Skip to content

Keystore

Security (Keystore) service implementation.

Keystore

Bases: ONVIFService

0.0.1 2.4

Security (Keystore) service client.

Property Details
First introduced ONVIF 2.4 (August 2013)
Binding name KeystoreBinding (ver10/advancedsecurity/wsdl/advancedsecurity.wsdl)
Operations advancedsecurity.wsdl
Spec Security

CreateRSAKeyPair 

CreateRSAKeyPair(KeyLength, Alias=None)

This operation triggers the asynchronous generation of an RSA key pair of a particular key length (specified as the number of bits) as specified in [RFC 3447], with a suitable key generation mechanism on the device.

Keys, especially RSA key pairs, are uniquely identified using key IDs.

If the device does not have not enough storage capacity for storing the key pair to be created, the maximum number of keys reached fault shall be produced and no key pair shall be generated. Otherwise, the operation generates a keyID for the new key and associates the generating status to it.

Immediately after key generation has started, the device shall return the keyID to the client and continue to generate the key pair. The client may query the device with the GetKeyStatus operation whether the generation has finished. The client may also subscribe to Key Status events to be notified about key status changes.

The device also returns a best-effort estimate of how much time it requires to create the key pair. A client may use this information as an indication how long to wait before querying the device whether key generation is completed.

After the key has been successfully created, the device shall assign it the ok status. If the key generation fails, the device shall assign the key the corrupt status.

Input
  • KeyLength [nonNegativeInteger]
    The length of the key to be created.
  • Alias - optional; [string]
    The client-defined alias of the key.
Output
  • KeyID [KeyID]
    The key ID of the key pair being generated.
    Maximum length: 64
  • EstimatedCreationTime [duration]
    Best-effort estimate of how long the key generation will take.

CreateECCKeyPair 

CreateECCKeyPair(EllipticCurve, Alias=None)

This operation triggers the asynchronous generation of an ECC key pair using a particular elliptic curve as specified in [RFC 8422], with a suitable key generation mechanism on the device.

Keys, especially ECC key pairs, are uniquely identified using key IDs.

If the device does not have not enough storage capacity for storing the key pair to be created, the maximum number of keys reached fault shall be produced and no key pair shall be generated. Otherwise, the operation generates a keyID for the new key and associates the generating status to it.

Immediately after key generation has started, the device shall return the keyID to the client and continue to generate the key pair. The client may query the device with the GetKeyStatus operation whether the generation has finished. The client may also subscribe to Key Status events to be notified about key status changes.

The device also returns a best-effort estimate of how much time it requires to create the key pair. A client may use this information as an indication how long to wait before querying the device whether key generation is completed.

After the key has been successfully created, the device shall assign it the ok status. If the key generation fails, the device shall assign the key the corrupt status.

Input
  • EllipticCurve [string]
    The name of the elliptic curve to be used for generating the ECC keypair. Supported curve names can be found in the IANA TLS Supported Groups section, under the Description field.
  • Alias - optional; [string]
    The client-defined alias of the key.
Output
  • KeyID [KeyID]
    The key ID of the key pair being generated.
    Maximum length: 64
  • EstimatedCreationTime [duration]
    Best-effort estimate of how long the key generation will take.

UploadKeyPairInPKCS8 

UploadKeyPairInPKCS8(
    KeyPair,
    Alias=None,
    EncryptionPassphraseID=None,
    EncryptionPassphrase=None,
)

Deprecated method for uploading a key pair in a PKCS#8 data structure as specified in [RFC 5958, RFC 5959].

If an encryption passphrase ID is supplied in the request, the device shall assume that the KeyPair parameter contains an EncryptedPrivateKeyInfo ASN.1 structure that is encrypted under the passphrase in the keystore that corresponds to the supplied ID, where the EncryptedPrivateKeyInfo structure contains both the private key and the corresponding public key. If no encryption passphrase ID is supplied, the device shall assume that the KeyPair parameter contains a OneAsymmetricKey ASN.1 structure which contains both the private key and the corresponding public key.

Input
  • KeyPair [Base64DERencodedASN1Value]
    The key pair to be uploaded in a PKCS#8 data structure.
  • Alias - optional; [string]
    The client-defined alias of the key pair.
  • EncryptionPassphraseID - optional; [PassphraseID]
    The ID of the passphrase to use for decrypting the uploaded key pair.
    Maximum length: 64
  • EncryptionPassphrase - optional; [string]
    The passphrase to use for decrypting the uploaded key pair.
Output
  • KeyID [KeyID]
    The key ID of the uploaded key pair.
    Maximum length: 64

UploadCertificateWithPrivateKeyInPKCS12 

UploadCertificateWithPrivateKeyInPKCS12(
    CertWithPrivateKey,
    CertificationPathAlias=None,
    KeyAlias=None,
    IgnoreAdditionalCertificates=None,
    IntegrityPassphraseID=None,
    EncryptionPassphraseID=None,
    Passphrase=None,
)

This operation uploads a certification path consisting of X.509 certificates as specified by [RFC 5280] in DER encoding along with a private key to a device’s keystore.

Certificates and private key are supplied in the form of a PKCS#12 file as specified in [PKCS#12].

