---
title: "POST /api/v1/cert-manager/signers/{signerId}/certificate/reissue"
method: POST
path: "/api/v1/cert-manager/signers/{signerId}/certificate/reissue"
tags: ["PKI Signers"]
---

# POST /api/v1/cert-manager/signers/{signerId}/certificate/reissue

`POST /api/v1/cert-manager/signers/{signerId}/certificate/reissue`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/cert-manager/signers/{signerId}/certificate/reissue`
- Auth: none declared

Re-issue the signer's certificate (optionally from a different CA or with a different key source)

## Path parameters

- `signerId` string, uuid, required

## Request body

- object
  - `caId` string, uuid, required
  - `commonName` string
  - `certificateTtlDays` integer
  - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1'
  - `certificate` object
    - `hsmConnectorId` string, uuid
    - `keySource` 'infisical' | 'hsm', required
  - `externalConfiguration` object
    - `caType` 'digicert' | 'adcs': Optional. The CA type is resolved from caId. If provided, it must match the type of that certificate authority.
    - `reissueFromExternalOrderId` string: DigiCert only. Reissue into this existing DigiCert order instead of placing a new order (reuses the subscription slot). DigiCert revokes the order's previous certificate.
    - `template` string: Active Directory Certificate Service only. The certificate template this signer requests when issuing (e.g. a code-signing template).

## Response `200`

Default Response

- object
  - `id` string, uuid, required
  - `name` string, required
  - `description` string, nullable
  - `status` string
  - `certificateId` string, uuid, nullable
  - `approvalPolicyId` string, uuid, nullable
  - `lastSignedAt` string, date-time, nullable
  - `createdAt` string, date-time, required
  - `updatedAt` string, date-time, required
  - `caId` string, uuid, nullable
  - `commonName` string, nullable
  - `certificateTtlDays` number, nullable
  - `certificateRenewBeforeDays` number, nullable
  - `certificateFailureReason` string, nullable
  - `keyAlgorithm` string
  - `externalCaConfig` unknown

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-10-21** `50b9a16ac93a`: 2 breaking, 3 info
  - removed `subschema #1, subschema #2` from the `externalConfiguration` request property `anyOf` list
  - the `externalConfiguration` request property type changed from no type to `object`
  - added the new optional request property `externalConfiguration/caType`
  - added the new optional request property `externalConfiguration/reissueFromExternalOrderId`
  - …1 more

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/cert-manager/signers/:signerId/certificate/reissue/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/7f940199c899?raw)