GlobalSign API for MSSL Certificates

Transcription

1 GlobalSign API for MSSL Certificates Implementation Guide and Definitions Version 1.2 Version Release Notes Version Changes - Updated error codes Version Changes - Workflow updates Version Changes - Added Query functions Version Changes - Added Domain and Profile status descriptions Version 1.1 Changes - Added AEG functionality Version 1.2 Changes - Updated Reissue Function for Hash Algorithm SHA-256, Section 15.6 Copyright GlobalSign, Inc. All rights reserved. GlobalSign, the GlobalSign logo and OneClickSSL are trademarks and registered trademarks of GlobalSign, Inc. or its affiliates in the United States and other countries. All other trademarks are the property of their respective owners.

2 Contents 1. Outline SSL Product Type Explanations Web Service Functions Order & Query Workflow Overview Managed SSL Functions Functions Standard SSL Query functions Issued Certificates API URL s GlobalSign URL Test Account URLs WSDL Files GlobalSign URL Test Account URLs Ordering MSSL OrganizationSSL Certificates Ordering an MSSL OrganizationSSL Certificate... 7 PVOrder Request... 7 PVOrder Response Ordering MSSL OrganizationSSL Certificates using AutoCSR... 9 Ordering an OrganizationSSL Certificate using AutoCSR... 9 PVOrderWithoutCSR Request... 9 PVOrderWithoutCSR Response Modify MSSL Order ModifyMSSLOrder Request ModifyMSSLOrder Response Add MSSL Profile AddMSSLProfile Request AddMSSLProfile Response Add MSSL Domain AddMSSLDomain Request AddMSSLDomain Response Update MSSL Profile UpdateMSSLProfile Request UpdateMSSLProfile Response Get MSSL Profiles GetMSSLProfile Request GetMSSLProfile Response Get MSSL Domain List GetMSSLDomainList Request GetMSSLDomainList Response Modify MSSL Domain ModifyMSSLDomain Request ModifyMSSLDomain Response Query API Calls Get Issued Certificate Single Certificate (GetOrderByOrderID) Query API to get Issued Certificate - Multiple Orders (GetOrderByDateRange) Query API to Get Recently Modified Orders (GetModifiedOrders) Query to Determine Upcoming Renewals (GetOrderByExpirationDate) Query API to Get Certificate Orders (GetCertificateOrders) Query API to Reissue Certificates (ReIssue) CSR Decoder and Error Checker (DecodeCSR) Turn Renewal Notice On/Off (ToggleRenewalNotice) Certificate Order Entry Parameters GlobalSign API for MSSL Certificates v1.2 Page 2 of 47

3 16.1 MSSL Profile and Domain ID s Product Codes Validity Period Date/Time Formatting Setting Validity Period of the Certificate (by Not before/not after date) Order Type Options Licenses CreditAgency/OrganizationCode KeyLength OptionName Subject Alternative Names (SANs) Entry Country Status Explanations Order/Certificate Status ModificationEventName MSSL Domain Status MSSL Profile Status Resend Type Success / Error Codes Client Error Codes Server Error Codes XML Field Definitions GlobalSign API for MSSL Certificates v1.2 Page 3 of 47

4 1. Outline GlobalSign offers a Simple Object Access Protocol (SOAP) API for its partners and customers to directly order and manage certificates. Through this API, partners can perform functions such as ordering the different products, cancelling and fulfilling orders, and querying for order data. The API is organized as two Web Services ORDER and QUER. The operations in the ORDER Web Service are focused around initiating and cancelling orders while the QUER Web service is focused on checking status of orders, getting fulfillment information for orders, such as issued certificates, reports, and obtaining order details. The API supports applications for SSL Certificates placed by customers using the SSL Managed service platform. Customers using the SSL Managed Service may use the API to place orders for certificates against the registered list of pre-vetted domains. Typically an API user will retrieve issued certificates using the QUER function and then use its own methods to install or communicate the certificate to the end customer. However the API also allows for orders to be ed directly to end customers if desired. 2. SSL Product Type Explanations OrganizationSSL: OrganizationSSL is a feature rich high value organization validated certificate. When placing an OrganizationSSL order the applicant can either supply a CSR or request GlobalSign creates a CSR on the fly (AutoCSR). Certificates requested using AutoCSR are returned in a packaged PKCS#12 file containing both the Certificate file and private key. Certificates requested by supplying a customer generated CSR are returned as standard Certificate files. To our partners these two products are known as OrganizationSSL and OrganizationSSL with Auto-CSR. Both of these product codes can be ordered as not only a standard and wildcard option, but also with certain SAN options. For the OrganizationSSL there are the following Subject Alternative Names options allowed: Unified Communications support for owa, autodiscover and mail Additional Subdomain support Internal Hostname support Public IP Address support Additional Fully Qualified Domain Name support These options can be added through both the OrganizationSSL product code, as well as the OrganizationSSL with Auto-CSR product code, in 1-5 year validity periods. Note: the API product code specification OrganizationSSL is referenced as OV. The product code for applications using AutoCSR is referenced as OV_SKIP Customers with SSL Managed Service accounts may obtain pre-vetted OrganizationSSL certificates by using the SSL Managed Service application calls. Extended SSL: ExtendedSSL is the product name for GlobalSign's Extended Validation (EV) SSL offering and is issued in strict adherence the published CA/B Forum EV SSL guidelines covering certificate profile format, vetting method and workflow. This product can be ordered as only a standard SSL Certificate with limited Subject Alternative Name support and does not support wildcard applications and globalip option, NOT as a wildcard option. This product can also work with all the SAN options. For the Extended SSL, the following SAN options allowed: Unified Communications support for owa, autodiscover and mail Additional Subdomain support GlobalSign API for MSSL Certificates v1.2 Page 4 of 47

