openapi: 3.2.0
info:
  title: Cisco ISE Certificates API
  version: 1.0.0
  x-provenance:
    method: harvested
    authored_by: Cisco
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    provider_published: true
    source_host: pubhub.devnetcloud.com
    note: 103 ISE API descriptions (1,490 operations; 32 OpenAPI 3.0.x + 71 Swagger 2.0) enumerated from Cisco's own DevNet project manifest and fetched anonymously. Byte-identity reconfirmed 2026-08-19 by SHA-256 against the live source.
  x-evidence:
  - type: source
    url: https://pubhub.devnetcloud.com/media/identity-services-engine-api-v1/docs/
  - type: source
    url: https://developer.cisco.com/docs/identity-services-engine/
servers:
- url: https://10.127.96.94:443
  description: Inferred Url
tags:
- name: Certificates
paths:
  /api/v1/certs/certificate-signing-request:
    get:
      tags:
      - Certificates
      summary: Get all Certificate Signing Requests from PAN
      description: '<p style="font-size: 15px;"> This API supports filtering, sorting and pagination. </p><br/> <p style="font-size: 14px;">Filtering and sorting are supported for the following attributes: </p>    <ul style="font-size: 14px;">        <li>friendlyName</li>        <li>subject</li>        <li>timeStamp</li>          <ul>            <li>Supported Date Format: yyyy-MM-dd HH:mm:ss.SSS</li>            <li>Supported Operators: EQ, NEQ, GT and LT</li>          </ul>      </ul> '
      operationId: getCSRs
      parameters:
      - name: page
        in: query
        description: Page number
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: size
        in: query
        description: Number of objects returned per page
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: sort
        in: query
        description: sort type - asc or desc
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - asc
          - desc
      - name: sortBy
        in: query
        description: sort column by which objects needs to be sorted
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
      - name: filter
        in: query
        description: '<div> <style type="text/css" scoped> .apiServiceTable td, .apiServiceTable th { padding: 5px 10px !important; text-align: left; } </style> <span> <b>Simple filtering</b> should be available through the filter query string parameter. The structure of a filter is a triplet of field operator and value separated with dots. More than one filter can be sent. The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the <i>"filterType=or"</i> query string parameter. Each resource Data model description should specify if an attribute is a filtered field. </span> <br /> <table class="apiServiceTable"> <thead> <tr> <th>OPERATOR</th> <th>DESCRIPTION</th> </tr> </thead> <tbody> <tr> <td>EQ</td> <td>Equals</td> </tr> <tr> <td>NEQ</td> <td>Not Equals</td> </tr> <tr> <td>GT</td> <td>Greater Than</td> </tr> <tr> <td>LT</td> <td>Less Then</td> </tr> <tr> <td>STARTSW</td> <td>Starts With</td> </tr> <tr> <td>NSTARTSW</td> <td>Not Starts With</td> </tr> <tr> <td>ENDSW</td> <td>Ends With</td> </tr> <tr> <td>NENDSW</td> <td>Not Ends With</td> </tr> <tr> <td>CONTAINS</td> <td>Contains</td> </tr> <tr> <td>NCONTAINS</td> <td>Not Contains</td> </tr> </tbody> </table> </div>'
        required: false
        style: form
        explode: true
        schema:
          type: string
          exampleSetFlag: true
      - name: filterType
        in: query
        description: The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the parameter
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - AND
          - OR
      responses:
        '200':
          description: Paged array of Certificate Signing Requests.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CSRGetAllRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
    post:
      tags:
      - Certificates
      summary: Generate a Certificate Signing Request (CSR)
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Generate a certificate signing request for Multi-Use, Admin, EAP Authentication, RADIUS DTLS, PxGrid, SAML, Portal and IMS Services.</h3> Following parameters are present in the POST request body<br> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>hostnames</td> <td>List of Cisco ISE node hostnames for which CSRs should be generated</td> <td>"hostnames": ["ise-host1", "ise-host2"]</td> </tr> <tr> <td>allowWildCardCert</td> <td>Allow use of wildCards in certificates</td> <td>"allowWildCardCert": false</td> </tr> <tr> <td>keyLength<sup><font color=red>*required</font></sup></td> <td>Length of the key used for CSR generation.</td> <td>"keyLength": "512"</td> </tr> <tr> <td>keyType<sup><font color=red>*required</font></sup></td> <td>Type of key used for CSR generation either RSA or ECDSA.</td> <td>"keyType": "RSA"</td> </tr> <tr> <td>digestType<sup><font color=red>*required</font></sup></td> <td>Hash algorithm used for signing CSR.</td> <td>"digestType": "SHA-256"</td> </tr> <tr> <td>usedFor<sup><font color=red>*required</font></sup></td> <td>Certificate usage.</td> <td>"usedFor": "MULTI-USE"</td> </tr> <tr> <td>certificatePolicies</td> <td>Certificate policy OID or list of OIDs that the certificate should conform to. Use comma or space to separate the OIDs. </td> <td>"certificatePolicies": "Certificate Policies"</td> </tr> <tr> <td>subjectCommonName<sup><font color=red>*required</font></sup></td> <td>Certificate common name (CN).</td> <td>"subjectCommonName": "$FQDN$"</td> </tr> <tr> <td>subjectOrgUnit</td> <td>Certificate organizational unit (OU).</td> <td>"subjectOrgUnit": "Engineering"</td> </tr> <tr> <td>subjectOrg</td> <td>Certificate organization (O).</td> <td>"subjectOrg": "Cisco"</td> </tr> <tr> <td>subjectCity</td> <td>Certificate city or locality (L).</td> <td>"subjectCity": "San Jose"</td> </tr> <td>subjectState</td> <td>Certificate state (ST).</td> <td>"subjectState": "California"</td> </tr> <tr> <td>subjectCountry</td> <td>Certificate country (C).</td> <td>"subjectCountry": "US"</td> </tr> <tr> <td>sanDNS</td> <td>Array of SAN (Subject Alternative Name) DNS entries (optional).</td> <td>"sanDNS": ["ise.example.com"]</td> </tr> <td>sanIP</td> <td>Array of SAN IP entries (optional).</td> <td>"sanIP": ["1.1.1.1"]</td> </tr> <tr> <td>sanURI</td> <td>Array of SAN URI entries (optional).</td> <td>"sanURI": ["https://1.1.1.1"]</td> </tr> <tr> <td>sanDir</td> <td>Array of SAN DIR entries (optional).</td> <td>"sanDir": ["CN=AAA,DC=COM,C=IL"]</td> </tr> <tr> <td>portalGroupTag</td> <td>Portal Group Tag when using certificate for PORTAL service</td> <td>"portalGroupTag": "Default Portal Certificate Group"</td> </tr> </tbody> </table></br> <b>NOTE: </b>For <b>allowWildCardCert</b> to be false, the following parameter is mandatory:</br> <b>- hostnames </b></br> <p>When certificate is selected to be used for Portal Service, the following parameter is mandatory:</br> <b>- portalGroupTag</b></br></p> <hr/> '
      operationId: generateCSR
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CSRRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Generated CSR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateCSRRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/certificate-signing-request/export/{hostname}/{id}:
    get:
      tags:
      - Certificates
      summary: Export a CSR for a given CSR ID and hostname
      description: Response of this API carries a CSR corresponding to the requested ID.
      operationId: exportCSR
      parameters:
      - name: hostname
        in: path
        description: Hostname to which the CSR belongs.
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: id
        in: path
        description: ID of the CSR to be exported.
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Exported CSR successfully
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
        '400':
          description: Bad Request
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/ExportCSRFailRespPayload'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/ExportCSRFailRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
  /api/v1/certs/certificate-signing-request/intermediate-ca:
    post:
      tags:
      - Certificates
      summary: Generate an intermediate CA CSR (certificate signing request)
      description: CSR generation for Intermediate Certificates.
      operationId: generateIntermediateCACsr
      responses:
        '200':
          description: Generated Cisco ISE Intermediate CA CSR
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateIntermediateCACsrRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/certificate-signing-request/{hostName}/{id}:
    get:
      tags:
      - Certificates
      summary: Get the certificate signing request for a given ID
      description: This API displays details of a certificate signing request of a particular node for a given hostname and ID.
      operationId: getCSRById
      parameters:
      - name: hostName
        in: path
        description: Name of the host of which CSR's should be returned
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: id
        in: path
        description: ID of the Certificate Signing Request returned
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Returns the CSR of given ID.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CSRGetByIdRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
    delete:
      tags:
      - Certificates
      summary: Delete the certificate signing request for a given ID
      description: This API deletes the certificate signing request of a particular node based on a given hostname and ID.
      operationId: deleteCSR
      parameters:
      - name: hostName
        in: path
        description: Name of the host of which CSR's should be deleted
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: id
        in: path
        description: ID of the Certificate Signing Request to be deleted
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Deleted CSR of the given ID.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteCSRRespPayload'
                exampleSetFlag: false
        '204':
          description: No Content
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
      security:
      - BasicAuth: []
  /api/v1/certs/ise-root-ca/regenerate:
    post:
      tags:
      - Certificates
      summary: Regenerate entire internal CA certificate chain including root CA on the primary PAN and subordinate CAs on the PSNs (Applicable only for internal CA service)
      description: This API initiates regeneration of Cisco ISE root CA certificate chain. The response contains an ID which can be used to track the status. <br>  Setting "removeExistingISEIntermediateCSR" to true removes existing Cisco ISE Intermediate CSR.
      operationId: regenerateISERootCA
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RegenerateRootCA'
              exampleSetFlag: false
      responses:
        '200':
          description: unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '201':
          description: Created
        '202':
          description: Regeneration of Cisco ISE Root CA is initiated. Please use status API to get the status.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RegenerateRootCaRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/renew-certificate:
    post:
      tags:
      - Certificates
      summary: Renew certificates of OCSP responder and Cisco ISE Messaging Service
      description: This API initiates regeneration of certificates. The response contains an ID which can be used to track the status.
