---
title: "POST /generate-intermediate-ca"
method: POST
path: "/generate-intermediate-ca"
tags: ["Certificates"]
---

# POST /generate-intermediate-ca

`POST /generate-intermediate-ca`

## Request

- Base URL: `https://api.akeyless.io`
- URL: `https://api.akeyless.io/generate-intermediate-ca`
- Auth: none declared

## Request body

- GenerateIntermediateCA
  - `alg` string
  - `allowed-domains` string: Allowed domains for future leaf issuance, not inherited into the SCEP subordinate CA certificate
  - `common-name` string: Optional Common Name for the intermediate CA certificate
  - `delete_protection` string: Protection from accidental deletion of this object [true/false]
  - `destination-path` string: Destination path for SCEP-issued leaf certificates. Not derived from the CA certificate item path.
  - `enable-scep` boolean: Enable the fixed SCEP Stage 1 profile
  - `extended-key-usage` string: Extended key usage for future leaf issuance (serverauth / clientauth / codesigning)
  - `json` boolean: Set output format to JSON
  - `max-path-len` integer: The maximum path length of the generated intermediate CA certificate
  - `name` string, required: Base path for derived intermediate CA resources
  - `parent-ca-name` string: Parent PKI certificate issuer name
  - `scep-password` string: SCEP static challenge password. Request-only; never returned
  - `split-level` integer: The number of fragments that the DFC key will be split into
  - `token` string: Authentication token (see `/auth` and `/configure`)
  - `ttl` string: Maximum TTL for certificates issued by the new intermediate issuer, supported formats are s,m,h,d
  - `uid-token` string: The universal identity token, Required only for universal_identity authentication

## Response `200`

GenerateIntermediateCAResponse wraps the response body.

- GenerateIntermediateCAOutput
  - `certificate_name` string
  - `issuer_display_id` string
  - `issuer_name` string
  - `key_name` string
  - `scep_url` string

## Other responses

- `default`: errorResponse wraps any error to return it as a JSON object with one "error" field.

## Changes

- **2026-11-03** `4e133adcd48a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/akeyless/apis/akeyless-api/changes/generate-intermediate-ca/post.md)

---

[API](https://skmtc.dev/akeyless/apis/akeyless-api.md) - [All operations](https://skmtc.dev/akeyless/apis/akeyless-api/llms.txt) - [OpenAPI document](https://skmtc.dev/akeyless/apis/akeyless-api/revisions/4e133adcd48a?raw)