CA Configuration¶
Overview¶
Use the CA Configuration API to save, retrieve, or delete a certificate authority (CA) configuration.
REST Endpoint: /mgmt/cm/adc-core/external-ca/config¶
Requests¶
POST /mgmt/cm/adc-core/external-ca/config¶
Send a POST request to the endpoint to save a CA configuration.
Request Parameters¶
The JSON in the body of the POST request can contain the following parameters.
Name | Type | Required | Description |
---|---|---|---|
name | string | True | Name of the CA server |
caProvider | string | True | The certificate authority provider. Possible values: “Let’s Encrypt” and “Venafi”. |
webSdkEndPoint | string | True | URL of the web SDK |
keyAlgorithm | string | True | Cryptography algorithm. Possible value: “RSA”. This parameter does not apply if the value of caProvider equals “Venafi”. |
keySize | number | True | Size of the cryptography key. For example: 2048. This parameter does not apply if the value of caProvider equals “Venafi”. |
terms | boolean | True | Terms of the external CA. This parameter does not apply if the value of caProvider equals “Venafi”. |
autoRenewalThreshold | number | False | Optional Venafi threshold value |
autoDeployThreshold | number | False | Optional Venafi threshold value |
keyPassphrase | string | False | Optional Venafi Key Passphrase for Sync |
userName | string | True if caProvider equals “Venafi” | Venafi Server User Name |
password | string | True if caProvider equals “Venafi” | Venafi Server Password |
Query Parameters¶
None
Response¶
The JSON in the POST’s response can include the following parameters.
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
uuid | string | UUID of the configuration |
name | string | Name of the CA server |
caProvider | string | The certificate authority provider. Possible values: “Let’s Encrypt” and “Venafi”. |
webSdkEndPoint | string | URL of the web SDK |
keyAlgorithm | string | Cryptography algorithm. Possible value: “RSA”. This parameter does not apply if the value of caProvider equals “Venafi”. |
keySize | number | Size of the cryptography key. For example: 2048. This parameter does not apply if the value of caProvider equals “Venafi”. |
terms | boolean | Terms of the external CA. This parameter does not apply if the value of caProvider equals “Venafi”. |
selfLink | string | URL of the configuration |
autoRenewalThreshold | number | Venafi threshold value |
autoDeployThreshold | number | Venafi threshold value |
userName | string | Venafi Server User Name |
encryptedPassword | string | Encrypted Venafi password |
keyPassphrase | string | Venafi passphrase |
Permissions¶
Role | Allow |
---|---|
admin | Yes |
Certificate Editor/Viewer | No |
GET /mgmt/cm/adc-core/external-ca/config¶
To retrieve information for all CA configurations, send a GET request to the collection’s endpoint. To retrieve information for a specific configuration, append the configuration’s uuid.
Request Parameters¶
None
Query Parameters¶
None
Response¶
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
items | object | List of records for CA configurations |
uuid | string | UUID of the configuration |
name | string | Name of the server |
caProvider | string | The certificate authority provider. Possible values: “Let’s Encrypt” and “Venafi”. |
webSdkEndPoint | string | URL of the web SDK |
keyAlgorithm | string | Cryptography algorithm. Possible value: “RSA”. This parameter does not apply if the value of caProvider equals “Venafi”. |
keySize | number | Size of the cryptography key. For example: 2048. This parameter does not apply if the value of caProvider equals “Venafi”. |
terms | boolean | Terms of the external CA. This parameter does not apply if the value of caProvider equals “Venafi”. |
selfLink | string | URL of the configuration |
username | string | The Venafi server’s user name. This can be present if caProvide is “Venafi”. |
keyPassphrase | string | This can be present if the value of caProvide is “Venafi”. |
encryptedPassword | string | This can be present if the value of caProvide is “Venafi”. |
autoDeployThreshold | string | This can be present if the value of caProvide is “Venafi”. |
autoRenewalThreshold | string | This can be present if the value of caProvide is “Venafi”. |
selfLink | string | URL of the configuration collection |
Permissions¶
Role | Allow |
---|---|
admin | Yes |
Certificate Editor/Viewer | Yes |
PATCH /mgmt/cm/adc-core/external-ca/config/{uuid}¶
To change a CA configuration, send a PATCH request to the configuration’s endpoint.
Request Parameters¶
The JSON in the body of the PATCH request can contain the following parameters.