The device shall support PKCS#12 files that contain the following safe bags:

  • one or more instances of CertBag [PKCS#12, Sect. 4.2.3]
  • either exactly one instance of KeyBag [PKCS#12, Sect. 4.3.1] or exactly one instance of PKCS8ShroudedKeyBag [PKCS#12, Sect. 4.2.2].

If the IgnoreAdditionalCertificates parameter has the value true, the device shall behave as if the client had supplied only the first CertBag in the sequence of CertBag instances. The device shall support PKCS#12 passphrase integrity mode for integrity protection of the PKCS#12 PFX as specified in [PKCS#12, Sect. 4]. The device shall support PKCS8ShroudedKeyBags that are encrypted with the same passphrase as the CertBag instances. If an integrity passphrase ID is supplied, the device shall use the corresponding passphrase in the keystore to check the integrity of the supplied PKCS#12 PFX. If an integrity passphrase ID is supplied, but the supplied PKCS#12 PFX has no integrity protection, the device shall produce a BadPKCS12File fault and shall not store the uploaded certificates nor the uploaded key pair in the keystore. If an encryption passphrase ID is supplied, the device shall use the corresponding passphrase in the keystore to decrypt the PKCS8ShroudedKeyBag and the CertBag instances. If an EncryptionPassphraseID is supplied, but a CertBag is not encrypted, the device shall ignore the supplied EncryptionPassphraseID when processing this CertBag. If an EncryptionPassphraseID is supplied, but a KeyBag is provided instead of a PKCS8ShroudedKeyBag, the device shall ignore the supplied EncryptionPassphraseID when processing the KeyBag.

Input
  • CertWithPrivateKey [Base64DERencodedASN1Value]
    The certificates and key pair to be uploaded in a PKCS#12 data structure.
  • CertificationPathAlias - optional; [string]
    The client-defined alias of the certification path.
  • KeyAlias - optional; [string]
    The client-defined alias of the key pair.
  • IgnoreAdditionalCertificates - optional; [boolean]
    True if and only if the device shall behave as if the client had only supplied the first certificate in the sequence of certificates.
    Default: false
  • IntegrityPassphraseID - optional; [PassphraseID]
    The ID of the passphrase to use for integrity checking of the uploaded PKCS#12 data structure.
    Maximum length: 64
  • EncryptionPassphraseID - optional; [PassphraseID]
    The ID of the passphrase to use for decrypting the PKCS8ShroudedKeyBag and the CertBag instances.
    Maximum length: 64
  • Passphrase - optional; [string]
    The passphrase to use for integrity checking and decrypting the uploaded PKCS#12 data structure.
Output
  • CertificationPathID [CertificationPathID]
    The certification path ID of the uploaded certification path.
    Maximum length: 64
  • KeyID [KeyID]
    The key ID of the uploaded key pair.
    Maximum length: 64

GetKeyStatus 

GetKeyStatus(KeyID)

This operation returns the status of a key.

Keys are uniquely identified using key IDs. If no key is stored under the requested key ID in the keystore, an InvalidKeyID fault is produced. Otherwise, the status of the key is returned.

Input
  • KeyID [KeyID]
    The ID of the key for which to return the status.
    Maximum length: 64
Output
  • KeyStatus [string]
    Status of the requested key. The value should be one of the values in the tas:KeyStatus enumeration.

GetPrivateKeyStatus 

GetPrivateKeyStatus(KeyID)

This operation returns whether a key pair contains a private key.

Keys are uniquely identified using key IDs. If no key is stored under the requested key ID in the keystore or the key identified by the requested key ID does not identify a key pair, the device shall produce an InvalidKeyID fault. Otherwise, this operation returns true if the key pair identified by the key ID contains a private key, and false otherwise.

Input
  • KeyID [KeyID]
    The ID of the key pair for which to return whether it contains a private key.
    Maximum length: 64
Output
  • hasPrivateKey [boolean]
    True if and only if the key pair contains a private key.

GetAllKeys 

GetAllKeys()

This operation returns information about all keys that are stored in the device’s keystore.

This operation may be used, e.g., if a client lost track of which keys are present on the device. If no key is stored on the device, an empty list is returned.

Output
  • KeyAttribute - optional, unbounded; [KeyAttribute]
    Information about a key in the keystore.
    • KeyID [KeyID]
      The ID of the key.
      Maximum length: 64
    • Alias - optional; [string]
      The client-defined alias of the key.
    • hasPrivateKey - optional; [boolean]
      Absent if the key is not a key pair. True if and only if the key is a key pair and contains a private key. False if and only if the key is a key pair and does not contain a private key.
    • KeyStatus [string]
      The status of the key. The value should be one of the values in the tas:KeyStatus enumeration.
    • externallyGenerated - optional; [boolean]
      True if and only if the key was generated outside the device.
    • securelyStored - optional; [boolean]
      True if and only if the key is stored in a specially protected hardware component inside the device.
    • Extension - optional; [complexType]

DeleteKey 

DeleteKey(KeyID)

This operation deletes a key from the device’s keystore.

