---
title: "POST /cacertificate"
method: POST
path: "/cacertificate"
---

# POST /cacertificate

`POST /cacertificate`

Registers a CA certificate with Amazon Web Services IoT Core. There is no limit to the number of CA certificates you can register in your Amazon Web Services account. You can register up to 10 CA certificates with the same `CA subject field` per Amazon Web Services account.

Requires permission to access the [RegisterCACertificate](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions) action.

## Query parameters

- `setAsActive` boolean
- `allowAutoRegistration` boolean

## Request body

- object
  - `caCertificate` string, required — The PEM of a certificate.
  - `verificationCertificate` string — The PEM of a certificate.
  - `registrationConfig` object — The registration configuration.
    - `templateBody` string — The template body.
    - `roleArn` string — The ARN of the role.
    - `templateName` string — The name of the provisioning template.
  - `tags` Tag[] — <p>Metadata which can be used to manage the CA certificate.</p> <note> <p>For URI Request parameters use format: ...key1=value1&amp;key2=value2...</p> <p>For the CLI command-line parameter use format: &amp;&amp;tags "key1=value1&amp;key2=value2..."</p> <p>For the cli-input-json file use format: "tags": "key1=value1&amp;key2=value2..."</p> </note>
    - `Key` string, required — The tag's key.
    - `Value` string — The tag's value.
  - `certificateMode` 'DEFAULT' | 'SNI_ONLY' — Describes the certificate mode in which the Certificate Authority (CA) will be registered. If the <code>verificationCertificate</code> field is not provided, set <code>certificateMode</code> to be <code>SNI_ONLY</code>. If the <code>verificationCertificate</code> field is provided, set <code>certificateMode</code> to be <code>DEFAULT</code>. When <code>certificateMode</code> is not provided, it defaults to <code>DEFAULT</code>. All the device certificates that are registered using this CA will be registered in the same certificate mode as the CA. For more information about certificate mode for device certificates, see <a href="https://docs.aws.amazon.com/iot/latest/apireference/API_CertificateDescription.html#iot-Type-CertificateDescription-certificateMode"> certificate mode</a>.

## Response `200`

Success

- RegisterCACertificateResponse — The output from the RegisterCACertificateResponse operation.
  - `certificateArn` string — The CA certificate ARN.
  - `certificateId` string — The CA certificate identifier.

## Other responses

- `480` — ResourceNotFoundException
- `481` — ResourceAlreadyExistsException
- `482` — RegistrationCodeValidationException
- `483` — InvalidRequestException
- `484` — CertificateValidationException
- `485` — ThrottlingException
- `486` — LimitExceededException
- `487` — UnauthorizedException
- `488` — ServiceUnavailableException
- `489` — InternalFailureException

---

[API](https://skmtc.net/aws/apis/iot.md) · [All operations](https://skmtc.net/aws/apis/iot/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iot/revisions/deef5c4b09f0/schema)