5 Additional Fully Qualified Domain Name support This product can only be ordered in a 1-2 year validity period. 3. Web Service Functions Order & Query Workflow Overview Order processing for SSL Certificates and web identity products is asynchronous. For these types of orders an API client places an order and then later checks the server for the completed order. The specification document is split into two sections: Managed SSL (MSSL) Functions: calls to place orders, modify or cancel orders, modify or query MSSL specific account information Standard SSL Query Functions: calls needed to complete order calls, such as querying, and searching for complete orders (such as getting issued certificates) The general approach for ordering is to place orders using an Order function, then periodically request the list of all orders that have changed status during a specified time interval (for example, the last four hours) using the Query function of GetModifiedOrders. This returns a list of all orders and detailed order information for orders that have changed status in the specified time interval. The status of all returned orders can then be updated locally and used as necessary. An alternative to querying for a set of modified orders within a time period is to specifically request the status of a specific order. In this case the ordering flow consists of the following operations: place an order, and then periodically check the status of the specific order (GetOrderByOrderID). Once the order has been completed, the fulfillment information is returned with the GetOrderByOrderID operation. This approach is less efficient, but might be more appropriate when there is a low volume of certificates being managed. 3.1 Managed SSL Functions Functions Function Get List of MSSL Profiles Get List of MSSL Domains Order Pre-vetted SSL Certificate via SSL Managed Service account Order Pre-vetted AutoCSR SSL Certificate via SSL Managed Service account Add domain to MSSL account Add profile to MSSL account Update existing MSSL Profile Modify Existing MSSL Order Modify Existing MSSL Domain API Request GetMSSLProfiles GetMSSLDomains GSPVOrder GSPVOrderWithoutCSR AddMSSLDomain AddMSSLProfile UpdateMSSLProfile ModifyMSSLOrder ModifyMSSLDomain 3.2 Standard SSL Query functions The following functions are not specific to MSSL, but are used across the range of SSL products. Function Searching order information by Order ID Searching modified orders by modified date (from/to) Getting order list Searching orders by order date (from/to) API Request GetOrderByOrderID GetModifiedOrders GetCertificateOrders GetOrderByDataRange GlobalSign API for MSSL Certificates v1.2 Page 5 of 47

6 3.3 Issued Certificates There are two methods for certificate delivery, either via the API or through . Issued certificates can be delivered directly to the user specified in the appropriate Order functions. In the Order Requests, specify the end user who shall receive the certificate and their address in the <ContactInfo> field. 4. API URL s 4.1 GlobalSign URL The following URL s should be used to access the GlobalSign live API: MSSL: Query & General: Test Account URLs The following URLs* should be used to access the GlobalSign Test API: MSSL: Query & General: *Test system accounts are available to API customers upon request 5. WSDL Files 5.1 GlobalSign URL GlobalSign s WSDL files are available from: MSSL: Query & General: Test Account URLs Test account WSDL files are available from: MSSL: Query & General: *Test system accounts are available to API customers upon request GlobalSign API for MSSL Certificates v1.2 Page 6 of 47

7 6. Ordering MSSL OrganizationSSL Certificates Set order information and order OrganizationSSL certificate (1) PVOrder Request PVOrder Response 6.1 Ordering an MSSL OrganizationSSL Certificate PVOrder Request Input Type Size Req? Remarks OrderRequestHeader AuthToken UserName String 30 Password String 30 OrderRequestParameter ProductCode String "PV" BaseOption - OrderKind String New, Renewal, Transfer Licenses Options Option + OptionName EXP: ExpressOption INS: InsuranceOption GSS: GSSupportOption VPC: ValidityPeriodCustomizeOption, SAN: SANOption OptionValue Boolean true, false ValidityPeriod Months int 4 NotBefore Date -MM-DDTHH:MM:SS.000Z NotAfter Date -MM-DDTHH:MM:SS.000Z CSR String 4000 RenewalTargetOrderId String 50 TargetCert String 4000 SpecialIntructions String 4000 Coupon String 50 Campaign String 50 MssLProfileId String MsslPDomainId String SubId String 50 PVSealInfo String AddressLine1 String 100 AddressLine2 String 100 AddressLine3 String 100 PostalCode String 20 Phone String 30 Fax String 30 ContactInfo FirstName String 100 GlobalSign API for MSSL Certificates v1.2 Page 7 of 47

8 LastName String 100 Phone String 30 String 255 SANEntries SANEntry + SANOptionType String SANAltName String 4000 ModifyOperations PVOrder Response Output Type Size Req? Remarks OrderResponseHeader SuccessCode int 2 Errors N Error ErrorCode int 2 ErrorField String 1000 N ErrorMessage String 1000 Timestamp DateTime -MM-DDTHH:MM:SS.000Z GSPVOrderDetail N CertificateInfo N CertificateStatus int 5 1: INITIAL, 2: Waiting for phishing check 3: Cancelled - not issued 4: Issue Completed 5: Cancelled - issued 6: Waiting for revocation 7: Revoked StartDate Date -MM-DDTHH:MM:SS.000Z EndDate Date -MM-DDTHH:MM:SS.000Z CommonName String 64 SerialNumber String 64 SubjectName String 3000 DNSNames String 300 N Fulfillment N CACerticates CACertificate ServerCertificate N CACertType String Root, Inter CACert String 4000 N X509Cert String 4000 PKCS7Cert String 4000 GlobalSign API for MSSL Certificates v1.2 Page 8 of 47

9 7. Ordering MSSL OrganizationSSL Certificates using AutoCSR Set order information and order OrganizationSSL certificate (1) PVOrderWithoutCSR Request PVOrderWithoutCSR Response Retrieve Organization SSL PKCS#12 Certificate (1) GetOrderbyOrderID Request GetOrderbyOrderID Response Ordering an OrganizationSSL Certificate using AutoCSR PVOrderWithoutCSR Request Input Type Size Req? Remarks OrderRequestHeader AuthToken UserName String 30 Password String 30 OrderRequestParameterWithoutCSR ProductCode String PV_SKIP BaseOption OrderKind String New, Renewal, Transfer Licenses Options Option + EXP: ExpressOption INS: InsuranceOption OptionName GSS: GSSupportOption VPC: ValidityPeriodCustomizeOption, SAN: SANOption OptionValue Boolean true, false ValidityPeriod Months int 4 NotBefore Date -MM-DDTHH:MM:SS.000Z NotAfter Date -MM-DDTHH:MM:SS.000Z Pin String KeyLength int 2048 RenewalTargetOrderId String 50 TargetCert String 4000 SpecialIntructions String 4000 Coupon String 50 Campaign String 50 MssLProfileID String MsslPDomainID String SubId String 50 PVSealInfo String AddressLine1 String 100 GlobalSign API for MSSL Certificates v1.2 Page 9 of 47

10 AddressLine2 String 100 AddressLine3 String 100 PostalCode String 20 Phone String 30 Fax String 30 OVCSRInfo CommonName String OrganizationUnit String ContactInfo FirstName String 100 LastName String 100 Phone String 30 String 255 SANEntries SANEntry + SANOptionType String SANAltName String 4000 ModifyOperations PVOrderWithoutCSR Response Siz Require Output Type Remarks e d OrderResponseHeader SuccessCode int 2 Errors Error ErrorCode int 2 Strin 100 ErrorField g 0 ErrorMessag Strin 100 e g 0 Timestamp DateTime -MM-DDTHH:MM:SS.000Z GSPVOrderDetai l CertificateInfo 1: INITIAL, 2: Waiting for phishing check 3: Cancelled - not issued CertificateStatus int 5 4: Issue Completed 5: Cancelled - issued 6: Waiting for revocation 7: Revoked StartDate Date -MM-DDTHH:MM:SS.000Z EndDat Date -MM-DDTHH:MM:SS.000Z e Strin CommonName 64 g Strin SerialNumber 64 g Strin 300 SubjectName g 0 Strin DNSNames 300 g Fulfillment CACerticates CACertificate Strin Root, Inter ServerCertificate X509Cert PKCS7Cert g Strin g Strin g Strin g Modify MSSL Order ModifyMSSLOrder Request GlobalSign API for MSSL Certificates v1.2 Page 10 of 47

