Create a client certificate authority on an event broker service

A client certificate authority is a trusted root or intermediate certificate that the event broker service uses to validate client certificates during mutual TLS (mTLS) authentication.

Certificate content is write-only and is never returned.

Adds a client certificate authority to the event broker service. After the operation completes, the event broker service trusts client certificates issued by this certificate authority during mutual TLS (mTLS) authentication. You can enable OCSP revocation checking for those client certificates when you create the certificate authority, or later with a PATCH request.

This request is asynchronous. The response contains an operation ID that you can use to poll for completion using Get the status of a service operation.

Your token must have one of the permissions listed in the Token Permissions.



Token Permissions: [ mission_control:access or service_requests:post:certificate_authentication ]
Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Path Params
string
required

The unique identifier for the event broker service.

Body Params

The client certificate authority to create.

string
required
length ≥ 1
(?!\.{1,2}$)[A-Za-z0-9._-]{1,64}

The name of the certificate authority. The name must be 1 to 64 characters. Use only letters, digits, periods, underscores, and hyphens. The name must be unique among the certificate authorities of the same type on the event broker service. You cannot change the name after you create the certificate authority.

string
required
length ≥ 1

The PEM-encoded X.509 certificate. Provide exactly one certificate. This field is write-only and is never returned.

boolean
required

Indicates whether the event broker service uses OCSP to check the revocation status of client certificates issued by this certificate authority. The default is false.

string
^((?![Hh][Tt][Tt][Pp][Ss]://)[^:/]+://.+)?$

The URL of the OCSP responder to use instead of the OCSP responder URL in the client certificate. The URL must include the scheme, for example http://ocsp.example.com. HTTPS is not supported. An empty string means no override URL.

int32
required
1 to 86400

The number of seconds to wait for an OCSP response. Valid values are 1 to 86400. The default is 5.

boolean
required

Indicates whether the event broker service accepts an OCSP response signed by a certificate other than the certificate of the OCSP responder. The default is false.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
*/*