# Document API - Invalid Certificate

**URL:** <http://forum.companieshouse.gov.uk/t/document-api-invalid-certificate/3317>\
**Category:** API Issues\
**Created:** [October 3, 2020, 6:59pm UTC](http://forum.companieshouse.gov.uk/t/document-api-invalid-certificate/3317 "2020-10-03T18:59:39Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![voracityemail](http://forum.companieshouse.gov.uk/letter_avatar_proxy/v4/letter/v/b77776/32.png) [@voracityemail](http://forum.companieshouse.gov.uk/u/voracityemail)\
**Post date:** [October 4, 2020, 7:23pm UTC](http://forum.companieshouse.gov.uk/t/document-api-invalid-certificate/3317/3 "2020-10-04T19:23:30Z")

</div>

As of now (2020-10-04 19:47) I find the same issue. This seems to be limited to the documents API. The rest of the API checked so far seems to work OK on either [api.companieshouse.gov.uk](http://api.companieshouse.gov.uk) or [api.company-information.service.gov.uk](http://api.company-information.service.gov.uk)

a) Documents API on new URI is using the old certificate so failing.  
b) Both old and new APIs - [filing-history list](https://developer.company-information.service.gov.uk/api/docs/company/company_number/filing-history/getFilingHistoryList.html) / filing-history item will return links which don’t seem to work either as given or “build-your own URI” per the documentation at eg. [Fetch a document's metadata](https://developer.company-information.service.gov.uk/document/docs/document/id/fetchDocumentMeta.html)  
c) The [CH post about this change](https://forum.aws.chdev.org/t/update-important-url-changes/3310) should mention both [api.company-information.service.gov.uk](http://api.company-information.service.gov.uk) and [document-api.company-information.service.gov.uk](http://document-api.company-information.service.gov.uk) to be clearer.

**Detail**  
Using the old API (not document API endpoint) references server certificate:

subject: [CN=companieshouse.gov.uk](http://CN=companieshouse.gov.uk),OU=IT Infrastructure,O=Companies House,L=Cardiff,C=GB  
start date: Mar 26 00:00:00 2020 GMT  
expire date: Apr 17 12:00:00 2021 GMT  
common name: [companieshouse.gov.uk](http://companieshouse.gov.uk)  
issuer: CN=GeoTrust RSA CA 2018,[OU=www.digicert.com](http://OU=www.digicert.com),O=DigiCert Inc,C=US

The new API references server certificate:  
subject: CN=\*.company-information.service.gov.uk,OU=IT Infrastructure,O=Companies House,L=Cardiff,C=GB  
start date: Feb 18 00:00:00 2020 GMT  
expire date: Feb 17 12:00:00 2022 GMT  
common name: \*.company-information.service.gov.uk  
issuer: CN=GeoTrust RSA CA 2018,[OU=www.digicert.com](http://OU=www.digicert.com),O=DigiCert Inc,C=US

All OK. However if you call e.g. the filing history endpoint, both old and new APIs return document metadata URIs of the new form:

[https://frontend-doc-api.company-information.service.gov.uk/document/](https://frontend-doc-api.company-information.service.gov.uk/document/)…

If you attempt to request this, you see the following certificate referenced (and the connection will fail):

subject: [CN=companieshouse.gov.uk](http://CN=companieshouse.gov.uk),OU=IT Infrastructure,O=Companies House,L=Cardiff,C=GB  
start date: Mar 26 00:00:00 2020 GMT  
expire date: Apr 17 12:00:00 2021 GMT  
common name: [companieshouse.gov.uk](http://companieshouse.gov.uk)  
issuer: CN=GeoTrust RSA CA 2018,[OU=www.digicert.com](http://OU=www.digicert.com),O=DigiCert Inc,C=US

…e.g the OLD certificate.

I see that the documentation for the Documents API here:

> **[Fetch a document's metadata](https://developer.company-information.service.gov.uk/document/docs/document/id/fetchDocumentMeta.html)**

…now says you should use the form:

[http://document-api.company-information.service.gov.uk/document/{id}](http://document-api.company-information.service.gov.uk/document/%7Bid%7D)

If you simply take the ID from the document link we received above (e.g. ignore the “frontend…” part) and call this using the new host as suggested by the documentation:

```
curl -v -uMY_API_KEY_HERE: "https://document-api.company-information.service.gov.uk/document/xJtrS2FVn-SjSKzIKugmOjHajrcg4--QL4ijPJFA_CQ"

```

… again the old certificate is referenced and this fails. (I checked and just using [api.company-information.service.gov.uk/document/](http://api.company-information.service.gov.uk/document/)… fails as expected e.g. 404 not found).

Using the old API works fine:

```
curl -v -uMY_API_KEY_HERE: "https://document-api.companieshouse.gov.uk/document/xJtrS2FVn-SjSKzIKugmOjHajrcg4--QL4ijPJFA_CQ"

```

…the correct (old) certificate is used:  
subject: [CN=companieshouse.gov.uk](http://CN=companieshouse.gov.uk),OU=IT Infrastructure,O=Companies House,L=Cardiff,C=GB  
start date: Mar 26 00:00:00 2020 GMT  
expire date: Apr 17 12:00:00 2021 GMT  
common name: [companieshouse.gov.uk](http://companieshouse.gov.uk)  
issuer: CN=GeoTrust RSA CA 2018,[OU=www.digicert.com](http://OU=www.digicert.com),O=DigiCert Inc,C=US

**Checks run**

```
curl -v -uMY_API_KEY_HERE: "https://api.company-information.service.gov.uk/company/SC294759/filing-history/MzA3MTM0MTMzNWFkaXF6a2N4"

curl -v -uMY_API_KEY_HERE: "https://api.company-information.service.gov.uk/company/SC294759/filing-history/MzA3MTM0MTMzNWFkaXF6a2N4"

```

…produce a record with the same document metadata link:

```
 ...
 "links" : {
    "document_metadata" : "https://frontend-doc-api.company-information.service.gov.uk/document/xJtrS2FVn-SjSKzIKugmOjHajrcg4--QL4ijPJFA_CQ",
    ...

```

---

_[View the full topic](http://forum.companieshouse.gov.uk/t/document-api-invalid-certificate/3317)._