Keys are uniquely identified using key IDs. If no key is stored under the requested key ID in the keystore, a device shall produce an InvalidArgVal fault. If a reference exists for the specified key, a device shall produce the corresponding fault and shall not delete the key. If there is a key under the requested key ID stored in the keystore and the key could not be deleted, a device shall produce a KeyDeletion fault. If the key has the status generating, a device shall abort the generation of the key and delete from the keystore all data generated for this key. After a key is successfully deleted, the device may assign its former ID to other keys.

Input
  • KeyID [KeyID]
    The ID of the key that is to be deleted from the keystore.
    Maximum length: 64

CreatePKCS10CSR 

CreatePKCS10CSR(
    Subject, KeyID, SignatureAlgorithm, CSRAttribute=None
)

This operation generates a DER-encoded PKCS#10 v1.7 certification request (sometimes also called certificate signing request or CSR) as specified in RFC 2986 for a public key on the device.

The key pair that contains the public key for which a certification request shall be produced is specified by its key ID. If no key is stored under the requested KeyID or the key specified by the requested KeyID is not an asymmetric key pair, an invalid key ID fault shall be produced and no CSR shall be generated.

A device that supports this command shall as minimum support the sha-1WithRSAEncryption signature algorithm as specified in RFC 3279. If the specified signature algorithm is not supported by the device, an UnsupportedSignatureAlgorithm fault shall be produced and no CSR shall be generated.

If the public key identified by the requested Key ID is an invalid input to the specified signature algorithm, a KeySignatureAlgorithmMismatch fault shall be produced and no CSR shall be generated. If the key pair does not have status ok, a device shall produce an InvalidKeyStatus fault and no CSR shall be generated.

Input
  • Subject [DistinguishedName]
    The subject to be included in the CSR.
    • Country - optional, unbounded; [DNAttributeValue]
      A country name as specified in X.500.
    • Organization - optional, unbounded; [DNAttributeValue]
      An organization name as specified in X.500.
    • OrganizationalUnit - optional, unbounded; [DNAttributeValue]
      An organizational unit name as specified in X.500.
    • DistinguishedNameQualifier - optional, unbounded; [DNAttributeValue]
      A distinguished name qualifier as specified in X.500.
    • StateOrProvinceName - optional, unbounded; [DNAttributeValue]
      A state or province name as specified in X.500.
    • CommonName - optional, unbounded; [DNAttributeValue]
      A common name as specified in X.500.
    • SerialNumber - optional, unbounded; [DNAttributeValue]
      A serial number as specified in X.500.
    • Locality - optional, unbounded; [DNAttributeValue]
      A locality as specified in X.500.
    • Title - optional, unbounded; [DNAttributeValue]
      A title as specified in X.500.
    • Surname - optional, unbounded; [DNAttributeValue]
      A surname as specified in X.500.
    • GivenName - optional, unbounded; [DNAttributeValue]
      A given name as specified in X.500.
    • Initials - optional, unbounded; [DNAttributeValue]
      Initials as specified in X.500.
    • Pseudonym - optional, unbounded; [DNAttributeValue]
      A pseudonym as specified in X.500.
    • GenerationQualifier - optional, unbounded; [DNAttributeValue]
      A generation qualifier as specified in X.500.
    • GenericAttribute - optional, unbounded; [DNAttributeTypeAndValue]
      A generic type-value pair attribute.
      • Type [DNAttributeType]
        The attribute type.
      • Value [DNAttributeValue]
        The value of the attribute.
    • MultiValuedRDN - optional, unbounded; [MultiValuedRDN]
      A multi-valued RDN
      • Attribute - optional, unbounded; [DNAttributeTypeAndValue]
        A list of types and values defining a multi-valued RDN
        • Type [DNAttributeType]
          The attribute type.
        • Value [DNAttributeValue]
          The value of the attribute.
    • anyAttribute - optional; [complexType]
      Required extension point. It is recommended to not use this element, and instead use GenericAttribute and the numeric Distinguished Name Attribute Type.
      • DomainComponent - optional, unbounded; [DNAttributeValue]
        Domain Component as specified in RFC3739
  • KeyID [KeyID]
    The ID of the key for which the CSR shall be created.
    Maximum length: 64
  • CSRAttribute - optional, unbounded; [CSRAttribute]
    An attribute to be included in the CSR.
    • X509v3Extension [X509v3Extension]
      An X.509v3 extension field.
      • extnOID [DotDecimalOID]
        The OID of the extension field.
        Pattern: [0-9]+(.[0-9]+)*
      • critical [boolean]
        True if and only if the extension is critical.
        Default: false
      • extnValue [Base64DERencodedASN1Value]
        The value of the extension field as a base64-encoded DER representation of an ASN.1 value.
    • BasicRequestAttribute [BasicRequestAttribute]
      A basic CSR attribute.
      • OID [DotDecimalOID]
        The OID of the attribute.
        Pattern: [0-9]+(.[0-9]+)*
      • value [Base64DERencodedASN1Value]
        The value of the attribute as a base64-encoded DER representation of an ASN.1 value.
    • anyAttribute - optional; [complexType]
  • SignatureAlgorithm [AlgorithmIdentifier]
    The signature algorithm to be used to sign the CSR.
    • algorithm [DotDecimalOID]
      The OID of the algorithm in dot-decimal form.
      Pattern: [0-9]+(.[0-9]+)*
    • parameters - optional; [Base64DERencodedASN1Value]
      Optional parameters of the algorithm (depending on the algorithm).
    • anyParameters - optional; [complexType]
Output
  • PKCS10CSR [Base64DERencodedASN1Value]
    The DER encoded PKCS#10 certification request.

