---
title: "GET /api/v1/cert-manager/ca"
method: GET
path: "/api/v1/cert-manager/ca"
tags: ["PKI Certificate Authorities"]
---

# GET /api/v1/cert-manager/ca

`GET /api/v1/cert-manager/ca`

Get Certificate Authorities

## Response `200`

Default Response

- object
  - `certificateAuthorities` union[], required
    - union
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'internal', required
        - `configuration` object, required
          - `type` 'root' | 'intermediate', required — The type of CA to create.
          - `friendlyName` string — A friendly name for the CA.
          - `commonName` string — The common name (CN) for the CA.
          - `organization` string — The organization (O) for the CA.
          - `ou` string — The organization unit (OU) for the CA.
          - `country` string — The country name (C) for the CA.
          - `province` string — The state of province name for the CA.
          - `locality` string — The locality name for the CA.
          - `notBefore` string — The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
          - `notAfter` string — The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
          - `maxPathLength` number, nullable — The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.
          - `keyAlgorithm` 'RSA_2048' | 'RSA_3072' | 'RSA_4096' | 'EC_prime256v1' | 'EC_secp384r1' | 'EC_secp521r1' | 'ML-DSA-44' | 'ML-DSA-65' | 'ML-DSA-87' | 'SLH-DSA-SHA2-128f' | 'SLH-DSA-SHA2-128s' | 'SLH-DSA-SHA2-192f' | 'SLH-DSA-SHA2-192s' | 'SLH-DSA-SHA2-256f' | 'SLH-DSA-SHA2-256s' | 'SLH-DSA-SHAKE-128f' | 'SLH-DSA-SHAKE-128s' | 'SLH-DSA-SHAKE-192f' | 'SLH-DSA-SHAKE-192s' | 'SLH-DSA-SHAKE-256f' | 'SLH-DSA-SHAKE-256s', required — The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA.
          - `keySource` 'infisical' | 'hsm' — Where the CA's signing key is generated and stored. 'infisical' keeps the key in Infisical's KMS; 'hsm' generates and stores the key in the HSM reached through the specified HSM Connector.
          - `hsmConnectorId` string, uuid — The ID of the HSM Connector to generate and store the CA's signing key in. Required when keySource is 'hsm'.
          - `hsmKeyLabel` string — The label of the CA's signing key on the HSM. Not user-supplied: it is the HSM Connector's configured key name prefix followed by a per-CA label built from the CA name and a random 5-character suffix (ca-<name>-<slug>).
          - `dn` string, nullable
          - `parentCaId` string, uuid, nullable
          - `serialNumber` string, nullable
          - `activeCaCertId` string, uuid, nullable
          - `crlDistributionPointUrls` string[] — Additional CRL Distribution Point URLs (HTTP/HTTPS) embedded in every certificate issued by this CA. Up to 4 URLs; the Infisical-managed CRL endpoint is included by default unless disabled.
          - `disableManagedCrlDistributionPointUrl` boolean — When set to true, the Infisical-managed CRL endpoint URL will not be embedded in certificates issued by this CA. Only custom CRL Distribution Point URLs (if any) will be included.
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'acme', required
        - `configuration` object, required
          - `dnsAppConnectionId` string, uuid, required — The ID of the App Connection to use for creating and managing DNS TXT records required for ACME domain validation. This connection must have permissions to create and delete TXT records in your DNS provider (e.g., Route53) for the ACME challenge process.
          - `dnsProviderConfig` object, required
            - `provider` 'route53' | 'cloudflare' | 'dns-made-easy' | 'azure-dns', required — The DNS provider for the ACME Certificate Authority.
            - `hostedZoneId` string, required — The hosted zone ID for the ACME Certificate Authority.
          - `directoryUrl` string, uri, required — The directory URL for the ACME Certificate Authority.
          - `accountEmail` string, required — The email address for the ACME Certificate Authority.
          - `eabKid` string — The External Account Binding (EAB) Key ID for the ACME Certificate Authority. Required if the ACME provider uses EAB.
          - `dnsResolver` union — An optional custom DNS resolver IP address to use for verifying DNS propagation during ACME challenges. Must be a valid IP address (e.g. 8.8.8.8). When not set, the system default DNS resolver is used.
            - string, ipv4
