> For the complete documentation index, see [llms.txt](https://help.security.gallagher.com/knowledge-hub/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-certificates.md).

# REST API - certificates

Configure and troubleshoot REST API client and server certificate trust.

The REST API uses TLS with two **independent** trust checks. Understanding both is the fastest way to diagnose a connection that will not establish.

1. **The client must trust the server.** If it does not, Command Centre never receives a connection and raises **no alarm**. The problem is entirely client-side.
2. **The server must trust the client.** If **"Do not require pinned client certificates"** is not ticked and Command Centre cannot match a REST Client item, it raises an **"invalid client certificate"** alarm.

Because the two checks are independent, work through them in order: confirm the client trusts the server first, then confirm the server trusts the client.

## The two certificates

| Certificate            | Purpose                                                                             | Page                                                                                                                                                                                                                  |
| ---------------------- | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Client certificate** | Lets the server trust the caller. Its thumbprint is pinned on the REST Client item. | [Creating the Client Certificate](/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-creating-the-client-certificate.md)                           |
| **Server certificate** | Lets the client trust Command Centre. Imported into Command Centre's Web Services.  | [Creating and Importing REST API Certificates](/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-creating-and-importing-rest-api-certificates.md) |

A custom server certificate is **not** required for experimental development, but requiring pinned client certificates is the server's best protection against network attackers in production.

***

🔗 **Related**

* [REST API - Creating the Client Certificate](/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-creating-the-client-certificate.md). Self-signed client certificate via PowerShell.
* [REST API - Creating and Importing REST API Certificates](/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-creating-and-importing-rest-api-certificates.md). Create, export, and import the server certificate.
* [REST API - Connection](/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-connection.md). Diagnose a connection using the alarms above.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://help.security.gallagher.com/knowledge-hub/products/cc-software/configure/interface-options/api/representational-state-transfer-rest-api/rest-api-certificates.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.