CreateSelfSignedCertificate 

CreateSelfSignedCertificate(
    Subject,
    KeyID,
    SignatureAlgorithm,
    X509Version=None,
    Alias=None,
    notValidBefore=None,
    notValidAfter=None,
    Extension=None,
)

This operation generates for a public key on the device a self-signed X.509 certificate that complies to RFC 5280.

The X509Version parameter specifies the version of X.509 that the generated certificate shall comply to. A device that supports this command shall support the generation of X.509v3 certificates as specified in RFC 5280 and may additionally be able to handle other X.509 certificate formats as indicated by the X.509Versions capability.

The key pair that contains the public key for which a self-signed certificate shall be produced is specified by its key pair ID. The subject parameter describes the entity that the public key belongs to. If the key pair does not have status ok, a device shall produce an InvalidKeyStatus fault and no certificate shall be generated. The signature algorithm parameter determines which signature algorithm shall be used for signing the certification request with the public key specified by the key ID parameter. A device that supports this command shall as minimum support the sha-1WithRSAEncryption signature algorithm as specified in RFC 3279. The Extensions parameter specifies potential X509v3 extensions that shall be contained in the certificate. A device that supports this command shall support the extensions that are defined in [RFC 5280], Sect. 4.2] as mandatory for CAs that issue self-signed certificates.

Certificates are uniquely identified using certificate IDs. If the command was successful, the device generates a new ID for the generated certificate and returns this ID.

If the device does not have not enough storage capacity for storing the certificate to be created, the maximum number of certificates reached fault shall be produced and no certificate shall be generated.

Input
  • X509Version - optional; [positiveInteger]
    The X.509 version that the generated certificate shall comply to.
  • Subject [DistinguishedName]
    Distinguished name of the entity that the certificate shall belong to.
    • Country - optional, unbounded; [DNAttributeValue]
      A country name as specified in X.500.
    • Organization - optional, unbounded; [DNAttributeValue]
      An organization name as specified in X.500.
    • OrganizationalUnit - optional, unbounded; [DNAttributeValue]
      An organizational unit name as specified in X.500.
    • DistinguishedNameQualifier - optional, unbounded; [DNAttributeValue]
      A distinguished name qualifier as specified in X.500.
    • StateOrProvinceName - optional, unbounded; [DNAttributeValue]
      A state or province name as specified in X.500.
    • CommonName - optional, unbounded; [DNAttributeValue]
      A common name as specified in X.500.
    • SerialNumber - optional, unbounded; [DNAttributeValue]
      A serial number as specified in X.500.
    • Locality - optional, unbounded; [DNAttributeValue]
      A locality as specified in X.500.
    • Title - optional, unbounded; [DNAttributeValue]
      A title as specified in X.500.
    • Surname - optional, unbounded; [DNAttributeValue]
      A surname as specified in X.500.
    • GivenName - optional, unbounded; [DNAttributeValue]
      A given name as specified in X.500.
    • Initials - optional, unbounded; [DNAttributeValue]
      Initials as specified in X.500.
    • Pseudonym - optional, unbounded; [DNAttributeValue]
      A pseudonym as specified in X.500.
    • GenerationQualifier - optional, unbounded; [DNAttributeValue]
      A generation qualifier as specified in X.500.
    • GenericAttribute - optional, unbounded; [DNAttributeTypeAndValue]
      A generic type-value pair attribute.
      • Type [DNAttributeType]
        The attribute type.
      • Value [DNAttributeValue]
        The value of the attribute.
    • MultiValuedRDN - optional, unbounded; [MultiValuedRDN]
      A multi-valued RDN
      • Attribute - optional, unbounded; [DNAttributeTypeAndValue]
        A list of types and values defining a multi-valued RDN
        • Type [DNAttributeType]
          The attribute type.
        • Value [DNAttributeValue]
          The value of the attribute.
    • anyAttribute - optional; [complexType]
      Required extension point. It is recommended to not use this element, and instead use GenericAttribute and the numeric Distinguished Name Attribute Type.
      • DomainComponent - optional, unbounded; [DNAttributeValue]
        Domain Component as specified in RFC3739
  • KeyID [KeyID]
    The ID of the key for which the certificate shall be created.
    Maximum length: 64
  • Alias - optional; [string]
    The client-defined alias of the certificate to be created.
  • notValidBefore - optional; [dateTime]
    The X.509 not valid before information to be included in the certificate. Defaults to the device's current time or a time before the device's current time.
  • notValidAfter - optional; [dateTime]
    The X.509 not valid after information to be included in the certificate. Defaults to the time 99991231235959Z as specified in RFC 5280.
  • SignatureAlgorithm [AlgorithmIdentifier]
    The signature algorithm to be used for signing the certificate.
    • algorithm [DotDecimalOID]
      The OID of the algorithm in dot-decimal form.
      Pattern: [0-9]+(.[0-9]+)*
    • parameters - optional; [Base64DERencodedASN1Value]
      Optional parameters of the algorithm (depending on the algorithm).
    • anyParameters - optional; [complexType]
  • Extension - optional, unbounded; [X509v3Extension]
    An X.509v3 extension to be included in the certificate.
    • extnOID [DotDecimalOID]
      The OID of the extension field.
      Pattern: [0-9]+(.[0-9]+)*
    • critical [boolean]
      True if and only if the extension is critical.
      Default: false
    • extnValue [Base64DERencodedASN1Value]
      The value of the extension field as a base64-encoded DER representation of an ASN.1 value.
Output
  • CertificateID [CertificateID]
    The ID of the generated certificate.
    Maximum length: 64

