Certificate Management APIs
The endpoints in this section manage TLS certificates. If you want certificates to secure SSH keys, see the SshCertificates section
PKIX Parameter Set
As of TPP 25.1 algorithms are identified by an OID called PKIX Parameter Set. The following table lists the OID for each algorithm:
RSA Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| RSA 1024 | 1.3.6.1.4.1.28783.10.1.1.1024 | RSA 1024 bits offers moderate security but is now considered vulnerable and outdated for most modern applications. |
| RSA 2048 | 1.3.6.1.4.1.28783.10.1.1.2048 | RSA 2048 bits offers strong security and is widely used for modern encryption and digital signatures. |
| RSA 3072 | 1.3.6.1.4.1.28783.10.1.1.3072 | RSA 3072 bits provides a higher security level, suitable for long-term protection of sensitive data. |
| RSA 4096 | 1.3.6.1.4.1.28783.10.1.1.4096 | RSA 4096 bits offers very high security, commonly used for highly sensitive data and long-term encryption. |
| RSA 8192 | 1.3.6.1.4.1.28783.10.1.1.8192 | RSA 8192 bits provides extremely high security, used for the most sensitive data and long-term protection. |
| RSA PSS/OAEP 1024 | 1.3.6.1.4.1.28783.10.1.2.1024 | RSA 1024 bits PSS provides moderate security for digital signatures, with PSS offering improved resistance against certain attacks, though it's now considered vulnerable for most applications. |
| RSA PSS/OAEP 2048 | 1.3.6.1.4.1.28783.10.1.2.2048 | RSA 2048 bits PSS offers strong security with enhanced resistance to forgery and adaptive chosen-message attacks, making it widely used in modern systems. |
| RSA PSS/OAEP 3072 | 1.3.6.1.4.1.28783.10.1.2.3072 | RSA 3072 bits PSS provides enhanced security for long-term digital signature protection, with PSS improving resistance to certain signature-related attacks. |
| RSA PSS/OAEP 4096 | 1.3.6.1.4.1.28783.10.1.2.4096 | RSA 4096 bits PSS provides very high security for digital signatures, with PSS offering added protection against vulnerabilities in deterministic signature schemes. |
| RSA PSS/OAEP 8192 | 1.3.6.1.4.1.28783.10.1.2.8192 | RSA 8192 bits PSS offers extremely high security for critical digital signatures, with PSS further strengthening resistance to advanced cryptographic attacks and long-term protection. |
Elliptic Curve Digital Signature Algorithms (ECDSA)
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| ECDSA P-256 | 1.3.6.1.4.1.28783.10.2.1.256 | Digital signature algorithm based on the NIST P-256 curve, providing 128-bit security. |
| ECDSA P-384 | 1.3.6.1.4.1.28783.10.2.1.384 | Digital signature algorithm based on the NIST P-384 curve, providing 192-bit security. |
| ECDSA P-521 | 1.3.6.1.4.1.28783.10.2.1.521 | Digital signature algorithm based on the NIST P-521 curve, providing 256-bit security. |
| Brainpool P-256r1 | 1.3.6.1.4.1.28783.10.2.2.1 | Brainpool P256 is a 256-bit elliptic curve offering strong security for digital signatures and key exchange. |
| Brainpool P-384r1 | 1.3.6.1.4.1.28783.10.2.2.2 | Brainpool P384 is a 384-bit elliptic curve providing enhanced security for high-assurance applications. |
| Brainpool P-512r1 | 1.3.6.1.4.1.28783.10.2.2.3 | Brainpool P512 is a 512-bit elliptic curve offering very high security for sensitive data and long-term protection. |
| Brainpool P-160r1 | 1.3.6.1.4.1.28783.10.2.2.4 | Brainpool P160 is a 160-bit curve, offering moderate security for lightweight cryptographic applications. |
| Brainpool P-160t1 | 1.3.6.1.4.1.28783.10.2.2.5 | Brainpool P160T is a 160-bit twisted curve, offering efficient performance and moderate security for lightweight applications. |
| Brainpool P-192r1 | 1.3.6.1.4.1.28783.10.2.2.6 | Brainpool P192 is a 192-bit curve providing a balanced security level for general-purpose cryptography. |
| Brainpool P-192t1 | 1.3.6.1.4.1.28783.10.2.2.7 | Brainpool P192T is a 192-bit twisted curve, optimized for faster cryptographic operations with improved security. |
| Brainpool P-224r1 | 1.3.6.1.4.1.28783.10.2.2.8 | Brainpool P224 is a 224-bit curve offering strong security for medium-strength cryptographic applications. |
| Brainpool P-224t1 | 1.3.6.1.4.1.28783.10.2.2.9 | Brainpool P224T is a 224-bit twisted Edwards curve, optimized for efficient cryptographic operations with strong security. |