      operationId: renewCerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RenewCertificates'
              exampleSetFlag: false
      responses:
        '200':
          description: unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '201':
          description: Created
        '202':
          description: Regeneration of Certificate is initiated. Please use the status API to get the status.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RenewCertRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/signed-certificate/bind:
    post:
      tags:
      - Certificates
      summary: Bind CA Signed Certificate
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Bind CA Signed Certificate.</h3> <b>NOTE: </b>This API requires an existing certificate signing request, and the root certificate must already be trusted.<br> <b>NOTE: </b>The certificate may have a validity period greater than 398 days. It may be untrusted by many browsers.<br> <b>NOTE: </b>Request parameters accepting True and False as input can be replaced by 1 and 0 respectively.<br> <h4>Following parameters are used in the POST body</h4> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>name</td> <td>Friendly name of the certificate.</td> <td>"name": "CA Signed Certificate"</td> </tr> <tr> <td>data<sup><font color=red>*required</font></sup></td> <td> Plain-text contents of the certificate file. Every space needs to be replaced with a newline escape sequence (\n).<br/> Use the command <cmd>awk &apos;NF {sub(/\r/, ""); printf "%s\\n",$0;}&apos; &lt;&lt;your .pem file&gt;&gt;</cmd> to extract data from certificate file. </td> <td>"data": "Plain-text contents of the certificate file."</td> </tr> <tr> <td>allowExtendedValidity<sup><font color=red>*required</font></sup></td> <td>Allow the certificates with validity greater than 398 days.</td> <td>"allowExtendedValidity": true</td> </tr> <tr> <td>allowOutOfDateCert<sup><font color=red>*required</font></sup></td> <td> Allow out of date certificates.</br> <b>SECURITY ALERT: </b>We recommend to set the parameter the parameter <b>allowOutOfDateCert</b> as <b>false</b> to avoid binding of expired certificates (not secure). </td> <td>"allowOutOfDateCert": true</td> </tr> <tr> <td>allowReplacementOfCertificates<sup><font color=red>*required</font></sup></td> <td>Allow Replacement of certificates.</td> <td>"allowReplacementOfCertificates": true</td> </tr> <tr> <td>allowReplacementOfPortalGroupTag<sup><font color=red>*required</font></sup></td> <td>Allow Replacement of Portal Group Tag.</td> <td>"allowReplacementOfPortalGroupTag": true</td> </tr> <td>admin</td> <td>Use certificate to authenticate the Cisco ISE Admin Portal</td> <td>"admin": false</td> </tr> <tr> <td>eap</td> <td>Use certificate for EAP protocols that use SSL/TLS tunneling</td> <td>"eap": false</td> </tr> <tr> <td>radius</td> <td>Use certificate for RADSec server</td> <td>"radius": false</td> </tr> <tr> <td>pxgrid</td> <td>Use certificate for the pxGrid Controller</td> <td>"pxgrid": false</td> </tr> <tr> <td>ims</td> <td>Use certificate for the Cisco ISE Messaging Service</td> <td>"ims": false</td> </tr> <tr> <td>saml</td> <td>Use certificate for SAML Signing</td> <td>"saml": false</td> </tr> <tr> <td>portal</td> <td>Use certificate for portal</td> <td>"portal": false</td> </tr> <tr> <td>portalGroupTag</td> <td>Portal Group Tag for using certificate with portal role</td> <td>"portalGroupTag": "Default Portal Certificate Group"</td> </tr> <tr> <td>validateCertificateExtensions</td> <td>Validate Certificate Extensions</td> <td>"validateCertificateExtensions": false</td> </tr> </tbody> </table> <br/> <h4>Following roles can be used in any combinations</h4> <table class="certTable"> <thead> <tr> <th>ROLE</th> <th>DEFAULT</th> <th>WARNING</th> </tr> </thead> <tbody> <tr> <td>Admin</td> <td>False</td> <td>Enabling admin role for this certificate causes an application server restart on the selected node.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates.</td> </tr> <tr> <td>EAP Authentication</td> <td>False</td> <td>Only one system certificate can be used for EAP. Assigning EAP to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates.</td> </tr> <tr> <td>RADIUS DTLS</td> <td>False</td> <td>Only one system certificate can be used for DTLS. Assigning DTLS to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates</td> </tr> <tr> <td>SAML</td> <td>False</td> <td>SAML cannot be used with other Usage. Enabling SAML unchecks all other Usage.</br><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates.</td> </tr> </tbody> </table> '
      operationId: bindCSR
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/BindCSRRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: CSR Binded Successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BindCSRRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '404':
          description: Not Found
      security:
      - BasicAuth: []
  /api/v1/certs/system-certificate/export:
    post:
      tags:
      - Certificates
      summary: Export a system certificate with a given a certificate ID
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Export System Certificate.</h3> Following parameters are used in the POST body <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>id<sup><font color=red>*required</font></sup></td> <td>ID of a System Certificate.</td> <td>"id": "CERT-ID"</td> </tr> <tr> <td>hostName<sup><font color=red>*required</font></sup></td> <td>Name of the host for which the system certificate should be exported</td> <td>"hostName": "ise-node-001"</td> </tr> <tr> <td>export</td> <td> One of the following options is required: <ul> <li><b>"CERTIFICATE" :</b>Export only certificate without private key<br/></li> <li><b>"CERTIFICATE_WITH_PRIVATE_KEY" :</b>Export both certificate and private key (<b>"certificatePassword"</b> is required).</li> </ul> </td> <td>"export": "CERTIFICATE_WITH_PRIVATE_KEY"</td> </tr> <tr> <td>password<sup><font color=red>*required</font></sup></td> <td>Certificate password (required if <b>"export" : CERTIFICATE_WITH_PRIVATE_KEY</b>).</br> <b>Password constraints:</b> <ul> <li>Alphanumeric</li> <li>Minimum of 8 Characters</li> <li>Maximum of 100 Characters</li> </ul> </td> <td>"password": "certificate password"</td> </tr> </tbody> </table> <b>NOTE: </b>The response of this API carries a ZIP file containing the certificate and private key if  the request contains <b>"export" : "CERTIFICATE_WITH_PRIVATE_KEY"</b>. If the request body contains <b>"export" : "CERTIFICATE"</b>, the response carries a ZIP file containing only the certificate. <br/><br/> <b>WARNING: </b>Exporting a private key is not a secure operation. It could lead to possible exposure of the private key. <br/> '
      operationId: exportSystemCert
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ExportCertRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Exported certificate successfully
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
  /api/v1/certs/system-certificate/generate-selfsigned-certificate:
    post:
      tags:
      - Certificates
      summary: Generate self-signed certificate in Cisco ISE
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Generate Self-signed Certificate</h3> <p><b>NOTE: </b>The certificate may have a validity period greater than 398 days. It may be untrusted by many browsers.<br> <b>NOTE: </b>Request parameters accepting True and False as input can be replaced by 1 and 0 respectively. <br> <b>NOTE: </b>Wildcard certificate and SAML certificate can be generated only on the primary PAN or a standalone node.<br></p> <br/> <h4>Following parameters are used in the POST body</h4> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>hostName<sup><font color=red>*required</font></sup></td> <td>Hostname or FQDN of the node in which the certificate needs to be created.</td> <td>"hostName": "ise-node-001"</td> </tr> <tr> <td>name</td> <td>Friendly name of the certificate.</td> <td>"name": "Self-signed System Certificate"</td> </tr> <tr> <td>subjectCommonName</td> <td> Certificate common name (CN)<br/> <b>NOTE: </b><ul><li>CN is Mandatory if SAN not configured.</li><li>>Subject can contain a multi-valued CN. For multi-valued RDNs, follow the format "CN=value1, CN=value2"</li></ul> </td> <td>"subjectCommonName": "$FQDN$"</td> </tr> <tr> <td>subjectOrgUnit</td> <td> Certificate organizational unit (OU)<br/> <b>NOTE: </b>Subject can contain a multi-valued OU. For multi-valued RDNs, follow the format "OU=value1, OU=value2" </td> <td>"subjectOrgUnit": "Engineering"</td> </tr> <tr> <td>subjectOrg</td> <td> Certificate organization (O)<br/> <b>NOTE: </b>Subject can contain multi-valued O fields. For multi-valued RDNs, follow the format "O=value1, O=value2" </td> <td>"subjectOrg": "Cisco"</td> </tr> <tr> <td>subjectCity</td> <td>Certificate city or locality (L)</td> <td>"subjectCity": "San Jose"</td> </tr> <tr> <td>subjectState</td> <td>Certificate state (ST)</td> <td>"subjectState": "California"</td> </tr> <tr> <td>subjectCountry</td> <td>Certificate country (C)</td> <td>"subjectCountry": "US"</td> </tr> <tr> <td>sanDNS</td> <td>Array of SAN (Subject Alternative Name) DNS entries</td> <td>"sanDNS": ["ise.example.com"]</td> </tr> <tr> <td>sanIP</td> <td>Array of SAN IP address entries</td> <td>"sanIP": ["1.1.1.1"]</td> </tr> <tr> <td>sanURI</td> <td>Array of SAN URI entries</td> <td>"sanURI": ["https://1.1.1.1"]</td> </tr> <tr> <td>keyType<sup><font color=red>*required</font></sup></td> <td>Algorithm to use for certificate public key creation.</td> <td>"keyType": "RSA"</td> </tr> <tr> <td>keyLength<sup><font color=red>*required</font></sup></td> <td>Bit size of the public key.</td> <td>"keyLength": "4096"</td> </tr> <tr> <td>digestType<sup><font color=red>*required</font></sup></td> <td>Digest to sign with.</td> <td>"digestType": "SHA-384"</td> </tr> <tr> <td>certificatePolicies</td> <td>Certificate policy OID or list of OIDs that the certificate should conform to. Use comma or space to separate the OIDs. </td> <td>"certificatePolicies": "Certificate Policies"</td> </tr> <tr> <td>expirationTTL<sup><font color=red>*required</font></sup></td> <td> Certificate expiration value.<br/> <b>NOTE: </b>Expiration TTL should be within Unix time limit </td> <td>"expirationTTL": 2</td> </tr> <tr> <td>expirationTTLUnit<sup><font color=red>*required</font></sup></td> <td>Certificate expiration unit.</td> <td>"expirationTTLUnit": "years"</td> </tr> <tr> <td>admin</td> <td>Use certificate to authenticate the Cisco ISE Admin Portal</td> <td>"admin": false</td> </tr> <tr> <td>eap</td> <td>Use certificate for EAP protocols that use SSL/TLS tunneling</td> <td>"eap": false</td> </tr> <tr> <td>radius</td> <td>Use certificate for RADSec server</td> <td>"radius": false</td> </tr> <tr> <td>pxgrid</td> <td>Use certificate for the pxGrid controller</td> <td>"pxgrid": false</td> </tr> <tr> <td>saml</td> <td>Use certificate for SAML Signing</td> <td>"saml": false</td> </tr> <tr> <td>portal</td> <td>Use certificate for portal</td> <td>"portal": false</td> </tr> <tr> <td>portalGroupTag</td> <td>Portal Group Tag for using certificate with portal role</td> <td>"portalGroupTag": "Default Portal Certificate Group"</td> </tr> <tr> <td>allowReplacementOfPortalGroupTag<sup><font color=red>*required</font></sup></td> <td>Allow Replacement of Portal Group Tag.</td> <td>"allowReplacementOfPortalGroupTag": true</td> </tr> <tr> <td>allowWildCardCertificates</td> <td>Allow use of WildCards in certificates</td> <td>"allowWildCardCertificates": false</td> </tr> <tr> <td>allowReplacementOfCertificates<sup><font color=red>*required</font></sup></td> <td>Allow replacement of certificates.</td> <td>"allowReplacementOfCertificates": true</td> </tr> <tr> <td>allowExtendedValidity<sup><font color=red>*required</font></sup></td> <td>Allow generation of self-signed certificate with validity greater than 398 days.</td> <td>"allowExtendedValidity": true</td> </tr> <tr> <td>allowRoleTransferForSameSubject<sup><font color=red>*required</font></sup></td> <td>Allow the transfer of roles to certificates with same subject.<br/> If the matching certificate on Cisco ISE has either admin or portal role and if the request has admin or portal role selected along with <b>allowRoleTransferForSameSubject</b> parameter as true, a self-signed certificate would be generated with both admin and portal role enabled.</td> <td>"allowRoleTransferForSameSubject": true</td> </tr> <tr> <td>allowPortalTagTransferForSameSubject<sup><font color=red>*required</font></sup></td> <td>Acquire the group tag of the matching certificate.</br> If the request portal groug tag is different from the group tag of the matching certificate (If matching certificate in Cisco ISE has portal role enabled), a self-signed certificate would be generated by acquiring the group tag of the matching certificate if the <b>allowPortalTagTransferForSameSubject</b> parameter is true.</td> <td>"allowPortalTagTransferForSameSubject": true</td> </tr> <tr> <td>allowSanDnsBadName<sup><font color=red>*required</font></sup></td> <td> Allow generation of self-signed certificates with bad common name & SAN values such as "example.org.","invalid.","test.","localhost" and so on.</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowSanDnsBadName</b> as <b>false</b> to avoid generation of certificates with bad Common Name & SAN Values which are not secure. </td> <td>"allowSanDnsBadName": true</td> </tr> <tr> <td>allowSanDnsNonResolvable<sup><font color=red>*required</font></sup></td> <td>Allow generation of self-signed certificate with non resolvable Common Name or SAN Values .</td> <td>"allowSanDnsNonResolvable": true</td> </tr> </tbody> </table> <br/> <table class="certTable"> <thead> <tr> <th>ROLE</th> <th>DEFAULT</th> <th>WARNING</th> </tr> </thead> <tbody> <tr> <td>Admin</td> <td>False</td> <td>Enabling Admin role for this certificate causes an application server restart on the selected node.</td> </tr> <tr> <td>EAP Authentication</td> <td>False</td> <td>Only one system certificate can be used for EAP. Assigning EAP to this certificate removes the assignment from another certificate.</td> </tr> <tr> <td>RADIUS DTLS</td> <td>False</td> <td>Only one system certificate can be used for DTLS. Assigning DTLS to this certificate removes the assignment from another certificate.</td> </tr> <tr> <td>SAML</td> <td>False</td> <td>SAML cannot be used with other Usage.</td> </tr> </tbody> </table> '
      operationId: generateSelfSignedCertificate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/GenerateSelfsignedCertRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Created Certificate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateSelfsignedCertRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateSelfsignedCertRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '406':
          description: Not Acceptable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenerateSelfsignedCertRespPayload'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/system-certificate/import:
    post:
      tags:
      - Certificates
      summary: Import system certificate in Cisco ISE
