---
title: "Create a New Certificate"
method: POST
path: "/v2/certificates"
tags: ["DigitalOcean-public.v2-new_Certificates"]
---

# Create a New Certificate

`POST /v2/certificates`

To upload new SSL certificate which you have previously generated, send a POST
request to `/v2/certificates`.

When uploading a user-generated certificate, the `private_key`,
`leaf_certificate`, and optionally the `certificate_chain` attributes should
be provided. The type must be set to `custom`.

When using Let's Encrypt to create a certificate, the `dns_names` attribute
must be provided, and the type must be set to `lets_encrypt`.

## Request body

- union
  - CertificateRequestLetsEncrypt
    - `name` string, required — A unique human-readable name referring to a certificate.
    - `type` 'custom' | 'lets_encrypt' — A string representing the type of the certificate. The value will be `custom` for a user-uploaded certificate or `lets_encrypt` for one automatically generated with Let's Encrypt.
    - `dns_names` string[], required — An array of fully qualified domain names (FQDNs) for which the certificate was issued. A certificate covering all subdomains can be issued using a wildcard (e.g. `*.example.com`).
  - CertificateRequestCustom
    - `name` string, required — A unique human-readable name referring to a certificate.
    - `type` 'custom' | 'lets_encrypt' — A string representing the type of the certificate. The value will be `custom` for a user-uploaded certificate or `lets_encrypt` for one automatically generated with Let's Encrypt.
    - `private_key` string, required — The contents of a PEM-formatted private-key corresponding to the SSL certificate.
    - `leaf_certificate` string, required — The contents of a PEM-formatted public SSL certificate.
    - `certificate_chain` string — The full PEM-formatted trust chain between the certificate authority's certificate and your domain's SSL certificate.

## Response `201`

The response will be a JSON object with a key called `certificate`. The value of this will be an object that contains the standard attributes associated with a certificate.
When using Let's Encrypt, the initial value of the certificate's `state` attribute will be `pending`. When the certificate has been successfully issued by Let's Encrypt, this will transition to `verified` and be ready for use.

- object
  - `certificate` Certificate
    - `id` string, uuid — A unique ID that can be used to identify and reference a certificate.
    - `name` string — A unique human-readable name referring to a certificate.
    - `not_after` string, date-time — A time value given in ISO8601 combined date and time format that represents the certificate's expiration date.
    - `sha1_fingerprint` string — A unique identifier generated from the SHA-1 fingerprint of the certificate.
    - `created_at` string, date-time — A time value given in ISO8601 combined date and time format that represents when the certificate was created.
    - `dns_names` string[] — An array of fully qualified domain names (FQDNs) for which the certificate was issued.
    - `state` 'pending' | 'verified' | 'error' — A string representing the current state of the certificate. It may be `pending`, `verified`, or `error`.
    - `type` 'custom' | 'lets_encrypt' — A string representing the type of the certificate. The value will be `custom` for a user-uploaded certificate or `lets_encrypt` for one automatically generated with Let's Encrypt.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

---

[API](https://skmtc.net/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.net/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/revisions/cb3bf9b21459/schema)