If set, clients can request certificates for any CN

If set, will allow copying the extra extensions from the csr file (if given)

If set, clients can request certificates for subdomains of the allowed domains

A list of the allowed domains that clients can request to be included in the certificate (in a comma-delimited list)

A json string containing the allowed extra extensions for the pki cert issuer

A list of the allowed CIDRs for ips that clients can request to be included in the certificate as part of the IP Subject Alternative Names (in a comma-delimited list)

A list of the allowed URIs that clients can request to be included in the certificate as part of the URI Subject Alternative Names (in a comma-delimited list)

Automatically renew certificates before expiration

The name of an existing CA target to attach this PKI Certificate Issuer to, required in Public CA mode

If set, certificates will be flagged for client auth use

If set, certificates will be flagged for code signing use

A comma-separated list of countries that will be set in the issued certificate

Set this to allow the issuer will expose a CRL endpoint in the Gateway

Set this to enable an OCSP endpoint in the Gateway and include its URL in AIA

Set this to allow the cert issuer will expose a public CRL endpoint

Set this to enable a public OCSP endpoint and include its URL in AIA (served by UAM and includes account id)

Mark key usage as critical [true/false]

Protection from accidental deletion of this object [true/false]

Description of the object

A path in which to save generated certificates

If set, generation of wildcard certificates will be disabled.

If set, the cert issuer will support the acme protocol

The GW cluster URL to issue the certificate from. Required in Public CA mode, to allow CRLs on private CA, or to enable ACME

If set, the basic constraints extension will be added to certificate

Set output format to JSON

key-usage

A comma-separated list of localities that will be set in the issued certificate

The maximum path length for the generated certificate. -1, means unlimited

Deprecated - use description

PKI certificate issuer name

If set, any names are allowed for CN and SANs in the certificate and not only a valid host name

If set, clients can request certificates without a CN

OCSP NextUpdate window for OCSP responses (min 10m). Supports s,m,h,d suffix.

A comma-separated list of organizational units (OU) that will be set in the issued certificate

A comma-separated list of organizations (O) that will be set in the issued certificate

A comma-separated list of postal codes that will be set in the issued certificate

Whether to protect generated certificates from deletion

A comma-separated list of provinces that will be set in the issued certificate

Number of days before expiration to renew certificates

If set, certificates will be flagged for server auth use

A key to sign the certificate with, required in Private CA mode

A comma-separated list of street addresses that will be set in the issued certificate

Authentication token (see /auth and /configure)

The maximum requested Time To Live for issued certificates, in seconds. In case of Public CA, this is based on the CA target's supported maximum TTLs

The universal identity token, Required only for universal_identity authentication