            - string, ipv6
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'azure-ad-cs', required
        - `configuration` object, required
          - `azureAdcsConnectionId` string, uuid, required — Azure ADCS Connection ID
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'adcs', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — The ADCS App Connection ID.
          - `caName` string — The AD CS certification authority name. Optional: discovered automatically from the CA host when omitted.
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'aws-pca', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — The ID of the AWS App Connection to use for authenticating with AWS Private Certificate Authority (PCA). This connection must have permissions to issue, get, and revoke certificates from the specified PCA.
          - `certificateAuthorityArn` string, required — The ARN of the AWS Private Certificate Authority to use for issuing certificates.
          - `region` 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2' | 'us-gov-east-1' | 'us-gov-west-1' | 'af-south-1' | 'ap-east-1' | 'ap-south-1' | 'ap-south-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ca-central-1' | 'eu-central-1' | 'eu-central-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'eu-south-1' | 'eu-south-2' | 'eu-north-1' | 'me-south-1' | 'me-central-1' | 'sa-east-1', required — The AWS region where the Private Certificate Authority is located.
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'digicert', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — DigiCert App Connection ID
          - `organizationId` integer, required — CertCentral Organization ID that will be listed on issued certificates
          - `productNameId` string, required — The DigiCert product name_id used for issuance (e.g. ssl_plus, code_signing, code_signing_ev). Fetch available products from GET /app-connections/digicert/:id/products.
          - `purpose` 'ssl' | 'code_signing' — Whether this CA issues SSL/TLS or code-signing certificates (defaults to ssl)
          - `verifiedContact` object — Contact info for the user who approves first-time code signing orders for the organization
            - `firstName` string, required
            - `lastName` string, required
            - `email` string, email, required
            - `jobTitle` string, required
            - `telephone` string, required
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'godaddy', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — GoDaddy App Connection ID
          - `productType` 'DV_SSL', required — The GoDaddy DV product used for issuance (DV_SSL for a single domain)
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'aws-acm-public-ca', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — The ID of the AWS App Connection to use for authenticating with AWS Certificate Manager (ACM). This connection must have permissions to request, describe, export, renew, and delete certificates.
          - `dnsAppConnectionId` string, uuid, required — The ID of the AWS App Connection to use for creating and managing Route 53 CNAME records required for ACM domain validation.
          - `hostedZoneId` string, required — The Route 53 hosted zone ID to use for ACM DNS validation CNAME records.
          - `region` 'us-east-1' | 'us-east-2' | 'us-west-1' | 'us-west-2' | 'us-gov-east-1' | 'us-gov-west-1' | 'af-south-1' | 'ap-east-1' | 'ap-south-1' | 'ap-south-2' | 'ap-northeast-1' | 'ap-northeast-2' | 'ap-northeast-3' | 'ap-southeast-1' | 'ap-southeast-2' | 'ap-southeast-3' | 'ap-southeast-4' | 'ca-central-1' | 'eu-central-1' | 'eu-central-2' | 'eu-west-1' | 'eu-west-2' | 'eu-west-3' | 'eu-south-1' | 'eu-south-2' | 'eu-north-1' | 'me-south-1' | 'me-central-1' | 'sa-east-1', required — The AWS region to use for the ACM API calls.
      - object
        - `enableDirectIssuance` boolean
        - `name` string, required
        - `id` string, uuid, required
        - `status` 'active' | 'disabled' | 'pending-certificate', required
        - `type` 'venafi-tpp', required
        - `configuration` object, required
          - `appConnectionId` string, uuid, required — The Venafi TPP App Connection ID.
          - `policyDN` string, required — The policy folder DN in Venafi TPP (e.g., '\\VED\\Policy\\Certificates').

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)