X.509 Certificates

The X.509 signer issues certificates by signing a certificate signing request (CSR) with one of your certificate authority identifiers. The requester keeps the private key; Core returns the signed certificate chain.

Before you begin

• A certificate authority identifier to sign with. See Certificates.
• A CSR in PEM format. It can come from any tool, or from another Core instance, which can generate CSRs for its keys. See Generating CSRs.
• The X509_CERTIFICATE_SIGN permission, when Core runs in STS authentication mode.

Request

POST /api/signature/v1

{
  "issuer": "<certificate authority identifier ID>",
  "signer": "X509_CERTIFICATE",
  "data": {
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBSTCB8AIBADBK...\n-----END CERTIFICATE REQUEST-----"
  }
}

data takes a single field:

Field	Type	Description
csr	string	Required. The CSR in PEM format.

For the other request fields, see Creating a signature.

How the CSR becomes a certificate

Core verifies the CSR's signature, then builds the certificate from it.

The subject is copied from the CSR unchanged.

Extensions are copied only if they are on this list. A CSR that requests any other extension or value is rejected.

Extension	Allowed values
Key usage	digitalSignature, keyCertSign, cRLSign
Extended key usage	ISO 18013-5 mDL Document Signer, ISO mdoc Document Signer
Subject alternative name	Email address, DNS name, URI

Core then adds the extensions that depend on the issuer:

• Authority key identifier, from the issuing CA's key.
• Issuer alternative name, if the issuing CA is a self-signed root with one.
• CRL distribution point, if the signer has a revocation method.

Leaf and CA certificates

A CSR that requests the keyCertSign key usage asks for a CA certificate. Core issues one only if the signer allows CA signing; otherwise the request is rejected. The CA certificate's path length is limited by the signer's configuration.

Any other CSR produces a leaf certificate, which cannot sign other certificates.

See Signer configuration.

Response

{
  "id": "4f1c2b7e-...",
  "result": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n"
}

result is a PEM certificate chain: the new certificate first, followed by the issuing CA's chain. Use the full chain when you create a certificate identifier from it.

Store id to revoke the certificate or check its status later. See Revocation and status.