Litmus Edge Manager 3.0.x - Admin Console: CA Certificates
List all instance-level CA certificates
GET {{LEM_adminURL}}/admin/v1/ca-certificates
List all instance-level CA certificates
Lists the instance-level CA certificates trusted across the installation. These CAs are distributed to edge devices so they can validate server certificates.
Endpoint
GET {{LEM_adminURL}}/admin/v1/ca-certificates
Authentication
API key in a request header (case sensitive). The value is the LEM admin API token.
| URL prefix | Auth header |
|---|---|
{{LEM_URL}}/api/v1/... (main fleet API) |
X-AuthToken: <token> |
{{LEM_adminURL}}/admin/v1/... (admin console, port 8446) |
X-AuthToken: <token> |
{{LEM_URL}}/mpcs/... (Marketplace Catalog) |
Authorization: <token> (3.0.x also accepts X-AuthToken) |
| ## Response |
A list of CA certificate records (id, subject, issuer, validity).
Errors
| HTTP status | When it happens |
|---|---|
400 Bad Request |
Missing or malformed query/body parameter. |
401 Unauthorized |
Missing or invalid credentials. |
403 Forbidden |
Token lacks permission for this operation. |
404 Not Found |
Target entity does not exist. |
5xx |
Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support. |
TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.
Response
Status: 200 OK
[]
Upload CA certificate(s) as a PEM file
POST {{LEM_adminURL}}/admin/v1/ca-certificates/upload
Upload CA certificate(s) as a PEM file
Uploads one or more CA certificates from a PEM file and stores them as instance-level trusted CAs. Use Preview first to validate the file.
Endpoint
POST {{LEM_adminURL}}/admin/v1/ca-certificates/upload
Authentication
API key in a request header (case sensitive). The value is the LEM admin API token.
| URL prefix | Auth header |
|---|---|
{{LEM_URL}}/api/v1/... (main fleet API) |
X-AuthToken: <token> |
{{LEM_adminURL}}/admin/v1/... (admin console, port 8446) |
X-AuthToken: <token> |
{{LEM_URL}}/mpcs/... (Marketplace Catalog) |
Authorization: <token> (3.0.x also accepts X-AuthToken) |
| ## Request body |
The PEM file contents (one or more concatenated CA certificates).
Response
The stored CA certificate record(s).
Errors
| HTTP status | When it happens |
|---|---|
400 Bad Request |
Missing or malformed query/body parameter. |
401 Unauthorized |
Missing or invalid credentials. |
403 Forbidden |
Token lacks permission for this operation. |
404 Not Found |
Target entity does not exist. |
5xx |
Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support. |
TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.
Preview CA certificate(s) from a PEM file without storing
POST {{LEM_adminURL}}/admin/v1/ca-certificates/preview
Preview CA certificate(s) from a PEM file without storing
Parses a PEM file and returns the CA certificates it contains without storing anything. Use to validate and inspect a file before Upload.
Endpoint
POST {{LEM_adminURL}}/admin/v1/ca-certificates/preview
Authentication
API key in a request header (case sensitive). The value is the LEM admin API token.
| URL prefix | Auth header |
|---|---|
{{LEM_URL}}/api/v1/... (main fleet API) |
X-AuthToken: <token> |
{{LEM_adminURL}}/admin/v1/... (admin console, port 8446) |
X-AuthToken: <token> |
{{LEM_URL}}/mpcs/... (Marketplace Catalog) |
Authorization: <token> (3.0.x also accepts X-AuthToken) |
| ## Request body |
The PEM file contents to parse.
Response
Parsed certificate details (subject, issuer, validity) for each CA found.
Errors
| HTTP status | When it happens |
|---|---|
400 Bad Request |
Missing or malformed query/body parameter. |
401 Unauthorized |
Missing or invalid credentials. |
403 Forbidden |
Token lacks permission for this operation. |
404 Not Found |
Target entity does not exist. |
5xx |
Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support. |
TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.
Download a CA certificate as PEM
GET {{LEM_adminURL}}/admin/v1/ca-certificates/{{id}}/download
Download a CA certificate as PEM
Downloads a single stored instance-level CA certificate as a PEM file.
Endpoint
GET {{LEM_adminURL}}/admin/v1/ca-certificates/{id}/download
Authentication
API key in a request header (case sensitive). The value is the LEM admin API token.
| URL prefix | Auth header |
|---|---|
{{LEM_URL}}/api/v1/... (main fleet API) |
X-AuthToken: <token> |
{{LEM_adminURL}}/admin/v1/... (admin console, port 8446) |
X-AuthToken: <token> |
{{LEM_URL}}/mpcs/... (Marketplace Catalog) |
Authorization: <token> (3.0.x also accepts X-AuthToken) |
| ## Parameters |
| id | path | The CA certificate id. |
Response
The certificate in PEM format.
Errors
| HTTP status | When it happens |
|---|---|
400 Bad Request |
Missing or malformed query/body parameter. |
401 Unauthorized |
Missing or invalid credentials. |
403 Forbidden |
Token lacks permission for this operation. |
404 Not Found |
Target entity does not exist. |
5xx |
Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support. |
TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.
Delete an instance-level CA certificate
DELETE {{LEM_adminURL}}/admin/v1/ca-certificates/{{id}}
Delete an instance-level CA certificate
Deletes a stored instance-level CA certificate. Devices will no longer trust certificates signed by this CA after the change propagates.
Endpoint
DELETE {{LEM_adminURL}}/admin/v1/ca-certificates/{id}
Authentication
API key in a request header (case sensitive). The value is the LEM admin API token.
| URL prefix | Auth header |
|---|---|
{{LEM_URL}}/api/v1/... (main fleet API) |
X-AuthToken: <token> |
{{LEM_adminURL}}/admin/v1/... (admin console, port 8446) |
X-AuthToken: <token> |
{{LEM_URL}}/mpcs/... (Marketplace Catalog) |
Authorization: <token> (3.0.x also accepts X-AuthToken) |
| ## Parameters |
| id | path | The CA certificate id. |
Response
ApiResponse on success.
Errors
| HTTP status | When it happens |
|---|---|
400 Bad Request |
Missing or malformed query/body parameter. |
401 Unauthorized |
Missing or invalid credentials. |
403 Forbidden |
Token lacks permission for this operation. |
404 Not Found |
Target entity does not exist. |
5xx |
Service is unreachable, restarting, or internally errored. Inspect device logs under System > Support. |
TLS note: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.