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Import an X509 certificate as a system certificate.</h3> <b>NOTE: </b><br/> <ul> <li>This API is used to import a certificate on a specific node mentioned in the server section of the URL. To import a certificate on a secondary node, execute this RESTApi directly on a secondary node by specifying the server name of the secondary node in the URL<br/> Example: "&lt;https://secondary-ise-node&gt;/api/v1/certs/system-certificate/import"</li> <li>The certificate may have a validity period of more than 398 days. It may be untrusted by many browsers.</li> <li>Request parameters accepting True and False as input can be replaced by 1 and 0 respectively.</li> </ul> <h4>Following parameters are used in the POST body</h4> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>name</td> <td>Friendly name of the certificate.</td> <td>"name": "System certificate"</td> </tr> <tr> <td>password<sup><font color=red>*required</font></sup></td> <td>Password of the certificate to be imported.</td> <td>"password": "certificate password"</td> </tr> <tr> <td>data<sup><font color=red>*required</font></sup></td> <td> Plain-text contents of the certificate file. Every space needs to be replaced with a newline escape sequence (\n).<br/> Use the command <cmd>awk &apos;NF {sub(/\r/, ""); printf "%s\\n",$0;}&apos; &lt;&lt;your .pem file&gt;&gt;</cmd> to extract data from the certificate file. </td> <td>"data": "Plain-text contents of the certificate file."</td> </tr> <tr> <td>privateKeyData<sup><font color=red>*required</font></sup></td> <td> Plain-text contents of the private key file. Every space needs to be replaced with a newline escape sequence (\n).</br> Use the command <cmd>awk &apos;NF {sub(/\r/, ""); printf "%s\\n",$0;}&apos; &lt;&lt;your .pem file&gt;&gt;</cmd> to extract privateKeyData from private key file. </td> <td>"data": "Plain-text contents of the private key file."</td> </tr> <tr> <td>allowOutOfDateCert<sup><font color=red>*required</font></sup></td> <td> Allow out of date certificates .</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowOutOfDateCert</b> as <b>false</b> to avoid the import of expired certificates (not Secure). </td> <td>"allowOutOfDateCert": true</td> </tr> <tr> <td>allowSHA1certificates<sup><font color=red>*required</font></sup></td> <td> Allow import of certificate with signature that uses the SHA-1 hashing algorithm and is considered less secure .</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowSHA1certificates</b>as <b>false</b> to avoid the import of SHA1 based certificates (less secure). </td> <td>"allowSHA1certificates": true</td> </tr> <tr> <td>allowExtendedValidity<sup><font color=red>*required</font></sup></td> <td>Allow the certificates greater than validity of 398 days.</td> <td>"allowExtendedValidity": true</td> </tr> <tr> <td>allowRoleTransferForSameSubject</td> <td>password<sup><font color=red>*required</font></sup></td> <td>Allow the transfer of roles to certificates with the same subject</td> <td>"allowRoleTransferForSameSubject": true</td> </tr> <tr> <td>allowPortalTagTransferForSameSubject</td> <td>password<sup><font color=red>*required</font></sup></td> <td>Acquire the group tag of the matching certificate</td> <td>"allowPortalTagTransferForSameSubject": true</td> </tr> <tr> <td>admin</td> <td>Use the certificate to authenticate the Cisco ISE admin portal</td> <td>"admin": false</td> </tr> <tr> <td>eap</td> <td>Use the certificate for EAP protocols that use SSL/TLS tunneling</td> <td>"eap": false</td> </tr> <tr> <td>radius</td> <td>Use the certificate for RADSec server</td> <td>"radius": false</td> </tr> <tr> <td>pxgrid</td> <td>Use the certificate for the pxGrid Controller</td> <td>"pxgrid": false</td> </tr> <tr> <td>ims</td> <td>Use the certificate for the Cisco ISE messaging service</td> <td>"ims": false</td> </tr> <tr> <td>saml</td> <td>Use the certificate for SAML Signing</td> <td>"saml": false</td> </tr> <tr> <td>portal</td> <td>Use the certificate for portal</td> <td>"portal": false</td> </tr> <tr> <td>portalGroupTag</td> <td>Portal Group Tag for using certificate with portal role</td> <td>"portalGroupTag": "Default Portal certificate Group"</td> </tr> <tr> <td>allowReplacementOfPortalGroupTag<sup><font color=red>*required</font></sup></td> <td>Allow Replacement of Portal Group Tag .</td> <td>"allowReplacementOfPortalGroupTag": true</td> </tr> <tr> <td>allowWildCardcertificates</td> <td>Allow use of wildcards in certificates</td> <td>"allowWildCardcertificates": false</td> </tr> <tr> <td>validatecertificateExtensions</td> <td>Validate certificate extensions</td> <td>"validatecertificateExtensions": false</td> </tr> </tbody> </table> <br/> <h4>Following roles can be used in any combinations</h4> <table class="certTable"> <thead> <tr> <th>ROLE</th> <th>DEFAULT</th> <th>WARNING</th> </tr> </thead> <tbody> <tr> <td>Admin</td> <td>False</td> <td>Enabling Admin role for this certificate causes an application server restart on the selected node.<br/><b>Note:</b> Make sure the required certificate chain is imported under Trusted Certificates</td> </tr> <tr> <td>EAP Authentication</td> <td>False</td> <td>Only one system certificate can be used for EAP. Assigning EAP to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure required Certificate Chain is imported under Trusted Certificates</td> </tr> <tr> <td>RADIUS DTLS</td> <td>False</td> <td>Only one system certificate can be used for DTLS. Assigning DTLS to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure required Certificate Chain is imported under Trusted Certificates</td> </tr> <tr> <td>SAML</td> <td>False</td> <td>SAML cannot be used with other Usage. Enabling SAML unchecks all other Usage.</br><b>Note:</b> Make sure the required certificate chain is imported under Trusted Certificates</td> </tr> </tbody> </table> '
      operationId: importSystemCert
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SystemCert'
              exampleSetFlag: false
      responses:
        '200':
          description: Created Certificate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ImportSystemCertRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '406':
          description: Not Acceptable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '409':
          description: Certificate already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '417':
          description: Requried parameters missing expectation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '422':
          description: The request was well-formed but was unable to be followed due to semantic errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/system-certificate/{hostName}:
    get:
      tags:
      - Certificates
      summary: Get all system certificates of a particular node
      description: '<p style="font-size: 15px;"> This API supports filtering, sorting and pagination. </p><br/> <p style="font-size: 14px;">Filtering and sorting supported for the following attributes: </p>    <ul style="font-size: 14px;">        <li>friendlyName</li>        <li>issuedTo</li>        <li>issuedBy</li>        <li>validFrom</li>          <ul>            <li>Supported Date Format: yyyy-MM-dd HH:mm:ss</li>            <li>Supported Operators: EQ, NEQ, GT and LT</li>          </ul>        <li>expirationDate</li>          <ul>            <li>Supported Date Format: yyyy-MM-dd HH:mm:ss</li>            <li>Supported Operators: EQ, NEQ, GT and LT</li>          </ul>      </ul> '
      operationId: getSystemCertificates
      parameters:
      - name: hostName
        in: path
        description: Name of the host for which the system certificates should be returned
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: page
        in: query
        description: Page number
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: size
        in: query
        description: Number of objects returned per page
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: sort
        in: query
        description: sort type - asc or desc
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - asc
          - desc
      - name: sortBy
        in: query
        description: sort column by which objects needs to be sorted
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
      - name: filter
        in: query
        description: '<div> <style type="text/css" scoped> .apiServiceTable td, .apiServiceTable th { padding: 5px 10px !important; text-align: left; } </style> <span> <b>Simple filtering</b> should be available through the filter query string parameter. The structure of a filter is a triplet of field operator and value separated with dots. More than one filter can be sent. The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the <i>"filterType=or"</i> query string parameter. Each resource Data model description should specify if an attribute is a filtered field. </span> <br /> <table class="apiServiceTable"> <thead> <tr> <th>OPERATOR</th> <th>DESCRIPTION</th> </tr> </thead> <tbody> <tr> <td>EQ</td> <td>Equals</td> </tr> <tr> <td>NEQ</td> <td>Not Equals</td> </tr> <tr> <td>GT</td> <td>Greater Than</td> </tr> <tr> <td>LT</td> <td>Less Then</td> </tr> <tr> <td>STARTSW</td> <td>Starts With</td> </tr> <tr> <td>NSTARTSW</td> <td>Not Starts With</td> </tr> <tr> <td>ENDSW</td> <td>Ends With</td> </tr> <tr> <td>NENDSW</td> <td>Not Ends With</td> </tr> <tr> <td>CONTAINS</td> <td>Contains</td> </tr> <tr> <td>NCONTAINS</td> <td>Not Contains</td> </tr> </tbody> </table> </div>'
        required: false
        style: form
        explode: true
        schema:
          type: string
          exampleSetFlag: true
      - name: filterType
        in: query
        description: The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the parameter
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - AND
          - OR
      responses:
        '200':
          description: Fetched list of all system certificates
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SystemCertGetAllRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/system-certificate/{hostName}/{id}:
    get:
      tags:
      - Certificates
      summary: Get system certificate of a particular node by ID
      description: This API provides details of a system certificate of a particular node based on given hostname and ID.
      operationId: getSystemCertificateById
      parameters:
      - name: hostName
        in: path
        description: Name of the host of which system certificates should be returned
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: id
        in: path
        description: ID of the system certificate
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Fetched system certificate of given ID
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SystemCertGetByIdRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
    put:
      tags:
      - Certificates
      summary: Update data for existing system certificate
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Update a System Certificate.</h3> <b>NOTE: </b>Renewing a certificate causes an application server restart on the selected node.<br> <b>NOTE: </b>Request parameters accepting True and False as input can be replaced by 1 and 0 respectively.<br> <h4>Following parameters are used in the POST body</h4> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>name</td> <td>Friendly name of the certificate.</td> <td>"name": "System Certificate"</td> </tr> <tr> <td>description</td> <td>Description of the certificate</td> <td>"description": "Description of certificate"</td> </tr> <tr> <td>admin</td> <td>Use certificate to authenticate the Cisco ISE Admin Portal</td> <td>"admin": false</td> </tr> <tr> <td>eap</td> <td>Use certificate for EAP protocols that use SSL/TLS tunneling</td> <td>"eap": false</td> </tr> <tr> <td>radius</td> <td>Use certificate for RADSec server</td> <td>"radius": false</td> </tr> <tr> <td>pxgrid</td> <td>Use certificate for the pxGrid Controller</td> <td>"pxgrid": false</td> </tr> <tr> <td>ims</td> <td>Use certificate for the Cisco ISE Messaging Service</td> <td>"ims": false</td> </tr> <tr> <td>saml</td> <td>Use certificate for SAML Signing</td> <td>"saml": false</td> </tr> <tr> <td>portal</td> <td>Use certificate for portal</td> <td>"portal": false</td> </tr> <tr> <td>portalGroupTag</td> <td>Portal Group Tag for using certificate with portal role</td> <td>"portalGroupTag": "Default Portal Certificate Group"</td> </tr> <tr> <td>allowReplacementOfPortalGroupTag<sup><font color=red>*required</font></sup></td> <td>Allow Replacement of Portal Group Tag.</td> <td>"allowReplacementOfPortalGroupTag": true</td> </tr> <tr> <td>allowRoleTransferForSameSubject<sup><font color=red>*required</font></sup></td> <td>Allow transfer of roles to certificates with same subject.</td> <td>"allowRoleTransferForSameSubject": true</td> </tr> <tr> <td>allowPortalTagTransferForSameSubject<sup><font color=red>*required</font></sup></td> <td>Acquire group tag of the matching certificate.</td> <td>"allowPortalTagTransferForSameSubject": true</td> </tr> <tr> <td>renewSelfSignedCertificate</td> <td>Renew Self-signed Certificate</td> <td>"renewSelfSignedCertificate": false</td> </tr> <tr> <td>expirationTTLPeriod</td> <td>Expiration Period</td> <td>"expirationTTLPeriod": 365</td> </tr> <tr> <td>expirationTTLUnits</td> <td>Expiration Units in one of the below formats <ul> <li>days / weeks / months / years</li> </ul> </td> <td>"expirationTTLUnits": "days"</td> </tr> </tbody> </table> <br/> <h4>Following roles can be used in any combinations</h4> <table class="certTable"> <thead> <tr> <th>ROLE</th> <th>DEFAULT</th> <th>WARNING</th> </tr> </thead> <tbody> <tr> <td>Admin</td> <td>False</td> <td>Enabling Admin role for this certificate causes an application server restart on the selected node.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates</td> </tr> <tr> <td>EAP Authentication</td> <td>False</td> <td>Only one system certificate can be used for EAP. Assigning EAP to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates</td> </tr> <tr> <td>RADIUS DTLS</td> <td>False</td> <td>Only one system certificate can be used for DTLS. Assigning DTLS to this certificate removes the assignment from another certificate.<br/><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates</td> </tr> <tr> <td>SAML</td> <td>False</td> <td>SAML cannot be used with other usage. Enabling SAML unchecks all other usage.</br><b>Note:</b> Make sure that the required certificate chain is imported under Trusted Certificates</td> </tr> </tbody> </table> '
      operationId: updateSystemCert
      parameters:
      - name: id
        in: path
        description: ID of the System Certificate to be updated
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: hostName
        in: path
        description: Name of host whose certificate needs to be updated
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateSystemCertRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Created Certificate
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateSystemCertRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '406':
          description: Not Acceptable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '409':
          description: Certificate already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '417':
          description: Requried parameters missing expectation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '422':
          description: The request was well-formed but was unable to be followed due to semantic errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
    delete:
      tags:
      - Certificates
      summary: Delete System Certificate by ID and hostname
      description: This API deletes a system certificate of a particular node based on the given hostname and ID.
