GlobalSign API for MSSL Certificates

Transcription

1 GlobalSign API for MSSL Certificates Implementation Guide and Definitions Version 2.1 8/26/2016 Version Release Notes Version 2.1 Changes Added a new command to change SANs in existing MSSL certificates: ChangeSubjectAltName New API commands to add MSSL Domains to MSSL profiles via , HTTP or DNS validation methods Identified new test system URLs Removed SHA-1 references as SHA-1 has been deprecated Updated list of error codes and descriptions Clarified the definition of Custom Validity Period. Added new API field to request specific values for KeyUsage and Extended Key Usage Version 2.0 Changes Added IntranetSSL product Added support for ordering ExtendedSSL certificates Reorganized and clarified many sections to improve technical accuracy and readability Version 1.3 Changes Updated country codes to use CW or SX instead of AN Fixed spelling error in RenewalTargetOrderID Replaced list of ModificationEventName responses with new values Copyright GlobalSign, Inc. All rights reserved. GlobalSign, the GlobalSign logo and OneClickSSL are trademarks and registered trademarks of GlobalSign, Inc. or its affiliates in the United States and other countries. All other trademarks are the property of their respective owners.

2 Contents 1. Outline and Overview Overview Managed SSL Product Types OrganizationSSL Extended SSL IntranetSSL Summary of key MSSL Product Features Web Service Functions Order & Query Workflow Overview Managed SSL Functions Query functions API and WSDL URLs Order Management Ordering Certificates PVOrder uest PVOrder Response Ordering Certificates using AutoCSR PVOrderWithoutCSR uest PVOrderWithoutCSR Response Modify MSSL Order ModifyMSSLOrder uest ModifyMSSLOrder Response Change SubjectAltName ChangeSubjectAltName uest ChangeSubjectAltName Response Domain Management Add Domain to Profile AddDomainToProfile uest AddDomainToProfile Response Verify MSSL Domain VerifyMsslDomain uest VerifyMsslDomain Response Add MSSL Domain AddMSSLDomain uest AddMSSLDomain Response Get MSSL Domain List GetMSSLDomainList uest GetMSSLDomainList Response Modify MSSL Domain ModifyMSSLDomain uest ModifyMSSLDomain Response Profile Management (Advanced) Get MSSL Profiles GetMSSLProfile uest GetMSSLProfile Response Add MSSL Profile AddMSSLProfile uest AddMSSLProfile Response Update MSSL Profile UpdateMSSLProfile uest UpdateMSSLProfile Response Query API Calls Get Issued Certificate Single Certificate (GetOrderByOrderID) GetOrderByOrderID uest GetOrderByOrderID Response Query API to get Issued Certificates by date range (GetOrderByDateRange) GetOrderByDateRange uest GetOrderByDateRange Response Query API to Get Recently Modified Orders (GetModifiedOrders) GetModifiedOrders uest GetModifiedOrders Response GlobalSign API for MSSL Certificates v2.1 Page 2 of 52

3 5.4 Query to Determine Upcoming Renewals (GetOrderByExpirationDate) GetOrderByExpirationDate uest GetOrderByExpirationDate Response Query API to Get Certificate Orders (GetCertificateOrders) GetCertificateOrders uest GetCertificateOrders Response Query API to Reissue Certificates (ReIssue) ReIssue uest ReIssue Response CSR Decoder and Error Checker (DecodeCSR) DecodeCSR uest DecodeCSR Response Turn Renewal Notice On/Off (ToggleRenewalNotice) Toggle Renewal Notice uest Toggle RenewalNotice Response Certificate Order Entry Parameters BaseOptions Custom Validity Period and Start/End dates Hash Algorithm KeyLength ModifyOrder Extensions OptionName Order Type Product Codes Subject Alternative Names (SANs) Tag Location Validity Period Vetting Level Vetting Type Profile Parameters (Advanced) Country CreditAgency/OrganizationCode MSSL Profile and Domain ID s Order Status Fields and Codes Order/Certificate Status ModificationEventName MSSL Domain Status MSSL Profile Status Success / Error Codes Success Codes Client Error Codes Server Error Codes Data Field Definitions Data Types Data Definitions GlobalSign API for MSSL Certificates v2.1 Page 3 of 52

4 1. Outline and Overview 1.1 Overview GlobalSign offers a Simple Object Access Protocol (SOAP) API for its partners and customers to directly order and manage certificates. Through this API, partners can perform functions such as ordering the different products, cancelling and fulfilling orders, and querying for order data. The API is organized as two Web Services ORDER and QUER. The operations in the ORDER Web Service are focused around initiating and cancelling orders while the QUER Web Service is focused on checking status of orders, getting fulfillment information for orders, such as issued certificates, reports, and obtaining order details. The API supports requests for SSL Certificates placed into the SSL Managed Service platform against previously validated organizational information and domains. Typically, an API user will retrieve issued certificates using the QUER function and then use its own methods to install or communicate the certificate to the end customer. However the API also allows for certificates to be ed directly to the order contacts (See the command ToggleRenewalNotice for more info) 1.2 Managed SSL Product Types All Product Types require that the Organization information and at least one Domain be registered in the Managed SSL account prior to ordering. When ordering certificates, the Domains Names for the CommonName and all Subject Alternative Names (SANs) must be registered and approved for the account prior to placing the order or the user will receive an error that the domain is not valid. This information is generally referred to as PreVetted (PV) and is referenced as such in the list of supported Product codes, see section OrganizationSSL When placing an OrganizationSSL order into an MSSL profile the applicant has a number of options available to them: Base Certificate type: OrganizationSSL supports Standard, Wildcard and GlobalIP (Publicly routable IP addresses) as values in the certificate Common Name. SAN Options: Depending on the options configured for your account, you can order certificates with a variety of SAN options including FQDN, SubDomain, GlobalIP, Unified Communications and Wildcard. Unified Communications Support: ou may specify the entry of the following host names for no additional fee: www, owa, autodiscover and mail Provide a CSR, or have GlobalSign generate the keys: The API allows you to enter a CSR or request that GlobalSign creates the keys and corresponding CSR on the fly (AutoCSR). Certificates requested using AutoCSR are returned in a packaged, encrypted PKCS#12 file containing both the Certificate file and private key. Certificates requested by supplying a customer generated CSR are returned as standard Certificates Extended SSL ExtendedSSL is the product name for GlobalSign's Extended Validation (EV) SSL offering and is issued in strict adherence the published CA/B Forum EV SSL guidelines covering certificate profile format, vetting method and workflow. This product is limited to a 2-year validity period option (and up to a maximum of 27 months with added renewal/bonus months). It also does not support wildcard nor IP address options. See section for more information. GlobalSign API for MSSL Certificates v2.1 Page 4 of 52

