- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
CA Management
The CA Management endpoints list the certificate authorities (CAs) configured in CertSecure Manager, return the CAs the calling user can enroll from, and add, update, or remove CA configurations.
For the corresponding user interface, refer to the Administration > CA Management section.
Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /available_ca | List CAs available to user. |
| GET | /ca | List CA configurations. |
| POST | /ca | Add CA configuration. |
| PATCH | /ca | Update CA renewal period. |
| DELETE | /ca | Delete CA configuration. |
| GET | /template/ca | List CAs with templates. |
GET /available_ca
Returns the CAs the caller has permission to enroll from, grouped by CA type, with the agents that serve each CA.
Example Request
curl -X GET "https://<certsecure-backend-url>/available_ca" \
-H "Authorization: Bearer <token>"Example Response
{
"MSCA": {
"Example Issuing CA": [
"MSCA-Agent"
]
},
"LETSENCRYPT": {
"Lets Encrypt": [
"CertSecure Backend"
]
},
"AWS-PCA": {
"Example AWS Private CA": [
"CertSecure Backend"
]
}
}Responses
| Status Code | Description |
|---|---|
| 200 | CA list. |
GET /ca
Lists the CAs configured in CertSecure Manager with their type, primary agent, renewal interval, and restriction setting.
Example Request
curl -X GET "https://<certsecure-backend-url>/ca" \
-H "Authorization: Bearer <token>"Example Response
[
{
"Name": "Example Issuing CA",
"Type": "MSCA",
"Primary Agent": "MSCA-Agent",
"RenewalInterval": 300,
"CA Restricted": false
},
{
"Name": "Example Vault PKI",
"Type": "HashicorpVault",
"Primary Agent": "CertSecure Backend",
"RenewalInterval": 30,
"CA Restricted": false
}
]Responses
| Status Code | Description |
|---|---|
| 200 | CA list. |
POST /ca
Adds a CA configuration to CertSecure Manager.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca |
object | Yes | CA configuration payload (name, type, credentials, etc.) |
Example Request
curl -X POST "https://<certsecure-backend-url>/ca" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca": {}}'Responses
| Status Code | Description |
|---|---|
| 200 | The resource was added. |
PATCH /ca
Updates the renewal period (in days) of a CA.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca |
string | Yes | CA name. |
renewal |
integer | Yes | Renewal window in days. |
Example Request
curl -X PATCH "https://<certsecure-backend-url>/ca" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca": "string", "renewal": 1}'Responses
| Status Code | Description |
|---|---|
| 200 | The resource was updated. |
DELETE /ca
Removes a CA configuration from CertSecure Manager.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca |
string | Yes | CA name. |
Example Request
curl -X DELETE "https://<certsecure-backend-url>/ca" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca": "string"}'Responses
| Status Code | Description |
|---|---|
| 200 | The resource was deleted. |
GET /template/ca
Returns the configured CAs together with their certificate templates and template details.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
ca |
Query | string | No | Name of the certificate authority (CA) as configured in CertSecure Manager. |
Example Request
curl -X GET "https://<certsecure-backend-url>/template/ca" \
-H "Authorization: Bearer <token>"Responses
| Status Code | Description |
|---|---|
| 200 | CA + templates. |
Connector CA Endpoints
These endpoints are used by the Certificate Authorities screens to register, test and edit agentless CAs. All of them require authentication. probe-account, acme/probe-directory and update-ca-agent also require the Manage Certification Authorities permission and answer 403 with "You need the 'Manage Certification Authorities' permission to do this." without it.
