CA Services

Overview

This page describes CA services used by IPA.

General

• POST /ca/admin/ca/getStatus

  • GetStatus Service

  • dogtag.ca_status()

• /ca/ee/ca/*

• /ca/agent/ca/*

• /ca/rest/*

Authentication

• GET /ca/rest/account/login

  • PKI Login REST API

  • RestClient.__enter__()

• GET /ca/rest/account/logout

  • PKI Logout REST API

  • RestClient.__exit__()

Certificates

• GET /ca/ee/ca/getCertChain

  • CA EE Get Certificate Chain

  • dogtag.get_ca_certchain()

• POST /ca/ee/ca/profileSubmit

  • CA Profile Submit Service

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_517

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1020

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1053

• POST /ca/ee/ca/profileSubmitSSLClient

  • CA Profile Submit Service

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_517

  • CertDB.issue_server_cert()

• GET /ca/ee/ca/profileReview

  • CA Profile Review Service

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_639

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1076

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1095

• POST /ca/ee/ca/profileProcess

  • CA Profile Process Service

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_639

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1084

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1104

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1113

• GET /ca/ee/ca/profileList

  • CA Profile List Service

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_666

• GET /ca/ee/ca/checkRequest

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_616

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1137

• GET /ca/ee/ca/displayCertFromRequest

  • https://pagure.io/certmonger/blob/master/f/src/dogtag.c#_655

  • https://pagure.io/certmonger/blob/master/f/src/submit-d.c#_1146

• GET /ca/rest/certs/<id>

  • CA Retrieve Certificate REST API

  • ra.get_certificate()

• POST /ca/rest/certs/search

  • CA Search Certificates REST API

  • ra.find()

• POST /ca/rest/agent/certs/<id>/revoke

  • CA Revoke Certificate REST API

  • ra.revoke_certificate()

• POST /ca/rest/agent/certs/<id>/unrevoke

  • CA Unrevoke Certificate REST API

  • ra.take_certificate_off_hold()

Certificate Requests

• POST /ca/rest/certrequests

  • ra.request_certificate()

• GET /ca/rest/certrequests/<id>

  • ra.check_request_status()

Certificate Profiles

• POST /ca/rest/profiles/raw

  • ra_certprofile.create_profile()

• GET /ca/rest/profiles/<id>/raw

  • ra_certprofile.read_profile()

• PUT /ca/rest/profiles/<id>/raw

  • ra_certprofile.update_profile()

• POST /ca/rest/profiles/<id>?action=enable

  • ra_certprofile.enable_profile()

• POST /ca/rest/profiles/<id>?action=disable

  • ra_certprofile.disable_profile()

• DELETE /ca/rest/profiles/<id>

  • ra_certprofile.delete_profile()

Certificate Authorities

• POST /ca/rest/authorities

  • ra_lightweight_ca.create_ca()

• GET /ca/rest/authorities/<id>

  • ra_lightweight_ca.read_ca()

• POST /ca/rest/authorities/<id>/enable

  • ra_lightweight_ca.enable_ca()

• POST /ca/rest/authorities/<id>/disable

  • ra_lightweight_ca.disable_ca()

• GET /ca/rest/authorities/<id>/cert

  • ra_lightweight_ca.read_ca_cert()

• GET /ca/rest/authorities/<id>/chain

  • ra_lightweight_ca.read_ca_chain()

• DELETE /ca/rest/authorities/<id>

  • ra_lightweight_ca.delete_ca()

Certificate Pruning

• pki-server ca-config-set jobsScheduler.job.pruning.<name>

  • PKI Server Subsystem Configuration CLI

  • IPAACMEManage.pruning.ca_config_set()

• pki-server ca-config-show jobsScheduler.job.pruning.<name>

  • PKI Server Subsystem Configuration CLI

  • IPAACMEManage.pruning.ca_config_show()

• pki ca-job-start pruning

  • PKI Job CLI

  • IPAACMEManage.pruning.run_pruning()

CRL

• GET /ca/ee/ca/getCRL

  • GetCRL Service

  • ipa-pki-proxy.conf.template

  • CAInstance.crl_rewriterule

• POST /ca/agent/ca/updateCRL

  • UpdateCRL Service

  • ra.updateCRL()

OCSP

• POST /ca/ocsp

  • OCSP Service

  • acmeIPAServerCert.cfg

  • caIPAserviceCert.cfg

  • caIPAserviceCert.UPGRADE.cfg

  • IECUserRoles.cfg

  • KDCs_PKINIT_Certs.cfg

  • ca_add_default_ocsp_uri()

  • PKIIniLoader.__init__()

Security Domain

• DELETE /ca/securityDomain/hosts/<id>

  • ra_securitydomain.delete_domain()