5 1.2.3 IntranetSSL The IntranetSSL certificates are issued under a set of Non-Public Roots which are not distributed within the major browser or operating system Root key stores. The use of non-public roots allows the issuance of certificates which do not need to comply with the industry CA/B Forum or Root store requirements, specifically the ability to issue certificates with internal server names. IntranetSSL supports many of the options in OrganizationSSL plus the use of Internal Server names or reserved IP addresses in the CN or SAN as well as certificate validity period up to 5 years. See section for more information Summary of key MSSL Product Features This is a table with the key features for the suite of MSSL products: Function ExtendedSSL OrganizationSSL IntranetSSL Base Options Wildcard N Global IP N Private N N Coupons or Promotional code Validity Period in request (years) Up to 2 Up to 3 Up to 5 Maximum cert validity period (months) Order Options (OptionName) SAN Option Renewal Extension Option N Validity Period Customize Option N Order Kind New Renewal Transfer N SAN Options: Unified Communications N FQDN SubDomain GlobalIP Address N Wildcard N Internal SAN or Reserved IP N N address Extensions Extended Key Usage Key Usage Future Future TLS Feature Extension AutoCSR with RSA 2048 bit keys N CSR Key Types supported RSA ECC P-256 ECC P-384 Post issuance actions Reissue Add/Delete SAN Cancel Revoke Renewal Future GlobalSign API for MSSL Certificates v2.1 Page 5 of 52

6 1.3 Web Service Functions Order & Query Workflow Overview Order processing for SSL Certificates and web identity products is asynchronous. For these types of orders an API client places an order and then later checks the server for the completed order. The specification document is split into two sections: Managed SSL (MSSL) Functions: calls to place orders, modify or cancel orders, modify or query MSSL specific account information Standard SSL Query Functions: calls needed to complete order calls, such as querying, and searching for complete orders (such as getting issued certificates) The general approach for ordering is to place orders using an Order function, then periodically request the list of all orders that have changed status during a specified time interval (for example, the last four hours) using the Query function of GetModifiedOrders. This returns a list of all orders and detailed order information for orders that have changed status in the specified time interval. The status of all returned orders can then be updated locally and used as necessary. An alternative to querying for a set of modified orders within a time period is to request the status of a specific order. In this case the ordering flow consists of the following operations: place an order, and then periodically check the status of the specific order (GetOrderByOrderID). Once the order has been completed, the fulfillment information is returned with the GetOrderByOrderID operation. This approach is less efficient, but might be more appropriate when there is a low volume of certificates being managed Managed SSL Functions Function Order Management Order an MSSL OV, MSSL EV or IntranetSSL certificate Order an MSSL OV, MSSL EV or IntranetSSL certificate using AutoCSR Modify Existing MSSL Order Change the SANs in an MSSL Order Domain Management Get List of MSSL Domains Add domain to profile ( , HTTP, DNS) Verify a domain (HTTP, DNS) Add domain to MSSL account (manually vetting) Modify Existing MSSL Domain Profile Management (Advanced) Get List of MSSL Profiles Add profile to MSSL account Update existing MSSL Profile API uest GSPVOrder GSPVOrderWithoutCSR ModifyMSSLOrder ChangeSubjectAltName GetMSSLDomains AddDomainToProfile VerifyMsslDomain AddMSSLDomain ModifyMSSLDomain GetMSSLProfiles AddMSSLProfile UpdateMSSLProfile Query functions The following functions are used to obtain information about existing orders or to perform utility functions. Function Searching order information by Order ID Searching orders by order date (from/to) Searching modified orders by modified date (from/to) Get orders by expiration date Getting order list Reissue a certificate Decode a CSR Toggle Renewal Notices API uest GetOrderByOrderID GetOrderByDateRange GetModifiedOrders GetOrderByExpirationDate GetCertificateOrders Reissue DecodeCSR ToggleRenewalNotice GlobalSign API for MSSL Certificates v2.1 Page 6 of 52

7 1.4 API and WSDL URLs WSDL URL s PROD Feature MSSL Functions WSDL Query WSDL URL TEST MSSL Functions WSDL Query WSDL API URL s: PROD Feature MSSL Functions Query URL TEST SSL Functions Service / Query *Test system accounts are available to API customers upon request GlobalSign API for MSSL Certificates v2.1 Page 7 of 52

8 2. Order Management 2.1 Ordering Certificates Set order information and order certificate (1) PVOrder uest PVOrder Response PVOrder uest The important fields in this message are: Product Codes not containing "SKIP" in section 6.9 can be used in this message to order ExtendedSSL, OrganizationSSL and IntranetSSL certificates. Those product codes that contains SKIP can be used in the next API message, PVOrderWithoutCSR. Base Option specifies Wildcard, GlobalIP or Private certificate types, if needed KindOrder: New, Renewal or Transfer Options: Specify order options for SANs, Renewal extension of 30 days, or custom validity period. Validity period in months GlobalSign API for MSSL Certificates v2.1 Page 8 of 52

9 Field Type Size Opt, Remarks, NA PVOrderuest OrderuestHeader AuthToken UserName String 30 Password String 30 OrderuestParameter string 50 ProductCode String BaseOption OrderKind Licenses Options - Option - OptionName OptionValue ValidityPeriod - Months NotBefore NotAfter CSR RenewalTargetOrderId TargetCert SpecialIntructions Coupon Campaign MsslProfileId MsslDomainId SubId Opt PVSealInfo - Opt AddressLine1 AddressLine2 AddressLine3 PostalCode Phone Fax ContactInfo - FirstName LastName Phone SANEntries - Opt SANEntry - SANOptionType SubjectAltName Extensions - Opt See section 6.6 Extension - Name Value GlobalSign API for MSSL Certificates v2.1 Page 9 of 52