| Method | Endpoint | Description |
|---|---|---|
| POST | /connector/ca-agent/probe-account | Test a CA's credentials and return its template options. |
| POST | /connector/ca-agent/acme/probe-directory | Read an ACME directory. |
| POST | /connector/ca-agent/aws-pca/authorities | List the AWS Private CAs visible to a set of credentials. |
| POST | /connector/ca-agent/digicert/catalogue | List the DigiCert products, divisions and organizations of an account. |
| POST | /connector/ca-agent/{caID}/verify-credentials | Check one CA's credential now. |
| PUT | /connector/ca-agent/{caID}/update-ca-agent | Edit an agentless CA. |
POST /connector/ca-agent/probe-account
Tests the credentials of a CA and returns the options its default certificate template can use. Registering a CA runs the same check, so values that pass here can be used to register the CA.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
ca_type |
string | Yes | CA type to test: digicert, sectigo, sectigo-ps, globalsign, globalsign-acme, godaddy, godaddy-automated, aws-pca, aws-acm, letsencrypt, googlepublicca or acme. |
caID |
string | No | ID of an existing CA. The credentials stored for that CA are used, and any other field in the body overrides them. The CA must be of the type given in ca_type. |
name |
string | No | Name of the CA being registered. |
| Credential fields | various | Depends on the CA type | The credentials of the CA type, for example api_key and api_secret, or directory_url, eab_kid and eab_hmac_key for an ACME CA. Fields that the CA type does not use are ignored. |
Example Request
curl -X POST "https://<certsecure-backend-url>/connector/ca-agent/probe-account" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"ca_type": "digicert", "api_key": "<api-key>"}'Example Response
{
"ok": true,
"ca_type": "digicert",
"account": {},
"requires_template": true,
"requires": [],
"policy": {},
"existing_template": null,
"template_properties": {}
}Response Fields
| Field | Description |
|---|---|
ok |
true when the CA accepted the credentials. |
account |
Lists read from the account (for example organizations or authorities) that the form offers as choices. |
requires_template |
false for a CA type that does not issue from a template (AWS Public CA). |
requires |
What must still be chosen before a policy can be built, for example the AWS Private CA. Choose it and test again. |
policy |
The certificate policy the CA reports, which limits what a template may request. |
existing_template |
When caID is given, the current default template of that CA; otherwise null. |
template_properties |
The template options in the same form as GET /template/configure, or null. |
Responses
| Status Code | Description |
|---|---|
| 200 | Credentials accepted. |
| 400 | ca_type is missing, the CA type cannot be tested, caID belongs to a CA of another type, an endpoint was changed without re-entering the stored secrets, or the CA rejected the values. The message carries the reason. |
| 403 | The caller lacks the Manage Certification Authorities permission. |
| 404 | caID was not found. |
| 502 | The CA could not be reached. |
POST /connector/ca-agent/acme/probe-directory
Reads an ACME directory and reports what registering against it needs. Nothing is created at the CA. It shows whether the directory requires External Account Binding before the CA is submitted and catches a mistyped URL.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
directory_url |
string | Yes | ACME directory URL (http or https). |
directory_ca_bundle |
string | No | PEM certificate of the CA that issued the ACME server's own TLS certificate. Use it to test an internal ACME server. |
Example Request
curl -X POST "https://<certsecure-backend-url>/connector/ca-agent/acme/probe-directory" \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
-d '{"directory_url": "https://acme.example.com/directory"}'Example Response
{
"directory_url": "https://acme.example.com/directory",
"external_account_required": true,
"terms_of_service": "https://acme.example.com/terms",
"website": "",
"caa_identities": [],
"profiles": [],
"endpoints": ["keyChange", "newAccount", "newNonce", "newOrder", "revokeCert"]
}Responses
| Status Code | Description |
|---|---|
| 200 | Directory read. |
| 400 | directory_url is missing, is not an http(s) URL, did not answer, or did not return an ACME directory (no newAccount resource). Private and loopback addresses can be refused by the endpoint policy of the deployment. |
| 403 | The caller lacks the Manage Certification Authorities permission. |
POST /connector/ca-agent/aws-pca/authorities
Lists the AWS Private CAs that a set of AWS credentials can see in a region, so the ARN does not have to be copied from the AWS console.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
region |
string | Yes, with credentials | AWS region, for example us-gov-west-1. |
access_key_id |
string | Yes, with credentials | AWS access key ID. |
secret_access_key |
string | Yes, with credentials | AWS secret access key. |
session_token |
string | No | AWS session token for temporary credentials. |
caID |
string | No | ID of an existing AWS Private CA. Its stored credentials are used instead of the fields above, and region may be given to list another region. |
Example Response
{
"authorities": [
{
"arn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/example",
"common_name": "Example Issuing CA",
"status": "ACTIVE",
"type": "SUBORDINATE",
"key_algorithm": "RSA_2048",
"signing_algorithm": "SHA256WITHRSA",
"owner_account": "111122223333",
"not_after": "2030-01-01T00:00:00+00:00"
}
]
}Responses
| Status Code | Description |
|---|---|
| 200 | Authorities listed. Authorities that are not ACTIVE are included with their status. |
| 400 | Neither credentials nor caID was given, AWS rejected the credentials or the region, or caID is not an AWS Private CA. |
| 404 | caID was not found. |
| 502 | AWS could not be reached. |
POST /connector/ca-agent/digicert/catalogue
Returns the products, divisions (containers) and organizations of a DigiCert account. The key is sent in the body and never in the query string.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
api_key |
string | One of api_key or caID | DigiCert CertCentral API key. |
api_base_url |
string | No | DigiCert API base URL. Defaults to the DigiCert services endpoint. |
caID |
string | One of api_key or caID | ID of an existing DigiCert CA whose stored key is used. |
Responses
| Status Code | Description |
|---|---|
| 200 | Object with products, containers, organizations and errors. A list that the key is not allowed to read is returned empty and the reason is listed in errors. |
| 400 | Neither api_key nor caID was given, caID is not a DigiCert CA, or DigiCert rejected the key. |
| 404 | caID was not found. |
POST /connector/ca-agent/{caID}/verify-credentials
Checks the stored credential of one CA against the CA now, instead of waiting for the next background check. The result is stored and returned. The check is recorded as a closed task named Verify CA Credentials.
