Replacing a certificate

original_certificate

Valid base-64 encoded certificate

Required if original_transaction_id is not present

Base-64 encoded X.509 certificate from the original enrollment

original_transaction_id

Text

Required if original_certificate is not present.

32

Transaction id from the original enrollment

original_challenge

Text

Y

32

The challenge phrase from the original enrollment

challenge

Text

Y

32

A new challenge phrase for the requested certificate

reason

Text

Y

32

Reason for replacing the certificate.

csr

Base-64

Y

Base-64 PKCS#10 formatted certificate signing request.

specificEndDate

MM/DD/YYYY

N

10

The end date for the replacement certificate. For all public SSL/TLS certificates, the end date must be 2 years or less from the start date of the original certificate. For Private SSL and code signing certificates, the end date must be 3 years or less from the start date of the original certificate.

For this parameter to take effect, you must enable an option the Control Center. Go to the Configuration tab, Enrollment page, Select Certificate Lifecycle Options section, and select Applicants can request a specific end date within the validity period.

firstName

Text

N

240

Subscriber's first name

middleInitial

Text

N

1

Subscriber's middle initial

lastName

Text

N

240

Subscriber's last name

email

Text

N

Subscriber's email address

serverType

Text

Y

64

Server software type. See serverType for more information.

This parameter is ignored for code signing certificates.

comment/addtional_field3

T61

N

512

Comments from the subscriber.

jobTitle

T61

N

64

Job title. This field is configured as either required or optional in the Control Center, but is overwritten by the API value.

employeeID

T61

N

64

Employee ID. This field is configured as either required or optional in the Control Center, but is overwritten by the API value.

serverIP /additional_field10

T61

N

64

Server IP. This field is configured as either required or optional in the Control Center, but is overwritten by the API value.

mailStop

T61

N

64

Mail Stop. This field is configured as either required or optional in the Control Center, but is overwritten by the API value.

additional_field#0

T61

N

64

Enter up to 10 additional fields. # indicates 1-10.

subject_alt_name#

Text

N

50

The subject alternative names (SANs). One certificate can secure the common name in the CSR and additional domains that are entered as SANs (also known as subjectAltName). Each SAN must be an FQDN.

Enter up to 20 SANs. # indicates 1-20. The newer format, subject_alt_names, supports up to 100 SANs.

subject_alt_names

Text

N

A comma-separated list of domain names. Enter up to 100 SANs. Example:

mail.example.com, blog.example.com, ftp.example.com

signatureAlgorithm

Text

N

32

The certificate's signature algorithm. Enter one of the following values:

• sha1WithRSAEncryption

• sha256WithRSAEncryption(default)

• sha256WithRSAEncryptionFull

• ECDSAwithSHA256

• ECDSAwithSHA256andRSAroot

ctLogOption

Text

N

Optional and case sensitive. Sets the Certificate Transparency logging level for the certificate. Defaults to public (full Certificate Transparency logging). public is the best choice for public websites.

Valid values:

• public - Log domain names for best security. Provides the best browsing experience and helps you monitor certificates issued for your domains.

• nolog - Don't log domain names. Intended for private domains to keep internal names hidden from public. However, Google Chrome disables the green address bar (EV only) and shows warnings when anyone connects to your site.

For certificates with private subdomains ("secretproject.example.com"), don't log your certificates. Apply the CT exemption policy on company devices so internal users don't see warnings in Chrome.

Learn more about Certificate Transparency

See Presenting Certificate Transparency logging options.