UploadCertificate 

UploadCertificate(
    Certificate,
    Alias=None,
    KeyAlias=None,
    PrivateKeyRequired=None,
)

This operation uploads an X.509 certificate as specified by [RFC 5280] in DER encoding and the public key in the certificate to a device’s keystore.

A device that supports this command shall be able to handle X.509v3 certificates as specified in RFC 5280 and may additionally be able to handle other X.509 certificate formats as indicated by the X.509Versions capability. A device that supports this command shall support sha1-WithRSAEncryption as certificate signature algorithm.

Certificates are uniquely identified using certificate IDs, and key pairs are uniquely identified using key IDs. The device shall generate a new certificate ID for the uploaded certificate.

Certain certificate usages, e.g. TLS server authentication, require the private key that corresponds to the public key in the certificate to be present in the keystore. In such cases, the client may indicate that it expects the device to produce a fault if the matching private key for the uploaded certificate is not present in the keystore by setting the PrivateKeyRequired argument in the upload request to true.

The uploaded certificate has to be linked to a key pair in the keystore. If no private key is required for the public key in the certificate and a key pair exists in the keystore with a public key equal to the public key in the certificate, the uploaded certificate is linked to the key pair identified by the supplied key ID by adding a reference from the certificate to the key pair. If no private key is required for the public key in the certificate and no key pair exists with the public key equal to the public key in the certificate, a new key pair with status ok is created with the public key from the certificate, and this key pair is linked to the uploaded certificate by adding a reference from the certificate to the key pair. If a private key is required for the public key in the certificate, and a key pair exists in the keystore with a private key that matches the public key in the certificate, the uploaded certificate is linked to this keypair by adding a reference from the certificate to the key pair. If a private key is required for the public key and no such keypair exists in the keystore, the NoMatchingPrivateKey fault shall be produced and the certificate shall not be stored in the keystore. If the key pair that the certificate shall be linked to does not have status ok, an InvalidKeyID fault is produced, and the uploaded certificate is not stored in the keystore. If the device cannot process the uploaded certificate, a BadCertificate fault is produced and neither the uploaded certificate nor the public key are stored in the device’s keystore. The BadCertificate fault shall not be produced based on the mere fact that the device’s current time lies outside the interval defined by the notBefore and notAfter fields as specified by [RFC 5280], Sect. 4.1 . This operation shall not mark the uploaded certificate as trusted.

If the device does not have not enough storage capacity for storing the certificate to be uploaded, the maximum number of certificates reached fault shall be produced and no certificate shall be uploaded. If the device does not have not enough storage capacity for storing the key pair that eventually has to be created, the device shall generate a maximum number of keys reached fault. Furthermore the device shall not generate a key pair and no certificate shall be stored.

Input
  • Certificate [Base64DERencodedASN1Value]
    The base64-encoded DER representation of the X.509 certificate to be uploaded.
  • Alias - optional; [string]
    The client-defined alias of the certificate.
  • KeyAlias - optional; [string]
    The client-defined alias of the key pair.
  • PrivateKeyRequired - optional; [boolean]
    Indicates if the device shall verify that a matching key pair with a private key exists in the keystore.
    Default: false
Output
  • CertificateID [CertificateID]
    The ID of the uploaded certificate.
    Maximum length: 64
  • KeyID [KeyID]
    The ID of the key that the uploaded certificate certifies.
    Maximum length: 64

GetCertificate 

GetCertificate(CertificateID)

This operation returns a specific certificate from the device’s keystore.

Certificates are uniquely identified using certificate IDs. If no certificate is stored under the requested certificate ID in the keystore, an InvalidArgVal fault is produced. It shall be noted that this command does not return the private key that is associated to the public key in the certificate.

Input
  • CertificateID [CertificateID]
    The ID of the certificate to retrieve.
    Maximum length: 64
Output
  • Certificate [X509Certificate]
    The DER representation of the certificate.
    • CertificateID [CertificateID]
      The ID of the certificate.
      Maximum length: 64
    • KeyID [KeyID]
      The ID of the key that this certificate associates to the certificate subject.
      Maximum length: 64
    • Alias - optional; [string]
      The client-defined alias of the certificate.
    • CertificateContent [Base64DERencodedASN1Value]
      The base64-encoded DER representation of the X.509 certificate.
    • HasPrivateKey - optional; [boolean]
      The keystore has a matching private key.

GetAllCertificates 

GetAllCertificates()

This operation returns the IDs of all certificates that are stored in the device’s keystore.

This operation may be used, e.g., if a client lost track of which certificates are present on the device. If no certificate is stored in the device’s keystore, an empty list is returned.

