Upload certificate chain

POST 
/v2/config/digital-wallet/openid/key-management/keys/:keyId/certificate-chain

Uploads a certificate chain and links it to a key in the secure vault. The wallet then adds the chain as the x5c value of the key.

The file must be UTF-8 text in PEM format. Put the leaf certificate first, then the intermediate certificates, then the root certificate. The service refuses the file when it holds a private key, when the leaf certificate does not use the P-256 curve, when a certificate is expired or not yet valid, or when a chain signature is not correct.

Request

Path Parameters

keyId stringrequired

Unique identifier of the key

Header Parameters

X-SandboxOrgId stringrequired
Optional. Unique identifier of the sandbox organisation to use for this request. When you send this header, the service runs the operation in the context of the named sandbox organisation, that is, against the wallet of that sandbox organisation and not against the main wallet of the organisation. Leave the header out to use the main wallet.
The service reads this header only when you authenticate with a bearer access token. When you authenticate with an API key, the service takes the sandbox organisation from the API key and ignores this header. To run an API-key call in a sandbox organisation, bind the key to the sandbox organisation with PUT /v2/config/admin/apikey/{apiKeyId}/sandbox-org instead.
X-SubwalletId is the deprecated name of this header. The service continues to accept it, but X-SandboxOrgId wins if you send both headers.
The sandbox organisation must exist, must belong to your organisation and must be deployed. An unknown identifier, an identifier of a sandbox organisation that is not deployed, and an identifier that belongs to a different organisation all make the call fail with HTTP 400.
Example: 6889e1a4c5b2f30001a3d710

multipart/form-data

Body

required

PEM file that holds the certificate chain.

certificate_file binaryrequired

PEM file that holds the certificate chain in leaf, intermediate and root order. The file must not hold a private key.

Responses

200

Certificate chain uploaded successfully.

Response Headers

application/json

Schema

Schema

key_id stringrequired

Unique identifier of the key that the certificate chain belongs to.

certificates_count integerrequired

Number of certificates in the uploaded chain.

x5t stringrequired

SHA-1 thumbprint of the leaf certificate, in base64url format.

x5t_s256 stringrequired

SHA-256 thumbprint of the leaf certificate, in base64url format.

Example (from schema)

{
  "key_id": "3f2a91c47b8d4e6fa0c5d7e18b924f30",
  "certificates_count": 3,
  "x5t": "<base64url-sha1-thumbprint>",
  "x5t_s256": "<base64url-sha256-thumbprint>"
}

400

The key ID is missing, the file is not valid PEM, the file holds a private key, the leaf certificate does not use the P-256 curve, a certificate is expired, or a chain signature is not correct.

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

401

Unauthorized

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

500

Internal server error

Response Headers

application/json

Schema

Schema

errorCode integerrequired
errorDescription stringrequired

Example (from schema)

{
  "errorCode": 400,
  "errorDescription": "Bad input parameter"
}

Loading...