Request Parameters
| Name | Located In | Type | Required | Description |
|---|---|---|---|---|
caID |
Path | string | Yes | ID of the CA. |
Example Request
curl -X POST "https://<certsecure-backend-url>/connector/ca-agent/<caID>/verify-credentials" \
-H "Authorization: Bearer <token>"Example Response
{
"credential_status": "valid",
"credential_checked_at": "2026-11-03T10:15:00+00:00",
"credential_detail": ""
}credential_status is valid, invalid, unknown or not_configured. credential_detail is a short reason (at most 200 characters) and never contains the credential.
Responses
| Status Code | Description |
|---|---|
| 200 | Check completed. The body carries the result. |
| 404 | CA Agent not found. |
| 409 | The CA has not finished registering, so there is nothing to check yet. |
PUT /connector/ca-agent/{caID}/update-ca-agent
Edits an agentless CA without decommissioning it, so its caID and its inventory are kept. Send only the fields to change. A secret that is empty or still shows its masked value is treated as unchanged.
Request Body (application/json)
| Field | Type | Required | Description |
|---|---|---|---|
| Editable fields | various | At least one field or default_template |
The fields allowed for the CA type (see the table below). |
default_template |
object | No | A new default certificate template for the CA. It is validated against the stored policy of the CA before anything is written. |
Fields that can never be changed: caID, name, ca_type, ConnectorID, connectorStoreID, created_at and registrationToken. status may only be set to Active or Disabled. If api_base_url, directory_url or customer_uri changes, every stored secret of the CA must be sent again.
| CA type | Editable fields |
|---|---|
godaddy |
description, status, api_base_url, api_key, api_secret, customer_id, customer_number, shopper_id, product_type, root_type, period, contact, organization |
digicert |
description, status, api_base_url, api_key, product_type, container_id, organization_id, signature_hash, order_validity_days |
globalsign |
description, status, api_base_url, api_key, api_secret, mtls_cert, mtls_encrypted_key, mtls_key_password |
sectigo |
description, status, api_base_url, username, password, customer_uri, organization_id, cert_type_id |
sectigo-ps |
description, status, api_base_url, loginName, loginPassword, sub_account_id |
aws-pca |
description, status, ca_arn, region, access_key_id, secret_access_key, session_token |
aws-acm |
description, status, region, access_key_id, secret_access_key, session_token, validation_method, domain_name |
letsencrypt, googlepublicca, globalsign-acme |
description, status, email, directory_url, eab_kid, eab_hmac_key, profile, directory_ca_bundle |
godaddy-automated |
The ACME fields above plus api_base_url, api_key, api_secret, customer_id, customer_number |
acme |
The ACME fields above plus eab_extra |
Responses
| Status Code | Description |
|---|---|
| 200 | Updated. The body has message, updated (the names of the fields changed), default_template when a template was saved, and credential_status and credential_detail when a credential was edited, because a changed credential is checked straight away. |
| 400 | Empty body, an unsupported or immutable field, an invalid status, an endpoint change without its secrets, a rejected template, or a value rejected by the connector. |
| 403 | The caller lacks the Manage Certification Authorities permission. |
| 404 | CA Agent not found. |
| 409 | A decommissioned CA cannot be edited. |