---
title: "POST /crypto/certificatekeypairs/"
method: POST
path: "/crypto/certificatekeypairs/"
tags: ["crypto"]
---

# POST /crypto/certificatekeypairs/

`POST /crypto/certificatekeypairs/`

CertificateKeyPair Viewset

## Request body

- CertificateKeyPairRequest — CertificateKeyPair Serializer
  - `name` string, required
  - `certificate_data` string, required — PEM-encoded Certificate data
  - `key_data` string — Optional Private Key. If this is set, you can use this keypair for encryption.

## Response `201`

- CertificateKeyPair — CertificateKeyPair Serializer
  - `pk` string, uuid, required
  - `name` string, required
  - `fingerprint_sha256` string, nullable, required — SHA256 fingerprint of the certificate
  - `fingerprint_sha1` string, nullable, required — SHA1 fingerprint of the certificate
  - `cert_expiry` string, date-time, nullable, required — Certificate expiry date
  - `cert_subject` string, nullable, required — Certificate subject as RFC4514 string
  - `private_key_available` boolean, required — Show if this keypair has a private key configured or not
  - `key_type` 'rsa' | 'ec' | 'dsa' | 'ed25519' | 'ed448', required
  - `certificate_download_url` string, required — Get URL to download certificate
  - `private_key_download_url` string, required — Get URL to download private key
  - `managed` string, nullable, required — Objects that are managed by authentik. These objects are created and updated automatically. This flag only indicates that an object can be overwritten by migrations. You can still modify the objects via the API, but expect changes to be overwritten in a later update.

## Other responses

- `400`
- `403`

---

[API](https://skmtc.dev/goauthentik/apis/authentik.md) · [All operations](https://skmtc.dev/goauthentik/apis/authentik/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/goauthentik/authentik/revisions/4e42e86021d7/schema)