11 Input Type Size Req? OrderRequestHeader AuthToken UserName String 30 Password String 30 OrderID String 50 ModifyOrderOperation String 64 APPROVE CANCEL REVOKE ModifyMSSLOrder Response Output Type Size Req? OrderResponseHeader SuccessCode int 2 Errors Error ErrorCode int 2 ErrorField String 1000 ErrorMessage String 1000 Timestamp DateTime 9. Add MSSL Profile AddMSSLProfile Request Input Type Size Req? OrderRequestHeader AuthToken UserName String 30 Password String 30 VettingLevel String 2 MSSLOVProfileInfo MSSLOVProfile Country String 2 StateOrProvince String 255 Locality String 255 OrganisationUnit OrganizationName String String N OVSealInfo StreetAddress1 String 100 StreetAddress2 String 100 PostalCode String 20 OtherAddressInfo String 100 Telephone String 30 Fax String 30 BusinessOVInfo CreditAgency String 50 OrganizationCode String 50 MSSLEVProfileInfo MSSLEVProfile OrganizationName String 255 OrganisationUnit BusinessCategory String String N JurisdictionInfo JurisdictionCountry String 30 JurisdictionState String 255 JurisdictionLocality String 200 IncorporationAgency RegistrationNumber String 100 BusinessPlaceInfo StreetAddress1 String 100 StreetAddress2 String 100 BusinessCategory String 20 N City String 200 StateOrProvince String 255 PostalCode String 20 CountryCode String 2 Telephone String 30 Fax String 30 N BusinessEVInfo BusinessAssumedName String 255 CreditAgency String 50 OrganizationCode String 50 CertificateApprover OrganizationName String 255 JobTitle String 255 ContractSigner OrganizationName String 100 Department String 100 FirstName String 100 LastName String 100 GlobalSign API for MSSL Certificates v1.2 Page 11 of 47

12 JobTitle String 255 Telephone String 30 Address String 30 AddMSSLProfile Response Output OrderResponseHeader SuccessCod e Errors MSSLProfileI D Erro r Type int Siz e 2 Req? ErrorCode int 2 Strin 100 ErrorField g 0 ErrorMessag Strin 100 e g 0 Timestamp DateTime String 50 -MM- DDTHH:MM:SS.000Z 10. Add MSSL Domain AddMSSLDomain Request Input Type Size Req? Validation OrderRequestHeader AuthToken UserName String 30 required, maxlength Password String 30 required, maxlength MSSLProfileID String 50 maxlength DomainName String 64 maxlength, format AddMSSLDomain Response Output Type Size Req? OrderResponseHeader SuccessCode int 2 Errors Error ErrorCode int 2 ErrorField String 1000 ErrorMessage String 1000 Timestamp DateTime DomainName String 64 -MM- DDTHH:MM:SS.000Z 11. Update MSSL Profile UpdateMSSLProfile Request Input Type Size Req? Validation OrderRequestHeader AuthToken UserName String 30 required, maxlength Password String 30 required, maxlength MSSLProfielID String 50 required, maxlength MSSLEVProfileInfo MSSLEVProfile OrganizationName String 255 required, maxlength BusinessCategory String 20 required, maxlength, enumiccontains JurisdictionInfo JurisdictionCountry String 30 required, maxlength, enumiccontains GlobalSign API for MSSL Certificates v1.2 Page 12 of 47

13 JurisdictionState String 255 maxlength JurisdictionLocality String 200 maxlength IncorporationAgencyRegistrationNumber String 100 required, maxlength BusinessPlaceInfo StreetAddress1 String 100 required, maxlength StreetAddress2 String 100 maxlength City String 200 required, maxlength StateOrProvince String 255 required, maxlength PostalCode String 20 required, maxlength, postalcode CountryCode String 2 required, maxlength, enumiccontains Telephone String 30 required, maxlength, tel Fax String 30 maxlength, tel BusinessEVInfo BusinessAssumedName String 255 maxlength CreditAgency String 50 maxlength, enumcontains OrganizationCode String 50 maxlength CertificateApprover OrganizationName String 255 required, maxlength JobTitle String 255 maxlength ContractSigner OrganizationName String 255 required, maxlength Department String 100 required, maxlength FirstName String 100 required, maxlength LastName String 100 required, maxlength JobTitle String 255 required, maxlength Telephone String 30 required, maxlength, tel Address String 30 required, maxlength, UpdateMSSLProfile Response Output Type Size Req? OrderResponseHeader SuccessCode int 2 Errors Error ErrorCode int 2 ErrorField String 1000 ErrorMessage String 1000 Timestamp DateTime MSSLProfileID String 50 X 12. Get MSSL Profiles GetMSSLProfile Request Input Type Size Req? Validation OrderRequestHeader AuthToken UserName String 30 required, maxlength Password String 30 required, maxlength MSSLProfileID String 50 maxlength VettingLevel String 2 maxlength, enumiccontains MSSLProfileStatus String 5 maxlength, enumiccontains GetMSSLProfile Response OutPut Type Size Req? SearchMSSLProfileDetails SearchMSSLProfileDetail MSSLProfielID String 50 VettingLevel String 2 MSSLPlofileStatus String 5 docsubmission_date Date 25 pvrecieve_date Date 25 hold_end_date Date 25 request_date Date 25 MSSLOVProfileInfo MSSLOVProfile Country String 2 GlobalSign API for MSSL Certificates v1.2 Page 13 of 47

14 StateOrProvince String 255 Locality String 255 OrganizationName String 255 OVSealInfo StreetAddress1 String 100 StreetAddress2 String 100 PostalCode String 20 OtherAddressInfo String 100 Telephone String 30 Fax String 30 BusinessOVInfo CreditAgency String 50 OrganizationCode String 50 MSSLEVProfileInfo MSSLEVProfile OrganizationName String 255 BusinessCategory String 20 JurisdictionInfo JurisdictionCountry String 30 JurisdictionState String 255 JurisdictionLocality String 200 IncorporationAgencyRegistrationNumber String 100 BusinessPlaceInfo StreetAddress1 String 100 StreetAddress2 String 100 BusinessCategory String 20 City String 200 StateOrProvince String 255 PostalCode String 20 CountryCode String 2 Telephone String 30 Fax String 30 BusinessEVInfo BusinessAssumedName String 255 CreditAgency String 50 OrganizationCode String 50 CertificateApprover OrganizationName String 255 JobTitle String 255 ContractSigner OrganizationName String 255 Department String 100 FirstName String 100 LastName String 100 JobTitle String 255 Telephone String 30 Address String Get MSSL Domain List GetMSSLDomainList Request Input Type Size Req? OrderRequestHeader AuthToken UserName String 30 Password String 30 MSSLProfileID String 50 MSSLDomainID String 50 MSSLDomainName String 64 MSSLPlofileStatus String 5 GetMSSLDomainList Response Output Type Size Req? SearchMSSLDomainDetails SearchMSSLDomainDetail MSSLDomainID String 50 MSSLProfielID String 17 MSSLDomainName String 64 GlobalSign API for MSSL Certificates v1.2 Page 14 of 47

