Certification Authority - PKI: API integration in the enrollment certificates flow

Question

Hi everyone,

I need to know if it's possible to apply APIs to the Certification Authority for the enrollment of specific certificates and based on specific application needs?! Especially if it's possible to apply APIs that allow enrollment through user authentication.

So, in addition to my first question, I'd like to know:

-Whether APIs can be applied for issuing certificates by the NDES service?!

-Whether APIs can be applied for issuing certificates by CES\CEP services?!

This capability would allow some applications in the organization to securely interface with the CA to receive a certificate, and in other cases, it would allow users to securely request an emergency certificate by authenticating them.

Are there any Use Cases or Best Practices you can point me to?

Thank you in advance,

Alessio

Answer 1

Hello,

Thank you for posting in Q&A forum.

1. Is it possible to apply APIs to a certificate authority to register a specific certificate and based on specific application needs?

Yes, APIs (Application Programming Interfaces) can be applied to Certificate Authorities (CAs) to register specific certificates and operate based on specific application requirements. This is often referred to as a "certificate issuance API" or similar term. Through APIs, applications can securely interact with CAs, submit certificate enrollment requests, authenticate users, receive certificates, and more. This approach not only increases the degree of automation, but also enhances the flexibility and scalability of the system.

2. Can NDES services apply for API issuance certificates?

The Network Device Enrollment Service (NDES) service itself does not directly provide the function of issuing certificates through APIs, but it is a deployment method of Microsoft's Simple Certificate Enrollment Protocol (SCEP), and SCEP does support interacting with CAs through APIs to register certificates. So, if your goal is to implement API-based certificate issuance using NDES, you're actually doing so through the SCEP protocol. In this case, you need to make sure that your CA supports the SCEP protocol and that the NDES service is properly configured to accept and process certificate enrollment requests from your application.

3.Can I Apply for an API Certificate for CES/CEP Service?

CEP can request a certificate via API (in this case, HTTP/HTTPS request). CEP is essentially a protocol for registering and obtaining certificates through web service APIs.

In a PKI server that implements CEP, clients (such as network devices and applications) send HTTP requests containing certificate registration information to the server. The server processes these requests, verifies the client's identity, and issues certificates based on policy.

The specific implementation details of the CEP protocol (such as API endpoints, request formats, response formats, authentication mechanisms, etc.) may vary depending on the PKI Server implementation. Therefore, when using CEP, it is necessary to refer to the documentation of the specific PKI Server or contact the vendor for details.

The following websites may be helpful to you.

https://www.forsenergy.com/en-us/certsvr/html/ee335ea9-e1d1-4f85-b9a4-ab0a8e75a7d2.htm

Certification Authority Web Enrollment Role Service in Windows Server | Microsoft Learn

Request certificates using Web Enrollment in AD CS | Microsoft Learn

I hope the information above is helpful.

Best Regards,

Yanhong Liu

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.