Renewing a certificate

firstName

Text

Y

240

Subscriber first name.

lastName

Text

Y

240

Subscriber last name.

email

Text

Y

240

Subscriber email address. For multiple email addresses, use a comma-separated list.

csr

Base64-encoded CSR

Y

The Base64-encoded PKCS#10 certificate request for the Enrollment transaction. The headers ("-----BEGIN..." and "-----END...") are optional.

To generate a CSR, use your server software. When you generate the CSR, you must supply a fully qualified domain name (FQDN) for the common name.

certProductType

Certificate type parameter

Y

Certificate product type. Allowed values:

• HAServer - Standard Extended Validation SSL

• HAGlobalServer - Premium Extended Validation SSL

• Server - Standard SSL

• GlobalServer - Premium SSL

• IntranetServer - Standard Intranet SSL

• IntranetGlobalServer - Premium Intranet SSL

• PrivateServer - Private SSL

• GeotrustServer - Rapid SSL Enterprise

• PrivateServer - Private SSL

• CodeSigning - Code Signing for Authenticode

• JavaCodeSigning - Code Signing for Java

• EVCodeSigning - Extended Validation (EV) Code Signing for Microsoft

serverType

Server type parameter

Y

Server software type. See serverType for more information.

This parameter is ignored for code signing certificates.

validityPeriod

1Y, 2Y, or 3Y

Y

2

Validity period. 3Y (3 years) valid only for Private SSL and code signing certificates.

specificEndDate

MM/DD/YYYY

N

10

The end date for the certificate. For all public SSL/TLS certificates, the end date must be 2 years or less from the start date. For Private SSL and code signing certificates, the end date must be 3 years or less from the start date.

For this parameter to take effect, you must enable an option the Control Center. Go to the Configuration tab, Enrollment page, Select Certificate Lifecycle Options section, and select Applicants can request a specific end date within the validity period.

original_certificate

Valid base-64 encoded certificate

• Y, if original_transaction_id is not present

• N, if original_transaction_id is present

The certificate to renew.

original_transaction_id

Text

• Y, if original_certificate is not present

• N, if original_certificate is present

32

The transaction ID of the certificate to renew.

original_challenge

Text

Y

32

The current challenge phrase for the certificate to renew.

challenge

Text

Y

32

The new challenge phrase for the requested certificate

subject_alt_names

Text

N

A comma-separated list of domain names. Enter up to 100 SANs. Example:

mail.example.com, blog.example.com, ftp.example.com

signatureAlgorithm

Text

N

32

The certificate's signature algorithm. Enter one of the following values:

• sha1WithRSAEncryption

• sha256WithRSAEncryption(default)

• sha256WithRSAEncryptionFull

• ECDSAwithSHA256

• ECDSAwithSHA256andRSAroot

ctLogOption

Text

N

Optional and case sensitive. Sets the Certificate Transparency logging level for the certificate. Defaults to public (full Certificate Transparency logging). public is the best choice for public websites.

Valid values:

• public - Log domain names for best security. Provides the best browsing experience and helps you monitor certificates issued for your domains.

• nolog - Don't log domain names. Intended for private domains to keep internal names hidden from public. However, Google Chrome disables the green address bar (EV only) and shows warnings when anyone connects to your site.

For certificates with private subdomains ("secretproject.example.com"), don't log your certificates. Apply the CT exemption policy on company devices so internal users don't see warnings in Chrome.

Learn more about Certificate Transparency

See Presenting Certificate Transparency logging options.