15 SearchMSSLDomainDetails MSSLDomainStatus NotBefore NotAfter delete_date SearchMSSLDomainDetail String String String String 14. Modify MSSL Domain ModifyMSSLDomain Request Input Type Size Req? OrderRequestHeader AuthToken UserName String 30 Password String 30 OrderID String 50 MSSLDomainID String 64 ModifyDomainOperation String 64 DELETE ModifyMSSLDomain Response Output Type Size Req? OrderResponseHeader SuccessCode int 2 Errors Error ErrorCode int 2 ErrorField String 1000 ErrorMessage String 1000 Timestamp DateTime 15. Query API Calls 15.1 Get Issued Certificate Single Certificate (GetOrderByOrderID) GetOrderByOrderID Request <GetOrderByOrderID xmlns=" <Request> <QueryRequestHeader> <AuthToken> <UserName> 30 String <Password> 30 String </AuthToken> </QueryRequestHeader> <OrderID> 50 String (<OrderQueryOption> (<OrderStatus>)? <!- N/A --> (<ReturnOrderOption>)? 5 String true, false (<ReturnCertificateInfo>)? 5 String true, false (<ReturnFulfillment>)? 5 String true, false (<ReturnCACerts>)? 5 String ReturnFulfillment true </OrderQueryOption>)? </Request> GlobalSign API for MSSL Certificates v1.2 Page 15 of 47

16 </GetOrderByOrderID> GetOrderByOrderID Response GetOrderByOrderID xmlns=" <Response> <QueryResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> 25 -MM-DDTHH:MM:SS.000Z <ReturnCount> 5 </QueryResponseHeader> <OrderID>? 50 String (<Pkcs12File>)? 4000 String (<OrderDetail> <OrderInfo> <OrderID> 50 String <ProductCode> 20 String (<BaseOption>)? 20 String <OrderKind> 10 String <Licenses> 3 (<ExpressOption>)? 5 String (<ValidityPeriodCustomizeOption>)? 5 String (<InsuranceOption>)? 5 String (<GSSupportOption>)? 5 String (<RenewalExtentionOption>)? 5 String <DomainName> 255 String <OrderDate> 25 -MM-DDTHH:MM:SS.000Z (<OrderCompleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderCanceledDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderDeactivatedDate>)? 25 -MM- DDTHH:MM:SS.000Z <OrderStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked <Price> 10 <Currency> 10 String <ValidityPeriod> <Months> 4 (<NotBefore>)? 25 -MM-DDTHH:MM:SS.000Z (<NotAfter>)? 25 -MM-DDTHH:MM:SS.000Z </ValidityPeriod> (<SpecialInstructions>)? 4000 String </OrderInfo> <OrderSubInfo> <CSRSkipOrderFlag> 5 String true,false <DNSOrderFlag> 5 String true,false <TrustedOrderFlag> 5 String true,false (<P12DeleteStatus>)? 5 (<P12DeleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<VerificationUrl>)? 300 String <SubId> 50 String </OrderSubInfo> (<OrderOption> <ApproverNotifiedDate>? 25 -MM- DDTHH:MM:SS.000Z <ApproverConfirmDate>? 25 -MM-DDTHH:MM:SS.000Z <Approver Address>? 255 String <OrganizationInfo> <OrganizationName> 255 String (<CreditAgency>)? 50 String GlobalSign API for MSSL Certificates v1.2 Page 16 of 47

17 (<OrganizationCode>)? 50 String (<BusinessAssumedName>)? 255 String (<BusinessCategoryCode>)? 20 String <OrganizationAddress> <AddressLine1> 100 String (<AddressLine2>)? 100 String (<AddressLine3>)? 100 String <City> 200 String <Region> 255 String <PostalCode> 20 String <Country> 30 String <Phone> 30 String (<Fax>)? 30 String </OrganizationAddress> </OrganizationInfo> (<RequestorInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <OrganizationName> 255 String <OrganizationUnit> 100 String <Phone> 30 String < > 255 String </RequestorInfo>)? (<ApproverInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <OrganizationName> 255 String (<OrganizationUnit>)? 100 String <Phone> 30 String < > 255 String </ApproverInfo>)? (<AuthorizedSignerInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <Phone> 30 String < > 255 String </AuthorizedSignerInfo>)? (<JurisdictionInfo> <Country> 30 String <StateOrProvince> 255 String <Locality> 200 String <IncorporatingAgencyRegistrationNumber> 100 String </JurisdictionInfo>)? (<ContactInfo> <FirstName> 100 String <LastName> 100 String <Phone> 30 String < > 255 String </ContactInfo>)? </OrderOption>)? (<CertificateInfo> <CertificateStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 6: Waiting for revocation 7: Revoked <StartDate> 25 -MM-DDTHH:MM:SS.000Z <EndDate> 25 -MM-DDTHH:MM:SS.000Z <CommonName> 64 String <SerialNumber> 64 String <SubjectName> 3000 String (<DNSNames>)? 300 String </CertificateInfo>)? (<Fulfillment> (<CACertificates> (<CACertificate> <CACertType> 15 String Root,Inter GlobalSign API for MSSL Certificates v1.2 Page 17 of 47

