Certificates

Activate a prepared Certificate Authority

This API activates a prepared Certificate Authority for the service, and it should be called when the current CA rotation phase of the service is in “prepared”. This activates a new CA by updating the prepared Service CA state to “active” and the old active Service CA state to “deactivated”. Then it mints new certificates with the newly activated CA, and propagates the new certs and trust bundle to all Aviatrix nodes. The rotation phase is changed from “prepared” to “activated”.

PATCH

/

v2.5

/

api

/

pkis

/

{service}

/

certificate-authorities

/

{uid}

cURL

curl -sk -X PATCH "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}" \
  -H "Authorization: cid <CID>"

import requests

url = "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}"
headers = {"Authorization": "cid <CID>"}

response = requests.patch(url, headers=headers)
print(response.text)

package main

import (
  "fmt"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("PATCH", "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}", nil)
  req.Header.Set("Authorization", "cid <CID>")

  client := &http.Client{}
  resp, err := client.Do(req)
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  fmt.Println(resp.Status)
}

{
  "failed_nodes": [
    "<string>"
  ],
  "rotation_phase": "done",
  "service_ca": {
    "certificate_authority_id": "<string>",
    "created_time": 123,
    "display_name": "<string>",
    "id": "<string>",
    "origin": "Unspecified",
    "service": "internal",
    "signing_certificate": "<string>",
    "state": "active"
  }
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

Headers

Authorization

string

default:cid <CID>

required

Controller ID in the format: cid .

Example:

"cid <CID>"

Path Parameters

service

enum<string>

required

The service to activate the prepared CA for.

Available options:

internal,

uservpn

uid

string

required

The ID of a ServiceCA from protostore service_certificate_authority to activate.

Body

application/json

state

enum<string>

required

Set the ServiceCA state to "active" (currently only "active" is supported).

Available options:

active

check_interval

integer

default:5

Wait time (secs) for checking the activation status

Required range: 2 <= x <= 10

timeout_in_secs

integer

default:300

Timeout (secs) for activation

Required range: 120 <= x <= 600

Response

Successfully activated Certificate Authority

failed_nodes

string[]

required

List of nodes that failed to be updated with the latest PKI data

rotation_phase

enum<string>

required

CA rotation phase of a service

Available options:

done,

prepared,

activated

service_ca

object

required

The Service CA that is newly activated for the service

Show child attributes

⌘I

cURL

curl -sk -X PATCH "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}" \
  -H "Authorization: cid <CID>"

import requests

url = "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}"
headers = {"Authorization": "cid <CID>"}

response = requests.patch(url, headers=headers)
print(response.text)

package main

import (
  "fmt"
  "net/http"
)

func main() {
  req, _ := http.NewRequest("PATCH", "https://<controller>/v2.5/api/pkis/{service}/certificate-authorities/{uid}", nil)
  req.Header.Set("Authorization", "cid <CID>")

  client := &http.Client{}
  resp, err := client.Do(req)
  if err != nil {
    panic(err)
  }
  defer resp.Body.Close()

  fmt.Println(resp.Status)
}

{
  "failed_nodes": [
    "<string>"
  ],
  "rotation_phase": "done",
  "service_ca": {
    "certificate_authority_id": "<string>",
    "created_time": 123,
    "display_name": "<string>",
    "id": "<string>",
    "origin": "Unspecified",
    "service": "internal",
    "signing_certificate": "<string>",
    "state": "active"
  }
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}