d4-a716-446655440000

CA Certificate UUID

Header Parameters

x-organization-id

string format: uuid

UUID of the organization (tenant) the request acts in. It selects the tenant and grants nothing: the server checks membership or an open tenant switch. Not needed for global operations. A malformed value returns 400. API keys are fixed to their own organization; another organization returns 403. The x-organization-source header grants nothing.

Request Body^required

Media typeapplication/json

object

validityDays

Validity of the re-issued certificate in days, starting now

number

default: 365 >= 1 <= 3650

Example

365

Responses

200

CA certificate renewed successfully

Media typeapplication/json

object

id

required

Unique CA certificate identifier (UUID)

string format: uuid

name

required

Human-readable name for the CA certificate

string

fingerprint

required

SHA-256 fingerprint of the certificate

string

isRoot

required

Whether this is a root CA certificate

boolean

isDefault

required

Whether this is the default signing CA

boolean

notBefore

required

Certificate validity start date

string format: date-time

notAfter

required

Certificate validity end date (expiration)

string format: date-time

retiredAt

Date when the CA certificate was retired

string format: date-time

createdAt

required

Timestamp when the CA certificate was created

string format: date-time

subject

Full subject distinguished name

string

issuer

Full issuer distinguished name

string

serialNumber

Certificate serial number (hex)

string

keyAlgorithm

Public key algorithm and size

string

signatureAlgorithm

Signature algorithm

string

subjectAltNames

Subject Alternative Names

Array<string>

certificate

PEM-encoded public certificate (safe to share)

string

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Production Root CA",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "isRoot": true,
  "isDefault": true,
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2034-01-01T00:00:00Z",
  "retiredAt": "2024-06-01T00:00:00Z",
  "createdAt": "2024-01-01T00:00:00Z",
  "subject": "CN=Root CA, O=logiccloud, C=US",
  "issuer": "CN=Root CA, O=logiccloud, C=US",
  "serialNumber": "01:AB:CD:EF",
  "keyAlgorithm": "RSA-4096",
  "signatureAlgorithm": "SHA256withRSA",
  "subjectAltNames": [
    "DNS:example.com",
    "IP:192.168.1.1"
  ],
  "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

400

Bad Request - Cannot renew a retired CA certificate

401

Unauthorized - Invalid or missing authentication

403

Forbidden - Insufficient permissions (admin only)

404

CA certificate not found

409

Conflict - The CA was issued by a CA whose private key logiccloud orchestrate does not hold