Policy > Infra > Certificates

Associated URIs:

API Description API Path

Returns information about all the CA bundles


Returns information about all the bundles of trusted CA certificates.
GET /policy/api/v1/infra/cabundles

Deletes CA bundle


Deletes the specified bundle of trusted CA certificates.
DELETE /policy/api/v1/infra/cabundles/{cabundle-id}

Returns information about a CA bundle


Returns information about the specified bundle of trusted CA
certificates.
GET /policy/api/v1/infra/cabundles/{cabundle-id}

Adds or updates a CA bundle


Adds or updates a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates. The PEM-encoded bundle is replaced
with the one provided in the request.
PATCH /policy/api/v1/infra/cabundles/{cabundle-id}

Adds or replaces a CA bundle


Adds or replaces a new bundle of trusted CA certificates.
The multipart-uploaded file must be a concatenation of one or more
PEM-encoded certificates.
POST /policy/api/v1/infra/cabundles/{cabundle-id}

Adds or replaces a CA bundle


Adds or replaces a new bundle of trusted CA certificates.
The bundle must be a concatenation of one or more
PEM-encoded certificates.
PUT /policy/api/v1/infra/cabundles/{cabundle-id}

Downloads a CA bundle


Downloads the specified PEM-encoded bundle of trusted CA certificates.
GET /policy/api/v1/infra/cabundles/{cabundle-id}/pem-file

Return All the User-Facing Components' Certificates


Returns all certificate information viewable by the user, including each
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
GET /policy/api/v1/infra/certificates
GET /policy/api/v1/global-infra/certificates

Delete Certificate for the Given Certificate ID


Removes the specified certificate. The private key associated with the
certificate is also deleted.
DELETE /policy/api/v1/infra/certificates/{certificate-id}

Show Certificate Data for the Given Certificate ID


Returns information for the specified certificate ID, including the
certificate's id; pem_encoded data; and history of the
certificate (who created or modified it and when). For additional
information, include the ?details=true modifier at the end of the request
URI.
GET /policy/api/v1/infra/certificates/{certificate-id}
GET /policy/api/v1/global-infra/certificates/{certificate-id}

Add a New Certificate


Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This patch method does
not modify an existing certificate.
PATCH /policy/api/v1/infra/certificates/{certificate-id}

Add a New Certificate


Adds a new private-public certificate and, optionally, a private key that
can be applied to one of the user-facing components (appliance management
or edge). The certificate and the key should be stored in PEM format. If
no private key is provided, the certificate is used as a client
certificate in the trust store.
A private key can be uploaded for a CA certificate only if the "purpose"
parameter is set to "signing-ca".
A certificate chain will not be expanded
into separate certificate instances for reference, but would be pushed to
the enforcement point as a single certificate. This PUT method does
not modify an existing certificate.
PUT /policy/api/v1/infra/certificates/{certificate-id}

Return All Added CRLs


Returns information about all CRLs. For additional information, include the
?details=true modifier at the end of the request URI.
GET /policy/api/v1/infra/crls
GET /policy/api/v1/global-infra/crls

Delete a CRL


Deletes an existing CRL. 		DELETE /policy/api/v1/infra/crls/{crl-id}

Show CRL Data for the Given CRL id.


Returns information about the specified CRL. For additional information,
include the ?details=true modifier at the end of the request URI.
GET /policy/api/v1/infra/crls/{crl-id}
GET /policy/api/v1/global-infra/crls/{crl-id}

Create or patch a Certificate Revocation List


Create or patch a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
PATCH /policy/api/v1/infra/crls/{crl-id}

Create a new Certificate Revocation List


Adds a new certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
POST /policy/api/v1/infra/crls/{crl-id}?action=import

