AXIAM PHP SDK

__construct()

Constructs a CaCertificate.

Parameters

$createdAt : string

the server's created_at field

$fingerprint : string

SHA-256 fingerprint of the certificate.

$id : string

the server's id field

$keyAlgorithm : KeyAlgorithm

the server's key_algorithm field

$notAfter : string

Validity end.

$notBefore : string

Validity start.

$organizationId : string

The organization this CA belongs to.

$publicCertPem : string

PEM-encoded public certificate. The certificate that signs*, which under vault_pki custody is the intermediate rather than the root beneath which it was created.

$status : CertificateStatus

the server's status field

$subject : string

The certificate subject (e.g., CN=ACME Corp Root CA).

$chainPem : string|null = null

The issuers above [Self::public_cert_pem], concatenated PEM, nearest issuer first and the root last. None for a CA that is its own root, which is every CA AXIAM generated before Vault's PKI engine was an option. Present for a vault_pki CA, where it is the only copy of the root certificate anything outside Vault will ever see — a relying party cannot validate an AXIAM-issued leaf without it, and root/generate/internal returns it exactly once. (optional)

$keyCustody : string|null = null

Which custodian holds this CA's signing key. Recorded per CA rather than read from configuration, so adopting a new custodian does not strand the CAs that already exist. Not secret — an operator needs to see it, and it discloses only where a key is kept. (optional)

$keyLocator : string|null = null

Where the custodian put the key. A Vault path under its mount; None for database custody, whose locator is the row itself. (optional)

$mtlsTrustAnchor : bool|null = null

Whether this CA is offered as a trust anchor for mutual TLS. When set, the server exports this CA's public certificate to the bundle named by AXIAM__SERVER__TLS__CLIENT_CA_BUNDLE_PATH at startup and turns client-certificate authentication on (optional) if the operator has not configured it explicitly. A client presenting a certificate that chains to this CA is then verified by the TLS layer itself, which is what axiam_pki::mtls needs to authenticate an IoT device or a service account by certificate rather than by secret. # What is and is not copied Only public_cert_pem — the certificate. The private key stays where its custodian put it (Vault, or sealed into the row) and is never written to the server volume. A trust anchor is public by construction: it is what the server hands every client during the TLS handshake, and every device that has to validate the chain already holds a copy. # Why a restart rustls builds its RootCertStore once, when the listener is constructed, and actix-web binds that config for the process's life. Toggling this changes what the next boot trusts, and the API says so in its response rather than pretending the change took effect. Defaults to false, so a deployment that never touches this keeps exactly the TLS posture it has today. (optional)

$parentCaId : string|null = null

The CA in this organization that signed this one. None for an organization-level CA, which is either self-signed or imported and has no parent inside AXIAM. (optional)

$tenantId : string|null = null

The tenant this CA signs for, when it is a tenant signing CA. None for an organization-level CA — the trust anchor, and the only kind that existed before tenant signing CAs. Some for an intermediate created under one, which exists so a tenant's user, service and device certificates chain through a CA that can be revoked and replaced without touching the anchor the rest of the estate trusts. (optional)

jsonSerialize()

Renders this object for `json_encode()`.

toArray()

Renders this object back to its wire form.