---
title: "Sign an Agent Pool Certificate"
method: POST
path: "/agent-pools/{agent_pool}/actions/sign-csr"
tags: ["agent-pools-mtls-certificates"]
---

# Sign an Agent Pool Certificate

`POST /agent-pools/{agent_pool}/actions/sign-csr`

## Request

- Base URL: `https://example.scalr.io/api/iacp/v3`
- URL: `https://example.scalr.io/api/iacp/v3/agent-pools/{agent_pool}/actions/sign-csr`
- Auth: HTTP bearer

This endpoint signs a CSR for an agent pool certificate to use
it for agent mTLS connection.

Example CSR generation with OpenSSL (EC P-256)::

    openssl ecparam -genkey -name prime256v1 -noout -out scalr-agent.key
    openssl req -new -key scalr-agent.key -out scalr-agent.csr -subj "/CN=agent-pool"

## Path parameters

- `agent_pool` string, required

## Request body

- CertificateSigningRequest: Request body for agent pool CSR signing.
  - `csr` string, required: PEM-encoded certificate signing request for the agent pool certificate.
  - `not-valid-after` string, date-time: UTC datetime after which the issued certificate expires. Defaults to 1 year from the time of signing.
  - `replace-fingerprints` boolean: Whether the newly issued certificate should immediately replace the currently active agent pool mTLS fingerprint set.

## Response `201`

Certificate signed successfully.

- CertificateSigningResponse: Response body for agent pool CSR signing.
  - `certificate` string, required: PEM-encoded agent pool certificate signed by the Scalr platform.
  - `not-valid-after` string, date-time, required: UTC datetime after which the issued certificate expires.

## Other responses

- `403`: User unauthorized to perform this action.
- `409`: Agent pool already has an active certificate.
- `422`: Malformed request body, invalid CSR, or feature not available for this account.
- `501`: Scalr platform cannot sign the CSR.
- `503`: Scalr platform failed to sign the CSR.
- `4XX`: Client error.
- `5XX`: Server error.

---

[API](https://skmtc.dev/scalr/apis/scalr-iacp-api.md) - [All operations](https://skmtc.dev/scalr/apis/scalr-iacp-api/llms.txt) - [OpenAPI document](https://skmtc.dev/scalr/apis/scalr-iacp-api/revisions/d3e1dc85657a?raw)