Output
  • Certificate - optional, unbounded; [X509Certificate]
    A certificate stored in the keystore.
    • CertificateID [CertificateID]
      The ID of the certificate.
      Maximum length: 64
    • KeyID [KeyID]
      The ID of the key that this certificate associates to the certificate subject.
      Maximum length: 64
    • Alias - optional; [string]
      The client-defined alias of the certificate.
    • CertificateContent [Base64DERencodedASN1Value]
      The base64-encoded DER representation of the X.509 certificate.
    • HasPrivateKey - optional; [boolean]
      The keystore has a matching private key.

DeleteCertificate 

DeleteCertificate(CertificateID)

This operation deletes a certificate from the device’s keystore.

The operation shall not delete the public key that is contained in the certificate from the keystore. Certificates are uniquely identified using certificate IDs. If no certificate is stored under the requested certificate ID in the keystore, an InvalidArgVal fault is produced. If there is a certificate under the requested certificate ID stored in the keystore and the certificate could not be deleted, a CertificateDeletion fault is produced. If a reference exists for the specified certificate, the certificate shall not be deleted and the corresponding fault shall be produced. After a certificate has been successfully deleted, the device may assign its former ID to other certificates.

Input
  • CertificateID [CertificateID]
    The ID of the certificate to delete.
    Maximum length: 64

CreateCertificationPath 

CreateCertificationPath(CertificateIDs, Alias=None)

This operation creates a sequence of certificates that may be used, e.g., for certification path validation or for TLS server authentication.

Certification paths are uniquely identified using certification path IDs. Certificates are uniquely identified using certificate IDs. A certification path contains a sequence of certificate IDs. If there is a certificate ID in the sequence of supplied certificate IDs for which no certificate exists in the device’s keystore, the corresponding fault shall be produced and no certification path shall be created.

The signature of each certificate in the certification path except for the last one must be verifiable with the public key contained in the next certificate in the path. If there is a certificate ID in the request other than the last ID for which the corresponding certificate cannot be verified with the public key in the certificate identified by the next certificate ID, an InvalidCertificateChain fault shall be produced and no certification path shall be created.

Input
  • CertificateIDs [CertificateIDs]
    The IDs of the certificates to include in the certification path, where each certificate signature except for the last one in the path must be verifiable with the public key certified by the next certificate in the path.
    • CertificateID - unbounded; [CertificateID]
      A certificate ID.
      Maximum length: 64
  • Alias - optional; [string]
    The client-defined alias of the certification path.
Output
  • CertificationPathID [CertificationPathID]
    The ID of the generated certification path.
    Maximum length: 64

GetCertificationPath 

GetCertificationPath(CertificationPathID)

This operation returns a specific certification path from the device’s keystore.

Certification paths are uniquely identified using certification path IDs. If no certification path is stored under the requested ID in the keystore, an InvalidArgVal fault is produced.

Input
  • CertificationPathID [CertificationPathID]
    The ID of the certification path to retrieve.
    Maximum length: 64
Output
  • CertificationPath [CertificationPath]
    The certification path that is stored under the given ID in the keystore.
    • CertificateID - unbounded; [CertificateID]
      A certificate in the certification path.
      Maximum length: 64
    • Alias - optional; [string]
      The client-defined alias of the certification path.
    • anyElement - optional; [complexType]

GetAllCertificationPaths 

GetAllCertificationPaths()

This operation returns the IDs of all certification paths that are stored in the device’s keystore.

This operation may be used, e.g., if a client lost track of which certificates are present on the device. If no certification path is stored on the device, an empty list is returned.

Output
  • CertificationPathID - optional, unbounded; [CertificationPathID]
    An ID of a certification path in the keystore.
    Maximum length: 64

SetCertificationPath 

SetCertificationPath(
    CertificationPathID, CertificationPath
)

This operation allows to modify a certification path.

Input
  • CertificationPathID [CertificationPathID]
    The ID of the certification path to be modidfied.
    Maximum length: 64
  • CertificationPath [CertificationPath]
    The updated certification path to be stored in the keystore.
    • CertificateID - unbounded; [CertificateID]
      A certificate in the certification path.
      Maximum length: 64
    • Alias - optional; [string]
      The client-defined alias of the certification path.
    • anyElement - optional; [complexType]

DeleteCertificationPath 

DeleteCertificationPath(CertificationPathID)

This operation deletes a certification path from the device’s keystore.

This operation shall not delete the certificates that are referenced by the certification path. Certification paths are uniquely identified using certification path IDs. If no certification path is stored under the requested certification path ID in the keystore, an InvalidArgVal fault is produced. If there is a certification path under the requested certification path ID stored in the keystore and the certification path could not be deleted, a CertificationPathDeletion fault is produced. If a reference exists for the specified certification path, the certification path shall not be deleted and the corresponding fault shall be produced. After a certification path is successfully deleted, the device may assign its former ID to other certification paths.

Input
  • CertificationPathID [CertificationPathID]
    The ID of the certification path to delete.
    Maximum length: 64

UploadPassphrase 

UploadPassphrase(Passphrase, PassphraseAlias=None)

This operation uploads a passphrase to the keystore of the device.