Upload a new or updated Certificate Revocation List


Adds or replaces a certificate revocation list (CRLs). The CRL is used to verify the client
certificate status against the revocation lists published by the CA. For this reason,
the administrator needs to add the CRL in certificate repository as well.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the upload content.
An X.509 CRL can contain a single CRL or multiple CRLs depending on the PEM data.
- Single CRL: a single CRL is created with the given id.
- Composite CRL: multiple CRLs are generated. Each of the CRL is created with an id
generated based on the given id. First CRL is created with crl-id, second with crl-id-1,
third with crl-id-2, etc.
Differently from action=import, this method allows multi-part upload of the CRL(s).
The TlsCrl resource returned in the body of the response will have an empty pem_encoded
field, as it may be large. Use a GET request to retrieve the PEM-encoded CRL.
POST /policy/api/v1/infra/crls/{crl-id}?action=upload

Create or fully replace a Certificate Revocation List


Create or replace a Certificate Revocation List for the given id. The CRL is used to
verify the client certificate status against the revocation lists published by the CA.
For this reason, the administrator needs to add the CRL in certificate repository as well.
The CRL must contain PEM data for a single CRL. Revision is required.
A CRL can be in the PEM X.509 format (crl_type=X509) or JSON OneCRL
(crl_type=OneCRL).
If crl_type is not specified, it is auto-detected based on the presence of
fields pem_encoded or one_crl.
PUT /policy/api/v1/infra/crls/{crl-id}

Return All the Generated CSRs


Returns information about all of the CSRs that have been created. 		GET /policy/api/v1/infra/csrs

Generate a new self-signed certificate


Creates a new self-signed certificate. A private key is also created at the
same time. This is convenience call that will generate a CSR and then self-sign it.
For validity of non-CA certificates, if a value greater than 825 days is
provided, it will be set to 825 days. No limit is set for CA certificates.
POST /policy/api/v1/infra/csrs?action=self_sign

Delete a CSR


Removes a specified CSR. If a CSR is not used for verification, you can
delete it. Note that the CSR import and upload POST actions automatically
delete the associated CSR.
DELETE /policy/api/v1/infra/csrs/{csr-id}

Show CSR Data for the Given CSR ID


Returns information about the specified CSR. 		GET /policy/api/v1/infra/csrs/{csr-id}

Self-Sign the CSR


Self-signs the previously generated CSR. This action is similar to the
import certificate action, but instead of using a public certificate signed
by a CA, the self_sign POST action uses a certificate that is signed with
NSX's own private key.
For validity of non-CA certificates, if a value greater than 825 days is
provided, it will be set to 825 days. No limit is set for CA certificates.
POST /policy/api/v1/infra/csrs/{csr-id}?action=self_sign

Generate a New Certificate Signing Request


Creates a new certificate signing request (CSR). A CSR is encrypted text that
contains information about your organization (organization name, country,
and so on) and your Web server's public key, which is a public certificate
the is generated on the server that can be used to forward this request to a
certificate authority (CA). A private key is also usually created at the
same time as the CSR.
POST /policy/api/v1/infra/csrs/{csr-id}?action=create

Import a Certificate Associated with an Approved CSR


Imports a certificate authority (CA)-signed certificate for a CSR. This
action links the certificate to the private key created by the CSR. The
pem_encoded string in the request body is the signed certificate provided by
your CA in response to the CSR that you provide to them. The import POST
action automatically deletes the associated CSR.
POST /policy/api/v1/infra/csrs/{csr-id}?action=import

Upload the Certificate PEM File Signed by the CA Associated with a CSR


Uploads the certificate authority (CA)-signed certificate. After you send
the certificate request to the CA of your choice, and the CA sends back the
signed certificate, you can use the upload POST action to upload the signed
certificate. The upload action is similar to the import action, but the
upload action allows you to directly upload the PEM-encoded file (signed
certificate) provided by the CA. Like the import POST action, the upload
POST action automatically deletes the associated CSR.
POST /policy/api/v1/infra/csrs/{csr-id}?action=upload

Get CSR PEM File for the Given CSR ID


Downloads the CSR PEM file for a specified CSR. Clients must include an Accept: text/plain request header. 		GET /policy/api/v1/infra/csrs/{csr-id}/pem-file