---
title: "POST /crypto/certificatekeypairs/generate/"
method: POST
path: "/crypto/certificatekeypairs/generate/"
tags: ["crypto"]
---

# POST /crypto/certificatekeypairs/generate/

`POST /crypto/certificatekeypairs/generate/`

Generate a new, self-signed certificate-key pair

## Request body

- CertificateGenerationRequest — Certificate generation parameters
  - `common_name` string, required
  - `subject_alt_name` string
  - `validity_days` integer, required
  - `alg` 'rsa' | 'ecdsa' | 'ed25519' | 'ed448'

## Response `200`

- CertificateKeyPair — CertificateKeyPair Serializer
  - `pk` string, uuid, required
  - `name` string, required
  - `fingerprint_sha256` string, nullable, required — SHA256 fingerprint of the certificate
  - `fingerprint_sha1` string, nullable, required — SHA1 fingerprint of the certificate
  - `cert_expiry` string, date-time, nullable, required — Certificate expiry date
  - `cert_subject` string, nullable, required — Certificate subject as RFC4514 string
  - `private_key_available` boolean, required — Show if this keypair has a private key configured or not
  - `key_type` 'rsa' | 'ec' | 'dsa' | 'ed25519' | 'ed448', required
  - `certificate_download_url` string, required — Get URL to download certificate
  - `private_key_download_url` string, required — Get URL to download private key
  - `managed` string, nullable, required — Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

## Other responses

- `400` — Bad request
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)