| Brainpool P-256t1 | 1.3.6.1.4.1.28783.10.2.2.10 | Brainpool P256T is a 256-bit twisted curve, optimized for faster operations and improved security in digital signatures and key exchange. |
| Brainpool P-320r1 | 1.3.6.1.4.1.28783.10.2.2.11 | Brainpool P320 is a 320-bit curve providing strong security for cryptographic operations, suitable for high-security applications. |
| Brainpool P-320t1 | 1.3.6.1.4.1.28783.10.2.2.12 | Brainpool P320T is a 320-bit twisted curve, balancing strong security and efficient performance for cryptographic tasks. |
| Brainpool P-384t1 | 1.3.6.1.4.1.28783.10.2.2.13 | Brainpool P384T is a 384-bit twisted curve providing strong security for digital signatures and key exchange, optimized for performance and efficiency. |
| Brainpool P-512t1 | 1.3.6.1.4.1.28783.10.2.2.14 | Brainpool P512T is a 512-bit twisted curve, providing very high security and optimized for efficient cryptographic processing. |
| SEC P-256k1 | 1.3.6.1.4.1.28783.10.2.3.1 | Sec P256K is a 256-bit curve widely used in Bitcoin and blockchain technologies, optimized for fast elliptic curve operations. |
| SEC P-224r1 | 1.3.6.1.4.1.28783.10.2.3.2 | Sec P224 is a 224-bit curve offering strong security for general-purpose cryptography, commonly used in digital signatures. |
| SEC P-224k1 | 1.3.6.1.4.1.28783.10.2.3.3 | Sec P224K is a 224-bit curve used in cryptographic applications with an emphasis on fast and efficient operations. |
| SEC P-192r1 | 1.3.6.1.4.1.28783.10.2.3.4 | Sec P192 is a 192-bit curve providing moderate security for lightweight cryptographic applications. |
| SEC P-192k1 | 1.3.6.1.4.1.28783.10.2.3.5 | Sec P192K is a 192-bit curve widely used in blockchain and cryptographic systems, optimized for efficient operations. |
Edwards Curve Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| Ed25519 | 1.3.6.1.4.1.28783.10.3.25519 | Ed25519 is a high-security elliptic curve signature algorithm, designed for fast performance and resistance to side-channel attacks. |
| Ed448 | 1.3.6.1.4.1.28783.10.3.44448 | Ed448 is a highly secure elliptic curve signature algorithm, offering stronger security than ED25519, with a larger key size. |
ML-DSA Quantum-Safe Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| ML-DSA44 | 1.3.6.1.4.1.28783.10.4.44 | ML-DSA44 offers 128-bit quantum security, designed for lightweight applications that require post-quantum resilience with moderate security. |
| ML-DSA65 | 1.3.6.1.4.1.28783.10.4.65 | ML-DSA65 provides 192-bit quantum security, offering stronger protection against quantum adversaries while maintaining efficiency for broader use cases. |
| ML-DSA87 | 1.3.6.1.4.1.28783.10.4.87 | ML-DSA87 delivers 256-bit quantum security, designed for high-assurance applications needing robust resistance to future quantum computing threats. |
SLH-DSA Quantum-Safe Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| SLH-DSA-SHA2-128s | 1.3.6.1.4.1.28783.10.5.1.1 | SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. |
| SLH-DSA-SHA2-128f | 1.3.6.1.4.1.28783.10.5.1.2 | SLH-DSA SHAKE 128bit Fast: Delivers 128-bit security with SHAKE, optimized for fast performance. |
| SLH-DSA-SHA2-192s | 1.3.6.1.4.1.28783.10.5.1.3 | SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. |
| SLH-DSA-SHA2-192f | 1.3.6.1.4.1.28783.10.5.1.4 | SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. |
| SLH-DSA-SHA2-256s | 1.3.6.1.4.1.28783.10.5.1.5 | SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. |
| SLH-DSA-SHA2-256f | 1.3.6.1.4.1.28783.10.5.1.6 | SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. |
| SLH-DSA-Shake-128s | 1.3.6.1.4.1.28783.10.5.1.7 | SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. |
| SLH-DSA-Shake-128f | 1.3.6.1.4.1.28783.10.5.1.8 | SLH-DSA SHAKE 128bit Fast: Ensures 128-bit security with SHAKE, optimized for fast performance. |
| SLH-DSA-Shake-192s | 1.3.6.1.4.1.28783.10.5.1.9 | SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. |
| SLH-DSA-Shake-192f | 1.3.6.1.4.1.28783.10.5.1.10 | SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. |
| SLH-DSA-Shake-256s | 1.3.6.1.4.1.28783.10.5.1.11 | SLH-DSA SHAKE 256bit Small: Offers 256-bit security with SHAKE, suitable for small footprint applications. |
