POST
/
api
/
v1
/
pki
/
ca
/
{caId}
/
sign-certificate
cURL
curl --request POST \
  --url https://us.infisical.com/api/v1/pki/ca/{caId}/sign-certificate \
  --header 'Content-Type: application/json' \
  --data '{
  "csr": "<string>",
  "pkiCollectionId": "<string>",
  "friendlyName": "<string>",
  "commonName": "<string>",
  "altNames": "",
  "ttl": "<string>",
  "notBefore": "<string>",
  "notAfter": "<string>",
  "keyUsages": [
    "digitalSignature"
  ],
  "extendedKeyUsages": [
    "clientAuth"
  ]
}'
{
  "certificate": "<string>",
  "issuingCaCertificate": "<string>",
  "certificateChain": "<string>",
  "serialNumber": "<string>"
}

Path Parameters

​
caId
string
required

The ID of the CA to issue the certificate from.

Body

application/json
​
csr
string
required

The pem-encoded CSR to sign with the CA to be used for certificate issuance.

Minimum length: 1
​
ttl
string
required

The time to live for the certificate such as 1m, 1h, 1d, 1y, ...

​
pkiCollectionId
string

The ID of the PKI collection to add the certificate to.

​
friendlyName
string

A friendly name for the certificate.

​
commonName
string

The common name (CN) for the certificate.

Minimum length: 1
​
altNames
string
default:""

A comma-delimited list of Subject Alternative Names (SANs) for the certificate; these can be host names or email addresses.

​
notBefore
string

The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.

​
notAfter
string

The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format.

​
keyUsages
enum<string>[]
​
extendedKeyUsages
enum<string>[]

Response

Default Response

​
certificate
string
required

The issued certificate.

​
issuingCaCertificate
string
required

The certificate of the issuing CA.

​
certificateChain
string
required

The certificate chain of the issued certificate.

​
serialNumber
string
required

The serial number of the issued certificate.