---
title: "POST /api/v1/cert-manager/certificates/{id}/renew"
method: POST
path: "/api/v1/cert-manager/certificates/{id}/renew"
tags: ["PKI Certificates"]
---

# POST /api/v1/cert-manager/certificates/{id}/renew

`POST /api/v1/cert-manager/certificates/{id}/renew`

Renew a certificate. The renewed certificate copies the one being renewed, then applies only the changes supplied here. Profile defaults are not applied.

## Path parameters

- `id` string, uuid, required

## Request body

- object, nullable
  - `removeRootsFromChain` union — Whether to remove the root certificate from the returned certificate chain.
    - boolean
    - string
  - `renewalKeySource` 'new' | 'reuse' | 'csr' — How the renewed certificate's key pair is handled. 'new' generates a fresh pair, 'reuse' keeps the current one so the renewed certificate carries the same public key, and 'csr' takes the key from a supplied signing request. Defaults to 'new'.
  - `csr` string — A PEM-encoded certificate signing request to renew from. Its subject, key and extensions take precedence, so only TTL and basic constraints may be set alongside it.
  - `attributes` object — Certificate fields to change on renewal. Anything omitted is copied from the certificate being renewed. Profile defaults are not applied.
    - `commonName` string, nullable
    - `organization` string, nullable
    - `organizationalUnit` string, nullable
    - `country` string, nullable
    - `state` string, nullable
    - `locality` string, nullable
    - `domainComponents` string[], nullable
    - `keyUsages` string[]
    - `extendedKeyUsages` string[]
    - `altNames` object[]
      - `type` 'dns_name' | 'ip_address' | 'email' | 'uri' | 'upn', required
      - `value` string, required
    - `signatureAlgorithm` 'RSA-SHA256' | 'RSA-SHA384' | 'RSA-SHA512' | 'ECDSA-SHA256' | 'ECDSA-SHA384' | 'ECDSA-SHA512' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s'
    - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s'
    - `ttl` string
    - `basicConstraints` object
      - `isCA` boolean, required
      - `pathLength` integer

## Response `200`

Default Response

- object
  - `certificate` string, required
  - `issuingCaCertificate` string, required
  - `certificateChain` string, required
  - `privateKey` string
  - `serialNumber` string, required
  - `certificateId` string, required
  - `certificateRequestId` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/d87fa2e5de58/schema)