External Cert reseller

[gjarassier]

Hi!

I bought my certificate from a reseller, and they don't support ACME.

I need to run a Bash script to generate the certificate and private key. The certificate chain and the certificate files are stored in a folder on my server.

So, I need to upload this certificate to the UCM and replace the previous one before running my deployment script.

Is this possible?

Do you have any documentation explaining how to upload a certificate through the API?

[NeySlim]

Hi! Yes, this works today through the API.

POST /api/v2/certificates/import (multipart, API key in the X-API-Key header, permission write:certificates) replaces the certificate in place when UCM already holds one with the same subject and issuer: it keeps its ID, and the stored key is replaced by the new one you send (update_existing defaults to true).

cat cert.pem key.pem > bundle.pem
curl -sS -H "X-API-Key: $UCM_API_KEY" -F file=@bundle.pem \
  https://ucm.example.com:8443/api/v2/certificates/import

A few notes:

• The key goes in the same file as the certificate (or send a PKCS#12 with -F password=...).
• Only the first certificate of a PEM file is read: import your reseller's intermediate once on its own, through the same endpoint (it is detected as a CA).
• If UCM deploys the certificate for you (Deploy Hooks), the import does not trigger the push yet: call POST /api/v2/deploy/bindings/<id>/deploy afterwards. Triggering it automatically is on the list.

All fields and status codes are now documented in the wiki: API Reference: Import Certificate.

[NeySlim]

Follow-up: this is now automatic in v2.253.

When POST /api/v2/certificates/import replaces an existing certificate with one that has a new serial number, UCM treats it as a renewal and queues the deploy bindings of that certificate, exactly as after a renewal done by UCM itself. Your script no longer needs the extra POST /api/v2/deploy/bindings/<id>/deploy call.

Re-importing the same certificate (same serial) changes nothing and queues nothing, so the import step stays safe to run repeatedly.