10 2.1.2 PVOrder Response Field Type Size Remarks PVOrderResponse OrderResponseHeader SuccessCode Int 2 Errors Timestamp DateTime OrderID PVOrderDetail CertificateInfo CertificateStatus 5 StartDate DateTime EndDate DateTime CommonName 64 SerialNumber 64 SubjectName 3000 DNSNames 300 Fulfillment CACerticates CACertificate CACertType 15 Root, Inter CACert 4000 ServerCerticate X509Cert 4000 PKCS7Cert Ordering Certificates using AutoCSR Set order information and order certificate (1) PVOrderWithoutCSR uest PVOrderWithoutCSR Response Retrieve SSL PKCS#12 Certificate (1) GetOrderbyOrderID uest GetOrderbyOrderID Response The Product Codes containing "SKIP" in section 6.9 can be used in this command which results in GlobalSIgn generating the keys and returning them via P12 in the API. This follows the same basic order processing as the PVOrder described above PVOrderWithoutCSR uest This is essentially the same as PVOrder except for the bolded fields below. GlobalSign API for MSSL Certificates v2.1 Page 10 of 52

11 Field Type Size Opt, Remarks, NA PVOrderWithoutCSR OrderuestHeader AuthToken UserName String 30 Password String 30 OrderuestParameterWithoutCSR string 50 NA ProductCode String BaseOption OrderKind Licenses Options - Option - OptionName OptionValue ValidityPeriod - Months NotBefore NotAfter Pin String KeyLength Int See section 6.4 RenewalTargetOrderId TargetCert SpecialIntructions Coupon Campaign MsslProfileId MsslDomainId SubId Opt PVSealInfo - Opt AddressLine1 AddressLine2 AddressLine3 PostalCode Phone Fax OVCSRInfo CommonName OrganizationUnit ContactInfo - FirstName LastName Phone SANEntries - Opt SANEntry - SANOptionType SubjectAltName Extensions - Opt See section 6.6 Extension - Name Value GlobalSign API for MSSL Certificates v2.1 Page 11 of 52

12 2.2.2 PVOrderWithoutCSR Response Field Type Size Opt, Remarks, NA PVOrderWithoutCSRResponse OrderResponseHeader SuccessCode Int 2 Errors N Timestamp DateTime OrderID PVOrderDetail N CertificateInfo N CertificateStatus 5 StartDate DateTime EndDate DateTime CommonName 64 SerialNumber 64 SubjectName 3000 DNSNames 300 Fulfillment N CACerticates N CACertificate CACertType 15 Root, Inter CACert 4000 ServerCerticate N X509Cert 4000 PKCS7Cert Modify MSSL Order The ModifyMSSLOrder command is used to: approve a pending order cancel an order, or revoke a certificate See section 6.5 for more information ModifyMSSLOrder uest Field Type Size Opt,, NA ModifyMSSLOrder OrderuestHeader AuthToken UserName String 30 Password String 30 OrderID string 50 ModifyOrderOperation String Remarks ModifyMSSLOrder Response Field Type Size Remarks ModifyMSSLOrderResponse OrderResponseHeader SuccessCode Errors Timestamp DateTime GlobalSign API for MSSL Certificates v2.1 Page 12 of 52

13 2.4 Change SubjectAltName The ChangeSubjectAltName command is used to replace the current set of SANs with a new set of SANs. To use this command, specify the OrderID you want to change and then specify an entirely new set of SANs which will replace the current set of SANs. The Public Key and expiration date of the certificate remain the same, but SANs are updated ChangeSubjectAltName uest Field Type Size Opt, Remarks, NA ChangeSubjectAltName OrderuestHeader AuthToken UserName String 30 Password String 30 OrderID string 50 NA TargetOrderID string 50 The OrderID which will have the SANs changed Approver string 255 NA Not currently used SANEntries Opt If not supplied, then there will be no SANs other than the value form the CommonName SANEntryArray SANOptionType SubjectAltName PIN NA Not currently used ChangeSubjectAltName Response Field Type Size Remarks ChangeSubjectAltNameResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 OrderID string 50 This is the new OrderID with the new set of SANs TargetOrderID 50 This is the OrderID of the order what was changed (the value from TargetOrderID in the uest) GlobalSign API for MSSL Certificates v2.1 Page 13 of 52

14 3. Domain Management 3.1 Add Domain to Profile The new AddDomainToProfile command allows customers to add domains to the specified profile within their GCC account and then perform domain control to have it approved using the , HTTP or DNS approval methods. This allows customers to self approve domains which can be fully automated and expands Domain Validation methos to support cases where the Enterprise is not listed as the domain owner in whois, AddDomainToProfile uest Field Type Size Opt, Remarks, NA AddDomainToProfile OrderuestHeader AuthToken UserName String 30 Password String 30 MSSLProfileID String DomainName string 64 Reg VettingLevel string See section 6.11 VettingType string See section 6.14 Approval string Opt uired when VettingType = AddDomainToProfile Response Field Type Size Remarks AddDomainToProfileResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 MSSLDomainID MetaTag String Either MetaTag or DnsTXT will be returned DnsText String 3.2 Verify MSSL Domain The VerifyMsslDomain command allows customers to approve domains they have added top their profile using the DNS or HTTP methods to demonstrate domain control. GlobalSign API for MSSL Certificates v2.1 Page 14 of 52

15 3.2.1 VerifyMsslDomain uest Field Type Size Opt, Remarks, NA VerifyMsslDomain OrderuestHeader AuthToken UserName String 30 Password String 30 DomainID string TagLocation string See section 6.11 VettingType String See section 6.14 Note: This will be added to the API as a required field on September 26, 2016, so plan to expect this new field VerifyMsslDomain Response Field Type Size Remarks VerifyMsslDomainResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 DomainID string 64 The DomainID for the added domain. 3.3 Add MSSL Domain The AddMSSLDomain command allows customers to add domains to the specified profile within their GCC account. Each domain is reviewed by our vetting departement prior to being activated. When adding domains to EV profiles additional industry mandated procedures are required to be followed which may add additional time prior to activation. For automated domain approval via , DNS or HTTP methods, please use the AddMsslDomain uest documented in section AddMSSLDomain uest Field Type Size Opt, Remarks, NA AddMSSLDomain OrderuestHeader AuthToken UserName String 30 Password String 30 MSSLProfileID string 50 DomainName string 64 VettingLevel String See section AddMSSLDomain Response Field Type Size Remarks AddMSSLDomainResponse GlobalSign API for MSSL Certificates v2.1 Page 15 of 52

