The storeDigitalCertificate operation stores a digital certificate within the TR31 database.
This webservice in the TR31 module stores either:
- A KEK Transport Authentication digital certificate issued by Apple after submitting a Transport Authentication certificate signing request (CSR). This certificate is used for signing the KEK package and submitting to Apple.
- A KEK Transport digital certificate. This certificate is used to encrypt the KEK for submission to Apple; this ensures that only Apple – which possesses the private key to its certificate, can decrypt and store it within their infrastructure
The storeDigitalCertificate web service requires twelve (12) parameters:
|
did |
The unique encryption domain identifier. |
|
svccred |
The username (service credential) within the encryption domain with the authorization to call this web service. The credential requires the KMO and KMA privileges. |
|
password |
The password of the username to authenticate the credential of the requester. |
|
environment |
The environment in which this certificate will be used. Accepted values: |
|
kpid |
The keypair ID of the signing keypair for this certificate (if any). KPID is not need for transport certificates since there is no local keypair for it; this value may be null in this scenario. |
|
kpsid |
The SID of the server where the signing keypair was generated if one is associated with this certificate. Transport certificates will NOT have associated signing keypairs; this value may be null in this scenario. |
|
certType |
The type of certificate to be generated by this module. Accepted values: |
|
keyuseType |
The usage of the new keypair. Accepted values: |
|
subjectDn |
The full distinguished name (DN) of the end-entity (EE) certificate – the string must be enclosed in double-quotes and in reverse order without any spaces between DN components. Normally, the CSR (when viewed using OpenSSL and most tools) displays the Subject DN as follows: “CN=XYZ KEK Authentication PIN Signing Key, OU=For TEST Use Only, O=XYZ” However, the TR31 module requires DN to be specified in reverse order (RFC 2253) for the certificate to be accepted – and even displays the certificate in log files similarly (as the sample output shows): "O=XYZ,OU=For TEST Use Only,CN=XYZ KEK Authentication PIN Signing Key" |
| certChain | PEM-encoded certificate chain. |
| status |
Status of the certificate record. Accepted values: |
| notes | [Optional] notes that you can provide to store information about the certificate being stored. |