Private trust stack reference

Use this reference to trace identifiers across DigiCert® Account Manager, DigiCert® Private CA, DigiCert® Device Trust Manager, and DigiCert® Software Trust Manager. You can also look up response structures, authentication methods, and API-specific request formats.

Implementation status and saved values

Record non-secret resource IDs and references to entries in your approved secret manager. Do not record API tokens, passcodes, or private-key values in this status record. Use the linked checkpoint to determine whether each phase is complete.

Environment variables do not survive a new shell. Values to retain lists what to record for the run. Before resuming in a new shell, use Restore the shell environment to re-export the values from the response files in the working directory.

Files each phase writes

Every example uses relative paths, so run all five phases in one working directory. The phase examples create these files:

Cross-product data flow

Response structures

Authentication matrix

Endpoint quick reference

The examples use this host:

https://demo.one.digicert.com

For GET /account/api/v1/user/me and for Software Trust Manager keypair creation and signing, change the host to:

https://clientauth.demo.one.digicert.com

API-specific request formats

Map a product to its role response key and access checks

GET /account/api/v1/role groups roles by product code. The codes are stable and some predate the current product names, so they do not always match the name used elsewhere in the interface or in this manual.

The application_code query parameter narrows the role list to one product, but its documented values do not include device_trust_manager. Request the full list instead, and select the keys you need from the response.

The role list does not report permissions. Verify the assigned role names and effective permission codes on the created service user with GET /account/api/v1/user/{user_id}. Its applications entries keep roles and permissions separate.

Select a template from the correct product

Use the template endpoint in the product that creates the profile:

The DigiCert Private CA GET /template operation returns a third template resource. You cannot use its IDs in Device Trust Manager or Software Trust Manager profile requests.

Device Trust group policy assignment

{
  "policy_id": "IOT_<uuid>",
  "assignment_name": "Private device bootstrap certificate",
  "type": "bootstrapCertificate",
  "auth_policy_id": "<authentication-policy-uuid>",
  "status": "ACTIVE"
}

Device Trust server-side device registration

{
  "name": "device-<unique-run-label>.example.internal",
  "description": "Private trust validation device",
  "account_id": "<account-uuid>",
  "device_group_id": "<device-group-uuid>",
  "certificate_policies": {
    "bootstrap": [
      {
        "server_side_key_gen": true,
        "certificate_policy_id": "IOT_<uuid>",
        "key_type": "RSA_2048",
        "key_format": "PEM",
        "key_syntax": "PKCS8",
        "attributes": [
          {
            "name": "subject.common_name",
            "value": "device-<unique-run-label>.example.internal"
          }
        ]
      }
    ]
  }
}

Software Trust private trust certificate profile

Use this request format:

{
  "profile_type": "CA_PROFILE",
  "ca_certificate_profile_request": {
    "certificate_template_id": "<code-signing-template-uuid>",
    "profile": "TEST",
    "body": [],
    "organization": {
      "id": "<organization-uuid>"
    },
    "ca": {
      "id": "<ica-id>"
    }
  }
}

Related pages

• Operate and maintain the solution.
• Troubleshoot failed runs or requests with uncertain results.
• Return to the solution overview.