16 OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 DomainName string Get MSSL Domain List This command is used to obtain a list of the domains associated with a specific MSSL ProfileID GetMSSLDomainList uest Field Type Size Opt, Remarks, NA GetMSSLDomainList QueryuestHeader AuthToken UserName String 30 Password String 30 MSSLProfileID string 50 Opt If supplied the response will contain only DomainIDs in the specified profile MSSLDomainID string 50 Opt MSSLDomainName string 64 Opt MSSLProfileStatus string 5 Opt GetMSSLDomainList Response Field Type Size Remarks GetMSSLDomainListResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 SearchMSSLDomainDetails SearchMSSLDomainDetail MSSLDomainID 50 MSSLProfielID 17 MSSLDomainName 64 MSSLDomainStatus NotBefore date NotAfter date delete_date date 3.5 Modify MSSL Domain The ModifyMSSLDomain command is used to delete a domain from the specified profile. GlobalSign API for MSSL Certificates v2.1 Page 16 of 52

17 3.5.1 ModifyMSSLDomain uest Field Type Size Opt, Remarks, NA ModifyMSSLDomain OrderuestHeader AuthToken UserName String 30 Password String 30 MSSLDomainID string 64 ModifyDomainOperation string 64 DELETE ModifyMSSLDomain Response Field Type Size Remarks ModifyMSSLDomainResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 GlobalSign API for MSSL Certificates v2.1 Page 17 of 52

18 4. Profile Management (Advanced) 4.1 Get MSSL Profiles GetMSSLProfile uest Field Type Size Opt,, NA GetMSSLProfile QueryuestHeader AuthToken UserName String 30 Password String 30 MSSLProfileID string 50 Opt VettingLevel string 2 Opt MSSLProfileStatus string 5 Opt Remarks GetMSSLProfile Response Field Type Size Remarks GetMSSLProfileResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 SearchMSSLProfileDetails SearchMsslProfileDetail MSSLProfileId VettingLevel MSSLPlofileStatus DocSubmissionDate PVRecieveDate HoldEndDate uestdate MSSLOVProfileInfo MSSLOVProfile OVSealInfo BusinessOVInfo MSSLEVProfileInfo MSSLEVProfile JurisdictionInfo BusinessPlaceInfo BusinessEVInfo CertificateApprover ContractSigner Either OV or EV profile will be returned 4.2 Add MSSL Profile Normally profiles are added via GCC, however this can also be done via the API. The profile will be reviewed and activated by the GlobalSign vetting team once received. GlobalSign API for MSSL Certificates v2.1 Page 18 of 52

19 4.2.1 AddMSSLProfile uest Field Type Size Opt,, NA AddMSSLProfile OrderuestHeader AuthToken UserName String 30 Password String 30 VettingLevel string 2 Opt MSSLOVProfileInfo MSSLEVProfileInfo Opt Remarks Either the OV or EV profile info must be present AddMSSLProfile Response Field Type Size Remarks GetMSSLProfileResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 MSSLProfileID String Update MSSL Profile UpdateMSSLProfile uest Field Type Size Opt,, NA UpdateMSSLProfile OrderuestHeader AuthToken UserName String 30 Password String 30 MsslProfileID string 2 MSSLEVProfileInfo Opt Remarks UpdateMSSLProfile Response Field Type Size Remarks GetMSSLProfileResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 MSSLProfileID String 50 GlobalSign API for MSSL Certificates v2.1 Page 19 of 52

20 5. Query API Calls 5.1 Get Issued Certificate Single Certificate (GetOrderByOrderID) This command is used to obtain order information based on OrderID and is the typical method to get the order details for orders GetOrderByOrderID uest Field Type Size Opt,, NA GetOrderByOrderID QueryuestHeader AuthToken UserName String 30 Password String 30 OrderID string 50 OrderQueryOption string 50 OrderStatus Int NA ReturnOrderOption boolean ReturnCertificateInfo boolean ReturnFulfillment boolean ReturnCACerts boolean Remarks GetOrderByOrderID Response Field Type Size Remarks GetOrderByOrderIDResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 Pkcs12File OrderDetails OrderDetail OrderInfo OrderSubInfo OrderOption CertificateInfo Fulfillment ModificationEvents GlobalSign API for MSSL Certificates v2.1 Page 20 of 52

21 5.2 Query API to get Issued Certificates by date range (GetOrderByDateRange) GetOrderByDateRange uest Field Type Size Opt,, NA GetOrderByDateRange QueryuestHeader AuthToken UserName String 30 Password String 30 FromDate string:date 24 ToDate string:date 24 OrderQueryOption OrderStatus boolean ReturnOrderOption boolean ReturnCertificateInfo boolean ReturnFulfillment boolean ReturnCACerts boolean Remarks GetOrderByDateRange Response Field Type Size Remarks GetOrderByOrderIDResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 Pkcs12File OrderDetails OrderDetail+ OrderInfo OrderSubInfo OrderOption CertificateInfo Fulfillment ModificationEvents 5.3 Query API to Get Recently Modified Orders (GetModifiedOrders) The GetModifiedOrders API will return a list of orders modified within a specified time frame GetModifiedOrders uest Field Type Size Opt,, NA GetModifiedOrders QueryuestHeader AuthToken UserName String 30 Password String 30 FromDate string:date 24 ToDate string:date 24 OrderQueryOption OrderStatus Int ReturnOrderOption boolean ReturnCertificateInfo boolean ReturnFulfillment boolean ReturnCACerts boolean Remarks GlobalSign API for MSSL Certificates v2.1 Page 21 of 52

22 5.3.2 GetModifiedOrders Response Field Type Size Remarks GetModifiedOrdersResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 ReturnCount 5 FromDate string:date 24 ToDate string:date 24 OrderDetails OrderDetail+ OrderInfo OrderSubInfo OrderOption CertificateInfo Fulfillment ModificationEvents 5.4 Query to Determine Upcoming Renewals (GetOrderByExpirationDate) This is a request to obtain a list of OrderIDs with certificates expiring in a specified date range GetOrderByExpirationDate uest Field Type Size Opt,, NA GetOrderByExpirationDate QueryuestHeader AuthToken UserName String 30 Password String 30 ExpirationFromDate Date ExpirationToDate Date FQDN string 64 OrderKind Int 10 OrderStatus String 5 SubID String 50 Remarks GlobalSign API for MSSL Certificates v2.1 Page 22 of 52

