---
title: "POST /keys-and-certificate"
method: POST
path: "/keys-and-certificate"
---

# POST /keys-and-certificate

`POST /keys-and-certificate`

Creates a 2048-bit RSA key pair and issues an X.509 certificate using the issued public key. You can also call `CreateKeysAndCertificate` over MQTT from a device, for more information, see [Provisioning MQTT API](https://docs.aws.amazon.com/iot/latest/developerguide/provision-wo-cert.html#provision-mqtt-api).

**Note** This is the only time IoT issues the private key for this certificate, so it is important to keep it in a secure location.

Requires permission to access the [CreateKeysAndCertificate](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiot.html#awsiot-actions-as-permissions) action.

## Query parameters

- `setAsActive` boolean

## Response `200`

Success

- CreateKeysAndCertificateResponse — The output of the CreateKeysAndCertificate operation.
  - `certificateArn` string — The ARN of the certificate.
  - `certificateId` string — The ID of the certificate. IoT issues a default subject name for the certificate (for example, IoT Certificate).
  - `certificatePem` string — The certificate data, in PEM format.
  - `keyPair` object — The generated key pair.
    - `PublicKey` string — The public key.
    - `PrivateKey` string, password — The private key.

## Other responses

- `480` — InvalidRequestException
- `481` — ThrottlingException
- `482` — UnauthorizedException
- `483` — ServiceUnavailableException
- `484` — InternalFailureException

---

[API](https://skmtc.net/aws/apis/iot.md) · [All operations](https://skmtc.net/aws/apis/iot/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/iot/versions/deef5c4b09f0/schema)