      operationId: deleteSystemCertificateById
      parameters:
      - name: hostName
        in: path
        description: Name of the host from which system certificate needs to be deleted
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      - name: id
        in: path
        description: ID of the system certificate to be deleted
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DeleteSystemCertRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Deleted the System Certificate of given ID.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteSystemCertRespPayload'
                exampleSetFlag: false
        '204':
          description: No Content
        '400':
          description: Given hostname or certificate ID not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteSystemCertRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
      security:
      - BasicAuth: []
  /api/v1/certs/trusted-certificate:
    get:
      tags:
      - Certificates
      summary: Get list of all trusted certificates
      description: '<p style="font-size: 15px;"> This API supports Filtering, Sorting and Pagination. </p><br/> <p style="font-size: 14px;">Filtering and Sorting are supported for the following attributes: </p>    <ul style="font-size: 14px;">        <li>friendlyName</li>        <li>subject</li>        <li>issuedTo</li>        <li>issuedBy</li>        <li>validFrom</li>         <ul>          <li>Supported Date Format: yyyy-MM-dd HH:mm:ss</li>          <li>Supported Operators: EQ, NEQ, GT and LT</li>         </ul>        <li>expirationDate</li>         <ul>          <li>Supported Date Format: yyyy-MM-dd HH:mm:ss</li>          <li>Supported Operators: EQ, NEQ, GT and LT</li>         </ul>        <li>status</li>         <ul>          <li>Allowed values: enabled, disabled</li>          <li>Supported Operators: EQ, NEQ</li>         </ul>      </ul>      <br>    <b>Note: </b> ISE internal CA certificates will not be exported. '
      operationId: getTrustedCertificates
      parameters:
      - name: page
        in: query
        description: Page number
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: size
        in: query
        description: Number of objects returned per page
        required: false
        style: form
        schema:
          type: integer
          format: int32
          exampleSetFlag: true
      - name: sort
        in: query
        description: sort type - asc or desc
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - asc
          - desc
      - name: sortBy
        in: query
        description: sort column by which objects needs to be sorted
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
      - name: filter
        in: query
        description: '<div> <style type="text/css" scoped> .apiServiceTable td, .apiServiceTable th { padding: 5px 10px !important; text-align: left; } </style> <span> <b>Simple filtering</b> should be available through the filter query string parameter. The structure of a filter is a triplet of field operator and value separated with dots. More than one filter can be sent. The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the <i>"filterType=or"</i> query string parameter. Each resource Data model description should specify if an attribute is a filtered field. </span> <br /> <table class="apiServiceTable"> <thead> <tr> <th>OPERATOR</th> <th>DESCRIPTION</th> </tr> </thead> <tbody> <tr> <td>EQ</td> <td>Equals</td> </tr> <tr> <td>NEQ</td> <td>Not Equals</td> </tr> <tr> <td>GT</td> <td>Greater Than</td> </tr> <tr> <td>LT</td> <td>Less Then</td> </tr> <tr> <td>STARTSW</td> <td>Starts With</td> </tr> <tr> <td>NSTARTSW</td> <td>Not Starts With</td> </tr> <tr> <td>ENDSW</td> <td>Ends With</td> </tr> <tr> <td>NENDSW</td> <td>Not Ends With</td> </tr> <tr> <td>CONTAINS</td> <td>Contains</td> </tr> <tr> <td>NCONTAINS</td> <td>Not Contains</td> </tr> </tbody> </table> </div>'
        required: false
        style: form
        explode: true
        schema:
          type: string
          exampleSetFlag: true
      - name: filterType
        in: query
        description: The logical operator common to ALL filter criteria will be by default AND, and can be changed by using the parameter
        required: false
        style: form
        schema:
          type: string
          exampleSetFlag: true
          enum:
          - AND
          - OR
      responses:
        '200':
          description: Fetched list of all trusted certificates
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrustCertGetAllRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
  /api/v1/certs/trusted-certificate/export/{id}:
    get:
      tags:
      - Certificates
      summary: Export a trust certificate by a given certificate ID
      description: The response of this API carries a trusted certificate file mapped to the requested ID.
      operationId: exportTrustedCert
      parameters:
      - name: id
        in: path
        description: ID of the Trusted Certificate to be exported.
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Exported Trusted Certificate successfully
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/Resource'
                exampleSetFlag: false
        '400':
          description: Bad Request
          content:
            application/octet-stream:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
  /api/v1/certs/trusted-certificate/import:
    post:
      tags:
      - Certificates
      summary: Add root certificate to the Cisco ISE truststore
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Import an X509 certificate as a trust certificate</h3><br> <p><b>NOTE: </b>Request parameters accepting True and False as input can be replaced by 1< and 0< respectively.<br> Following parameters are used in the POST body:</p> <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>name</td> <td>Friendly name of the certificate</td> <td>"name": "Trust Certificate"</td> </tr> <tr> <td>description</td> <td>Description of the certificate</td> <td>"description": "Imported Trust Certificate"</td> </tr> <tr> <td>data<sup><font color=red>*required</font></sup></td> <td> Plain-text contents of the certificate file. Every space needs to be replaced with a newline escape sequence (\n).<br/> Use the command <cmd>awk &apos;NF {sub(/\r/, ""); printf "%s\\n",$0;}&apos; &lt;&lt;your .pem file&gt;&gt;</cmd> to extract data from the certificate file. </td> <td>"data": "Plain-text contents of the certificate file."</td> </tr> <tr> <td>allowOutOfDateCert<sup><font color=red>*required</font></sup></td> <td> Allow out of date certificates.</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowOutOfDateCert</b> as <b>false</b> to avoid the import of expired certificates (not secure). </td> <td>"allowOutOfDateCert": true</td> </tr> <tr> <td>allowSHA1Certificates<sup><font color=red>*required</font></sup></td> <td> Allow import of certificate with signature that uses SHA-1 hashing algorithm and is considered less secure.</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowSHA1Certificates</b> as <b>false</b> to avoid the import of SHA1 based certificates (less secure). </td> <td>"allowSHA1Certificates": true</td> </tr> <tr> <td>allowBasicConstraintCAFalse<sup><font color=red>*required</font></sup></td> <td> Allow certificates with Basic Constraints CA Field as False.</br> <b>SECURITY ALERT: </b>We recommend to set the parameter <b>allowBasicConstraintCAFalse</b> as <b>false</b> to avoid the import of certificates with <b>Basic Constraints CA Field</b> set as <b>False</b> (not Secure). </td> <td>"allowBasicConstraintCAFalse": true</td> </tr> <tr> <td>trustForIseAuth</td> <td>Trust for authentication within Cisco ISE</td> <td>"trustForIseAuth": false</td> </tr> <tr> <td>trustForClientAuth</td> <td>Trust for client authentication and syslog</td> <td>"trustForClientAuth": false</td> </tr> <tr> <td>trustForCertificateBasedAdminAuth</td> <td>Trust for certificate based admin authentication</td> <td>"trustForCertificateBasedAdminAuth": false</td> </tr> <tr> <td>trustForCiscoServicesAuth</td> <td>Trust for authentication of Cisco services</td> <td>"trustForCiscoServicesAuth": false</td> </tr> <tr> <td>validateCertificateExtensions</td> <td>Validate extensions for trust certificate</td> <td>"validateCertificateExtensions": false</td> </tr> </tbody> </table></br> <p><b>NOTE</b>: If <b>name</b> is not set, a default name with the following format is used where <b>nnnnn</b> is a unique number: </br> <b>- common-name#issuer#nnnnn</b></br> You can always change the friendly name later by editing the certificate.</p> <hr/> <p>You must choose how this certificate is trusted in Cisco ISE. The objective here is to distinguish between certificates that are used for trust within a Cisco ISE deployment and public certificates that are used to trust Cisco services. We recommend not using a given certificate for both purposes.</p> <table class="certTable"> <thead> <tr> <th>Trusted For</th> <th>Usage</th> </tr> </thead> <tbody> <tr> <td>Authentication within Cisco ISE</td> <td>Use <b>"trustForIseAuth":true</b> if the certificate is used for trust within Cisco ISE, such as for secure communication between Cisco ISE nodes</td> </tr> <tr> <td>Client authentication and Syslog</td> <td>Use <b>"trustForClientAuth":true</b> if the certificate is to be used for authentication of endpoints that contact Cisco ISE over the EAP protocol. This is also used if the certificate is used to trust a Syslog server. Make sure to have keyCertSign bit asserted under KeyUsage extension for this certificate.</br> <b>Note:</b> "" can be set true only if the "trustForIseAuth" has been set true.</td> </tr> <tr> <td>Certificate based admin authentication</td> <td>Use <b>"trustForCertificateBasedAdminAuth":true</b> if the certificate is used for trust within Cisco ISE, such as for secure communication between Cisco ISE nodes</br> <b>Note:</b><b>trustForCertificateBasedAdminAuth</b> can be set true only if both <b>trustForIseAuth</b> and <b>trustForClientAuth</b> are true.</td></td> </tr> <tr> <td>Authentication of Cisco Services</td> <td> Use <b>"trustForCiscoServicesAuth":true</b> if the certificate is to be used for trusting external Cisco services, such as Feed Service.</td> </tr> </tbody> </table> '
      operationId: importTrustCert
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TrustCert'
              exampleSetFlag: false
      responses:
        '200':
          description: Imported trust certificate successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ImportTrustCertRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '405':
          description: Invalid Input
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '409':
          description: Certificate Already Exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '417':
          description: Requried parameters missing; expectation failed
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '422':
          description: The request was well-formed but was unable to be followed due to semantic errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
  /api/v1/certs/trusted-certificate/{id}:
    get:
      tags:
      - Certificates
      summary: Get Trust Certificate By ID
      description: This API can displays details of a Trust Certificate based on a given ID.
