Renew the client certificate (current certificate, signed body with a new certificate request)

POST /d/v1/renew

https://devices.tanba-ooh.kz/d/v1/renew

Анықтамалықтың техникалық мәтіні ағылшын тілінде жазылған.

Authenticated like a heartbeat: the client certificate and a signature of the body by the device key. The key in the request must be new; the request's own signature proves possession of it. The platform refuses a revoked device, a certificate that is not the newest of the device, a bad or unchanged key, and a certificate with more than 60 days left. The answer carries the new certificate (same device id, one year) and old_valid_until; the old certificate stays accepted until then, 24 hours. A player renews on its own when less than 30 days are left.

Аутентификация

Құрылғының клиенттік сертификаты (өзара TLS) және құрылғы кілтімен жасалған дене қолтаңбасы.

Параметрлер

Атауы	Орны	Түрі	Міндетті	Сипаттама	Мысал
`X-Tanba-Signature`	тақырып	string	иә	ES256 signature of the exact bytes of the body by the device key, raw `r\|\|s` (64 bytes), base64url without padding.	`q3J2y0uO8e1m4n7pXc5Zk9d2Wv6Tg0hLsB-aRfN1YjE6uHxPzD3oVtKiC8wMbQe2nSgA4rUl7yFhJ9XcT0dZaw`

Сұраудың денесі

`application/json`

Атауы	Түрі	Міндетті	Сипаттама	Мысал
`csr`	string	иә	Certificate request for the new key, PEM or base64 of the DER form; ECDSA P-256.	`"MIIBEjCBuAIBADAZMRcwFQYDVQQDEw5leGFtcGxlLXBsYXllcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA"`
`force`	boolean		Skip the 60-day rule; only after an administrator has allowed it for 24 hours.	`false`

Мысал

{
  "csr": "MIIBEjCBuAIBADAZMRcwFQYDVQQDEw5leGFtcGxlLXBsYXllcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA",
  "force": false
}

Жауаптар

200 New certificate issued; the old one stays accepted for 24 hours.

`application/json`

Атауы	Түрі	Міндетті	Сипаттама	Мысал
`device_id`	string (uuid)	иә	The same device identifier.	`"5c0e8f3a-71d2-4b6e-9a14-d8e2f7b30c59"`
`certificate_pem`	string	иә	The new certificate in PEM form.	`"-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n"`
`chain_pem`	string	иә	The chain up to the device certificate authority.	`"-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n"`
`not_after`	string (date-time)	иә	When the new certificate expires.	`"2028-10-14T09:00:00Z"`
`old_valid_until`	string (date-time)	иә	Until when the old certificate is still accepted.	`"2026-10-15T09:00:00Z"`

Мысал

{
  "device_id": "5c0e8f3a-71d2-4b6e-9a14-d8e2f7b30c59",
  "certificate_pem": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n",
  "chain_pem": "-----BEGIN CERTIFICATE-----\nMIIB...\n-----END CERTIFICATE-----\n",
  "not_after": "2028-10-14T09:00:00Z",
  "old_valid_until": "2026-10-15T09:00:00Z"
}

Қателер

Қателер problem құжаты (application/problem+json) түрінде, тұрақты code өрісімен келеді.

Мәртебесі	Мағынасы
401	The signature does not verify, or the device is unknown or revoked.
409	Renewal refused (`renewal_refused`): not due, not the newest certificate, or the key is already held.
422	Field errors (`validation_failed`).
default	An error as a problem document.

Код мысалдары

curl

curl -X POST 'https://devices.tanba-ooh.kz/d/v1/renew' \
  -H 'X-Tanba-Signature: q3J2y0uO8e1m4n7pXc5Zk9d2Wv6Tg0hLsB-aRfN1YjE6uHxPzD3oVtKiC8wMbQe2nSgA4rUl7yFhJ9XcT0dZaw' \
  -H 'Content-Type: application/json' \
  -d '{
  "csr": "MIIBEjCBuAIBADAZMRcwFQYDVQQDEw5leGFtcGxlLXBsYXllcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA",
  "force": false
}'

Python

import requests

response = requests.post(
    "https://devices.tanba-ooh.kz/d/v1/renew",
    headers={
        "X-Tanba-Signature": "q3J2y0uO8e1m4n7pXc5Zk9d2Wv6Tg0hLsB-aRfN1YjE6uHxPzD3oVtKiC8wMbQe2nSgA4rUl7yFhJ9XcT0dZaw",
        "Content-Type": "application/json",
    },
    json={
        "csr": "MIIBEjCBuAIBADAZMRcwFQYDVQQDEw5leGFtcGxlLXBsYXllcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA",
        "force": False,
    },
)
print(response.status_code, response.text)

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader(`{
  "csr": "MIIBEjCBuAIBADAZMRcwFQYDVQQDEw5leGFtcGxlLXBsYXllcjBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABA",
  "force": false
}`)
	req, err := http.NewRequest("POST", "https://devices.tanba-ooh.kz/d/v1/renew", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-Tanba-Signature", "q3J2y0uO8e1m4n7pXc5Zk9d2Wv6Tg0hLsB-aRfN1YjE6uHxPzD3oVtKiC8wMbQe2nSgA4rUl7yFhJ9XcT0dZaw")
	req.Header.Set("Content-Type", "application/json")
	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()
	data, _ := io.ReadAll(resp.Body)
	fmt.Println(resp.Status, string(data))
}