Name | Type | Required | Description |
---|---|---|---|
autoRenewalThreshold | number | False | Optional Venafi threshold value |
autoDeployThreshold | number | False | Optional Venafi threshold value |
keyPassphrase | string | False | Optional Venafi Key Passphrase for Sync |
Query Parameters¶
None
Response¶
The JSON in the PATCH’s response can include the following parameters.
HTTP/1.1 200 OK
Name | Type | Description |
---|---|---|
uuid | string | UUID of the configuration |
name | string | Name of the CA server |
caProvider | string | The certificate authority provider. Possible values: “Let’s Encrypt” and “Venafi”. |
webSdkEndPoint | string | URL of the web SDK |
keyAlgorithm | string | Cryptography algorithm. Possible value: “RSA”. This parameter does not apply if the value of caProvider equals “Venafi”. |
keySize | number | Size of the cryptography key. For example: 2048. This parameter does not apply if the value of caProvider equals “Venafi”. |
terms | boolean | Terms of the external CA. This parameter does not apply if the value of caProvider equals “Venafi”. |
selfLink | string | URL of the configuration |
autoRenewalThreshold | number | Venafi threshold value |
autoDeployThreshold | number | Venafi threshold value |
userName | string | Venafi Server User Name |
encryptedPassword | string | Encrypted Venafi password |
keyPassphrase | string | Venafi passphrase |
Permissions¶
Role | Allow |
---|---|
admin | Yes |
Certificate Editor/Viewer | No |
DELETE /mgmt/cm/adc-core/external-ca/config/{uuid}¶
To delete a specific CA configuration, send a DELETE request to the endpoint and append the configurations uuid. This will delete the CA configuration, linked policy folders and the markers in the certificate or key state. The body of the DELETE request can be empty.
Request Parameters¶
None
Query Parameters¶
None
Response¶
The JSON in the body of the DELETE response is for the deleted CA configuration.
HTTP/1.1 200 OK
Permissions¶
Role | Allow |
---|---|
admin | Yes |
Certificate Editor/Viewer | No |
Examples¶
POST to save a CA configuration (Let’s Encrypt)¶
The following example saves a CA configuration when the CA is Let’s Encrypt.
POST https://<BIG-IQ>/mgmt/cm/adc-core/external-ca/config
The JSON in the body of the POST can look similar to the following example.
{
"name": "LE_Staging_Server",
"caProvider": "Let's Encrypt",
"webSdkEndPoint": "https://acme-staging-v02.api.letsencrypt.org/",
"keyAlgorithm": "RSA",
"keySize": 2048,
"terms": true
}
Response¶
HTTP/1.1 200 OK
{
"uuid": "5194e771-18d1-377d-8706-1d3102ebb312",
"name": "LE_Staging_Server",
"caProvider": "Let's Encrypt",
"webSdkEndPoint": "https://acme-staging-v02.api.letsencrypt.org/",
"keyAlgorithm": "RSA",
"keySize": 2048,
"encryptedUserKey": "--- this value has been omitted from the example ---",
"terms": true,
"generation": 1,
"lastUpdateMicros": 1565688383079313,
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config/5194e771-18d1-377d-8706-1d3102ebb312"
}
POST to save a CA configuration (Venafi)¶
The following example saves a CA configuration when the CA is Venafi.
POST https://<BIG-IQ>/mgmt/cm/adc-core/external-ca/config
The JSON in the body of the POST can look similar to the following example.
{
"name": "Venafi_18.3_Server",
"autoRenewalThreshold": 7,
"autoDeployThreshold": "00:00",
"keyPassphrase": < Key Passphrase for Sync > ",
"caProvider": "Venafi",
"webSdkEndPoint": "https://101018183.dev.lab.venafi.com/vedsdk",
"userName": "<Venafi Server User Name>",
"password": "<Venafi Server Password>"
}
Response¶
HTTP/1.1 200 OK
{
"uuid": "7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d",
"name": "Venafi_18.3_Server",
"caProvider": "Venafi",
"webSdkEndPoint": "https://101018183.dev.lab.venafi.com/VEDSDK",
"autoRenewalThreshold": 7,
"autoDeployThreshold": "00:00",
"userName": "<Venafi Server User Name>",
"encryptedPassword": "GJMPBIt+lSTBbvKXsChH0qS9n6YWk4XnlNdvck7JXmU=",
"keyPassphrase": "Hq93MmWNGJfoP4eDYzdzPWlzx1PzGZlIh2SLxIgCmJ89TpKrwD+//3GoAo05b3CC",
"generation": 1,
"lastUpdateMicros": 1595501429130312,
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config/7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d"
}
GET to retrieve all CA configurations¶
The following example retrieves all the CA configurations.