      operationId: getTrustedCertificateById
      parameters:
      - name: id
        in: path
        description: ID of the trust certificate
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Fetched trust certificate of given ID
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TrustCertGetByIdRsp'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
      security:
      - BasicAuth: []
    put:
      tags:
      - Certificates
      summary: Update the trust certificate already present in the Cisco ISE trust store
      description: ' <style type="text/css" scoped> .certTable td , .certTable th { padding: 5px 10px !important; text-align: left;} </style> <h3>Update a trusted certificate present in Cisco ISE trust store.</h3> The following parameters are used in the PUT request body <table class="certTable"> <thead> <tr> <th>PARAMETER</th> <th>DESCRIPTION</th> <th>EXAMPLE</th> </tr> </thead> <tbody> <tr> <td>name<sup><font color=red>*required</font></sup></td> <td>Friendly name of the certificate.</td> <td>"name": "Trust Certificate"</td> </tr> <tr> <td>status</td> <td>Status of the certificate</td> <td>"status": "Enabled"</td> </tr> <tr> <td>description</td> <td>Description of the certificate</td> <td>"description": "Certificate for secure connection to cisco.com"</td> </tr> <tr> <td>trustForIseAuth</td> <td>Trust for authentication within Cisco ISE</td> <td>"trustForIseAuth": false</td> </tr> <tr> <td>trustForClientAuth</td> <td>Trust for client authentication and Syslog</td> <td>"trustForClientAuth": false</td> </tr> <tr> <td>trustForCertificateBasedAdminAuth</td> <td>Trust for certificate based Admin authentication</td> <td>"trustForCertificateBasedAdminAuth": false</td> </tr> <tr> <td>trustForCiscoServicesAuth</td> <td>Trust for authentication of Cisco Services</td> <td>"trustForCiscoServicesAuth": false</td> </tr> <tr> <td>enableOCSPValidation</td> <td>Switch to enable or disable OCSP Validation</td> <td>"enableOCSPValidation": false</td> </tr> <tr> <td>selectedOCSPService</td> <td>Name of selected OCSP Service</td> <td>"selectedOCSPService": "INTERNAL_OCSP_SERVICE"</td> </tr> <tr> <td>rejectIfNoStatusFromOCSP</td> <td>Switch to reject certificate if there is no status from OCSP</td> <td>"rejectIfNoStatusFromOCSP": false</td> </tr> <tr> <td>rejectIfUnreachableFromOCSP</td> <td>Switch to reject certificate if unreachable from OCSP</td> <td>"rejectIfUnreachableFromOCSP": false</td> </tr> <tr> <td>downloadCRL</td> <td>Switch to enable or disable download of CRL</td> <td>"downloadCRL": false</td> </tr> <tr> <td>crlDistributionUrl</td> <td>Certificate Revocation List Distribution URL</td> <td>"crlDistributionUrl": "CRL distribution URL"</td> </tr> <tr> <td>automaticCRLUpdate</td> <td>Switch to enable or disable automatic CRL update</td> <td>"automaticCRLUpdate": false</td> </tr> <tr> <td>automaticCRLUpdatePeriod</td> <td>Automatic CRL update period</td> <td>"automaticCRLUpdatePeriod": 5</td> </tr> <tr> <td>automaticCRLUpdateUnits</td> <td>Unit of time for automatic CRL update</td> <td>"automaticCRLUpdateUnits": "Minutes"</td> </tr> <tr> <td>nonAutomaticCRLUpdatePeriod</td> <td>Non automatic CRL update period</td> <td>"nonAutomaticCRLUpdatePeriod": 1</td> </tr> <tr> <td>nonAutomaticCRLUpdateUnits</td> <td>Unit of time of non automatic CRL update</td> <td>"nonAutomaticCRLUpdateUnits": "Hours"</td> </tr> <tr> <td>crlDownloadFailureRetries</td> <td>If CRL download fails, wait time before retry</td> <td>"crlDownloadFailureRetries": 10</td> </tr> <tr> <td>crlDownloadFailureRetriesUnits</td> <td>Unit of time before retry if CRL download fails</td> <td>"crlDownloadFailureRetriesUnits": "Minutes"</td> </tr> <tr> <td>enableServerIdentityCheck</td> <td>Switch to enable or disable verification if HTTPS or LDAP server certificate name fits the configured server URL</td> <td>"enableServerIdentityCheck": false</td> </tr> <tr> <td>authenticateBeforeCRLReceived</td> <td>Switch to enable or disable CRL Verification if CRL is not Received</td> <td>"authenticateBeforeCRLReceived": false</td> </tr> <tr> <td>ignoreCRLExpiration</td> <td>Switch to enable or disable ignore CRL Expiration</td> <td>"ignoreCRLExpiration": false</td> </tr> </tbody> </table></br> <hr/> <table class="certTable"> <thead> <tr> <th>Trusted For</th> <th>Usage</th> </tr> </thead> <tbody> <tr> <td>Authentication within Cisco ISE</td> <td>Use <b>"trustForIseAuth":true</b> if the certificate is used for trust within Cisco ISE, such as for secure communication between Cisco ISE nodes</td> </tr> <tr> <td>Client authentication and Syslog</td> <td>Use <b>"trustForClientAuth":true</b> if the certificate is to be used for authentication of endpoints that contact Cisco ISE over the EAP protocol. Also check this box if certificate is used to trust a Syslog server. Make sure to have keyCertSign bit asserted under KeyUsage extension for this certificate.</br> <b>Note:</b> "trustForClientAuth" can be set true only if "trustForIseAuth" has been set true.</td> </tr> <tr> <td>Certificate based admin authentication</td> <td>Use <b>"trustForCertificateBasedAdminAuth":true</b> if the certificate is used for trust within Cisco ISE, such as for secure communication between Cisco ISE nodes</br> <b>Note:</b> "trustForCertificateBasedAdminAuth" can be set true only if "trustForIseAuth" and "trustForClientAuth" are true.</td></td> </tr> <tr> <td>Authentication of Cisco Services</td> <td> Use <b>"trustForCiscoServicesAuth":true</b> if the certificate is to be used for trusting external Cisco services, such as Feed Service.</td> </tr> </tbody> </table> <table class="certTable"> <thead> <tr> <th>OCSP Configuration</th> <th>Usage</th> </tr> </thead> <tbody> <tr> <td>Validation against OCSP service</td> <td>Use <b>"enableOCSPValidation":true</b> to validate the certificate against OCSP service mentioned in the field <b>selectedOCSPService</b>.</td> </tr> <tr> <td>OCSP Service name</td> <td>Use <b>"selectedOCSPService":"Name of OCSP Service"</b> to mention the OCSP service name against which the certificate should be validated.</br> <b>Note:</b> <b>selectedOCSPService</b> value is used if <b>enableOCSPValidation</b> has been set true.</td> </tr> <tr> <td>Reject the request if OCSP returns UNKNOWN status</td> <td>Use <b>"rejectIfNoStatusFromOCSP":true</b> to reject the certificate if the OCSP service returns UNKNOWN status.</br> <b>Note:</b> <b>"rejectIfNoStatusFromOCSP":true</b> can be used only if the parameter <b>enableOCSPValidation</b> has been set true.</td> </tr> <tr> <td>Reject the request if OCSP Responder is unreachable</td> <td> Use <b>"rejectIfUnreachableFromOCSP":true</b> to reject the certificate if the OCSP service is unreachable.</br> <b>Note:</b> <b>"rejectIfUnreachableFromOCSP":true</b> can be used only if <b>enableOCSPValidation</b> has been set true.</td> </tr> </tbody> </table> <table class="certTable"> <thead> <tr> <th>Certificate Revocation List Configuration</th> <th>Usage</th> </tr> </thead> <tbody> <tr> <td>Validation against CRL</td> <td>Use <b>"downloadCRL":true</b> to validate the certificate against CRL downloaded from URL mentioned in the field <b>crlDistributionUrl</b></td> </tr> <tr> <td>CRL distribution url</td> <td>Use <b>"crlDistributionUrl"</b> to specify the URL from where the CRL should be downloaded</br> <b>Note:</b> "crlDistributionUrl" value is used if "downloadCRL" has been set true.</td> </tr> <tr> <td>Retrieve CRL time</td> <td>Use <b>"automaticCRLUpdate":true</b>, <b>automaticCRLUpdatePeriod</b>, and <b>automaticCRLUpdatePeriod</b> to set the time before which CRL is automatically retrieved prior to expiration</br> Use <b>nonAutomaticCRLUpdatePeriod</b> and <b>nonAutomaticCRLUpdateUnits</b> to set the time period for CRL retrieval in loop.<br> <b>Note:</b> All the above fields can be used only if <b>"downloadCRL"</b> has been set true.</td> </tr> <tr> <td>If download fails</td> <td>Use <b>"crlDownloadFailureRetries" and "crlDownloadFailureRetriesUnits"</b> to set retry time period if CRL download fails</br> <b>Note:</b><b>crlDownloadFailureRetries</b> and <b>crlDownloadFailureRetriesUnits</b> can be used only if <b>downloadCRL</b> has been set true.</td> </tr> <tr> <td>Enable Server Identity Check</td> <td>Use <b>"enableServerIdentityCheck":true</b> to verify that HTTPS or LDAPS server certificate name fits the configured server URL</br> <b>Note:</b><b>"enableServerIdentityCheck":true</b> can be used only if <b>downloadCRL</b> has been set true.</td> </tr> <tr> <td>Bypass CRL Verification if CRL is not Received</td> <td>Use <b>"authenticateBeforeCRLReceived":true</b> to bypass CRL Verification if CRL is not Received</br> <b>Note:</b><b>"authenticateBeforeCRLReceived":true can be used only if <b>downloadCRL</b> has been set true.</td> </tr> <tr> <td>Ignore that CRL is not yet valid or has expired</td> <td> Use <b>"ignoreCRLExpiration":true</b> to ignore if CRL is not yet valid or expired</br> <b>Note:</b><b>"ignoreCRLExpiration":true</b> can be used only if <b>downloadCRL</b> has been set true.</td> </tr> </tbody> </table> <br> <b>Note: </b>boolean properties accept integers values as well, with 0 considered as false and other values being considered as true '
      operationId: updateTrustedCertificate
      parameters:
      - name: id
        in: path
        description: ID of the trust certificate
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateTrustCertRequest'
              exampleSetFlag: false
      responses:
        '200':
          description: Update Trust Certificate Successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTrustCertRespPayload'
                exampleSetFlag: false
        '201':
          description: Created
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTrustCertRespPayload'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Not Found
        '422':
          description: Unprocessable entity
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UpdateTrustCertRespPayload'
                exampleSetFlag: false
      security:
      - BasicAuth: []
    delete:
      tags:
      - Certificates
      summary: Delete a trusted certificate based on a given ID
      description: This API deletes a Trust Certificate from Trusted Certificate Store based on a given ID.
      operationId: deleteTrustedCertificateById
      parameters:
      - name: id
        in: path
        description: ID of the Trusted Certificate to be deleted
        required: true
        style: simple
        schema:
          type: string
          exampleSetFlag: true
      responses:
        '200':
          description: Deleted Trusted Certificate of the given ID.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DeleteTrustedCertRespPayload'
                exampleSetFlag: false
        '204':
          description: No Content
        '400':
          description: Bad request while deleting the trusted cert.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Trusted Certificate with given ID is not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
                exampleSetFlag: false
      security:
      - BasicAuth: []
components:
  schemas:
    DeleteTrustedCertRespPayload:
      title: DeleteTrustedCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/DeleteTrustedCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    ExportCSRFailResponse:
      title: ExportCSRFailResponse
      type: object
      properties:
        message:
          type: string
          description: Response message on failure of export CSR
          exampleSetFlag: true
      exampleSetFlag: false
    BindCSRRequest:
      title: BindCSRRequest
      required:
      - allowExtendedValidity
      - allowOutOfDateCert
      - allowReplacementOfCertificates
      - allowReplacementOfPortalGroupTag
      - data
      - hostName
      - id
      type: object
      properties:
        admin:
          type: boolean
          description: ' Use certificate to authenticate the Cisco ISE Admin Portal'
          example: false
          exampleSetFlag: true
        allowExtendedValidity:
          type: boolean
          description: 'Allow import of certificates with validity greater than 398 days '
          example: true
          exampleSetFlag: true
        allowOutOfDateCert:
          type: boolean
          description: 'Allow out of date certificates '
          example: true
          exampleSetFlag: true
        allowReplacementOfCertificates:
          type: boolean
          description: 'Allow Replacement of certificates '
          example: true
          exampleSetFlag: true
        allowReplacementOfPortalGroupTag:
          type: boolean
          description: 'Allow Replacement of Portal Group Tag '
          example: true
          exampleSetFlag: true
        data:
          type: string
          description: 'Signed certificate data '
          example: Plain-text contents of the signed certificate file.