23 5.4.2 GetOrderByExpirationDate Response Field Type Size Remarks GetOrderByExpirationDateResponse QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 ReturnCount 5 SearchOrderDetails SearchOrderDetail+ Multiple possible OrderID 50 BaseOption 20 OrderKind 10 uestkind 10 Licenses 3 OrderuestDate Date 25 OrderIssueDate Date 25 OrderCanceledDate Date 25 OrderStatus 5 OrganizationName String 255 SubId 50 FQDN Query API to Get Certificate Orders (GetCertificateOrders) The GetCertificateOrders API will return a list of orders GetCertificateOrders uest Field Type Size Opt,, NA GetCertificateOrders QueryuestHeader AuthToken UserName String 30 Password String 30 FromDate Date ToDate Date FQDN string 64 OrderKind Int 10 OrderStatus String 5 SubID String 50 Remarks GetCertificateOrders Response Field Type Size Remarks GetCertificateOrdersresponse GlobalSign API for MSSL Certificates v2.1 Page 23 of 52

24 QueryResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 ReturnCount 5 SearchOrderDetails SearchOrderDetail+ OrderID 50 BaseOption 20 OrderKind 10 uestkind 10 Licenses 3 OrderuestDate Date 25 OrderIssueDate Date 25 OrderCanceledDate Date 25 OrderStatus 5 OrganizationName String 255 SubId 50 FQDN 64 Multiple possible 5.6 Query API to Reissue Certificates (ReIssue) Use the Reissue API to Re-order a certificate ReIssue uest Field Type Size Opt, Remarks ReIssue OrderuestHeader AuthToken UserName String 30 Password String 30 Orderparameter Date CSR String 4000 DNSNames string 300 Opt TargetOrderID string 50 HashAlgorithm string Extensions Opt See section 6.6. Note: If no values are supplied then the certificate will be issued with the Default values, not the values in the certificate being reissued ReIssue Response Field Type Size Remarks ReIssueResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 ReturnCount 5 OrderID String 50 TargetOrderID string CSR Decoder and Error Checker (DecodeCSR) uest to allow submission of CSR for parsing and error checking. GlobalSign API for MSSL Certificates v2.1 Page 24 of 52

25 5.7.1 DecodeCSR uest Field Type Size Opt,, NA DecodeCSR OrderuestHeader AuthToken UserName String 30 Password String 30 CSR String 4000 ProductType string Remarks DecodeCSR Response Field Type Size Remarks DecodeCSRResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 CSRData CommonName string 255 Organization string 255 OrganizationUnit string 255 Locality string 255 State string 255 Country string 30 Address string 255 KeyLength string Turn Renewal Notice On/Off (ToggleRenewalNotice) Toggle Renewal Notice uest Field Type Size Opt,, NA ToggleRenewalNotice OrderuestHeader AuthToken UserName String 30 Password String 30 OrderID String RenewalNotice Boolean 5 Remarks Toggle RenewalNotice Response Field Type Size Remarks ToggleRenewalNoticeResponse OrderResponseHeader SuccessCode 2 Errors TimeStamp string:date 24 OrderID GlobalSign API for MSSL Certificates v2.1 Page 25 of 52

26 6. Certificate Order Entry Parameters 6.1 BaseOptions BaseOptions can be added to the certificate order if it is for a specific type of certificate, the following BaseOptions are currently available. BaseOption Supported Products Notes wildcard OrganizationSSL IntranetSSL Common Name must contain the * character in place of the subdomain globalip OrganizationSSL IntranetSSL Common Name must contain a publicly accessible IP address private IntranetSSL Common name must be an internal server name or a Reserved IP address 6.2 Custom Validity Period and Start/End dates ou can control the validity period and set custom Not Before (N/B) and/or Not After (N/A) dates in the request and these will be represent in the issued certificate. - Certificates N/B date can be blank and then the value will be filled with the certificate issuance date/time. - If the Certificate N/B date is filled it, it must be set for a date at least one day in the future. This means that the certificate N/B date will never be newer than 1 day from the Order Date - The N/A date cannot be any further in the future than the current date plus requested validity period (plus any added validity due to renewal, trade-in, etc.). In other words, you cannot get a certificate that expires any later than the certificate ordered without a Custom Validity Period. - The N/B must be a date that precedes the N/A date In order to set custom validity periods you need to set the Order Option of "VPC" (ValidityPeriodCustomizeOption) to True and then supply N/B and N/A dates in the ValidityPeriod field. If the N/B or N/A dates are set incorrectly the order will be rejected. 6.3 Hash Algorithm When an order is being placed the Product Code is used to specify the hash algorithm, but when reissuing a certificate there is no Product Code, thus the need for Hash Algorithm. - If this is not specified, certificates will be issued based on the hash algorithm of the certificate being reissued. - If SHA1 is specified, the SHA1 product option will be issued (if supported for the specified product). - If SHA256 is specified, SHA-256 product option will be issued. - If ECC256 is specified, the ECC P-256 product option will be used (if supported for the specified product) Note that when changing the hash Algorithm the issuing CA will also change so a new Subordinate CA certificate will need to be configured on the server as part of the certificate installation process. Not all products support all Hash Algorithms, see section 6.9 for a list of the products that support each of the hashing algorithms. GlobalSign API for MSSL Certificates v2.1 Page 26 of 52

27 6.4 KeyLength This reflects the Key Length to be used if the keys for the certificate are being created on GlobalSign servers when AutoCSR options are used. Valid values for RSA keys: 2048 or ECC AutoCSR is not supported. 6.5 ModifyOrder The following OrderTypes can be ordered through the API. ModifyOrder APPROVE CANCEL REVOKE Supported Products ExtendedSSL OrganizationSSL IntranetSSL ExtendedSSL OrganizationSSL IntranetSSL ExtendedSSL OrganizationSSL IntranetSSL Notes Approve a pending order. If a user placed an order and did not have sufficient permissions, it will be queued for review. The API can identify and then approve these pending orders. An order can be cancelled within the first 7 days only Revokes all certificates in the order (all reissued and renewed certificates with the specified OrderID) 6.6 Extensions This extension allows the issuance of certificates with customer supplied values in the following extensions: ExtendedKeyUsage KeyUsage TLSFeature (future) Usage This options uses name value pairs where the Name is the name of the extension (ExtendedKeyUsage, KeyUsage or TLSFeature ) and the value is the value to be placed in the certificate. Multiple name value pairs will be used to specify multiple values for an extension (e.g., to request Server Auth and Client Auth in the EKU extension you would need to supply 2 name value pairs in the API) Product to feature mapping: - The Default behavior for all SSL products is listed in the Default column. - MSSL EV, MSSL OV and IntranetSSL have Basic and Advanced options as listed below. - PV_ARG (Private hierarchies) has a basic setting as listed in the last column. Name Value Name of OID/Bit position of EKU ExtendedKe Server yusage Authentication Default Basic Advanced PV_AEG Basic X X X X Client Authentication X X X X Protection X X X (S/MIME) GlobalSign API for MSSL Certificates v2.1 Page 27 of 52

