5.1 Common Request Model
Certificate create and renew requests use the same certificate payload shape for the requested certificate details. Renew also requires oldCertificate, which identifies the existing certificate being renewed.
Table 5-1 Certificate Request Payload Fields
| Field | Create | Renew | Description |
|---|---|---|---|
| name | Required | Required | Certificate name used by OCLM and by the retrieve API. |
| uuid | Optional | Not applicable (the renew endpoint uses {name}, not uuid). | Optional client-supplied identifier for create requests. When supplied, use this value with the retrieve API. |
| renewBefore | Optional | Optional | Renewal threshold value such as 15d. If omitted, the default value is used. |
| oldCertificate | Not used | Required | Full PEM certificate body of the existing certificate being renewed. Do not provide a filesystem path. |
| privateKey | Required | Required | New private key generation settings. OCLM generates the private key; clients do not submit the private key in the request. |
| csr | Required | Required | Requested certificate subject, subject alternative names, validity, key usage, extended key usage, and basic constraints. |
Table 5-2 Supported values
| Field | Supported Values |
|---|---|
| privateKey.keyAlgo | RSA |
| privateKey.keySize | KEYSIZE_2048, KEYSIZE_4096 |
| privateKey.keyEncoding | PEM only. DER requests are rejected with INVALID_INPUT. |
| csr.keyUsage.keyUsageValues | DIGITAL_SIGNATURE, KEY_ENCIPHERMENT, NON_REPUDIATION |
| csr.extendedKeyUsage.extendedKeyUsageValues | CLIENT_AUTH, SERVER_AUTH |
| csr.basicConstraints.basicConstraintsValue | END_ENTITY |