Private trust stack reference
Look up identifiers, response structures, authentication methods, and endpoints used by the solution.
Use this reference to trace identifiers across DigiCert® Account Manager, DigiCert® Private CA, DigiCert® Device Trust Manager, and DigiCert® Software Trust Manager. It also identifies response structures, authentication methods, and API-specific request formats.
Implementation status and saved values
Record non-secret resource IDs and references to entries in your approved secret manager. Never record API tokens, passcodes, or private-key values in this status record. Use the linked phase checkpoint to determine whether a phase is complete.
| Checkpoint | Workstream | Completion evidence | Values to retain | Next step |
|---|---|---|---|---|
| Establish the account foundation | Shared foundation | Service identity with limited roles and matching client certificate verified. | account_id, organization_id, service-user and credential IDs, secret-manager references for service_api_token and client.key | Prepare the private trust domain |
| Prepare the private trust domain | Shared foundation | CA assignments, certificate paths, and approved root fingerprint verified. | CA IDs, root-ca.pem, workload issuing-CA certificates | Configure the device certificate infrastructure and configure and test private code signing in either order or in parallel. |
| Configure the device certificate infrastructure | Device identity | Eligible template, division, profile, and policy verified. | division_id, device_certificate_profile_id, certificate_policy_id | Enroll and verify a device |
| Enroll and verify a device | Device identity | Passcode enrollment, key match, and device certificate path verified. | Authentication, passcode, group, request, and device-certificate IDs | Configure and test private code signing if code signing is incomplete. Otherwise, operate this solution. |
| Configure and test private code signing | Code signing | Signing certificate path and returned signature verified. | Template, profile, keypair, certificate, and signature IDs | Configure the device certificate infrastructure if device identity is incomplete. Otherwise, operate this solution. |
Cross-product data flow
| Data | Created or selected in | Used in | Format and handling |
|---|---|---|---|
account_id | Account Manager account list | All setup phases | UUID selected from the account response array. |
organization_id | Account Manager organization list | Software Trust Manager private trust certificate profile | UUID for an active organization in account_id. |
service_user_id | Account Manager create-user response | Credential administration and audit | UUID. It is not an authentication secret. |
api_token_id | Create-user response api_token.id | Credential removal and audit | UUID for the returned-once service API token. |
service_api_token | Create-user response api_token.token | Setup calls authenticated with an API token and Software Trust Manager multi-factor authentication | Secret API token that is returned once. Send it in the x-api-key header. It is not an OAuth bearer token. |
client_auth_certificate_id | Account Manager create-client-authentication-certificate response | Credential removal and audit | UUID for the credential created with the service user identified by service_user_id. |
client.crt, client.key | Account Manager client authentication certificate creation | Software Trust Manager keypair creation and signing | Generate the private key locally and submit only its certificate signing request (CSR). Protect the PEM private key as a secret. |
root_ca_id | DigiCert Private CA GET /ca | CA certificate download | Identifier selected from the active root CA record. |
root-ca.pem | DigiCert Private CA CA-download operation | Relying-party trust stores and path validation | Trust anchor. Validate the fingerprint before distribution. |
device_ica_id | Active intermediate from the DigiCert Private CA GET /ca operation | Device Trust Manager certificate policy | Identifier selected from the active device issuing-CA record. |
signing_ica_id | Active intermediate from the DigiCert Private CA GET /ca operation | Software Trust Manager private trust certificate profile | Identifier selected from the active signing issuing-CA record. It can equal device_ica_id when your public key infrastructure (PKI) policy permits a shared issuer. |
device-issuing-ca.pem | DigiCert Private CA CA-download operation | Device certificate-path construction | Device intermediate certificate. Do not install it as the trust anchor. |
