API standards and multilingual preset SDKs
The OpenAPI of this product (cas/2020-06-30) uses the RPC signature style. We have encapsulated SDKs for common programming languages for developers. Developers can download the SDK to directly call this product's OpenAPI without worrying about technical details. If the existing SDK does not meet your needs, you can use the signature mechanism for self-signing integration. Since the details of self-signing are very complex, it may take around 5 business days. Therefore, we recommend joining our DingTalk service group (147535001692) and conducting signature integration under expert guidance.
Before using the API, you need to prepare your identity account and access key (AccessKey) to effectively access the API through client tools (such as SDK and CLI). For details, see Obtain an AccessKey.
Custom signature scenarios
If your business scenario has special requirements and you need to integrate the API through self-signing, we recommend consulting our technical support team first (DingTalk service group: 147535001692) to obtain professional guidance and ensure efficient integration.
Account and security preparation
Alibaba Cloud accounts have full administrative permissions over all resources. Once an AccessKey is compromised, all associated resources will be at risk of unauthorized access. To ensure security, it is recommended to create a RAM user with only API access permissions and configure its AccessKey, while configuring RAM policies based on the principle of least privilege (PoLP). Use the Alibaba Cloud account only in specific scenarios where Alibaba Cloud account permissions are explicitly required.
Private CA certificates
|
API |
Title |
Description |
| CreateRootCACertificate | CreateRootCACertificate | Creates a root certificate authority (CA) certificate. |
| CreateSubCACertificate | CreateSubCACertificate | Creates a subordinate certificate authority (CA) certificate under an existing root CA. |
| CreateExternalCACertificate | CreateExternalCACertificate | Create and issue an external subordinate CA certificate using a CSR and API parameters. |
| GetCAInstanceStatus | GetCAInstanceStatus | Queries the status of a private certificate authority (CA) instance, including the remaining certificate quota. |
| DescribeCACertificateCount | DescribeCACertificateCount | Queries the number of certificate authority (CA) certificates that you created. |
| DescribeCACertificateList | DescribeCACertificateList | Queries all root and subordinate certificate authority (CA) certificates. |
| DescribeCACertificate | DescribeCACertificate | Retrieves information about a certificate authority (CA) certificate. |
| UpdateCACertificateStatus | UpdateCACertificateStatus | Changes the status of a root or subordinate certificate authority (CA) certificate, such as revoking or disabling an active CA. |
Client and server certificates
|
API |
Title |
Description |
| CreateCustomCertificate | CreateCustomCertificate | Issues a custom digital certificate with specified subject, subject alternative names (SANs), key usage, and extended key usage attributes. |
| CreateClientCertificateWithCsr | CreateClientCertificateWithCsr | Issues a client certificate by using a custom certificate signing request (CSR). |
| CreateServerCertificate | CreateServerCertificate | Issues a server certificate by using a system-generated certificate signing request (CSR). |
| CreateServerCertificateWithCsr | CreateServerCertificateWithCsr | Issues a server certificate by using a custom certificate signing request (CSR). |
| CreateRevokeClientCertificate | CreateRevokeClientCertificate | Revokes a client certificate or a server certificate issued by a private certificate authority (CA). |
| DescribeCertificatePrivateKey | DescribeCertificatePrivateKey | Queries the encrypted private key of a client certificate or server certificate. |
| DescribeClientCertificate | DescribeClientCertificate | Retrieves a client certificate or server certificate by its unique identifier. |
| DescribeClientCertificateStatus | DescribeClientCertificateStatus | Queries the status of a client certificate or server certificate by its unique identifier. |
| ListClientCertificate | ListClientCertificate | Lists all client certificates and server certificates issued by a private certificate authority (CA). |
| ListRevokeCertificate | ListRevokeCertificate | Queries all revoked client certificates and server certificates. |
Others
|
API |
Title |
Description |
| ListPcaCaCertificate | ListPcaCaCertificate | Lists private certificate authority (CA) certificates. |
| UploadPcaCertToCas | UploadPcaCertToCas | Uploads a private CA certificate to Certificate Management Service for centralized management. |
| AssignCertificateCount | AssignCertificateCount | Assigns the certificate quota to a subordinate certificate authority (CA) instance. |
| CreateClientCertificate | CreateClientCertificate | Issues a client certificate by using a system-generated certificate signing request (CSR). You must create a root CA certificate and a subordinate CA certificate before calling this operation. |
| DeleteClientCertificate | DeleteClientCertificate | Deletes a revoked client certificate or server certificate. Only revoked certificates can be deleted. |
| DescribeClientCertificateForSerialNumber | DescribeClientCertificateForSerialNumber | Retrieves the details of multiple client or server certificates by serial number. |
| DescribeClientCertificateStatusForSerialNumber | DescribeClientCertificateStatusForSerialNumber | Queries the status of client and server-side certificates using their serial numbers. |
| DescribePcaAndExternalCACertificateList | DescribePcaAndExternalCACertificateList | Returns all your certification authority (CA) certificates. These include certificates generated by Private CA and imported external certificates. |
| GetCaInstanceCrlAddress | Obtain the revocation list of a CA | Obtain the CRL URL of a CA |
| ListAllEndEntityInstance | ListAllEndEntityInstance | Queries the end-entity instances under a private certificate authority (CA). |
| ListCACertificateLog | ListCACertificateLog | Queries the operation logs of a certificate authority (CA) certificate, such as issuance and revocation events. |
| ListCert | ListCert | Retrieves a list of certificates. |
| ListTagResources | ListTagResources | Queries the tags that are attached to Certificate Management Service resources. |
| MoveResourceGroup | MoveResourceGroup | Moves a Certificate Management Service resource to a different resource group. |
| TagResources | TagResources | Attaches tags to one or more Certificate Management Service resources. |
| UntagResources | UntagResources | Removes tags from one or more Certificate Management Service resources. |
| UpdatePcaCertificate | UpdatePcaCertificate | Updates the properties of a private CA certificate, such as the export status. |