DTS root and intermediate CA certificates
Create DTS root CA certificate
Creates a DTS root CA certificate which is used to sign DTS intermediate and/or signer certificates.
- A maximum of three DTS root CA certificates can be created per tenant.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>application/json- body
commonName?stringIndicates the common name of the DTS root CA certificate. When specified, the value must be a valid PrintableString and cannot be an empty string. If not provided and a custom domain is configured and verified, the custom domain is used followed by the words DTS CA. If no custom domain is configured, the tenant subdomain is used instead.
country?stringIndicates the DTS provider's country. If not provided, a country is selected based on the region of the tenant subdomain cloud host. When specified, the value must be a valid Alpha 2 country code as per ISO 3166-1.
organisationName*stringIndicates the organization associated with the DTS root CA certificate.
notAfter?stringUsed to set the date and time when the DTS root CA certificate expires.
- If not provided, calculated as
notBefore+ 20 years. - If not provided and
notBeforeis not provided, calculated as time of creation + 20 years. - Maximum value is 20 years from creation.
- Must be after
notBefore, if provided.
date-timenotBefore?stringUsed to set the date and time when the DTS root CA certificate becomes valid and can be used to sign other intermediate certificates.
- Must not be in the past.
- Must be before
notAfter.
date-timeDTS root CA certificate created
application/json- response
id*stringUnique identifier for this DTS root CA certificate.
uuidactive*booleanIndicates whether the DTS root CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate (intermediate CA or signer) certificates: you can build a complete certificate chain while the root CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain. Only one DTS root CA certificate can be active at a time.
certificatePem*stringDTS root CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS root CA certificate content.
certificateData*isManaged*booleanIndicates whether the private key for this DTS root CA certificate is managed by MATTR (true) or out of band by the customer as an external certificate (false).
useIntermediateCa?booleanWhen true, this DTS root CA certificate uses the 3-tier certificate model, requiring and using DTS intermediate CA certificates as part of its chain of trust for signing operations. When false, the 2-tier model is used and the DTS root CA signs signer certificates directly. For an explanation of the 2-tier and 3-tier models, refer to the DTS certificates overview.
curl -X POST "https://example.com/v1/ecosystems/certificates/ca" \ -H "Content-Type: application/json" \ -d '{ "organisationName": "Example Inc." }'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "isManaged": true, "useIntermediateCa": true}Retrieve all DTS root CA certificates
Retrieves all DTS root CA certificates.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>limit?numberRange size of returned list.
1 <= value <= 1000100cursor?stringStarting point for the list of entries.
DTS root CA certificates retrieved
application/json- response
data?array<>nextCursor?nextCursorStarting point for next cursor to use in a paginated list.
curl -X GET "https://example.com/v1/ecosystems/certificates/ca"{ "data": [ { "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "isManaged": true, "useIntermediateCa": true } ], "nextCursor": "Y3JlYXRlZEF0PTIwMjAtMDgtMjVUMDY6NDY6MDkuNTEwWiZpZD1hNjZmZmVhNS04NDhlLTQzOWQtODBhNC1kZGE1NWY1M2UzNmM"}Retrieve all DTS root CA Certificates (public)
Retrieves all public DTS root CA certificates.
This endpoint is intended for public consumption, and as such does not require authentication.
Public DTS root CA certificates retrieved
application/json- response
rootCertificates?array<>curl -X GET "https://example.com/v1/ecosystems/public/certificates/ca"{ "rootCertificates": [ { "certificate": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "notBefore": "2023-10-22T00:00:00Z", "notAfter": "2024-10-22T00:00:00Z", "fingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "commonName": "MATTR DTS Root CA", "intermediateCertificates": [ { "certificate": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "notBefore": "2023-10-22T00:00:00Z", "notAfter": "2024-10-22T00:00:00Z", "fingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "commonName": "MATTR DTS Intermediate CA" } ] } ]}Retrieve a DTS root CA certificate
Retrieves a DTS root CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidDTS root CA certificate retrieved
application/json- response
id*stringUnique identifier for this DTS root CA certificate.
uuidactive*booleanIndicates whether the DTS root CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate (intermediate CA or signer) certificates: you can build a complete certificate chain while the root CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain. Only one DTS root CA certificate can be active at a time.
certificatePem*stringDTS root CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS root CA certificate content.
