---
title: "PUT /api/v1/cert-manager/ca/internal/{caId}/cross-signed-certificate"
method: PUT
path: "/api/v1/cert-manager/ca/internal/{caId}/cross-signed-certificate"
tags: ["PKI Certificate Authorities"]
---

# PUT /api/v1/cert-manager/ca/internal/{caId}/cross-signed-certificate

`PUT /api/v1/cert-manager/ca/internal/{caId}/cross-signed-certificate`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/cert-manager/ca/internal/{caId}/cross-signed-certificate`
- Auth: none declared
- TypeScript: <https://skmtc.dev/infisical/apis/infisical-api/docs/api/v1/cert-manager/ca/internal/:caId/cross-signed-certificate/put.ts> (a function with typed inputs; its response is checked against the schema)

Import or replace the cross-signed certificate of an internal CA. Certificates the CA and its internal sub-CAs issue afterwards carry it in their chain. An intermediate CA signed through sign-intermediate gets the CA's own chain without it. Certificates already issued keep their chain.

## Path parameters

- `caId` string, uuid, required

## Request body

- object
  - `certificate` string, required: The PEM-encoded cross-signed certificate: the CA's certificate signed by the old CA as a CA certificate. It must have the same subject, public key, and subject key identifier as the CA.
  - `certificateChain` string, required: The PEM-encoded certificates of the old CA, in order: start with the CA that signed the cross-signed certificate and end with its root. When the old root signed it directly, this is the old root's certificate.

## Response `200`

Default Response

- object
  - `crossSignedCertificate` object, required
    - `caId` string, uuid, required: The ID of the CA the cross-signed certificate belongs to.
    - `certificate` string, required: The PEM-encoded cross-signed certificate.
    - `certificateChain` string, required: The PEM-encoded certificates of the old CA, from the one that signed the cross-signed certificate up to its root.
    - `issuer` string, required: The distinguished name of the CA that signed the cross-signed certificate.
    - `serialNumber` string, required: The serial number of the cross-signed certificate.
    - `notBefore` string, date-time, required: The date and time the cross-signed certificate becomes valid.
    - `notAfter` string, date-time, required: The date and time the cross-signed certificate expires. After this, new certificates no longer include it in their chain.

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-11-05** `656a99cc1fd2`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/cert-manager/ca/internal/:caId/cross-signed-certificate/put.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/fcd86e7b5ec8?raw)