---
title: "Creates a new certificate."
method: POST
path: "/certificates/{certificate-name}/create"
---

# Creates a new certificate.

`POST /certificates/{certificate-name}/create`

If this is the first version, the certificate resource is created. This operation requires the certificates/create permission.

## Path parameters

- `certificate-name` string, required

## Query parameters

- `api-version` string, required

## Request body

- CertificateCreateParameters — The certificate create parameters.
  - `policy` CertificatePolicy — Management policy for a certificate.
    - `id` string — The certificate id.
    - `key_props` KeyProperties — Properties of the key pair backing a certificate.
      - `exportable` boolean — Indicates if the private key can be exported. Release policy must be provided when creating the first version of an exportable key.
      - `kty` 'EC' | 'EC-HSM' | 'RSA' | 'RSA-HSM' | 'oct' | 'oct-HSM' — The type of key pair to be used for the certificate.
      - `key_size` integer — The key size in bits. For example: 2048, 3072, or 4096 for RSA.
      - `reuse_key` boolean — Indicates if the same key pair will be used on certificate renewal.
      - `crv` 'P-256' | 'P-384' | 'P-521' | 'P-256K' — Elliptic curve name. For valid values, see JsonWebKeyCurveName.
    - `secret_props` SecretProperties — Properties of the key backing a certificate.
      - `contentType` string — The media type (MIME type).
    - `x509_props` X509CertificateProperties — Properties of the X509 component of a certificate.
      - `subject` string — The subject name. Should be a valid X509 distinguished Name.
      - `ekus` string[] — The enhanced key usage.
      - `sans` SubjectAlternativeNames — The Subject Alternative Names of a X509 object.
        - `emails` string[] — Email addresses.
        - `dns_names` string[] — Domain Names.
        - `upns` string[] — User Principal Names.
      - `key_usage` KeyUsageType[] — Defines how the certificate's key may be used.
      - `validity_months` integer — The duration that the certificate is valid in months.
    - `lifetime_actions` LifetimeAction[] — Actions that will be performed by Key Vault over the lifetime of a certificate.
      - `trigger` Trigger — A condition to be satisfied for an action to be executed.
        - `lifetime_percentage` integer — Percentage of lifetime at which to trigger. Value should be between 1 and 99.
        - `days_before_expiry` integer — Days before expiry to attempt renewal. Value should be between 1 and validity_in_months multiplied by 27. If validity_in_months is 36, then value should be between 1 and 972 (36 * 27).
      - `action` Action — The action that will be executed.
        - `action_type` 'EmailContacts' | 'AutoRenew' — The type of the action.
    - `issuer` IssuerParameters — Parameters for the issuer of the X509 component of a certificate.
      - `name` string — Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'.
      - `cty` string — Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL'
      - `cert_transparency` boolean — Indicates if the certificates generated under this policy should be published to certificate transparency logs.
    - `attributes` CertificateAttributes — The certificate management attributes.
      - `enabled` boolean — Determines whether the object is enabled.
      - `nbf` integer — Not before date in UTC.
      - `exp` integer — Expiry date in UTC.
      - `created` integer — Creation time in UTC.
      - `updated` integer — Last updated time in UTC.
      - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
      - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.
  - `attributes` CertificateAttributes — The certificate management attributes.
    - `enabled` boolean — Determines whether the object is enabled.
    - `nbf` integer — Not before date in UTC.
    - `exp` integer — Expiry date in UTC.
    - `created` integer — Creation time in UTC.
    - `updated` integer — Last updated time in UTC.
    - `recoverableDays` integer — softDelete data retention days. Value should be >=7 and <=90 when softDelete enabled, otherwise 0.
    - `recoveryLevel` 'Purgeable' | 'Recoverable+Purgeable' | 'Recoverable' | 'Recoverable+ProtectedSubscription' | 'CustomizedRecoverable+Purgeable' | 'CustomizedRecoverable' | 'CustomizedRecoverable+ProtectedSubscription' — Reflects the deletion recovery level currently in effect for secrets in the current vault. If it contains 'Purgeable', the secret can be permanently deleted by a privileged user; otherwise, only the system can purge the secret, at the end of the retention interval.
  - `tags` object — Application specific metadata in the form of key-value pairs.
  - `preserveCertOrder` boolean — Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0.

## Response `202`

The request has been accepted for processing, but processing has not yet completed.

- CertificateOperation — A certificate operation is returned in case of asynchronous requests.
  - `id` string — The certificate id.
  - `issuer` IssuerParameters — Parameters for the issuer of the X509 component of a certificate.
    - `name` string — Name of the referenced issuer object or reserved names; for example, 'Self' or 'Unknown'.
    - `cty` string — Certificate type as supported by the provider (optional); for example 'OV-SSL', 'EV-SSL'
    - `cert_transparency` boolean — Indicates if the certificates generated under this policy should be published to certificate transparency logs.
  - `csr` string, byte — The certificate signing request (CSR) that is being used in the certificate operation.
  - `cancellation_requested` boolean — Indicates if cancellation was requested on the certificate operation.
  - `status` string — Status of the certificate operation.
  - `status_details` string — The status details of the certificate operation.
  - `error` Error, nullable
    - `code` string — The error code.
    - `message` string — The error message.
    - `innererror` Error — recursive
  - `target` string — Location which contains the result of the certificate operation.
  - `preserveCertOrder` boolean — Specifies whether the certificate chain preserves its original order. The default value is false, which sets the leaf certificate at index 0.
  - `request_id` string — Identifier for the certificate operation.

## Other responses

- `default` — An unexpected error response.

---

[API](https://skmtc.net/azure/apis/keyvault-certificates.md) · [All operations](https://skmtc.net/azure/apis/keyvault-certificates/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/azure/keyvault-certificates/versions/b96f8513893b/schema)