certificateData*isManaged*booleanIndicates whether the private key for this DTS root CA certificate is managed by MATTR (true) or out of band by the customer as an external certificate (false).
useIntermediateCa?booleanWhen true, this DTS root CA certificate uses the 3-tier certificate model, requiring and using DTS intermediate CA certificates as part of its chain of trust for signing operations. When false, the 2-tier model is used and the DTS root CA signs signer certificates directly. For an explanation of the 2-tier and 3-tier models, refer to the DTS certificates overview.
curl -X GET "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2"{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "isManaged": true, "useIntermediateCa": true}Update a DTS root CA certificate
Updates a DTS root CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidapplication/json- body
active*booleanIndicates whether the DTS root CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate (intermediate CA or signer) certificates: you can build a complete certificate chain while the root CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain. Only one DTS root CA certificate can be active at a time.
useIntermediateCa?booleanWhen true, this DTS root CA certificate uses the 3-tier certificate model, requiring and using DTS intermediate CA certificates as part of its chain of trust for signing operations. When false, the 2-tier model is used and the DTS root CA signs signer certificates directly. Changing this value requires deleting all subordinate certificates. This field can only be set for unmanaged (external) DTS root CA certificates. For an explanation of the 2-tier and 3-tier models, refer to the DTS certificates overview.
DTS root CA certificate updated
application/json- response
id*stringUnique identifier for this DTS root CA certificate.
uuidactive*booleanIndicates whether the DTS root CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate (intermediate CA or signer) certificates: you can build a complete certificate chain while the root CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain. Only one DTS root CA certificate can be active at a time.
certificatePem*stringDTS root CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS root CA certificate content.
certificateData*isManaged*booleanIndicates whether the private key for this DTS root CA certificate is managed by MATTR (true) or out of band by the customer as an external certificate (false).
useIntermediateCa?booleanWhen true, this DTS root CA certificate uses the 3-tier certificate model, requiring and using DTS intermediate CA certificates as part of its chain of trust for signing operations. When false, the 2-tier model is used and the DTS root CA signs signer certificates directly. For an explanation of the 2-tier and 3-tier models, refer to the DTS certificates overview.
curl -X PUT "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2" \ -H "Content-Type: application/json" \ -d '{ "active": true }'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "isManaged": true, "useIntermediateCa": true}Delete a DTS root CA certificate
Deletes a DTS root CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidDTS root CA certificate deleted
curl -X DELETE "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2"Retrieve a DTS root CA certificate Certificate Revocation List (CRL) (public)
Retrieves the revocation list for a given DTS root CA certificate.
This endpoint is intended for public consumption, and as such does not require authentication.
dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidDTS root CA certificate revocation list retrieved
response?stringapplication/jsonbytecurl -X GET "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/crl""string"Create a DTS intermediate CA certificate
Creates a DTS intermediate CA certificate, which sits between the DTS root CA certificate and the signer certificate to sign DTS signer certificates.
DTS intermediate CA certificates are only relevant when using the 3-tier certificate model, where a DTS root CA signs an intermediate CA, which in turn signs the signer certificate. They are only supported for unmanaged (external) DTS root CA certificates that have useIntermediateCa set to true. For an explanation of the 2-tier and 3-tier models and guidance on choosing between them, refer to the DTS certificates overview.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidapplication/json- body
certificatePem*stringDTS intermediate CA certificate encoded in PEM format
usages*array<>The intended usages for this intermediate CA. Must contain at least one value.
1 <= itemsDTS intermediate CA certificate created
application/json- response
id*stringUnique identifier for this DTS intermediate CA certificate.
uuidactive*booleanIndicates whether the DTS intermediate CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate signer certificates: you can build a complete certificate chain while the intermediate CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain.
certificatePem*stringDTS intermediate CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS intermediate CA certificate content.
certificateData*usages?array<>caCertificateId?stringUnique identifier of the DTS root CA certificate used to sign the intermediate certificate.
uuidcurl -X POST "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/intermediate" \ -H "Content-Type: application/json" \ -d '{ "certificatePem": "string", "usages": [ "VICAL" ] }'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "usages": [ "VICAL" ], "caCertificateId": "3c667fc8-c92c-4eee-a159-5221f574052e"}Retrieve all DTS intermediate CA certificates under a root CA
Retrieves all DTS intermediate CA certificates issued under the specified DTS root CA.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuidlimit?numberRange size of returned list.