Input
  • Passphrase [string]
    The passphrase to upload.
  • PassphraseAlias - optional; [string]
    The alias for the passphrase to upload.
Output
  • PassphraseID [PassphraseID]
    The PassphraseID of the uploaded passphrase.
    Maximum length: 64

GetAllPassphrases 

GetAllPassphrases()

This operation returns information about all passphrases that are stored in the keystore of the device.

This operation may be used, e.g., if a client lost track of which passphrases are present on the device. If no passphrase is stored on the device, the device shall return an empty list.

Output
  • PassphraseAttribute - optional, unbounded; [PassphraseAttribute]
    Information about a passphrase in the keystore.
    • PassphraseID [PassphraseID]
      The ID of the passphrase.
      Maximum length: 64
    • Alias - optional; [string]
      The alias of the passphrase.

DeletePassphrase 

DeletePassphrase(PassphraseID)

This operation deletes a passphrase from the keystore of the device.

Input
  • PassphraseID [PassphraseID]
    The ID of the passphrase that is to be deleted from the keystore.
    Maximum length: 64

UploadCRL 

UploadCRL(Crl, Alias=None, anyParameters=None)

This operation uploads a certificate revocation list (CRL) as specified in [RFC 5280] to the keystore on the device.

If the device does not have enough storage space to store the CRL to be uploaded, the device shall produce a MaximumNumberOfCRLsReached fault and shall not store the supplied CRL. If the device is not able to process the supplied CRL, the device shall produce a BadCRL fault and shall not store the supplied CRL. If the device does not support the signature algorithm that was used to sign the supplied CRL, the device shall produce an UnsupportedSignatureAlgorithm fault and shall not store the supplied CRL.

Input
  • Crl [Base64DERencodedASN1Value]
    The CRL to be uploaded to the device.
  • Alias - optional; [string]
    The alias to assign to the uploaded CRL.
  • anyParameters - optional; [complexType]
Output
  • CrlID [CRLID]
    The ID of the uploaded CRL.
    Maximum length: 64

GetCRL 

GetCRL(CrlID)

This operation returns a specific certificate revocation list (CRL) from the keystore on the device.

Certification revocation lists are uniquely identified using CRLIDs. If no CRL is stored under the requested CRLID, the device shall produce a CRLID fault.

Input
  • CrlID [CRLID]
    The ID of the CRL to be returned.
    Maximum length: 64
Output
  • Crl [CRL]
    The CRL with the requested ID.
    • CRLID [CRLID]
      Maximum length: 64
    • Alias [string]
    • CRLContent [Base64DERencodedASN1Value]

GetAllCRLs 

GetAllCRLs()

This operation returns all certificate revocation lists (CRLs) that are stored in the keystore on the device.

If no certificate revocation list is stored in the device’s keystore, an empty list is returned.

Output
  • Crl - optional, unbounded; [CRL]
    A list of all CRLs that are stored in the keystore on the device.
    • CRLID [CRLID]
      Maximum length: 64
    • Alias [string]
    • CRLContent [Base64DERencodedASN1Value]

DeleteCRL 

DeleteCRL(CrlID)

This operation deletes a certificate revocation list (CRL) from the keystore on the device.

Certification revocation lists are uniquely identified using CRLIDs. If no CRL is stored under the requested CRLID, the device shall produce a CRLID fault. If a reference exists for the specified CRL, the device shall produce a ReferenceExists fault and shall not delete the CRL. After a CRL has been successfully deleted, a device may assign its former ID to other CRLs.

Input
  • CrlID [CRLID]
    The ID of the CRL to be deleted.
    Maximum length: 64

CreateCertPathValidationPolicy 

CreateCertPathValidationPolicy(
    Parameters, TrustAnchor, Alias=None, anyParameters=None
)

This operation creates a certification path validation policy.

Certification path validation policies are uniquely identified using certification path validation policy IDs. The device shall generate a new certification path validation policy ID for the created certification path validation policy. For the certification path validation parameters that are not represented in the certPathValidationParameters data type, the device shall use the default values specified in Sect. 3. If the device does not have enough storage capacity for storing the certification path validation policy to be created, the device shall produce a maximum number of certification path validation policies reached fault and shall not create a certification path validation policy. If there is at least one trust anchor certificate ID in the request for which there exists no certificate in the device’s keystore, the device shall produce a CertificateID fault and shall not create a certification path validation policy. If the device cannot process the supplied certification path validation parameters, the device shall produce a CertPathValidationParameters fault and shall not create a certification path validation policy.

Input
  • Alias - optional; [string]
    The alias to assign to the created certification path validation policy.
  • Parameters [CertPathValidationParameters]
    The parameters of the certification path validation policy to be created.
    • RequireTLSWWWClientAuthExtendedKeyUsage - optional; [boolean]
      True if and only if the TLS server shall not authenticate client certificates that do not contain the TLS WWW client authentication key usage extension as specified in RFC 5280, Sect. 4.2.1.12.
      Default: false
    • UseDeltaCRLs - optional; [boolean]
      True if and only if delta CRLs, if available, shall be applied to CRLs.
      Default: false
    • anyParameters - optional; [complexType]
  • TrustAnchor - unbounded; [TrustAnchor]
    The trust anchors of the certification path validation policy to be created.
    • CertificateID [CertificateID]
      The certificate ID of the certificate to be used as trust anchor.
      Maximum length: 64
  • anyParameters - optional; [complexType]
Output
  • CertPathValidationPolicyID [CertPathValidationPolicyID]
    The ID of the created certification path validation policy.
    Maximum length: 64

GetCertPathValidationPolicy 

GetCertPathValidationPolicy(CertPathValidationPolicyID)

This operation returns a certification path validation policy from the keystore on the device.

