Retire CA certificate

POST

/api/v1/ca-certificates/{id}/retire

const url = 'http://localhost:3000/api/v1/ca-certificates/550e8400-e29b-41d4-a716-446655440000/retire';
const options = {method: 'POST', headers: {'x-user-id': 'example', 'X-API-Key': '<X-API-Key>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url http://localhost:3000/api/v1/ca-certificates/550e8400-e29b-41d4-a716-446655440000/retire \
  --header 'X-API-Key: <X-API-Key>' \
  --header 'x-user-id: example'

Retire a CA certificate. Retired certificates are kept for audit but cannot be used for signing.

Authorizations

api-key
bearer

Parameters

Path Parameters

required

string format: uuid

Example

550e8400-e29b-41d4-a716-446655440000

CA Certificate UUID

Header Parameters

x-user-id

required

string

Responses

200

CA certificate retired successfully

application/json

object

required

Unique CA certificate identifier (UUID)

string format: uuid

name

required

Human-readable name for the CA certificate

string

fingerprint

required

SHA-256 fingerprint of the certificate

string

isRoot

required

Whether this is a root CA certificate

boolean

isDefault

required

Whether this is the default signing CA

boolean

notBefore

required

Certificate validity start date

string format: date-time

notAfter

required

Certificate validity end date (expiration)

string format: date-time

retiredAt

Date when the CA certificate was retired

string format: date-time

createdAt

required

Timestamp when the CA certificate was created

string format: date-time

subject

Full subject distinguished name

string

issuer

Full issuer distinguished name

string

serialNumber

Certificate serial number (hex)

string

keyAlgorithm

Public key algorithm and size

string

signatureAlgorithm

Signature algorithm

string

subjectAltNames

Subject Alternative Names

Array<string>

certificate

PEM-encoded public certificate (safe to share)

string

Example

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Production Root CA",
  "fingerprint": "A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2:C3:D4:E5:F6:A1:B2",
  "isRoot": true,
  "isDefault": true,
  "notBefore": "2024-01-01T00:00:00Z",
  "notAfter": "2034-01-01T00:00:00Z",
  "retiredAt": "2024-06-01T00:00:00Z",
  "createdAt": "2024-01-01T00:00:00Z",
  "subject": "CN=Root CA, O=logiccloud, C=US",
  "issuer": "CN=Root CA, O=logiccloud, C=US",
  "serialNumber": "01:AB:CD:EF",
  "keyAlgorithm": "RSA-4096",
  "signatureAlgorithm": "SHA256withRSA",
  "subjectAltNames": [
    "DNS:example.com",
    "IP:192.168.1.1"
  ],
  "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----"
}

400

Bad Request - CA certificate is already retired

401

Unauthorized - Invalid or missing authentication

403

Forbidden - Insufficient permissions (admin only)

404

CA certificate not found