1 <= value <= 1000100cursor?stringStarting point for the list of entries.
DTS intermediate CA certificates retrieved
application/json- response
data?array<>nextCursor?nextCursorStarting point for next cursor to use in a paginated list.
curl -X GET "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/intermediate"{ "data": [ { "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "usages": [ "VICAL" ], "caCertificateId": "3c667fc8-c92c-4eee-a159-5221f574052e" } ], "nextCursor": "Y3JlYXRlZEF0PTIwMjAtMDgtMjVUMDY6NDY6MDkuNTEwWiZpZD1hNjZmZmVhNS04NDhlLTQzOWQtODBhNC1kZGE1NWY1M2UzNmM"}Retrieve a DTS intermediate CA certificate
Retrieves a DTS intermediate CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuiddtsIntermediateCaCertificateId*stringUnique identifier of the DTS intermediate CA certificate.
uuidDTS intermediate CA certificate retrieved
application/json- response
id*stringUnique identifier for this DTS intermediate CA certificate.
uuidactive*booleanIndicates whether the DTS intermediate CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate signer certificates: you can build a complete certificate chain while the intermediate CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain.
certificatePem*stringDTS intermediate CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS intermediate CA certificate content.
certificateData*usages?array<>caCertificateId?stringUnique identifier of the DTS root CA certificate used to sign the intermediate certificate.
uuidcurl -X GET "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/intermediate/b0aae560-10e7-4247-8e96-7cdd3578a1e2"{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "usages": [ "VICAL" ], "caCertificateId": "3c667fc8-c92c-4eee-a159-5221f574052e"}Update a DTS intermediate CA certificate
Updates a DTS intermediate CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuiddtsIntermediateCaCertificateId*stringUnique identifier of the DTS intermediate CA certificate.
uuidapplication/json- body
active*booleanIndicates whether the DTS intermediate CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate signer certificates: you can build a complete certificate chain while the intermediate CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain.
usages?array<>DTS intermediate CA certificate updated
application/json- response
id*stringUnique identifier for this DTS intermediate CA certificate.
uuidactive*booleanIndicates whether the DTS intermediate CA certificate is active. Activating a certificate does not affect your ability to create or sign subordinate signer certificates: you can build a complete certificate chain while the intermediate CA is inactive. Instead, active certificates are included in the selection process MATTR VII uses when choosing the certificate chain to sign a trusted list (VICAL or RICAL), where MATTR VII prefers the most recently created active certificate at each level of the chain.
certificatePem*stringDTS intermediate CA certificate in PEM format.
certificateFingerprint*stringSHA-256 hash of DTS intermediate CA certificate content.
certificateData*usages?array<>caCertificateId?stringUnique identifier of the DTS root CA certificate used to sign the intermediate certificate.
uuidcurl -X PUT "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/intermediate/b0aae560-10e7-4247-8e96-7cdd3578a1e2" \ -H "Content-Type: application/json" \ -d '{ "active": true }'{ "id": "782f1885-c7c2-4459-8426-b6d7c111b0b1", "active": true, "certificatePem": "-----BEGIN CERTIFICATE-----\nMIIDXTCCAkWgAwIBAgIJAL5...\n-----END CERTIFICATE-----", "certificateFingerprint": "f6cad6e579d70b3973efa60624af731a580d1a11a7579e70f2f10f059dc86172", "certificateData": { "commonName": "example.com", "country": "US", "organisationName": "Example Inc.", "notAfter": "2024-10-22T00:00:00Z", "notBefore": "2023-10-22T00:00:00Z" }, "usages": [ "VICAL" ], "caCertificateId": "3c667fc8-c92c-4eee-a159-5221f574052e"}Delete a DTS intermediate CA certificate
Deletes a DTS intermediate CA certificate.
Roles
Analytics Events
bearerAuthAuthorizationBearer <token>dtsCaCertificateId*stringUnique identifier of the DTS root CA certificate.
uuiddtsIntermediateCaCertificateId*stringUnique identifier of the DTS intermediate CA certificate.
uuidDTS intermediate CA certificate deleted
curl -X DELETE "https://example.com/v1/ecosystems/certificates/ca/b0aae560-10e7-4247-8e96-7cdd3578a1e2/intermediate/b0aae560-10e7-4247-8e96-7cdd3578a1e2"How would you rate this page?
Last updated on