28 IPSec End System X X IPSec Tunnel X X IPSec User X X id-kp-ipsecike X X Smart Card Logon X X Key Archival X KDC Authentication X X IKE Intermediate X X Any Extended Key Usage X KeyUsage (RSA keys) KeyUsage (ECC keys) TLSFeature (Future) digitalsignature 0 X X - X keyencipherment 2 X X - X dataencipherment 3 X - X keyagreement 4 - X encipheronly 7 - X decipheronly 8 - X digitalsignature 0 X X - X keyencipherment 2 - X dataencipherment 3 X - X keyagreement 4 X X - X encipheronly 7 X - X decipheronly 8 X - X OCSPMustStaple OCSP Must Staple X X X The values permitted for your account will depend on how each of the products are configured within your account (Default, Basic or Advanced). If you need to specify certain values in any of the supported extensions listed above, please contact your account manager or GlobalSign support and ask that the configuration be updated for the product(s) needing this flexibility. 6.7 OptionName The following option types must be added for ordering certificates with extended options. Set to TRUE to activate. OptionName SAN REX VPC Supported Products ExtendedSSL OrganizationSSL IntranetSSL ExtendedSSL OrganizationSSL ExtendedSSL OrganizationSSL Description Activates the Subject Alternative Name (SANs) options see section on Subject Alternative Names (SANs) Optionally adds an additional 30 days to a Renewal order Allows the start date and end date of the Certificate to be customized see section on Setting validity period of the certificate (by Not before/not after date) 6.8 Order Type The following OrderTypes can be ordered through the API. GlobalSign API for MSSL Certificates v2.1 Page 28 of 52

29 No. OrderKind Supported Products Notes 1 New ExtendedSSL A new order OrganizationSSL IntranetSSL 2 Renewal ExtendedSSL OrganizationSSL IntranetSSL 3 Transfer ExtendedSSL OrganizationSSL A renewal order for replacing an expiring certificate with less than 90 days remaining A competitive switch a certificate is being traded in from another SSL provider and the remaining validity will be added onto this order (up to specified validity period limits set by the industry requirements) 6.9 Product Codes The product code is a necessary item in most of the API calls above, the code you enter should match the type of certificate your client requires. ProductCode Certificate Type ExtendedSSL PEV ExtendedSSL signed with SHA1 - DEPRECATED PEV_SHA2 ExtendedSSL signed with SHA-256 OrganizationSSL PV OrganizationSSL signed with SHA1 - DEPRECATED PV_SHA2 OrganizationSSL signed with SHA-256 PV_SKIP OrganizationSSL using AutoCSR signed with SHA1 DEPRECATED PV_SKIP_SHA2 OrganizationSSL using AutoCSR signed with SHA256 IntranetSSL PV_INTRA IntranetSSL signed with SHA1 PV_INTRA_SHA2 IntranetSSL signed with SHA-256 PV_INTRA_SKIP IntranetSSL using AutoCSR signed with SHA1 PV_INTRA_SKIP_SHA2 IntranetSSL using AutoCSR signed with SHA-256 PV_INTRA_ECCP256 IntranetSSL signed with ECC P-256 Note: if any of the Depreciated SHA1 options are specified, the SHA-256 equivalent will be used Subject Alternative Names (SANs) SANs should be added with a combination of OptionName set to SAN and SANOptionType set to one of the following together with the full SAN name in SubjectAltName. Value SANOptionType Products Explanation 1 UC cert option ExtendedSSL Unified Communication Cert OrganizationSSL allows only owa, mail or autodiscover subdomains to be added for no additional cost 2 Subdomain SAN ExtendedSSL Additional Subdomain option OrganizationSSL IntranetSSL 3 GIP SAN option OrganizationSSL Public IP address (IPv4 only) IntranetSSL 4 Internal SAN option IntranetSSL Internal Hostname or Reserved IP address 7 FQDN SAN option ExtendedSSL OrganizationSSL IntranetSSL Additional Fully Qualified Domain GlobalSign API for MSSL Certificates v2.1 Page 29 of 52

30 13 Wildcard SAN OrganizationSSL IntranetSSL Allows the entry of a SAN value starting with :*." 6.11 Tag Location When verifying domain control using the DNS or HTTP methods the TagLocation specifies the location of the random number. For DNS TXT record The random number can be posted in a DNS TXT record for that domain or any higher level in the domain hierarchy. Since there are multiple levels where the value can be posted, the exact location must be supplied as part of the Validation step. The CA/B Forum defines the acceptable locations as Authorization Domain Names. Here are some examples FQDN TagLocation values a.b.c.example.com store.example.com example.com a.b.c.example.com b.c.example.com c.example.com example.com store.example.com example.com example.com For HTTP Validation When performing HTTP validation, use an Authorization Domain Name. The TagLocation value is similar to that used for DNS validation above except there are two additional notes: o o The value must be preceded with or so the proper location can be queried. The FQDN must be appended with the directory location Domain being requested a.b.c.example.com Valid TagLocation values The full URI to be used can be any of the above with one of the above Authorization Domain Names (adn) following appended, where <adn> is a.b.c.example.com, b.c.example.com, etc. GlobalSign API for MSSL Certificates v2.1 Page 30 of 52