signing-issuing-ca.pem | DigiCert Private CA CA-download operation | Signing certificate-path construction | Signing intermediate certificate. Do not install it as the trust anchor. |
device_certificate_template_id | Device Trust Manager certificate-template list | Device certificate profile | UUID specific to Device Trust Manager. The template must require the client authentication extended key usage (EKU) and support this request’s key and subject sources. |
code_signing_certificate_template_id | Software Trust Manager certificate-template list | Private trust certificate profile in the same product | UUID specific to Software Trust Manager. The template must be active, custom, available to the account, and require code_signing. |
primary_rendezvous_zone_id | Device Trust Manager rendezvous-zone list records[].id | Device Trust Manager division creation | UUID for an enabled zone assigned to the account with is_primary_usage: true. |
division_id | Device Trust Manager division list records[].id | Device profile, policy, and group | UUID. The create response does not supply this ID directly. |
device_certificate_profile_id | Device Trust Manager create-profile response | Device Trust Manager certificate policy | UUID. |
certificate_policy_id | Device Trust Manager create-policy response | Group assignment and enrollment | IOT_<uuid> in the API examples. |
authentication_policy_id | Device Trust Manager create-authentication-policy response | Passcode and group policy assignment | UUID. |
passcode_id | Device Trust Manager create-passcode response | Credential removal | UUID. |
passcode | Client-supplied create-passcode value | Request-certificate x-passcode header | Secret. The create response might include it, so protect the complete response and continue using the original secret-store value. |
device_group_id | Device Trust Manager group list records[].id | Device certificate request | UUID required by this solution to apply the group authentication override. |
certificate_request_id | Device Trust Manager certificate-issuance response | Approval polling, troubleshooting, and audit correlation | Identifier for the device certificate request. |
device_certificate_id | Device Trust Manager certificate-issuance response | Approved-certificate download, inventory, and lifecycle operations | Identifier for the issued device certificate. |
signing_profile_id | Software Trust Manager create-profile response | Signing-certificate generation | UUID. |
keypair_id | Software Trust Manager create-keypair response | Certificate generation and signing paths | UUID. Keypair creation requires an API token and mutual TLS (mTLS). |
signing_certificate_id | Software Trust Manager certificate-generation response | Certificate identification and lifecycle tracking | Identifier for the private code-signing certificate. |
signature_id | Software Trust Manager sign response | Request identification and retained validation evidence | Identifier for the returned signature operation. |
Response structures
| Operation | Response structure |
|---|---|
| Account Manager list accounts | Top-level JSON array. |
| Account Manager list organizations | Top-level JSON array. |
| Account Manager list roles | Object keyed by Manager, each containing a role array. |
| DigiCert Private CA list CAs | Object with pagination metadata. CA records are in items, but the API reference does not document pagination parameters. Stop without selecting a CA when total differs from the number of returned items. |
| Device Trust Manager list certificate templates | Paginated object. Templates are in records; offset is the index of the first record. |
| Software Trust Manager list certificate templates | Paginated object. Templates are in items; offset is the page index. |
| Device Trust Manager list divisions | Paginated object. Divisions are in records; offset is the index of the first record. |
| Device Trust Manager list device groups | Paginated object. Groups are in records; offset is the index of the first record. |
| Device Trust Manager create division or group | Response with status information but no resource ID. Retrieve the new ID by listing resources and selecting the exact name. |
| Device Trust Manager create certificate policy | Object with the created policy in certificate_policy. |
Authentication matrix
| API operations | Host | Headers | Client certificate |
|---|---|---|---|
| Account Manager setup | Tenant host | API token in x-api-key | No |