18 <CACert> 4000 String </CACertificate>)+ </CACertificates>)? (<ServerCertificate> <X509Cert> 4000 String <PKCS7Cert> 4000 String </ServerCertificate>)? </Fulfillment>)? <ModificationEvents> (<ModificationEvent> <ModificationEventName> 5 <ModificationEventTimestamp>25 DDTHH:MM:SS.000Z </ModificationEvent>)+ </ModificationEvents>? </OrderDetail>)? </Response> </GetOrderByOrderID> -MM Query API to get Issued Certificate - Multiple Orders (GetOrderByDateRange) GetOrderByDateRange Request <GetOrderByDateRange xmlns=" <Request> <QueryRequestHeader> <AuthToken> <UserName> 30 <Password> 30 </AuthToken> </QueryRequestHeader> <FromDate> -MM-DDTHH:MM:SS.000Z <ToDate> -MM-DDTHH:MM:SS.000Z (<OrderQueryOption> (<OrderStatus>)? 5 String true, false (<ReturnOrderOption>)? 5 String true, false (<ReturnCertificateInfo>)? 5 String true, false (<ReturnFulfillment>)? 5 String true, false (<ReturnCACerts>)? 5 String </OrderQueryOption>)? </Request> </GetOrderByDataRange> GetOrderByDateRange Response <GetOrderByDateRange xmlns=" <Response> <QueryResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> 25 -MM-DDTHH:MM:SS.000Z <ReturnCount> 5 </QueryResponseHeader> <FromDate>? 25 -MM-DDTHH:MM:SS.000Z <ToDate>? 25 -MM-DDTHH:MM:SS.000Z (<OrderDetails> (<OrderDetail> <OrderInfo> <OrderID> 50 String <ProductCode> 20 String (<BaseOption>)? 20 String <OrderKind> 10 String <Licenses> 3 (<ExpressOption>)? 5 String GlobalSign API for MSSL Certificates v1.2 Page 18 of 47

19 DDTHH:MM:SS.000Z DDTHH:MM:SS.000Z (<ValidityPeriodCustomizeOption>)?5 String (<InsuranceOption>)? 5 String (<GSSupportOption>)? 5 String (<RenewalExtentionOption>)?5 String <DomainName> 255 String <OrderDate> 25 -MM-DDTHH:MM:SS.000Z (<OrderCompleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderCanceledDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderDeactivatedDate>)? 25 -MM- <OrderStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked <Price> 10 <Currency> 10 String <ValidityPeriod> <Months> 4 (<NotBefore>)? 25 -MM-DDTHH:MM:SS.000Z (<NotAfter>)? 25 -MM-DDTHH:MM:SS.000Z </ValidityPeriod> (<SpecialInstructions>)? 4000 String </OrderInfo> <OrderSubInfo> <CSRSkipOrderFlag> 5 String true,false <DNSOrderFlag> 5 String true,false <TrustedOrderFlag> 5 String true,false (<P12DeleteStatus>)? 5 (<P12DeleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<VerificationUrl>)? 300 String <SubId> 50 String </OrderSubInfo> (<OrderOption> <ApproverNotifiedDate>? 25 -MM- <ApproverConfirmDate>? 25 -MM-DDTHH:MM:SS.000Z <Approver Address>? 255 String <OrganizationInfo> <OrganizationName> 255 String (<CreditAgency>)? 50 String (<OrganizationCode>)? 50 String (<BusinessAssumedName>)? 255 String (<BusinessCategoryCode>)? 20 String <OrganizationAddress> (<AddressLine1>)? 100 String (<AddressLine2>)? 100 String (<AddressLine3>)? 100 String <City> 200 String <Region> 255 String (<PostalCode>)? 20 String <Country> 30 String <Phone> 30 String (<Fax>)? 30 String </OrganizationAddress> </OrganizationInfo> (<RequestorInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <OrganizationName> 255 String <OrganizationUnit> 100 String <Phone> 30 String < > 255 String </RequestorInfo>)? (<ApproverInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String GlobalSign API for MSSL Certificates v1.2 Page 19 of 47

20 <OrganizationName> 255 String (<OrganizationUnit>)? 100 String <Phone> 30 String < > 255 String </ApproverInfo>)? (<AuthorizedSignerInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <Phone> 30 String < > 255 String </AuthorizedSignerInfo>)? (<JurisdictionInfo> <Country> 30 String <StateOrProvince> 255 String <Locality> 200 String <IncorporatingAgencyRegistrationNumber>100 String </JurisdictionInfo>)? (<ContactInfo> <FirstName> 100 String <LastName> 100 String <Phone> 30 String < > 255 String </ContactInfo>)? </OrderOption>)? (<CertificateInfo> <CertificateStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 6: Waiting for revocation 7: Revoked <StartDate> 25 -MM-DDTHH:MM:SS.000Z <EndDate> 25 -MM-DDTHH:MM:SS.000Z <CommonName> 64 String <SerialNumber> 64 String <SubjectName> 3000 String (<DNSNames>)? 300 String </CertificateInfo>)? (<Fulfillment> (<CACertificates> (<CACertificate> <CACertType> 15 String Root,Inter <CACert> 4000 String </CACertificate>)+ </CACertificates>)? (<ServerCertificate> <X509Cert> 4000 String <PKCS7Cert> 4000 String </ServerCertificate>)? </Fulfillment>)? <ModificationEvents> (<ModificationEvent> <ModificationEventName> 5 <ModificationEventTimestamp>25 -MM- DDTHH:MM:SS.000Z </ModificationEvent>)+ </ModificationEvents>? </OrderDetail>)+ </OrderDetails>)? </Response> </GetOrderByDataRange> 15.3 Query API to Get Recently Modified Orders (GetModifiedOrders) As mentioned above the GetModifiedOrders API will return a list of orders modified within a specified time frame. GlobalSign API for MSSL Certificates v1.2 Page 20 of 47

21 GetModifiedOrders Request <GetModifiedOrders xmlns=" <Request> <QueryRequestHeader> <AuthToken> <UserName> <Password> </AuthToken> </QueryRequestHeader> <FromDate> -MM-DDTHH:MM:SS.000Z <ToDate> -MM-DDTHH:MM:SS.000Z (<OrderQueryOption> (<OrderStatus>)? 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked (<ReturnOrderOption>)? true,false (<ReturnCertificateInfo>)? true,false (<ReturnFulfillment>)? true,false (<ReturnCACerts>)? true,false </OrderQueryOption>)? </Request> </GetModifiedOrders> GetModifiedOrders Response <GetModifiedOrders xmlns=" <Response> <QueryResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> 25 -MM-DDTHH:MM:SS.000Z <ReturnCount> 5 </QueryResponseHeader> <FromDate>? 25 -MM-DDTHH:MM:SS.000Z <ToDate>? 25 -MM-DDTHH:MM:SS.000Z (<OrderDetails> (<OrderDetail> <OrderInfo> <OrderID> 50 String <ProductCode> 20 String (<BaseOption>)? 20 String <OrderKind> 10 String <Licenses> 3 (<ExpressOption>)? 5 String (<ValidityPeriodCustomizeOption>)?5 String (<InsuranceOption>)? 5 String (<GSSupportOption>)? 5 String (<RenewalExtentionOption>)?5 String <DomainName> 255 String <OrderDate> 25 -MM-DDTHH:MM:SS.000Z (<OrderCompleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderCanceledDate>)? 25 -MM-DDTHH:MM:SS.000Z (<OrderDeactivatedDate>)? 25 -MM- DDTHH:MM:SS.000Z <OrderStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed GlobalSign API for MSSL Certificates v1.2 Page 21 of 47