31 If you re using this method Root level index file (until 27 February 2017) Using the metatag in the /.wellknown directory (until 27 February 2017) New CA/B Forum specified location (After October 31)** then this is the TagLocation value ** Note: this location will be supported in the coming months 6.12 Validity Period ou can control the validity period of ordered certificates by setting the number of months. Not all validity periods are configured for every account since this depends on the MSSL agreement and pricing options agreed to. The actual validity period of the certificate depends on the selection of various options in the API in addition to this Validity Period field. Number Of Months Supported Products Certificate Validity Period (days) 6* ExtendedSSL 184* OrganizationSSL IntranetSSL 12 (default) ExtendedSSL 366 OrganizationSSL IntranetSSL 24 ExtendedSSL 731 OrganizationSSL IntranetSSL 36 OrganizationSSL 1096 IntranetSSL 48 IntranetSSL IntranetSSL Vetting Level When submitting domains to be added to an MSSL profile via the AddMsslDomain uest, the following vetting levels are supported: Value OV EV Description 6.14 Vetting Type The following values for VettingType are supported when used in the AddDomainToProfile and VerifyMsslDomain API messages. GlobalSign API for MSSL Certificates v2.1 Page 31 of 52

32 Value Description AddDomainToProfile VerifyMsslDomain is used to approve the X NA domain HTTP* The HTTP method is used to X X approve the domain. This is also known as URL or metatag. DNS The DNS method is used to approve the domain X X *Note to early developers: The value of URL will be used until October 31, 2016 at which point the value will be changed to HTTP. If the manual vetting option is needed, please use the AddMsslDomain API message in Section 3.3. GlobalSign API for MSSL Certificates v2.1 Page 32 of 52

33 7. Profile Parameters (Advanced) 7.1 Country List of country two digit codes and currently supported status, = supported N = not supported. Code Name Status AD ANDORRA AE UNITED ARAB EMIRATES AF AFGHANISTAN N AG ANTIGUA AND BARBUDA AI ANGUILLA AL ALBANIA AM ARMENIA AN NL ANTILLES (USE CW or SX) N AO ANGOLA N AQ ANTARCTICA AR ARGENTINA AS AMERICAN SAMOA AT AUSTRIA AU AUSTRALIA AW ARUBA AX ALANDS ISLANDS AZ AZERBAIJAN BA BOSNIA AND HERZEGOVINA BB BARBADOS BD BANGLADESH BE BELGIUM BF BURKINA FASO BG BULGARIA BH BAHRAIN BI BURUNDI BJ BENIN BM BERMUDA BN BRUNEI DARUSSALAM BO BOLIVIA BR BRAZIL GW GUINEA-BISSAU G GUANA HK HONG KONG HM HEARD ISLAND AND MCDONALD ISLANDS HN HONDURAS HR CROATIA HT HAITI HU HUNGAR ID INDONESIA IE IRELAND Code Name Status IL ISRAEL IM ISLE OF MAN IN INDIA IO BRITISH INDIAN OCEAN TERRITOR IQ IRAQ N IR IRAN, ISLAMIC REPUBLIC OF N IS ICELAND IT ITAL JE JERSE JM JAMAICA JO JORDAN JP JAPAN KE KENA KG KRGZSTAN KH CAMBODIA KI KIRIBATI KM COMOROS KN SAINT KITTS AND NEVIS KP NORTH KOREA (DEMOCRATIC PEOPLE S N REPUBLIC OF KOREA) BS BAHAMAS BT BHUTAN BV BOUVET ISLAND BW BOTSWANA B BELARUS BZ BELIZE CA CANADA CC COCOS (KEELING) ISLANDS CD CONGO, THE DEMOCRATIC REPUBLIC OF THE CF CENTRAL AFRICAN REPUBLIC CG CONGO CH SWITZERLAND CI COTE D IVOIRE CK COOK ISLANDS CL CHILE CM CAMEROON CN CHINA GlobalSign API for MSSL Certificates v2.1 Page 33 of 52

34 Code Name Status CO COLOMBIA CR COSTA RICA CU CUBA N CV CAPE VERDE CW CURACAO CX CHRISTMAS ISLAND C CPRUS CZ CZECH REPUBLIC DE GERMAN DJ DJIBOUTI DK DENMARK DM DOMINICA DO DOMINICAN REPUBLIC DZ ALGERIA KR KOREA, REPUBLIC OF KW KUWAIT K CAMAN ISLANDS KZ KAZAKSTAN LA LAO PEOPLE S DEMOCRATIC REPUBLIC LB LEBANON LC SAINT LUCIA LI LIECHTENSTEIN LK SRI LANKA LR LIBERIA N LS LESOTHO LT LITHUANIA LU LUXEMBOURG LV LATVIA L LIBAN ARAB JAMAHIRIA N MA MOROCCO MC MONACO MD MOLDOVA, REPUBLIC OF ME MONTENEGRO N MG MADAGASCAR MH MARSHALL ISLANDS MK MACEDONIA, THE FORMER UGOSLAV REPUBLIC OF ML MALI MM MANMAR MN MONGOLIA MO MACAU MP NORTHERN MARIANA ISLANDS MQ MARTINIQUE MR MAURITANIA Code Name Status EC ECUADOR EE ESTONIA EG EGPT EH WESTERN SAHARA ER ERITREA ES SPAIN ET ETHIOPIA FI FINLAND FJ FIJI FK FALKLAND ISLANDS (MALVINAS) FM MICRONESIA, FEDERATED STATES OF FO FAROE ISLANDS FR FRANCE GA GABON GB UNITED KINGDOM GD GRENADA GE GEORGIA GF FRENCH GUIANA GG GUERNSE GH GHANA GI GIBRALTAR GL GREENLAND GM GAMBIA GN GUINEA GP GUADELOUPE GQ EQUATORIAL GUINEA GR GREECE GS SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS GT GUATEMALA GU GUAM MS MONTSERRAT MT MALTA MU MAURITIUS MV MALDIVES MW MALAWI MX MEXICO M MALASIA MZ MOZAMBIQUE NA NAMIBIA NC NEW CALEDONIA NE NIGER NF NORFOLK ISLAND NG NIGERIA GlobalSign API for MSSL Certificates v2.1 Page 34 of 52

