---
title: "POST /api/v1/pki/certificates/sign-certificate"
method: POST
path: "/api/v1/pki/certificates/sign-certificate"
tags: ["PKI Certificates"]
---

# POST /api/v1/pki/certificates/sign-certificate

`POST /api/v1/pki/certificates/sign-certificate`

## Request

- Base URL: `https://us.infisical.com`
- URL: `https://us.infisical.com/api/v1/pki/certificates/sign-certificate`
- Auth: none declared

Sign certificate

## Request body

- object
  - `caId` string: The ID of the CA to issue the certificate from.
  - `certificateTemplateId` string: The ID of the certificate template to issue the certificate from.
  - `pkiCollectionId` string: The ID of the PKI collection to add the certificate to.
  - `csr` string, required: The pem-encoded CSR to sign with the CA to be used for certificate issuance.
  - `friendlyName` string: A friendly name for the certificate.
  - `commonName` string: The common name (CN) for the certificate.
  - `altNames` string: A comma-delimited list of Subject Alternative Names (SANs) for the certificate; these can be host names or email addresses.
  - `ttl` string, required: The time to live for the certificate such as 1m, 1h, 1d, 1y, ...
  - `notBefore` string: The date and time when the certificate becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `notAfter` string: The date and time when the certificate expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `keyUsages` string[]: The key usage extension of the certificate.
  - `extendedKeyUsages` string[]: The extended key usage extension of the certificate.

## Response `200`

Default Response

- object
  - `certificate` string, required: The issued certificate.
  - `issuingCaCertificate` string, required: The certificate of the issuing CA.
  - `certificateChain` string, required: The certificate chain of the issued certificate.
  - `serialNumber` string, required: The serial number of the issued certificate.

## Other responses

- `400`: Default Response
- `401`: Default Response
- `403`: Default Response
- `404`: Default Response
- `422`: Default Response
- `500`: Default Response

## Changes

- **2026-09-15** `838c6b7e6bb8`: 1 info
  - added the new `smartCardLogon` enum value to the request property `extendedKeyUsages/items/`
- **2026-07-31** `edde28ab3c8c`: 1 info
  - added the new `anyExtendedKeyUsage` enum value to the request property `extendedKeyUsages/items/`

[Operation history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/pki/certificates/sign-certificate/post.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) - [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) - [OpenAPI document](https://skmtc.dev/infisical/apis/infisical-api/revisions/7f940199c899?raw)