Vcenter CertificateManagement Vcenter SigningCertificate CreateSpec

Vcenter CertificateManagement Vcenter SigningCertificate CreateSpec
Vcenter CertificateManagement Vcenter SigningCertificate CreateSpec

The Vcenter CertificateManagement Vcenter SigningCertificate CreateSpec schema contains the subject and key parameters for generating a certificate signing request for the STS signing certificate. A private key is created and stored in the appliance; only the CSR is returned to the client.

Product requirements for STS token-signing key material, certificate name constraints, and CSR extensions are defined by the SSO/identity program. Confirm field usage and any required defaults with the SSO team for production configuration.

This schema was added in vSphere API 9.1.1.0.

JSON Example 
{
    "common_name": "string",
    "organization": "string",
    "organization_unit": "string",
    "locality": "string",
    "state_or_province": "string",
    "country": "string",
    "email_address": "string",
    "subject_alt_name": [
        "string"
    ],
    "key_size": 0
}
string
common_name
Optional

Common name field in certificate subject.

This property was added in vSphere API 9.1.1.0.

If missing or null, the common name will be the PNID.

string
organization
Optional

Organization field in certificate subject.

This property was added in vSphere API 9.1.1.0.

If missing or null, the implementation supplies an appliance-appropriate default when building the CSR.

string
organization_unit
Optional

Organization unit field in certificate subject.

CA Browser forum announced that "CAs MUST NOT include the organizationalUnitName field". Omission is preferred; some CAs reject a non-empty OU in the CSR.

This property was added in vSphere API 9.1.1.0.

If missing or null, the OU is omitted from the subject.

string
locality
Optional

Locality field in certificate subject.

This property was added in vSphere API 9.1.1.0.

If missing or null, the locality is omitted.

string
state_or_province
Optional

State or province in certificate subject.

This property was added in vSphere API 9.1.1.0.

If missing or null, the state is omitted.

string
country
Optional

Country in certificate subject.

This property was added in vSphere API 9.1.1.0.

If missing or null, the country is omitted.

string
email_address
Optional

Email address in certificate subject or extensions.

Omission is preferred; many modern certificate profiles and CAs discourage or reject email addresses in the subject DN.

This property was added in vSphere API 9.1.1.0.

If missing or null, the email address is omitted.

array of string
subject_alt_name
Optional

Subject alternative names to include in the CSR.

STS signing certificates are not TLS server certificates; the CSR does not add implicit PNID-based SAN entries. If this field is missing or null, the CSR has no subject alternative names (subject distinguished name only). If set, only the provided entries are included in the CSR.

This property was added in vSphere API 9.1.1.0.

If missing or null, no subject alternative names are included in the CSR.

integer As int64 As int64
key_size
Optional

The size of the key to be used for public and private key generation.

The key algorithm may evolve over time; this field is provided for cases where a specific size is required. Leaving it missing or null is recommended for most deployments.

This property was added in vSphere API 9.1.1.0.

If missing or null, the server will use a secure default.

Parameter To