How to override data from CSR when using the REST API pkcs10enroll

[neualiluj]

Hello EJBCA community,

We would like to enroll certificates using the pkcs10enroll REST API endpoint; we don't want, however, to trust anything else than the public key from the CSR. We would like to specify the Subject DN (or its elements) and SubjectAltName separately in the payload. Is it possible using this API and, if so, how?

The various examples we found on using pkcs10enroll don't seem to address the case. We are not a Java shop, so building EJBCA in development mode just to access the Swagger API is quite complicated for us.

Thank you in advance for your help!

Julien

[primetomas]

You do this in a two step process. First adding an endentity with the subjectDN you like, second a certenroll call with that username/enrollment code. Only the public key from the CSR will be used and the pre-registered DN will be used.

[neualiluj]

Thank you for your answer. It makes sense.

I believe the endentity API is not supported on community edition, so we'll check the content of the CSR before sending it to EJBCA to ensure we are actually issuing a certificate for the right target.

[jpertuz-19]

With wsdl

1. create entity (editUser) with tokentype USERGENERATED
2. create cert with csr (pkcs10Request)