| DigiCert Private CA setup | Tenant host | API token in x-api-key | No |
| Device Trust Manager administrative setup | Tenant host | API token in x-api-key | No |
| Device certificate request using passcode | Tenant host | x-passcode. Omit x-api-key. | No |
| Software Trust Manager profile and certificate setup | Tenant host | API token in x-api-key | No for the operations in the current API reference. |
| Software Trust Manager keypair creation and signing | clientauth. tenant host | API token in x-api-key | Yes. The certificate and key must belong to the identity associated with the API token. |
Endpoint quick reference
The examples use this host:
https://demo.one.digicert.com
| Method | Full path | Phase |
|---|---|---|
| GET | /account/api/v1/account | 1 |
| GET | /account/api/v1/role | 1 |
| GET | /account/api/v1/organization | 1 |
| POST | /account/api/v1/user | 1 |
| POST | /account/api/v1/client-auth-certificate | 1 |
| GET | /certificate-authority/api/v1/ca | 2 |
| POST | /certificate-authority/api/v1/ca/{ica_id}/accounts | 2 |
| GET | /certificate-authority/api/v1/ca/{ca_id}/download?format=pem | 2 |
| GET | /devicetrustmanager/certificate-configuration-service/api/v1/certificate-template | 3 |
| GET | /devicetrustmanager/api/v4/rendezvous-zone | 3 |
| POST | /devicetrustmanager/api/v4/division | 3 |
| GET | /devicetrustmanager/api/v4/division | 3 |
| POST | /devicetrustmanager/certificate-configuration-service/api/v1/certificate-profile | 3 |
| POST | /devicetrustmanager/certificate-configuration-service/api/v2/certificate-policy | 3 |
| POST | /devicetrustmanager/authentication-service/api/v1/authentication-policy | 4 |
| POST | /devicetrustmanager/authentication-service/api/v1/passcode | 4 |
| POST | /devicetrustmanager/api/v4/device-group | 4 |
| GET | /devicetrustmanager/api/v4/device-group | 4 |
| POST | /devicetrustmanager/certificate-issuance-service/api/v2/certificate | 4 |
| GET | /devicetrustmanager/certificate-issuance-service/api/v2/certificate-request/{certificate_request_id}/status | 4 |
| POST | /devicetrustmanager/certificate-issuance-service/api/v2/certificate/{certificate_id}/download-approved-certificate | 4 |
| GET | /signingmanager/api/v1/certificate-templates | 5 |
| POST | /signingmanager/api/v1/certificate-profiles | 5 |
| POST | /signingmanager/api/v1/keypairs | 5 |
| POST | /signingmanager/api/v1/keypairs/{keypair_id}/certificates | 5 |
| POST | /signingmanager/api/v1/keypairs/{keypair_id}/sign | 5 |
For Software Trust Manager keypair creation and signing, change the host to:
https://clientauth.demo.one.digicert.com
API-specific request formats
Select a template from the correct product
Use the template endpoint in the product that creates the profile:
| Product | Response structure | Required checks for this manual |
|---|---|---|
| Device Trust Manager | GET /devicetrustmanager/certificate-configuration-service/api/v1/certificate-template → records | Exact name, ACTIVE, custom, X.509 end-entity certificate, target-account access, client_authentication, RSA-2048 through key_types or the key_gen range, user-supplied common name, and required client authentication EKU. |
| Software Trust Manager | GET /signingmanager/api/v1/certificate-templates → items | Exact name, ACTIVE, CUSTOM, TEST, target-account access, code_signing, and required code-signing EKU. |
The DigiCert Private CA GET /template operation returns a third template resource. You cannot use its IDs in Device Trust Manager or Software Trust Manager profile requests.
Device Trust group policy assignment
{
"policy_id": "IOT_<uuid>",
"assignment_name": "Private device bootstrap certificate",
"type": "bootstrapCertificate",
"auth_policy_id": "<authentication-policy-uuid>",
"status": "ACTIVE"
}
Device Trust server-side certificate request
{
"certificate_policy_id": "IOT_<uuid>",
"device_group_id": "<device-group-uuid>",
"certificate_profile_attributes": [
{
"id": "subject.common_name",
"value": "device-001.example.internal"
}
],
"server_side_key_gen": true,
"key_type": "rsa_2048",
"private_key_format": "pem",
"private_key_syntax": "pkcs8",
"response_with_certificate_only": false,
"include_certificate_chain": true,
"split_certificate_response": true
}
Software Trust private trust certificate profile
The current API request uses this format:
{
"profile_type": "CA_PROFILE",
"ca_certificate_profile_request": {
"certificate_template_id": "<code-signing-template-uuid>",
"profile": "TEST",
"body": [],
"organization": {
"id": "<organization-uuid>"
},
"ca": {
"id": "<ica-id>"
}
}
}
Related pages
Was this page helpful?
Provide feedback