You can generate a client authentication certificate instead of using your API key to securely authenticate API requests. Creating a client authentication certificate may be useful for a service user if:
You prefer certificate-based authentication for enhanced security.
Your organization’s security policies require certificate authentication.
You want to avoid exposing API keys in API requests.
Tip
Specify the file path of your installed authentication certificate in the request header.
It may be useful to you to consider the following before you begin:
Store your certificate securely, it cannot be downloaded again after you generate it.
The certificate has an expiration date:
The date cannot be updated after the certificate is generated.
You must replace the certificate before it expires to avoid API failures.
Store the certificate password securely, it is shown only once.
Sign in to DigiCert ONE.
In the top-right corner, select the profile icon > View my user details.
Navigate to the Client authentication certificates section
Select Create client authentication certificate.
Provide the following information:
Nickname
This name is the display name on the Admin details page in the Authentication certificates section. The name must be unique and only include letters, numbers, spaces, dashes, and underscores.
End date
Enter the certificate expiration date. Make sure that the certificate expiration date does not expire after the API token expiration date.
If the API token end date does not fit your use case, update or remove the API token end date first. Then come back and generate the authentication certificate.
Tip
Note when the authentication certificate expires. You must generate a new certificate and update all API integrations using the certificate before it expires. If you don't, the API token integrations will stop working.
Encryption
Select an encryption algorithm to use for securing communications. DigiCert recommends AES (Advanced Encryption Standard), which is the default selection.
Signature hash algorithm
Select a hash function to use for verifying data integrity. DigiCert recommends SHA-256, which is the default selection.
Select Generate certificate.
Copy the certificate's password and store it in a secure location. You will need to use it later when installing the certificate or using it in your certificate request.
Tip
This password is required for installation and API requests. You will not be able to retrieve it later.
Select Download certificate.
Tip
You cannot download it again. If lost, you must generate a new certificate.
Remember the file path to your client authentication certificate, you will need to reference it later.
Select Close.