GET https://<BIG-IQ>/mgmt/cm/adc-core/external-ca/config
Response¶
The JSON in the GET’s response can look similar to the following example.
{
"items": [{
"uuid": "5194e771-18d1-377d-8706-1d3102ebb312",
"name": "LE_Staging_Server",
"caProvider": "Let's Encrypt",
"webSdkEndPoint": "https://acme-staging-v02.api.letsencrypt.org/",
"keyAlgorithm": "RSA",
"keySize": 2048,
"encryptedUserKey": "--- this value has been omitted from the example ---",
"terms": true,
"generation": 1,
"lastUpdateMicros": 1565688383079313,
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config/5194e771-18d1-377d-8706-1d3102ebb312"
},
{
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
"name": "Venafi_18.3_Server",
"uuid": "7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d",
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config/7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d",
"userName": "<Venafi Server User Name>",
"caProvider": "Venafi",
"generation": 1,
"keyPassphrase": "--- this value has been omitted from the example ---",
"webSdkEndPoint": "https://101018183.dev.lab.venafi.com/VEDSDK",
"lastUpdateMicros": 1595501429130312,
"encryptedPassword": "--- this value has been omitted from the example ---",
"autoDeployThreshold": "00:00",
"autoRenewalThreshold": 7
}
],
"generation": 2,
"kind": "cm:adc-core:external-ca:config:externalcaconfigcollectionstate",
"lastUpdateMicros": 1565688383445387,
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config"
}
PATCH to change a CA configuration¶
The following example changes a CA configuration, specified by the configuration’s uuid. In this example the value of uuid is “7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d” and the CA is Venafi.
PATCH https://<BIG-IQ>/mgmt/cm/adc-core/external-ca/config/7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d
The JSON in the body of the POST can look similar to the following example.
{
"autoRenewalThreshold": 7,
"autoDeployThreshold": "00:00",
"keyPassphrase": <Key Passphrase for Sync>
}
Response¶
HTTP/1.1 200 OK
{
"uuid": "7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d",
"name": "Venafi_18.3_Server",
"caProvider": "Venafi",
"webSdkEndPoint": "https://101018183.dev.lab.venafi.com/VEDSDK",
"autoRenewalThreshold": 7,
"autoDeployThreshold": "00:00",
"userName": "<Venafi Server User Name>",
"encryptedPassword": "GJMPBIt+lSTBbvKXsChH0qS9n6YWk4XnlNdvck7JXmU=",
"keyPassphrase": "ykhL5G6mCeiayYrVmhYyuATqhds5D3h0P1/p48kMqiuvgfChnMWIdWWd9tnNa0Av",
"generation": 2,
"lastUpdateMicros": 1595502426223510,
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
"selfLink": "https://localhost/mgmt/cm/adc-core/external-ca/config/7d9bf2c4-80b8-3aa0-b868-d34a8ad9b39d"
}
DELETE to delete a CA configuration¶
The following example deletes a CA configuration specified by it’s uuid. This can delete the CA configuration, linked policy folders and the markers in the cert/key state. This example deletes the configuration having a value of uuid equal to “bbd7a31c-cdaa-3ec8-b713-9457d74958c2”.
DELETE https://<BIG-IQ>/mgmt/cm/adc-core/external-ca/config/bbd7a31c-cdaa-3ec8-b713-9457d74958c2
Response¶
HTTP/1.1 200 OK
The JSON in the body of the response to the DELETE is for the record being removed.
{
"uuid": "bbd7a31c-cdaa-3ec8-b713-9457d74958c2",
"name": "LE_Staging_Server",
"caProvider": "Let's Encrypt",
"webSdkEndPoint": "https://acme-staging-v02.api.letsencrypt.org/",
"keyAlgorithm": "RSA",
"keySize": 2048,
"encryptedUserKey": "--- this value has been omitted from the example ---",
"terms": true,
"generation": 1,
"lastUpdateMicros": 1565688383079313,
"kind": "cm:adc-core:external-ca:config:externalcaconfigstate",
}