          exampleSetFlag: true
        eap:
          type: boolean
          description: Use certificate for EAP protocols that use SSL/TLS tunneling
          example: false
          exampleSetFlag: true
        hostName:
          type: string
          description: 'Name of Host whose CSR ID has been provided '
          example: Host Name
          exampleSetFlag: true
        id:
          type: string
          description: 'ID of the generated CSR '
          example: CSR ID
          exampleSetFlag: true
        ims:
          type: boolean
          description: Use certificate for the Cisco ISE Messaging Service
          example: false
          exampleSetFlag: true
        name:
          type: string
          description: Friendly Name of the certificate
          example: CA Signed Certificate
          exampleSetFlag: true
        portal:
          type: boolean
          description: Use for portal
          example: false
          exampleSetFlag: true
        portalGroupTag:
          type: string
          description: Set Group tag
          example: Default Portal Certificate Group
          exampleSetFlag: true
        pxgrid:
          type: boolean
          description: Use certificate for the pxGrid Controller
          example: false
          exampleSetFlag: true
        radius:
          type: boolean
          description: Use certificate for the RADSec server
          example: false
          exampleSetFlag: true
        saml:
          type: boolean
          description: Use certificate for SAML Signing
          example: false
          exampleSetFlag: true
        validateCertificateExtensions:
          type: boolean
          description: Validate Certificate Extensions
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    DeleteSystemCertRespPayload:
      title: DeleteSystemCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/DeleteSystemCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    CSRGetByIdRsp:
      title: CSRGetByIdRsp
      type: object
      properties:
        response:
          $ref: '#/components/schemas/CSRByIdResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    SystemCertificateResponse:
      title: SystemCertificateResponse
      type: object
      properties:
        expirationDate:
          type: string
          description: Time and date past which the certificate is no longer valid
          exampleSetFlag: true
        friendlyName:
          type: string
          description: Friendly name of system certificate
          exampleSetFlag: true
        groupTag:
          type: string
          exampleSetFlag: true
        id:
          type: string
          description: ID of system certificate
          exampleSetFlag: true
        issuedBy:
          type: string
          description: Common Name of the certificate issuer
          exampleSetFlag: true
        issuedTo:
          type: string
          description: Common Name of the certificate subject
          exampleSetFlag: true
        keySize:
          type: integer
          description: Length of the key used for encrypting system certificate
          format: int32
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        portalsUsingTheTag:
          type: string
          exampleSetFlag: true
        selfSigned:
          type: boolean
          example: false
          exampleSetFlag: true
        serialNumberDecimalFormat:
          type: string
          description: Used to uniquely identify the certificate within a CA's systems
          exampleSetFlag: true
        sha256Fingerprint:
          type: string
          exampleSetFlag: true
        signatureAlgorithm:
          type: string
          exampleSetFlag: true
        usedBy:
          type: string
          exampleSetFlag: true
        validFrom:
          type: string
          description: Time and date on which the certificate was created, also known as the Not Before certificate attribute
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateSystemCertResponse:
      title: UpdateSystemCertResponse
      type: object
      properties:
        id:
          type: string
          description: ID of the imported trust certificate
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        message:
          type: string
          description: Response message on import of system or trust certificate
          exampleSetFlag: true
        status:
          type: string
          description: HTTP response status after import
          exampleSetFlag: true
      exampleSetFlag: false
    DeleteSystemCertResponse:
      title: DeleteSystemCertResponse
      type: object
      properties:
        message:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    BindCSRRespPayload:
      title: BindCSRRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/BindCSRResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    TrustCertificateResponse:
      title: TrustCertificateResponse
      type: object
      properties:
        authenticateBeforeCRLReceived:
          type: string
          description: Switch to enable or disable authentication before receiving CRL
          exampleSetFlag: true
        automaticCRLUpdate:
          type: string
          description: Switch to enable or disable automatic CRL update
          exampleSetFlag: true
        automaticCRLUpdatePeriod:
          type: string
          description: Automatic CRL update period
          exampleSetFlag: true
        automaticCRLUpdateUnits:
          type: string
          description: Unit of time of automatic CRL update
          exampleSetFlag: true
        crlDistributionUrl:
          type: string
          description: CRL Distribution URL
          exampleSetFlag: true
        crlDownloadFailureRetries:
          type: string
          description: If CRL download fails, wait time before retry
          exampleSetFlag: true
        crlDownloadFailureRetriesUnits:
          type: string
          description: Unit of time before retry if CRL download fails
          exampleSetFlag: true
        description:
          type: string
          description: Description of trust certificate
          exampleSetFlag: true
        downloadCRL:
          type: string
          description: Switch to enable or disable download of CRL
          exampleSetFlag: true
        enableOCSPValidation:
          type: string
          description: Switch to enable or disable OCSP Validation
          exampleSetFlag: true
        enableServerIdentityCheck:
          type: string
          description: Switch to enable or disable Server Identity Check
          exampleSetFlag: true
        expirationDate:
          type: string
          description: The time and date past which the certificate is no longer valid
          exampleSetFlag: true
        friendlyName:
          type: string
          description: Friendly name of trust certificate
          exampleSetFlag: true
        id:
          type: string
          description: ID of trust certificate
          exampleSetFlag: true
        ignoreCRLExpiration:
          type: string
          description: Switch to enable or disable ignore CRL Expiration
          exampleSetFlag: true
        internalCA:
          type: boolean
          example: false
          exampleSetFlag: true
        issuedBy:
          type: string
          description: The entity that verified the information and signed the certificate
          exampleSetFlag: true
        issuedTo:
          type: string
          description: Entity to which trust certificate is issued
          exampleSetFlag: true
        keySize:
          type: string
          description: Length of the key used for encrypting trust certificate
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        nonAutomaticCRLUpdatePeriod:
          type: string
          description: Non automatic CRL update period
          exampleSetFlag: true
        nonAutomaticCRLUpdateUnits:
          type: string
          description: Unit of time of non automatic CRL update
          exampleSetFlag: true
        rejectIfNoStatusFromOCSP:
          type: string
          description: Switch to reject certificate if there is no status from OCSP
          exampleSetFlag: true
        rejectIfUnreachableFromOCSP:
          type: string
          description: Switch to reject certificate if unreachable from OCSP
          exampleSetFlag: true
        selectedOCSPService:
          type: string
          description: Name of selected OCSP Service
          exampleSetFlag: true
        serialNumberDecimalFormat:
          type: string
          description: Used to uniquely identify the certificate within a CA's systems
          exampleSetFlag: true
        sha256Fingerprint:
          type: string
          exampleSetFlag: true
        signatureAlgorithm:
          type: string
          description: Algorithm used for encrypting trust certificate
          exampleSetFlag: true
        status:
          type: string
          exampleSetFlag: true
        subject:
          type: string
          description: The Subject or entity with which public key of trust certificate is associated
          exampleSetFlag: true
        trustedFor:
          type: string
          description: Different services for which the certificated is trusted
          exampleSetFlag: true
        validFrom:
          type: string
          description: The earliest time and date on which the certificate is valid
          exampleSetFlag: true
      exampleSetFlag: false
    BindCSRResponse:
      title: BindCSRResponse
      type: object
      properties:
        message:
          type: string
          exampleSetFlag: true
        status:
          type: string
          description: Response status after import
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateTrustCertResponse:
      title: UpdateTrustCertResponse
      type: object
      properties:
        id:
          type: string
          description: ID of the trust certificate
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        message:
          type: string
          description: Response message on successful update of trust certificate
          exampleSetFlag: true
      exampleSetFlag: false
    DeleteTrustedCertResponse:
      title: DeleteTrustedCertResponse
      type: object
      properties:
        message:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    RegenerateRootCaResponse:
      title: RegenerateRootCaResponse
      type: object
      properties:
        id:
          type: string
          description: ID which can be used to track the status of Cisco ISE root CA chain regeneration
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        message:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateCSRRespPayload:
      title: GenerateCSRRespPayload
      type: object
      properties:
        response:
          type: array
          exampleSetFlag: true
          items:
            $ref: '#/components/schemas/GenerateCSRResponse'
            exampleSetFlag: false
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    DeleteCSRResponse:
      title: DeleteCSRResponse
      type: object
      properties:
        message:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    CSRByIdResponse:
      title: CSRByIdResponse
      type: object
      properties:
        csrContents:
          type: string
          description: Contents of the certificate file.
          exampleSetFlag: true
        friendlyName:
          type: string
          description: Friendly name of the certificate.
          exampleSetFlag: true
        groupTag:
          type: string
          description: GroupTag of the certificate.
          exampleSetFlag: true
        hostName:
          type: string
          description: Hostname or IP address of the Cisco ISE node.
          exampleSetFlag: true
        id:
          type: string
          description: ID of the certificate.
          exampleSetFlag: true
        keySize:
          type: string
          description: Size of the cryptographic key used.
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        sanNames:
          type: string
          description: String representation of subject alternative names.
          exampleSetFlag: true
        signatureAlgorithm:
          type: string
          description: Algorithm used for encrypting CSR
          exampleSetFlag: true
        subject:
          type: string
          description: Subject of the certificate. Includes Common Name (CN), Organizational Unit (OU), etc.
          exampleSetFlag: true
        timeStamp:
          type: string
          description: Timestamp of the certificate generation.
          exampleSetFlag: true
        usedFor:
          type: string
          description: Services for which the certificate is used for (for eg- MGMT, GENERIC).
          exampleSetFlag: true
      exampleSetFlag: false
    Error:
      title: Error
      required:
      - message
      - status
      type: object
      properties:
        message:
          type: string
          exampleSetFlag: true
        status:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    RegenerateRootCaRespPayload:
      title: RegenerateRootCaRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/RegenerateRootCaResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    SystemCertGetAllRsp:
      title: SystemCertGetAllRsp
      type: object
      properties:
        nextPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        previousPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        response:
          type: array
          exampleSetFlag: true
          items:
            $ref: '#/components/schemas/SystemCertificateResponse'
            exampleSetFlag: false
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    SystemCert:
      title: SystemCert
      required:
      - allowExtendedValidity
      - allowOutOfDateCert
      - allowPortalTagTransferForSameSubject
      - allowReplacementOfCertificates
      - allowReplacementOfPortalGroupTag
      - allowRoleTransferForSameSubject
      - allowSHA1Certificates
      - data
      - privateKeyData
      type: object
      properties:
        admin:
          type: boolean
          description: Use certificate to authenticate the Cisco ISE Admin Portal
          example: false
          exampleSetFlag: true
        allowExtendedValidity:
          type: boolean
          description: 'Allow import of certificates with validity greater than 398 days '
          example: true
          exampleSetFlag: true
        allowOutOfDateCert:
          type: boolean
          description: 'Allow out of date certificates '
          example: true
          exampleSetFlag: true
        allowPortalTagTransferForSameSubject:
          type: boolean
          description: Allow overwriting the portal tag from matching certificate of same subject
          example: true
          exampleSetFlag: true
        allowReplacementOfCertificates:
          type: boolean
          description: 'Allow Replacement of certificates '
          example: true
          exampleSetFlag: true
        allowReplacementOfPortalGroupTag:
          type: boolean
          description: 'Allow Replacement of Portal Group Tag '
          example: true
          exampleSetFlag: true
        allowRoleTransferForSameSubject:
          type: boolean
          description: 'Allow transfer of roles for certificate with matching subject '
          example: true
          exampleSetFlag: true
        allowSHA1Certificates:
          type: boolean
          description: 'Allow SHA1 based certificates '
          example: true
          exampleSetFlag: true
        allowWildCardCertificates:
          type: boolean
          description: Allow Wildcard certificates
          example: false
          exampleSetFlag: true
        data:
          type: string
          description: 'Certificate Content '
          example: Plain-text contents of the certificate file.
          exampleSetFlag: true
        eap:
          type: boolean
          description: Use certificate for EAP protocols that use SSL/TLS tunneling
          example: false
          exampleSetFlag: true
        ims:
          type: boolean
          description: Use certificate for the Cisco ISE Messaging Service
          example: false
          exampleSetFlag: true
        name:
          type: string
          description: Name of the certificate
          example: System Certificate
          exampleSetFlag: true
        password:
          type: string
          description: Certificate Password .
          example: Certificate Password
          exampleSetFlag: true
        portal:
          type: boolean
          description: Use for portal
          example: false
          exampleSetFlag: true
        portalGroupTag:
          type: string
          description: Set Group tag
          example: Default Portal Certificate Group
          exampleSetFlag: true
        privateKeyData:
          type: string
          description: 'Private Key data '
          example: Plain-text contents of the certificate private key file.