35 Code Name Status NI NICARAGUA NL NETHERLANDS NO NORWA NP NEPAL NR NAURU NU NIUE NZ NEW ZEALAND OM OMAN PA PANAMA PE PERU PF FRENCH POLNESIA PG PAPUA NEW GUINEA PH PHILIPPINES PK PAKISTAN PL POLAND PM SAINT PIERRE AND MIQUELON PN PITCAIRN PR PUERTO RICO PS PALESTINIAN TERRITOR, OCCUPIED PT PORTUGAL PW PALAU P PARAGUA QA QATAR RE REUNION RO ROMANIA RS SERBIA N RU RUSSIAN FEDERATION RW RWANDA N SA SAUDI ARABIA SB SOLOMON ISLANDS SC SECHELLES SD SUDAN N SE SWEDEN SG SINGAPORE SH SAINT HELENA SI SLOVENIA SJ SVALBARD AND JAN MAEN SK SLOVAKIA SL SIERRA LEONE N SM SAN MARINO SN SENEGAL SO SOMALIA N SR SURINAME Code Name Status ST SAO TOME AND PRINCIPE SV EL SALVADOR SX SINT MAARTEN S SRIAN ARAB REPUBLIC N SZ SWAZILAND TC TURKS AND CAICOS ISLANDS TD CHAD TF FRENCH SOUTHERN TERRITORIES TG TOGO TH THAILAND TJ TAJIKISTAN TK TOKELAU TL TIMOR-LESTE TM TURKMENISTAN TN TUNISIA TO TONGA TR TURKE TT TRINIDAD AND TOBAGO TV TUVALU TW TAIWAN, PROVINCE OF CHINA TZ TANZANIA, UNITED REPUBLIC OF UA UKRAINE UG UGANDA UM UNITED STATES MINOR OUTLING ISLANDS US UNITED STATES U URUGUA UZ UZBEKISTAN VA HOL SEE (VATICAN CIT STATE) VC SAINT VINCENT AND THE GRENADINES VE VENEZUELA VG VIRGIN ISLANDS, BRITISH VI VIRGIN ISLANDS, U.S. VN VIET NAM VU VANUATU WF WALLIS AND FUTUNA WS SAMOA E EMEN T MAOTTE ZA SOUTH AFRICA ZM ZAMBIA ZW ZIMBABWE GlobalSign API for MSSL Certificates v2.1 Page 35 of 52

36 7.2 CreditAgency/OrganizationCode CreditAgency/OrganizationCode is added to help GlobalSign validate the customers Organization. If the customer has one of these numbers it should just be flagged as available, the actual code is not to be entered. No. Credit Agency Value 1 Dunn and Bradstreet number 1 2 Teikoku Databank code MSSL Profile and Domain ID s To order MSSL Certificates, a MSSLProfileID and MSSLDomainID must be provided. These can be obtained by following the guidance below. MSSLProfileID: The MSSLProfileID can be obtained from either GCC or the API GCC Method: To obtain the ProfileID from GCC: - Login to your account, - Select the MSSL tab - Navigate to the Manage Domains & Profiles section, - The ProfileID is displayed in upper left of each of the Profile Tile. It will have a format similar to: 45678_SMS2_1234 API Method: If the ProfileIDs are not known, then the GetMSSLDomainList can be used. In addition to returning the MSSLDomainIDs, it will also return the MSSLProfileID for each of the domains. Assuming there is at least one domain in each profile, this will be a complete list of MSSLProfileIDs. Using the MSSLProfileID, detailed information about the Profile can be obtained via the GetMSSLProfile API message. MSSLDomainID: MSSLDomainID values can be obtained via GCC or the API GCC method 1: - Login to your account, - Select the MSSL tab - Navigate to the Manage Domains & Profiles section, - Select Manage Domains - The MSSLDomainID is displayed in the Domain column and will be in a format similar to: DSMS GCC method 2: If all domains were ordered or renewed via the Multi-step Add Domain process introduced in August 2016, then: - Login to your account, - Select the MSSL tab - In the left navigation panel, select Domain Order History - This lists all MSSLDomainIDs for all Profiles. Use the Export to CSV option to save this as a file. - The MSSLDomainID is displayed in the Domain column and will be in a format similar to: DSMS GlobalSign API for MSSL Certificates v2.1 Page 36 of 52

37 API method: If you know the ProfileIDs then you can get all of the MSSLDomainIDs using the GetMSSLDomainList GlobalSign API for MSSL Certificates v2.1 Page 37 of 52

38 8. Order Status Fields and Codes 8.1 Order/Certificate Status Order/Certificate status of any certificate request can be obtained at any time, via GetModifiedOrders API call. Value Order Status 1 INITIAL 2 Waiting for phishing check 3 Cancelled Not Issued 4 Issue completed 5 Cancelled - Issued 6 Waiting for revocation 7 Revoked 8.2 ModificationEventName ModificationEventName is returned from GetModifiedOrders. At any time all modified orders and their modification can be returned from the API. Code ModifictionEventName Description 0 ORDER_REQUEST Certificate application accepted 1 ORDER_CONSENT Certificate application permitted 2 ORDER_NOT_CONSENT Certificate application refused 3 ORDER_VALIDATE_REGISTER Vetting requested to RA 6 ORDER_APPROVE_DENIAL Order rejected by RA 7 CERT_ISSUE Issue certificate 8 ORDER_ISSUE_BEFORE_CANCEL Order cancelled before issue 9 ORDER_ISSUE_AFTER_CANCEL Order cancelled after issue 10 ORDER_CANCEL_REQUEST uest to cancel order 11 CERT_REVOKE_REQUEST uest to revoke certificate 12 CERT_REVOKE Certificate revoked 13 CERT_REVOKE_DENIAL Certificate revocation refused 14 CERT_CA_REVOKE Certificate revoked by CA 15 CERT_TRANSFER Certificate transferred to other corporations 16 CERT_REISSUE Certificate reissue 17 ORDER_ERROR_RECOVER Error recovered 23 CERT_REVOKE_CANCEL Certificate revocation cancelled 24 ORDER_REISSUE_REQUEST Application for certificate reissue 25 REORDER_CANCEL_REQUEST Cancelled certificate reorder 27 CERT_RENEWAL_INFORMATION Certificate renewal notice 28 CERT_REVOKE_REGISTER uest vetting for revoke to RA 29 ORDER_RESEND_APPROVAL_MAIL Resend approval 30 ORDER_CHANGE_APPROVAL_MAIL Change approval address 31 ORDER_CHANGE_PA_AFTER Change the payment method to after payment 32 ORDER_CHANGE_CONTRACTOR Change the contractor 33 ORDER_CHANGE_SALES Change the sales group, sales staff 35 SEAL_REGISTER uest for seal register 36 SEAL_REVOKE uest to delete seal 37 SEAL_CHANGE uest to change seal 38 DELETE_PKCS12 Delete PKCS12 39 DOWNLOAD_PKCS12 Download PKCS12 GlobalSign API for MSSL Certificates v2.1 Page 38 of 52