22 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked DDTHH:MM:SS.000Z <Price> 10 <Currency> 10 String <ValidityPeriod> <Months> 4 (<NotBefore>)? 25 -MM-DDTHH:MM:SS.000Z (<NotAfter>)? 25 -MM-DDTHH:MM:SS.000Z </ValidityPeriod> (<SpecialInstructions>)? 4000 String </OrderInfo> <OrderSubInfo> <CSRSkipOrderFlag> 5 String true,false <DNSOrderFlag> 5 String true,false <TrustedOrderFlag> 5 String true,false (<P12DeleteStatus>)? 5 (<P12DeleteDate>)? 25 -MM-DDTHH:MM:SS.000Z (<VerificationUrl>)? 300 String <SubId> 50 String </OrderSubInfo> (<OrderOption> <ApproverNotifiedDate>? 25 -MM- <ApproverConfirmDate>? 25 -MM-DDTHH:MM:SS.000Z <Approver Address>? 255 String <OrganizationInfo> <OrganizationName>255 String (<CreditAgency>)? 50 String (<OrganizationCode>)? 50 String (<BusinessAssumedName>)? 255 String (<BusinessCategoryCode>)? 20 String <OrganizationAddress> (<AddressLine1>)? 100 String (<AddressLine2>)? 100 String (<AddressLine3>)? 100 String <City> 200 String <Region> 255 String (<PostalCode>)? 20 String <Country> 30 String <Phone> 30 String (<Fax>)? 30 String </OrganizationAddress> </OrganizationInfo> (<RequestorInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <OrganizationName> 255 String <OrganizationUnit> 100 String <Phone> 30 String < > 255 String </RequestorInfo>)? (<ApproverInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <OrganizationName> 255 String (<OrganizationUnit>)? 100 String <Phone> 30 String < > 255 String </ApproverInfo>)? (<AuthorizedSignerInfo> <FirstName> 100 String <LastName> 100 String <Function> 255 String <Phone> 30 String < > 255 String </AuthorizedSignerInfo>)? (<JurisdictionInfo> GlobalSign API for MSSL Certificates v1.2 Page 22 of 47

23 <Country> 30 String <StateOrProvince> 255 String <Locality> 200 String <IncorporatingAgencyRegistrationNumber>100 String </JurisdictionInfo>)? (<ContactInfo> <FirstName> 100 String <LastName> 100 String <Phone> 30 String < > 255 String </ContactInfo>)? </OrderOption>)? (<CertificateInfo> <CertificateStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 6: Waiting for revocation 7: Revoked <StartDate> 25 -MM-DDTHH:MM:SS.000Z <EndDate> 25 -MM-DDTHH:MM:SS.000Z <CommonName> 64 String <SerialNumber> 64 String <SubjectName> 3000 String (<DNSNames>)? 300 String </CertificateInfo>)? (<Fulfillment> (<CACertificates> (<CACertificate> <CACertType> 15 Root,Inter <CACert> 4000 String </CACertificate>)+ </CACertificates>)? (<ServerCertificate> <X509Cert> 4000 String <PKCS7Cert> 4000 String </ServerCertificate>)? </Fulfillment>)? <ModificationEvents> (<ModificationEvent> <ModificationEventName> 5 <ModificationEventTimestamp> -MM- DDTHH:MM:SS.000Z </ModificationEvent>)+ </ModificationEvents>? </OrderDetail>)+ </OrderDetails>)? </Response> </GetModifiedOrders> 15.4 Query to Determine Upcoming Renewals (GetOrderByExpirationDate) Request to query for orders with certificates expiring in date range. GetOrderByExpirationDate Request <GetOrderByExpirationDate > <Request> <QueryRequestHeader> <AuthToken> <UserName> <Password> </AuthToken> </QueryRequestHeader> (<ExpirationFromDate>)? -MM-DDTHH:MM:SS.000Z (<ExpirationToDate>)? -MM-DDTHH:MM:SS.000Z (<FQDN>)? 64 String (<OrderKind>)? 10 String GlobalSign API for MSSL Certificates v1.2 Page 23 of 47

24 (<OrderStatus>)? 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked (<SubID>)? 50 String </Request> </GetCertificateOrders> GetOrderByExpirationDate Response <GetCertificateOrders xmlns=" <Response> <QueryResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> 25 -MM-DDTHH:MM:SS.000Z <ReturnCount> 5 </QueryResponseHeader> (<SearchOrderDetails> (<SearchOrderDetail> <OrderID> 50 String (<BaseOption>)? 20 String <OrderKind> 10 String <RequestKind> 10 String <Licenses> 3 <OrderRequestDate> 25 -MM-DDTHH:MM:SS.000Z <OrderIssueDate> 25 -MM-DDTHH:MM:SS.000Z (<OrderCanceledDate>)? 25 -MM-DDTHH:MM:SS.000Z <OrderStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked <OrganizationName> 255 String <Months> 4 <SubId> 50 String <FQDN> 64 String </SearchOrderDetail>)+ </SearchOrderDetails>)? </Response> </GetCertificateOrders> 15.5 Query API to Get Certificate Orders (GetCertificateOrders) As mentioned above the GetCertificateOrders API will return a list of orders. GetCertificateOrders Request <GetCertificateOrders xmlns=" <Request> <QueryRequestHeader> <AuthToken> <UserName> GlobalSign API for MSSL Certificates v1.2 Page 24 of 47

25 <Password> </AuthToken> </QueryRequestHeader> (<FromDate>)? -MM-DDTHH:MM:SS.000Z (<ToDate>)? -MM-DDTHH:MM:SS.000Z (<FQDN>)? 64 String (<OrderKind>)? 10 String (<OrderStatus>)? 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked (<SubID>)? 50 String </Request> </GetCertificateOrders> GetCertificateOrders Response <GetCertificateOrders xmlns=" <Response> <QueryResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> 25 -MM-DDTHH:MM:SS.000Z <ReturnCount> 5 </QueryResponseHeader> (<SearchOrderDetails> (<SearchOrderDetail> <OrderID> 50 String (<BaseOption>)? 20 String <OrderKind> 10 String <RequestKind> 10 String <Licenses> 3 <OrderRequestDate> 25 -MM-DDTHH:MM:SS.000Z <OrderIssueDate> 25 -MM- DDTHH:MM:SS.000Z (<OrderCanceledDate>)? 25 -MM-DDTHH:MM:SS.000Z <OrderStatus> 5 1: INITIAL 2: Waiting for phishing check 3: Cancelled - Not Issued 4: Issue completed 5: Cancelled - Issued 6: Waiting for revocation 7: Revoked <OrganizationName> 255 String <Months> 4 <SubId> 50 String <FQDN> 64 String </SearchOrderDetail>)+ </SearchOrderDetails>)? </Response> </GetCertificateOrders> 15.6 Query API to Reissue Certificates (ReIssue) Use the Reissue API to Re-order a certificate. GlobalSign API for MSSL Certificates v1.2 Page 25 of 47