          exampleSetFlag: true
        pxgrid:
          type: boolean
          description: Use certificate for the pxGrid Controller
          example: false
          exampleSetFlag: true
        radius:
          type: boolean
          description: Use certificate for the RADSec server
          example: false
          exampleSetFlag: true
        saml:
          type: boolean
          description: Use certificate for SAML Signing
          example: false
          exampleSetFlag: true
        validateCertificateExtensions:
          type: boolean
          description: Validate certificate extensions
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateSelfSignedCertResponse:
      title: GenerateSelfSignedCertResponse
      type: object
      properties:
        id:
          type: string
          description: ID of the generated self-signed system certificate
          exampleSetFlag: true
        message:
          type: string
          description: Response message on generation of self-signed system certificate
          exampleSetFlag: true
        status:
          type: string
          description: HTTP response status after import
          exampleSetFlag: true
      exampleSetFlag: false
    ExportCertRequest:
      title: ExportCertRequest
      required:
      - export
      - id
      type: object
      properties:
        export:
          type: string
          exampleSetFlag: true
          enum:
          - CERTIFICATE
          - CERTIFICATE_WITH_PRIVATE_KEY
        hostName:
          type: string
          description: Hostname of the Cisco ISE node in which self-signed certificate should be generated.
          example: ise-node-001
          exampleSetFlag: true
        id:
          type: string
          example: CERT-ID
          exampleSetFlag: true
        password:
          type: string
          example: password
          exampleSetFlag: true
      exampleSetFlag: false
    Link:
      title: Link
      type: object
      properties:
        href:
          type: string
          exampleSetFlag: true
        rel:
          type: string
          exampleSetFlag: true
          enum:
          - next
          - previous
          - self
          - status
        type:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    RenewCertRespPayload:
      title: RenewCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/RenewCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateTrustCertRespPayload:
      title: UpdateTrustCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/UpdateTrustCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    TrustCert:
      title: TrustCert
      required:
      - allowBasicConstraintCAFalse
      - allowOutOfDateCert
      - allowSHA1Certificates
      - data
      type: object
      properties:
        allowBasicConstraintCAFalse:
          type: boolean
          description: 'Allow certificates with Basic Constraints CA Field as False '
          example: true
          exampleSetFlag: true
        allowOutOfDateCert:
          type: boolean
          description: 'Allow out of date certificates '
          example: true
          exampleSetFlag: true
        allowSHA1Certificates:
          type: boolean
          description: 'Allow SHA1 based certificates '
          example: true
          exampleSetFlag: true
        data:
          type: string
          description: 'Certificate content '
          example: Plain-text contents of the certificate file.
          exampleSetFlag: true
        description:
          type: string
          description: Description of the certificate
          example: Imported Trust Certificate
          exampleSetFlag: true
        name:
          type: string
          description: Name of the certificate
          example: Trust Certificate
          exampleSetFlag: true
        trustForCertificateBasedAdminAuth:
          type: boolean
          description: Trust for Certificate based Admin authentication
          example: false
          exampleSetFlag: true
        trustForCiscoServicesAuth:
          type: boolean
          description: Trust for authentication of Cisco Services
          example: false
          exampleSetFlag: true
        trustForClientAuth:
          type: boolean
          description: Trust for client authentication and Syslog
          example: false
          exampleSetFlag: true
        trustForIseAuth:
          type: boolean
          description: Trust for authentication within Cisco ISE
          example: false
          exampleSetFlag: true
        validateCertificateExtensions:
          type: boolean
          description: Validate trust certificate extension
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    ImportTrustCertRespPayload:
      title: ImportTrustCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/ImportCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    ImportCertResponse:
      title: ImportCertResponse
      type: object
      properties:
        id:
          type: string
          description: ID of the imported trust certificate
          exampleSetFlag: true
        message:
          type: string
          description: Response message on import of system or trust certificate
          exampleSetFlag: true
        status:
          type: string
          description: HTTP response status after import
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateSystemCertRequest:
      title: UpdateSystemCertRequest
      required:
      - allowPortalTagTransferForSameSubject
      - allowReplacementOfPortalGroupTag
      - allowRoleTransferForSameSubject
      type: object
      properties:
        admin:
          type: boolean
          description: Use certificate to authenticate the Cisco ISE Admin Portal
          example: false
          exampleSetFlag: true
        allowPortalTagTransferForSameSubject:
          type: boolean
          description: Allow overwriting the portal tag from matching certificate of same subject
          example: true
          exampleSetFlag: true
        allowReplacementOfPortalGroupTag:
          type: boolean
          description: 'Allow Replacement of Portal Group Tag '
          example: true
          exampleSetFlag: true
        allowRoleTransferForSameSubject:
          type: boolean
          description: 'Allow transfer of roles for certificate with matching subject '
          example: true
          exampleSetFlag: true
        description:
          type: string
          description: Description of System Certificate
          example: Description of certificate
          exampleSetFlag: true
        eap:
          type: boolean
          description: Use certificate for EAP protocols that use SSL/TLS tunneling
          example: false
          exampleSetFlag: true
        expirationTTLPeriod:
          type: integer
          format: int32
          example: 36
          exampleSetFlag: true
        expirationTTLUnits:
          type: string
          exampleSetFlag: true
          enum:
          - days
          - months
          - weeks
          - years
        ims:
          type: boolean
          description: Use certificate for the Cisco ISE Messaging Service
          example: false
          exampleSetFlag: true
        name:
          type: string
          description: Name of the certificate
          example: System Certificate
          exampleSetFlag: true
        portal:
          type: boolean
          description: Use for portal
          example: false
          exampleSetFlag: true
        portalGroupTag:
          type: string
          description: Set Group tag
          example: Default Portal Certificate Group
          exampleSetFlag: true
        pxgrid:
          type: boolean
          description: Use certificate for the pxGrid Controller
          example: false
          exampleSetFlag: true
        radius:
          type: boolean
          description: Use certificate for the RADSec server
          example: false
          exampleSetFlag: true
        renewSelfSignedCertificate:
          type: boolean
          description: Renew Self-signed Certificate
          example: false
          exampleSetFlag: true
        saml:
          type: boolean
          description: Use certificate for SAML Signing
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    ImportSystemCertRespPayload:
      title: ImportSystemCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/ImportCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    RenewCertResponse:
      title: RenewCertResponse
      type: object
      properties:
        id:
          type: string
          description: ID which can be used to track the status of certificate regeneration
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        message:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateSelfsignedCertRequest:
      title: GenerateSelfsignedCertRequest
      required:
      - allowExtendedValidity
      - allowPortalTagTransferForSameSubject
      - allowReplacementOfCertificates
      - allowReplacementOfPortalGroupTag
      - allowRoleTransferForSameSubject
      - allowSanDnsBadName
      - allowSanDnsNonResolvable
      - digestType
      - expirationTTL
      - expirationTTLUnit
      - hostName
      - keyLength
      - keyType
      type: object
      properties:
        admin:
          type: boolean
          description: Use certificate to authenticate the Cisco ISE Admin Portal
          example: false
          exampleSetFlag: true
        allowExtendedValidity:
          type: boolean
          description: Allow generation of self-signed certificate with validity greater than 398 days
          example: true
          exampleSetFlag: true
        allowPortalTagTransferForSameSubject:
          type: boolean
          description: Allow overwriting the portal tag from matching certificate of same subject
          example: true
          exampleSetFlag: true
        allowReplacementOfCertificates:
          type: boolean
          description: Allow Replacement of certificates
          example: true
          exampleSetFlag: true
        allowReplacementOfPortalGroupTag:
          type: boolean
          description: Allow Replacement of Portal Group Tag
          example: true
          exampleSetFlag: true
        allowRoleTransferForSameSubject:
          type: boolean
          description: Allow transfer of roles for certificate with matching subject
          example: true
          exampleSetFlag: true
        allowSanDnsBadName:
          type: boolean
          description: Allow usage of SAN DNS Bad name
          example: true
          exampleSetFlag: true
        allowSanDnsNonResolvable:
          type: boolean
          description: Allow use of non resolvable Common Name or SAN Values
          example: true
          exampleSetFlag: true
        allowWildCardCertificates:
          type: boolean
          description: Allow Wildcard Certificates
          example: false
          exampleSetFlag: true
        certificatePolicies:
          type: string
          description: Certificate Policies
          exampleSetFlag: true
        digestType:
          type: string
          description: Digest to sign with
          example: SHA-384
          exampleSetFlag: true
          enum:
          - SHA-256
          - SHA-384
          - SHA-512
        eap:
          type: boolean
          description: Use certificate for EAP protocols that use SSL/TLS tunneling
          example: false
          exampleSetFlag: true
        expirationTTL:
          type: integer
          description: Certificate expiration value
          format: int32
          example: 2
          exampleSetFlag: true
        expirationTTLUnit:
          type: string
          description: Certificate expiration unit
          example: years
          exampleSetFlag: true
          enum:
          - days
          - months
          - weeks
          - years
        hostName:
          type: string
          description: Hostname of the Cisco ISE node in which self-signed certificate should be generated.
          example: ise-node-001
          exampleSetFlag: true
        keyLength:
          type: string
          description: Bit size of public key
          example: '4096'
          exampleSetFlag: true
          enum:
          - '1024'
          - '2048'
          - '4096'
          - '512'
        keyType:
          type: string
          description: Algorithm to use for certificate public key creation
          example: RSA
          exampleSetFlag: true
          enum:
          - ECDSA
          - RSA
        name:
          type: string
          description: Friendly name of the certificate.
          example: Self-Signed System Certificate
          exampleSetFlag: true
        portal:
          type: boolean
          description: Use for portal
          example: false
          exampleSetFlag: true
        portalGroupTag:
          type: string
          description: Set Group tag
          example: Default Portal Certificate Group
          exampleSetFlag: true
        pxgrid:
          type: boolean
          description: Use certificate for the pxGrid Controller
          example: false
          exampleSetFlag: true
        radius:
          type: boolean
          description: Use certificate for the RADSec server
          example: false
          exampleSetFlag: true
        saml:
          type: boolean
          description: Use certificate for SAML Signing
          example: false
          exampleSetFlag: true
        sanDNS:
          type: array
          description: Array of SAN (Subject Alternative Name) DNS entries
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        sanIP:
          type: array
          description: Array of SAN IP entries
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        sanURI:
          type: array
          description: Array of SAN URI entries
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        subjectCity:
          type: string
          description: Certificate city or locality (L)
          exampleSetFlag: true
        subjectCommonName:
          type: string
          description: Certificate common name (CN)
          example: $FQDN$
          exampleSetFlag: true
        subjectCountry:
          type: string
          description: Certificate country (C)
          exampleSetFlag: true
        subjectOrg:
          type: string
          description: Certificate organization (O)
          exampleSetFlag: true
        subjectOrgUnit:
          type: string
          description: Certificate organizational unit (OU)
          exampleSetFlag: true
        subjectState:
          type: string
          description: Certificate state (ST)
          exampleSetFlag: true
      exampleSetFlag: false
    ExportCSRFailRespPayload:
      title: ExportCSRFailRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/ExportCSRFailResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    RenewCertificates:
      title: RenewCertificates
      required:
      - certType
      type: object
      properties:
        certType:
          type: string
          exampleSetFlag: true
          enum:
          - IMS
          - OCSP
      exampleSetFlag: false
    RegenerateRootCA:
      title: RegenerateRootCA
      required:
      - removeExistingISEIntermediateCSR
      type: object
      properties:
        removeExistingISEIntermediateCSR:
          type: boolean
          description: Setting this attribute to true removes existing Cisco ISE Intermediate CSR
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateSelfsignedCertRespPayload:
      title: GenerateSelfsignedCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/GenerateSelfSignedCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    CSRResponse:
      title: CSRResponse
      type: object
      properties:
        friendlyName:
          type: string
          description: Friendly name of the certificate.
          exampleSetFlag: true
        groupTag:
          type: string
          description: GroupTag of the certificate.
          exampleSetFlag: true
        hostName:
          type: string
          description: Hostname or IP address of the Cisco ISE node.
          exampleSetFlag: true
        id:
          type: string
          description: ID of the certificate.
          exampleSetFlag: true
        keySize:
          type: string
          description: Size of the cryptographic key used.
