5.4 Renew Certificate

Perform the following command to renew certificate:

POST /oclm-config/v1/certs/{name}/renew

Renews an existing certificate through CMP Key Update Request. This operation is synchronous and returns the renewed certificate and new private key in the response.

For renew, path {name} must match the request body name. The oldCertificate value must contain the PEM certificate body, not a filesystem path.

Sample request payload:

{
  "name": "server",
  "oldCertificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n",
  "renewBefore": "15d",
  "privateKey": {
    "keyAlgo": "RSA",
    "keySize": "KEYSIZE_2048",
    "keyEncoding": "PEM"
  },
  "csr": {
    "subject": {
      "country": "US",
      "state": "CA",
      "location": "Redwood Shores",
      "organization": "Oracle",
      "organizationUnit": "OCLM",
      "commonName": "server.example.com"
    },
    "subjectAltName": {
      "critical": false,
      "dns": ["server.example.com"],
      "ipAddress": ["10.0.0.10"]
    },
    "keyUsage": {
      "critical": false,
      "keyUsageValues": ["DIGITAL_SIGNATURE"]
    },
    "extendedKeyUsage": {
      "critical": false,
      "extendedKeyUsageValues": ["CLIENT_AUTH", "SERVER_AUTH"]
    },
    "basicConstraints": {
      "critical": false,
      "basicConstraintsValue": "END_ENTITY"
    },
    "days": "390"
  }
}

Successful response:

200 OK

{
  "cert": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\n",
  "key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
}