| SLH-DSA-Shake-256f | 1.3.6.1.4.1.28783.10.5.1.12 | SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. |
Pre-Hash SLH-DSA Quantum-Safe Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| HASH-SLH-DSA-SHA2-128s-SHA256 | 1.3.6.1.4.1.28783.10.5.2.1 | Pre-Hash SLH-DSA SHA2 128bit Small: Offers 128-bit security with SHA-2, optimized for small footprint applications. |
| HASH-SLH-DSA-SHA2-128f-SHA256 | 1.3.6.1.4.1.28783.10.5.2.2 | Pre-Hash SLH-DSA SHA2 128bit Fast: Delivers 128-bit security with SHA-2, optimized for fast performance. |
| HASH-SLH-DSA-SHA2-192s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.3 | Pre-Hash SLH-DSA SHA2 192bit Small: Offers 192-bit security with SHA-2, suitable for small footprint applications. |
| HASH-SLH-DSA-SHA2-192f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.4 | Pre-Hash SLH-DSA SHA2 192bit Fast: Ensures 192-bit security with SHA-2, optimized for fast performance. |
| HASH-SLH-DSA-SHA2-256s-SHA512 | 1.3.6.1.4.1.28783.10.5.2.5 | Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. |
| HASH-SLH-DSA-SHA2-256f-SHA512 | 1.3.6.1.4.1.28783.10.5.2.6 | Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. |
| HASH-SLH-DSA-Shake-128s-Shake128 | 1.3.6.1.4.1.28783.10.5.2.7 | Pre-Hash SLH-DSA SHAKE 128bit Small: Provides 128-bit security with SHAKE, designed for small footprint applications. |
| HASH-SLH-DSA-Shake-128f-Shake128 | 1.3.6.1.4.1.28783.10.5.2.8 | Pre-Hash SLH-DSA SHA2 128bit Fast: Ensures 128-bit security with SHA-2, optimized for fast performance. |
| HASH-SLH-DSA-Shake-192s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.9 | Pre-Hash SLH-DSA SHAKE 192bit Small: Provides 192-bit security with SHAKE, designed for small footprint applications. |
| HASH-SLH-DSA-Shake-192f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.10 | Pre-Hash SLH-DSA SHAKE 192bit Fast: Delivers 192-bit security with SHAKE, optimized for fast performance. |
| HASH-SLH-DSA-Shake-256s-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.11 | Pre-Hash SLH-DSA SHA2 256bit Small: Offers 256-bit security with SHA-2, suitable for small footprint applications. |
| HASH-SLH-DSA-Shake-256f-SHAke256 | 1.3.6.1.4.1.28783.10.5.2.12 | Pre-Hash SLH-DSA SHA2 256bit Fast: Offers 256-bit security with SHAKE, optimized for fast performance. |
Composite Quantum-Safe Algorithms
| Algorithm | PKIX Parameter Set | Description |
|---|---|---|
| Composite ML-DSA44 / PSS2048 | 1.3.6.1.4.1.28783.10.7.1 | ML-DSA44 / RSA 2048 PSS combines 128-bit quantum security of ML-DSA44 with RSA2048PSS, suitable for moderate security applications requiring post-quantum and classical resilience. |
| Composite ML-DSA44 / RSA2048 | 1.3.6.1.4.1.28783.10.7.2 | ML-DSA44 / RSA 2048 combines 128-bit quantum security of ML-DSA44 with RSA 2048, suitable for moderate security applications requiring post-quantum and classical resilience. |
| Composite ML-DSA44 / Ed25519 | 1.3.6.1.4.1.28783.10.7.3 | ML-DSA44 / Ed25519 offers 128-bit quantum security of ML-DSA44 with Ed25519, optimized for fast and secure digital signatures. |
| Composite ML-DSA44 / ECP256 | 1.3.6.1.4.1.28783.10.7.4 | ML-DSA44 / ECP256 provides 128-bit quantum security of ML-DSA44 with ECDSA P-256, ideal for secure communications and data integrity. |
| Composite ML-DSA65 / PSS3072 | 1.3.6.1.4.1.28783.10.7.5 | ML-DSA65 / RSA 3072 PSS combines 192-bit quantum security of ML-DSA65 with RSA 3072 PSS, suitable for long-term protection and moderate security applications. |
| Composite ML-DSA65 / RSA3072 | 1.3.6.1.4.1.28783.10.7.6 | ML-DSA65 / RSA 3072 offers 192-bit quantum security of ML-DSA65 with RSA 3072, ideal for secure communications and data integrity. |
| Composite ML-DSA65 / PSS4096 | 1.3.6.1.4.1.28783.10.7.7 | ML-DSA65 / RSA 4096 PSS provides 192-bit quantum security of ML-DSA65 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. |
| Composite ML-DSA65 / RSA4096 | 1.3.6.1.4.1.28783.10.7.8 | ML-DSA65 / RSA 4096 combines 192-bit quantum security of ML-DSA65 with RSA 4096, ideal for high-security applications needing long-term protection. |
| Composite ML-DSA65 / ECP256 | 1.3.6.1.4.1.28783.10.7.9 | ML-DSA65 / ECP256 offers 192-bit quantum security of ML-DSA65 with ECDSA P-256, designed for secure communications and data integrity. |
