---
title: "POST /api/v1/cert-manager/signers/{signerId}/certificate/import"
method: POST
path: "/api/v1/cert-manager/signers/{signerId}/certificate/import"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers/{signerId}/certificate/import

`POST /api/v1/cert-manager/signers/{signerId}/certificate/import`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/cert-manager/signers/{signerId}/certificate/import`
- Auth: none declared

Switch the signer to the certificate already issued in an existing DigiCert order, signing with that certificate's private key on the HSM. DigiCert does not reissue or revoke anything.

## Path parameters

- `signerId` string, uuid, required

## Request body

- object
  - `caId` string, uuid, required: The DigiCert certificate authority the order belongs to.
  - `externalOrderId` string, required: The DigiCert order whose certificate the signer will use.
  - `certificate` object, required
    - `hsmConnectorId` string, uuid, required
    - `hsmKeyLabel` string, required
    - `hsmKeyId` string: The hex-encoded PKCS#11 key ID (CKA_ID) of the private key, used to tell apart keys that share a label. Only used with hsmKeyLabel.
  - `certificateRenewBeforeDays` integer, nullable: Days before expiry to renew the certificate with the same HSM key. Must be less than the certificate's validity. Omit to keep the signer's current setting, or set to null to turn renewal off.

## Response `200`

Default Response

- object
  - `id` string, uuid, required
  - `name` string, required
  - `description` string, nullable
  - `status` string
  - `certificateId` string, uuid, nullable
  - `approvalPolicyId` string, uuid, nullable
  - `lastSignedAt` string, date-time, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `caId` string, uuid, nullable
  - `commonName` string, nullable
  - `certificateTtlDays` number, nullable
  - `certificateRenewBeforeDays` number, nullable
  - `certificateFailureReason` string, nullable
  - `keyAlgorithm` string
  - `externalCaConfig` unknown

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-10-21** `50b9a16ac93a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/cert-manager/signers/:signerId/certificate/import/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/7f940199c899?raw)