26 "HashAlgorithm" is a newly added field in the API for reissue. - If this is not specified, certificates will be issued based on the hash algorithm of the certificate being reissued. - If "SHA1" is specified, SHA1 certificates will be issued. - If "SHA256" is specified, SHA-256 certificates will be issued. - However, when reissuing certificates from SHA-256 to SHA1, issuing certificates which exceeds the SHA-1 maximum validity period will be truncated. SHA-1 to SHA-1 certificate reissuance will not be affected. Example: Request a 5 year SHA-256 certificate. If you re-issue to SHA-1, you will receive a maximum 39 month certificate which could result in the loss of up to 21 months of validity period. Recommendation: By requesting a maximum of a 3-year certificate you can avoid any loss of validity period when performing reissues. ReIssue Request <ReIssue xmlns=" <Request> <OrderRequestHeader> <AuthToken> <UserName> 30 <Password> 30 </AuthToken> </OrderRequestHeader> <OrderParameter> <CSR> 4000 String (<DNSNames>)? 300 String </OrderParameter> <TargetOrderID> 50 String <HashAlgorithm> SHA1, SHA256 </Request> </ReOrder> ReIssue Response < ReIssue xmlns=" <Response> <OrderResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 (<ErrorField>)? 1000 String <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> -MM-DDTHH:MM:SS.000Z </OrderResponseHeader> <OrderID>? 50 String <TargetOrderID>? 50 String </Response> </ ReIssue > 15.7 CSR Decoder and Error Checker (DecodeCSR) Request to allow submission of CSR for parsing and error checking. GlobalSign API for MSSL Certificates v1.2 Page 26 of 47

27 DecodeCSR Request <DecodeCSR> <Request > <OrderRequestHeader> <AuthToken> <UserName> 30 String <Password> 30 String </AuthToken> </OrderRequestHeader> <CSR> 50 String <ProductType> DV_LOW,DV OV, EV </Request > </DecodeCSR> DecodeCSR Response <DecodeCSR> <Response> <OrderResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 (<ErrorField>)? 1000 String <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> -MM-DDTHH:MM:SS.000Z </OrderResponseHeader> <CSRData> (<CommonName>)? 255 String (<Organization>)? 255 String (<OrganizationUnit>)? 255 String (<Locality>)? 255 String (<State>)? 255 String (<Country>)? 30 String (< Address>)? 255 String (<KeyLength>)? 30 String </CSRData> <CertificatePreview> (<CommonName>)? 255 String (<Organization>)? 255 String (<OrganizationUnit>)? 255 String (<Locality>)? 255 String (<State>)? 255 String (<Country>)? 30 String (< Address>)? 255 String (<KeyLength>)? 30 String </CertificatePreview> </Response> </DecodeCSR> 15.8 Turn Renewal Notice On/Off (ToggleRenewalNotice) Toggle Renewal Notice Request <ToggleRenewalNotice> <Request> <OrderRequestHeader> <AuthToken> <UserName> 30 String <Password> 30 String GlobalSign API for MSSL Certificates v1.2 Page 27 of 47

28 </Request> </ ToggleRenewalNotice > </AuthToken> </OrderRequestHeader> <OrderID> 30 String <RenewalNotice> true, false Toggle RenewalNotice Response < ToggleRenewalNotice > <Response> <OrderResponseHeader> <SuccessCode> 2 (<Errors> (<Error> <ErrorCode> 5 (<ErrorField>)? 1000 String <ErrorMessage> 1000 String </Error>)+ </Errors>)? <Timestamp> -MM-DDTHH:MM:SS.000Z </OrderResponseHeader> <OrderID>? 50 String </Response> </ ToggleRenewalNotice > GlobalSign API for MSSL Certificates v1.2 Page 28 of 47

29 16. Certificate Order Entry Parameters 16.1 MSSL Profile and Domain ID s To order MSSL Certificates, an MSSLProfileID and MSSLDomainID must be provided. To obtain these values from the GUI, login to your account, navigate to the Manage Domains & Profiles section, and then click the Toggle display of Profile ID & Domain ID link at the bottom of the table. This will then show the IDs for each of your profiles and domains Product Codes The product code is a necessary item in most of the API calls above, the code you enter should match the type of certificate your client requires. Code PV PV_SKIP Certificate Type OrganizationSSL OrganizationSSL using AutoCSR 16.3 Validity Period ou can control the validity period of ordered certificates by setting the number of months Date/Time Formatting Number Of Months Certificate Validity Period (days) 6* 184* Date/Time is based on UTC and includes millisecond. eg: T18:16:33.594Z This format is defined* as xsd:datetime XML Simple Type * Setting Validity Period of the Certificate (by Not before/not after date) ou can control the validity period of a certificate by modifying the Not before (N/B) and Not after (N/A) dates, these dates represent Valid From and Valid To in the final certificate. ou can set either N/B and N/A dates, or just one of them. Restrictions are follows: N/B should be at least 3 days after the ordering date for GSDVOrders, and at least 7 days after for GSOVOrders. N/A should be as follows: Number of Months Restrictions for N/A GlobalSign API for MSSL Certificates v1.2 Page 29 of 47

30 6 DomainSSL : 4 days after or later from the ordering date and within 184 days OV : 8 days after or later from the ordering date and within 184 days days after or later from the ordering date and within 366 days days after or later from the ordering date and within 731 days days after or later from the ordering date and within 1096 days days after or later from the ordering date and within 1461 days days after or later from the ordering date and within 1826 days 16.6 Order Type The following OrderTypes can be ordered through the API. No. OrderKind Notes 1 New A new order 2 Renewal A renewal order for replacing an expiring certificate 3 Transfer A competitive switch a certificate is being traded in from another SSL provider 16.7 Options BaseOptions can be added to the certificate order if it is for a specific type of certificate, the following BaseOptions are currently available. BaseOption Supported Product Notes wildcard OrganizationSSL (both with or without Common Name must contain using AutoCSR) the * character in place of the globalip OrganizationSSL (both with or without using AutoCSR) subdomain Common Name must contain a publicly accessible IP address 16.8 Licenses GlobalSign has moved to an unlimited server licensing model for its SSL certificates. The values passed via the API in the license field are thus irrelevant. For new implementations, the request should be configured to submit a value of 1 licenses CreditAgency/OrganizationCode CreditAgency/OrganizationCode is added to help GlobalSign validate the customers Organization. If the customer has one of these numbers it should just be flagged as available, the actual code is not to be entered. No. Credit Agency Value 1 Dunn and Bradstreet number 1 2 Teikoku Databank code KeyLength This reflects the Key Length to be used if the certificate is being created on GlobalSign servers. Valid values 2048 or GlobalSign API for MSSL Certificates v1.2 Page 30 of 47