Certification path validation policies are uniquely identified using certification path validation policy IDs. If no certification path validation policy is stored under the requested certification path validation policy ID, the device shall produce a CertPathValidationPolicyID fault.

Input
  • CertPathValidationPolicyID [CertPathValidationPolicyID]
    The ID of the certification path validation policy to be created.
    Maximum length: 64
Output
  • CertPathValidationPolicy [CertPathValidationPolicy]
    The certification path validation policy that is stored under the requested ID.
    • CertPathValidationPolicyID [CertPathValidationPolicyID]
      Maximum length: 64
    • Alias - optional; [string]
    • Parameters [CertPathValidationParameters]
      • RequireTLSWWWClientAuthExtendedKeyUsage - optional; [boolean]
        True if and only if the TLS server shall not authenticate client certificates that do not contain the TLS WWW client authentication key usage extension as specified in RFC 5280, Sect. 4.2.1.12.
        Default: false
      • UseDeltaCRLs - optional; [boolean]
        True if and only if delta CRLs, if available, shall be applied to CRLs.
        Default: false
      • anyParameters - optional; [complexType]
    • TrustAnchor - unbounded; [TrustAnchor]
      • CertificateID [CertificateID]
        The certificate ID of the certificate to be used as trust anchor.
        Maximum length: 64
    • anyParameters - optional; [complexType]

GetAllCertPathValidationPolicies 

GetAllCertPathValidationPolicies()

This operation returns all certification path validation policies that are stored in the keystore on the device.

If no certification path validation policy is stored in the device’s keystore, an empty list is returned.

Output
  • CertPathValidationPolicy - optional, unbounded; [CertPathValidationPolicy]
    A list of all certification path validation policies that are stored in the keystore on the device.
    • CertPathValidationPolicyID [CertPathValidationPolicyID]
      Maximum length: 64
    • Alias - optional; [string]
    • Parameters [CertPathValidationParameters]
      • RequireTLSWWWClientAuthExtendedKeyUsage - optional; [boolean]
        True if and only if the TLS server shall not authenticate client certificates that do not contain the TLS WWW client authentication key usage extension as specified in RFC 5280, Sect. 4.2.1.12.
        Default: false
      • UseDeltaCRLs - optional; [boolean]
        True if and only if delta CRLs, if available, shall be applied to CRLs.
        Default: false
      • anyParameters - optional; [complexType]
    • TrustAnchor - unbounded; [TrustAnchor]
      • CertificateID [CertificateID]
        The certificate ID of the certificate to be used as trust anchor.
        Maximum length: 64
    • anyParameters - optional; [complexType]

SetCertPathValidationPolicy 

SetCertPathValidationPolicy(
    CertPathValidationPolicy,
    CertPathValidationPolicyID=None,
)

This operation allows to modify an existing certification path validation policy.

Input
  • CertPathValidationPolicyID - optional; [CertPathValidationPolicyID]
    This element is deprecated and ignored; the ID of the certification path validation policy being modified must be specified in the CertPathValidationPolicy structure.
    Maximum length: 64
  • CertPathValidationPolicy [CertPathValidationPolicy]
    The updated certification path validation policy to be stored.
    • CertPathValidationPolicyID [CertPathValidationPolicyID]
      Maximum length: 64
    • Alias - optional; [string]
    • Parameters [CertPathValidationParameters]
      • RequireTLSWWWClientAuthExtendedKeyUsage - optional; [boolean]
        True if and only if the TLS server shall not authenticate client certificates that do not contain the TLS WWW client authentication key usage extension as specified in RFC 5280, Sect. 4.2.1.12.
        Default: false
      • UseDeltaCRLs - optional; [boolean]
        True if and only if delta CRLs, if available, shall be applied to CRLs.
        Default: false
      • anyParameters - optional; [complexType]
    • TrustAnchor - unbounded; [TrustAnchor]
      • CertificateID [CertificateID]
        The certificate ID of the certificate to be used as trust anchor.
        Maximum length: 64
    • anyParameters - optional; [complexType]

DeleteCertPathValidationPolicy 

DeleteCertPathValidationPolicy(CertPathValidationPolicyID)

This operation deletes a certification path validation policy from the keystore on the device.

Certification path validation policies are uniquely identified using certification path validation policy IDs. If no certification path validation policy is stored under the requested certification path validation policy ID, the device shall produce an InvalidCertPathValidationPolicyID fault. If a reference exists for the requested certification path validation policy, the device shall produce a ReferenceExists fault and shall not delete the certification path validation policy. After the certification path validation policy has been deleted, the device may assign its former ID to other certification path validation policies.

Input
  • CertPathValidationPolicyID [CertPathValidationPolicyID]
    The ID of the certification path validation policy to be deleted.
    Maximum length: 64