| Composite ML-DSA65 / ECP384 | 1.3.6.1.4.1.28783.10.7.10 | ML-DSA65 / ECP384 offers 192-bit quantum security of ML-DSA65 with ECDSA P-384, ideal for high-security applications needing long-term protection. |
| Composite ML-DSA65 / Brainpool P-256 | 1.3.6.1.4.1.28783.10.7.11 | ML-DSA65 / Brainpool P-256 provides 192-bit quantum security of ML-DSA65 with Brainpool P-256, designed for secure communications and data integrity. |
| Composite ML-DSA65 / Ed25519 | 1.3.6.1.4.1.28783.10.7.12 | ML-DSA65 / Ed25519 combines 192-bit quantum security of ML-DSA65 with Ed25519, optimized for fast and secure digital signatures. |
| Composite ML-DSA87 / ECP384 | 1.3.6.1.4.1.28783.10.7.13 | ML-DSA87 / ECP384 ensures 256-bit quantum security of ML-DSA87 with ECDSA P-384, suitable for highly sensitive data and long-term protection. |
| Composite ML-DSA87 / Brainpool P-384 | 1.3.6.1.4.1.28783.10.7.14 | ML-DSA87 / Brainpool P-384 offers 256-bit quantum security of ML-DSA87 with Brainpool P-384, ideal for secure financial transactions and data integrity. |
| Composite ML-DSA87 / Ed448 | 1.3.6.1.4.1.28783.10.7.15 | ML-DSA87 / Ed448 combines 256-bit quantum security of ML-DSA87 with Ed448, designed for high-security digital signatures and fast performance. |
| Composite ML-DSA87 / PSS4096 | 1.3.6.1.4.1.28783.10.7.16 | ML-DSA87 / RSA 4096 PSS provides 256-bit quantum security of ML-DSA87 with RSA 4096 PSS, suitable for highly sensitive data and long-term protection. |
📄️ Retrieve a certificate by vault ID
Returns the available certificate data and optional private key information for an enrolled or archived certificate by its Vault Id.
📄️ Retrieve a certificate by vault ID (GET)
Returns the available certificate data and optional private key information for an enrolled or archived certificate by its Vault Id.
📄️ Get archived certificates
Retrieves the archived versions of a certificate identified by its GUID.
📄️ Validate a deployed certificate
Initiates SSL/TLS network validation for one or more certificates and any associated applications.
📄️ Set or update certificate attributes
Sets or updates the attributes of a certificate identified by its GUID.
📄️ Get certificate details
Retrieves details and validation information about the certificate.
📄️ Delete a certificate
Deletes a certificate object, all the associated objects including pending workflow tickets, and the corresponding vault information.
📄️ Check policy compliance
Performs a policy compliance assessment of a Certificate Signing Request (CSR) against a policy Distinguished Name (DN)
📄️ Enroll or provision a certificate
Enrolls or provisions a new certificate.
📄️ Retrieve an issued certificate
Returns the available certificate data and optional private key information for an enrolled
📄️ Retrieve an issued certificate (GET)
Returns the available certificate data and optional private key information for an enrolled certificate.
📄️ Renew a certificate
Requests immediate renewal for an existing certificate. A renewable certificate cannot be currently processing, in error,
📄️ Revoke a certificate
Revokes an existing certificate. The request can be made using either the certificate's Distinguished Name (DN) or its Thumbprint.
📄️ Search certificates
Returns certificate details and the total number of certificates that match the specified search filters.
📄️ Get certificates count
Searches and returns the number of certificates that match the specified search filters.
📄️ Associate an application
Allows one or more application objects to use an existing certificate
📄️ Dissociate an application
Detaches one or more application objects and corresponding device objects from an existing certificate.
📄️ Initiate provisioning
Initiates the certificate provisioning to some or all certificate consumers.
📄️ Import a certificate
Imports a certificate and performs reconciliation
📄️ Reset processing state
Resets the processing state of a certificate object and any associated applications.
📄️ Retry processing
Retries processing a certificate from its last unsuccessful lifecycle stage.
📄️ Retrieve certificate validation results
Retrieves a list of validation results for the certificate.