31 16.11 OptionName The following option types must be added for ordering certificates with extended options. Set to TRUE to activate. OptionName Description SAN SAN: SANOption Activates the Subject Alternative Name (SANs) options see section on Subject Alternative Names (SANs) Entry REX REX: RenewalExtentionOption Optionally adds an additional 30 days to a Renewal order VPC VPC:ValidityPeriodCustomizeOption Allows the start date and end date of the Certificate to be customized see section on Setting validity period of the certificate (by Not before/not after date) Subject Alternative Names (SANs) Entry SANs entries should be added with a combination of OptionName set to SAN and SANOptionType set to one of the following together with the full SAN name in SubjectAltName. No. SAN OptionType Explanation Value 1 1:UC cert option Unified Communication Cert Option 1 allows only owa, mail or autodiscover subdomains to be added 2 2:Subdomain SAN option Additional Subdomain Option 2 3 3:GIP SAN option Public IP Option 3 4 4:Internal SAN option Internal Hostname or non-public IP 4 Option 7 7:FQDN SAN option Additional Fully Qualified Domain Option Country List of country two digit codes and currently supported status, = supported N = not supported. Code Name Status AD ANDORRA AE UNITED ARAB EMIRATES AF AFGHANISTAN N AG ANTIGUA AND BARBUDA AI ANGUILLA AL ALBANIA AM ARMENIA AN NETHERLANDS ANTILLES AO ANGOLA N AQ ANTARCTICA AR ARGENTINA AS AMERICAN SAMOA AT AUSTRIA AU AUSTRALIA Code Name Status AW ARUBA AX ALANDS ISLANDS AZ AZERBAIJAN BA BOSNIA AND HERZEGOVINA BB BARBADOS BD BANGLADESH BE BELGIUM BF BURKINA FASO BG BULGARIA BH BAHRAIN BI BURUNDI BJ BENIN BM BERMUDA BN BRUNEI DARUSSALAM GlobalSign API for MSSL Certificates v1.2 Page 31 of 47

32 Code Name Status BO BOLIVIA BR BRAZIL GW GUINEA-BISSAU G GUANA HK HONG KONG HM HEARD ISLAND AND MCDONALD ISLANDS HN HONDURAS HR CROATIA HT HAITI HU HUNGAR ID INDONESIA IE IRELAND IL ISRAEL IM ISLE OF MAN IN INDIA IO BRITISH INDIAN OCEAN TERRITOR IQ IRAQ N IR IRAN, ISLAMIC REPUBLIC OF N IS ICELAND IT ITAL JE JERSE JM JAMAICA JO JORDAN JP JAPAN KE KENA KG KRGZSTAN KH CAMBODIA KI KIRIBATI KM COMOROS KN SAINT KITTS AND NEVIS KP NORTH KOREA (DEMOCRATIC PEOPLE S N REPUBLIC OF KOREA) BS BAHAMAS BT BHUTAN BV BOUVET ISLAND BW BOTSWANA B BELARUS BZ BELIZE CA CANADA CC COCOS (KEELING) ISLANDS CD CONGO, THE DEMOCRATIC REPUBLIC OF THE Code Name Status CF CENTRAL AFRICAN REPUBLIC CG CONGO CH SWITZERLAND CI COTE D IVOIRE CK COOK ISLANDS CL CHILE CM CAMEROON CN CHINA CO COLOMBIA CR COSTA RICA CU CUBA N CV CAPE VERDE CX CHRISTMAS ISLAND C CPRUS CZ CZECH REPUBLIC DE GERMAN DJ DJIBOUTI DK DENMARK DM DOMINICA DO DOMINICAN REPUBLIC DZ ALGERIA KR KOREA, REPUBLIC OF KW KUWAIT K CAMAN ISLANDS KZ KAZAKSTAN LA LAO PEOPLE S DEMOCRATIC REPUBLIC LB LEBANON LC SAINT LUCIA LI LIECHTENSTEIN LK SRI LANKA LR LIBERIA N LS LESOTHO LT LITHUANIA LU LUXEMBOURG LV LATVIA L LIBAN ARAB JAMAHIRIA N MA MOROCCO MC MONACO MD MOLDOVA, REPUBLIC OF ME MONTENEGRO N MG MADAGASCAR MH MARSHALL ISLANDS MK MACEDONIA, THE FORMER UGOSLAV REPUBLIC OF GlobalSign API for MSSL Certificates v1.2 Page 32 of 47

33 Code Name Status ML MALI MM MANMAR MN MONGOLIA MO MACAU MP NORTHERN MARIANA ISLANDS MQ MARTINIQUE MR MAURITANIA EC ECUADOR EE ESTONIA EG EGPT EH WESTERN SAHARA ER ERITREA ES SPAIN ET ETHIOPIA FI FINLAND FJ FIJI FK FALKLAND ISLANDS (MALVINAS) FM MICRONESIA, FEDERATED STATES OF FO FAROE ISLANDS FR FRANCE GA GABON GB UNITED KINGDOM GD GRENADA GE GEORGIA GF FRENCH GUIANA GG GUERNSE GH GHANA GI GIBRALTAR GL GREENLAND GM GAMBIA GN GUINEA GP GUADELOUPE GQ EQUATORIAL GUINEA GR GREECE GS SOUTH GEORGIA AND THE SOUTH SANDWICH ISLANDS GT GUATEMALA GU GUAM MS MONTSERRAT MT MALTA MU MAURITIUS MV MALDIVES MW MALAWI MX MEXICO Code Name Status M MALASIA MZ MOZAMBIQUE NA NAMIBIA NC NEW CALEDONIA NE NIGER NF NORFOLK ISLAND NG NIGERIA NI NICARAGUA NL NETHERLANDS NO NORWA NP NEPAL NR NAURU NU NIUE NZ NEW ZEALAND OM OMAN PA PANAMA PE PERU PF FRENCH POLNESIA PG PAPUA NEW GUINEA PH PHILIPPINES PK PAKISTAN PL POLAND PM SAINT PIERRE AND MIQUELON PN PITCAIRN PR PUERTO RICO PS PALESTINIAN TERRITOR, OCCUPIED PT PORTUGAL PW PALAU P PARAGUA QA QATAR RE REUNION RO ROMANIA RS SERBIA N RU RUSSIAN FEDERATION RW RWANDA N SA SAUDI ARABIA SB SOLOMON ISLANDS SC SECHELLES SD SUDAN N SE SWEDEN SG SINGAPORE SH SAINT HELENA SI SLOVENIA SJ SVALBARD AND JAN MAEN GlobalSign API for MSSL Certificates v1.2 Page 33 of 47