AXIAM PHP SDK

GeneratedCertificate
in package
implements JsonSerializable

FinalYes

Response returned when a tenant certificate is generated. Includes the private key PEM, returned **once** and never stored.

Table of Contents

Interfaces

JsonSerializable

Properties

$certType  : CertificateType
$chainPem  : string|null
$createdAt  : string
$fingerprint  : string
$id  : string
$issuerCaId  : string
$keyAlgorithm  : KeyAlgorithm
$metadata  : mixed
$notAfter  : string
$notBefore  : string
$privateKeyPem  : Sensitive
$publicCertPem  : string
$status  : CertificateStatus
$subject  : string
$tenantId  : string
$userId  : string|null

Methods

__construct()  : mixed
Constructs a GeneratedCertificate.
fromArray()  : self
Rebuilds a GeneratedCertificate from one decoded JSON object.
jsonSerialize()  : array<string, mixed>
Renders this object for `json_encode()`.
toArray()  : array<string, mixed>
Renders this object back to its wire form.
unknownEnumValue()  : string|null
The string the server sent for an open-enum member this SDK has no name for, or `null`.

Properties

Methods

__construct()

Constructs a GeneratedCertificate.

public __construct(CertificateType $certType, string $createdAt, string $fingerprint, string $id, string $issuerCaId, KeyAlgorithm $keyAlgorithm, mixed $metadata, string $notAfter, string $notBefore, string $publicCertPem, CertificateStatus $status, string $subject, string $tenantId, Sensitive $privateKeyPem[, string|null $userId = null ][, string|null $chainPem = null ]) : mixed
Parameters
$certType : CertificateType

the server's cert_type field

$createdAt : string

the server's created_at field

$fingerprint : string

SHA-256 fingerprint of the certificate.

$id : string

the server's id field

$issuerCaId : string

The CA certificate that signed this certificate.

$keyAlgorithm : KeyAlgorithm

the server's key_algorithm field

$metadata : mixed

Arbitrary key-value metadata (e.g., a device serial). Free-form and never authoritative: the account a User certificate was issued for is user_id. A metadata.user_id is still read, by the revocation of a user's certificates, for a row issued before the binding existed (schema v98, #533).

$notAfter : string

Validity end.

$notBefore : string

Validity start.

$publicCertPem : string

PEM-encoded public certificate.

$status : CertificateStatus

the server's status field

$subject : string

The certificate's common name, e.g. device-001. The normalised value: a CN= prefix in the request is understood and stripped, so this always says what the certificate's subject DN says (DF-023).

$tenantId : string

The tenant this certificate belongs to.

$privateKeyPem : Sensitive

PEM-encoded private key — returned only on generation. An unencrypted PKCS#8 PRIVATE KEY block. An Ed25519 key AXIAM generated is RFC 8410 version 1 (version INTEGER 0, the 32-byte seed and no embedded public key), which OpenSSL 3.0 reads; the longer RFC 5958 v2 form it does not. An RSA-4096 key is the usual PKCS#8 RSAPrivateKey.

$userId : string|null = null

The user account a User certificate was issued for, in this tenant (#533); null for every other type, for a User certificate issued without one, and for every certificate issued before schema v98. What revoking a user's certificates matches on — directory linking, administrator deletion and Art. 17 erasure. A row with None is matched by the older convention instead (metadata.user_id, or a subject common name equal to the account's username or email); a row naming another account never is. It does not make the certificate authenticate as the user: a certificate authenticates only as the service account it is bound to. (optional)

$chainPem : string|null = null

The issuing chain, concatenated PEM, nearest issuer first. Present only when the signer returned one — which is the vault_pki case, where the root's certificate exists nowhere a client could fetch it from. For a CA AXIAM signed with itself the chain is the CA certificate, which GET .../ca-certificates/{id} already serves, so the field is omitted rather than restating it. (optional)

fromArray()

Rebuilds a GeneratedCertificate from one decoded JSON object.

public static fromArray(array<string, mixed> $data) : self
Parameters
$data : array<string, mixed>

The raw wire object.

Return values
self

jsonSerialize()

Renders this object for `json_encode()`.

public jsonSerialize() : array<string, mixed>

Any Sensitive it carries stays WRAPPED here, so a log line or a json_encode($model) in application code prints [SENSITIVE]. The one place a secret is revealed is ManagementTransport, on the way to the wire and nowhere else (§27.5).

Rendering for a log line never fails: an unknown union arm renders its discriminator and an unrecognised enum value its empty Unknown spelling here, and only self::toArray() -- the request path -- refuses to send it (CONTRACT.md §31.2, §34.2 P12.2).

Return values
array<string, mixed>

toArray()

Renders this object back to its wire form.

public toArray() : array<string, mixed>

§27.4 rule 5: a null property is OMITTED, not emitted as null. On a sparse update those two say opposite things — "leave this alone" versus "set this to nothing" — and only omission means the first.

Return values
array<string, mixed>

unknownEnumValue()

The string the server sent for an open-enum member this SDK has no name for, or `null`.

public unknownEnumValue(string $wire) : string|null

Only a model decoded by self::fromArray() knows it, and only for a member that decoded to Unknown (CONTRACT.md §27.6.2 item 4, §34.8 (c)): it lets a refusal name the value. It is for messages -- it is never rendered by self::toArray() or self::jsonSerialize() and so is never sent.

Parameters
$wire : string

The member's wire name.

Return values
string|null
On this page

Search results