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        sanNames:
          type: string
          description: String representation of subject alternative names.
          exampleSetFlag: true
        signatureAlgorithm:
          type: string
          description: Algorithm used for encrypting CSR
          exampleSetFlag: true
        subject:
          type: string
          description: Subject of the certificate. Includes Common Name (CN), Organizational Unit (OU), etc.
          exampleSetFlag: true
        timeStamp:
          type: string
          description: Timestamp of the certificate generation.
          exampleSetFlag: true
        usedFor:
          type: string
          description: Services for which the certificate is used for (for eg- MGMT, GENERIC).
          exampleSetFlag: true
      exampleSetFlag: false
    DeleteSystemCertRequest:
      title: DeleteSystemCertRequest
      type: object
      properties:
        allowWildcardDelete:
          type: boolean
          description: If the given certificate to be deleted is a wildcard certificate, the corresponding certificate gets deleted on the rest of the nodes in the deployment as well.
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateIntermediateCACsrRespPayload:
      title: GenerateIntermediateCACsrRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/GenerateCSRResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    TrustCertGetByIdRsp:
      title: TrustCertGetByIdRsp
      type: object
      properties:
        response:
          $ref: '#/components/schemas/TrustCertificateGetByIdResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    Resource:
      title: Resource
      type: object
      properties:
        description:
          type: string
          exampleSetFlag: true
        file:
          type: string
          format: binary
          exampleSetFlag: true
        filename:
          type: string
          exampleSetFlag: true
        inputStream:
          $ref: '#/components/schemas/InputStream'
          exampleSetFlag: true
        open:
          type: boolean
          exampleSetFlag: true
        readable:
          type: boolean
          exampleSetFlag: true
        uri:
          type: string
          format: uri
          exampleSetFlag: true
        url:
          type: string
          format: url
          exampleSetFlag: true
      exampleSetFlag: false
    CSRRequest:
      title: CSRRequest
      required:
      - digestType
      - keyLength
      - keyType
      - usedFor
      type: object
      properties:
        allowWildCardCert:
          type: boolean
          example: false
          exampleSetFlag: true
        certificatePolicies:
          type: string
          exampleSetFlag: true
        digestType:
          type: string
          exampleSetFlag: true
          enum:
          - SHA-256
          - SHA-384
          - SHA-512
        hostnames:
          type: array
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        keyLength:
          type: string
          exampleSetFlag: true
          enum:
          - '1024'
          - '2048'
          - '4096'
          - '512'
        keyType:
          type: string
          exampleSetFlag: true
          enum:
          - ECDSA
          - RSA
        portalGroupTag:
          type: string
          exampleSetFlag: true
        sanDNS:
          type: array
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        sanDir:
          type: array
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        sanIP:
          type: array
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        sanURI:
          type: array
          exampleSetFlag: true
          items:
            type: string
            exampleSetFlag: false
        subjectCity:
          type: string
          exampleSetFlag: true
        subjectCommonName:
          type: string
          example: $FQDN$
          exampleSetFlag: true
        subjectCountry:
          type: string
          exampleSetFlag: true
        subjectOrg:
          type: string
          exampleSetFlag: true
        subjectOrgUnit:
          type: string
          exampleSetFlag: true
        subjectState:
          type: string
          exampleSetFlag: true
        usedFor:
          type: string
          exampleSetFlag: true
          enum:
          - ADMIN
          - DTLS-AUTH
          - EAP-AUTH
          - IMS
          - MULTI-USE
          - PORTAL
          - PXGRID
          - SAML
      exampleSetFlag: false
    DeleteCSRRespPayload:
      title: DeleteCSRRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/DeleteCSRResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    GenerateCSRResponse:
      title: GenerateCSRResponse
      type: object
      properties:
        id:
          type: string
          description: ID of the generated CSR
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        message:
          type: string
          description: Response message on generation of CSR
          exampleSetFlag: true
      exampleSetFlag: false
    TrustCertificateGetByIdResponse:
      title: TrustCertificateGetByIdResponse
      type: object
      properties:
        authenticateBeforeCRLReceived:
          type: string
          description: Switch to enable or disable authentication before receiving CRL
          exampleSetFlag: true
        automaticCRLUpdate:
          type: string
          description: Switch to enable or disable automatic CRL update
          exampleSetFlag: true
        automaticCRLUpdatePeriod:
          type: string
          description: Automatic CRL update period
          exampleSetFlag: true
        automaticCRLUpdateUnits:
          type: string
          description: Unit of time of automatic CRL update
          exampleSetFlag: true
        crlDistributionUrl:
          type: string
          description: CRL Distribution URL
          exampleSetFlag: true
        crlDownloadFailureRetries:
          type: string
          description: If CRL download fails, wait time before retry
          exampleSetFlag: true
        crlDownloadFailureRetriesUnits:
          type: string
          description: Unit of time before retry if CRL download fails
          exampleSetFlag: true
        description:
          type: string
          description: Description of trust certificate
          exampleSetFlag: true
        downloadCRL:
          type: string
          description: Switch to enable or disable download of CRL
          exampleSetFlag: true
        enableOCSPValidation:
          type: string
          description: Switch to enable or disable OCSP Validation
          exampleSetFlag: true
        enableServerIdentityCheck:
          type: string
          description: Switch to enable or disable Server Identity Check
          exampleSetFlag: true
        expirationDate:
          type: string
          description: The time and date past which the certificate is no longer valid
          exampleSetFlag: true
        friendlyName:
          type: string
          description: Friendly name of trust certificate
          exampleSetFlag: true
        id:
          type: string
          description: ID of trust certificate
          exampleSetFlag: true
        ignoreCRLExpiration:
          type: string
          description: Switch to enable or disable ignore CRL Expiration
          exampleSetFlag: true
        internalCA:
          type: boolean
          example: false
          exampleSetFlag: true
        isReferredInPolicy:
          type: boolean
          example: false
          exampleSetFlag: true
        issuedBy:
          type: string
          description: The entity that verified the information and signed the certificate
          exampleSetFlag: true
        issuedTo:
          type: string
          description: Entity to which trust certificate is issued
          exampleSetFlag: true
        keySize:
          type: string
          description: Length of the key used for encrypting trust certificate
          exampleSetFlag: true
        link:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        nonAutomaticCRLUpdatePeriod:
          type: string
          description: Non automatic CRL update period
          exampleSetFlag: true
        nonAutomaticCRLUpdateUnits:
          type: string
          description: Unit of time of non automatic CRL update
          exampleSetFlag: true
        rejectIfNoStatusFromOCSP:
          type: string
          description: Switch to reject certificate if there is no status from OCSP
          exampleSetFlag: true
        rejectIfUnreachableFromOCSP:
          type: string
          description: Switch to reject certificate if unreachable from OCSP
          exampleSetFlag: true
        selectedOCSPService:
          type: string
          description: Name of selected OCSP Service
          exampleSetFlag: true
        serialNumberDecimalFormat:
          type: string
          description: Used to uniquely identify the certificate within a CA's systems
          exampleSetFlag: true
        sha256Fingerprint:
          type: string
          exampleSetFlag: true
        signatureAlgorithm:
          type: string
          description: Algorithm used for encrypting trust certificate
          exampleSetFlag: true
        status:
          type: string
          exampleSetFlag: true
        subject:
          type: string
          description: The Subject or entity with which public key of trust certificate is associated
          exampleSetFlag: true
        trustedFor:
          type: string
          description: Different services for which the certificated is trusted
          exampleSetFlag: true
        validFrom:
          type: string
          description: The earliest time and date on which the certificate is valid
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateTrustCertRequest:
      title: UpdateTrustCertRequest
      required:
      - name
      type: object
      properties:
        authenticateBeforeCRLReceived:
          type: boolean
          description: Switch to enable or disable CRL verification if CRL is not received
          example: false
          exampleSetFlag: true
        automaticCRLUpdate:
          type: boolean
          description: Switch to enable or disable automatic CRL update
          example: false
          exampleSetFlag: true
        automaticCRLUpdatePeriod:
          type: integer
          description: Automatic CRL update period
          format: int32
          example: 5
          exampleSetFlag: true
        automaticCRLUpdateUnits:
          type: string
          description: Unit of time for automatic CRL update
          example: Minutes
          exampleSetFlag: true
          enum:
          - Days
          - Hours
          - Minutes
          - Weeks
        crlDistributionUrl:
          type: string
          description: CRL Distribution URL
          exampleSetFlag: true
        crlDownloadFailureRetries:
          type: integer
          description: If CRL download fails, wait time before retry
          format: int32
          example: 10
          exampleSetFlag: true
        crlDownloadFailureRetriesUnits:
          type: string
          description: Unit of time before retry if CRL download fails
          example: Minutes
          exampleSetFlag: true
          enum:
          - Days
          - Hours
          - Minutes
          - Weeks
        description:
          type: string
          description: Description for trust certificate
          exampleSetFlag: true
        downloadCRL:
          type: boolean
          description: Switch to enable or disable download of CRL
          example: false
          exampleSetFlag: true
        enableOCSPValidation:
          type: boolean
          description: Switch to enable or disable OCSP Validation
          example: false
          exampleSetFlag: true
        enableServerIdentityCheck:
          type: boolean
          description: Switch to enable or disable verification if HTTPS or LDAP server certificate name fits the configured server URL
          example: false
          exampleSetFlag: true
        ignoreCRLExpiration:
          type: boolean
          description: Switch to enable or disable ignore CRL expiration
          example: false
          exampleSetFlag: true
        name:
          type: string
          description: Friendly name of the certificate
          example: Trust Certificate
          exampleSetFlag: true
        nonAutomaticCRLUpdatePeriod:
          type: integer
          description: Non automatic CRL update period
          format: int32
          example: 1
          exampleSetFlag: true
        nonAutomaticCRLUpdateUnits:
          type: string
          description: Unit of time of non automatic CRL update
          example: Hours
          exampleSetFlag: true
          enum:
          - Days
          - Hours
          - Minutes
          - Weeks
        rejectIfNoStatusFromOCSP:
          type: boolean
          description: Switch to reject certificate if there is no status from OCSP
          example: false
          exampleSetFlag: true
        rejectIfUnreachableFromOCSP:
          type: boolean
          description: Switch to reject certificate if unreachable from OCSP
          example: false
          exampleSetFlag: true
        selectedOCSPService:
          type: string
          description: Name of selected OCSP Service
          exampleSetFlag: true
        status:
          type: string
          example: Enabled
          exampleSetFlag: true
          enum:
          - Disabled
          - Enabled
        trustForCertificateBasedAdminAuth:
          type: boolean
          description: Trust for Certificate based Admin authentication
          example: false
          exampleSetFlag: true
        trustForCiscoServicesAuth:
          type: boolean
          description: Trust for authentication of Cisco Services
          example: false
          exampleSetFlag: true
        trustForClientAuth:
          type: boolean
          description: Trust for client authentication and Syslog
          example: false
          exampleSetFlag: true
        trustForIseAuth:
          type: boolean
          description: Trust for authentication within Cisco ISE
          example: false
          exampleSetFlag: true
      exampleSetFlag: false
    UpdateSystemCertRespPayload:
      title: UpdateSystemCertRespPayload
      type: object
      properties:
        response:
          $ref: '#/components/schemas/UpdateSystemCertResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    InputStream:
      title: InputStream
      type: object
      exampleSetFlag: false
    TrustCertGetAllRsp:
      title: TrustCertGetAllRsp
      type: object
      properties:
        nextPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        previousPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        response:
          type: array
          exampleSetFlag: true
          items:
            $ref: '#/components/schemas/TrustCertificateResponse'
            exampleSetFlag: false
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    CSRGetAllRsp:
      title: CSRGetAllRsp
      type: object
      properties:
        nextPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        previousPage:
          $ref: '#/components/schemas/Link'
          exampleSetFlag: true
        response:
          type: array
          exampleSetFlag: true
          items:
            $ref: '#/components/schemas/CSRResponse'
            exampleSetFlag: false
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false
    SystemCertGetByIdRsp:
      title: SystemCertGetByIdRsp
      type: object
      properties:
        response:
          $ref: '#/components/schemas/SystemCertificateResponse'
          exampleSetFlag: true
        version:
          type: string
          exampleSetFlag: true
      exampleSetFlag: false