---
title: "POST /api/v1/cert-manager/ca/internal/{caId}/certificate"
method: POST
path: "/api/v1/cert-manager/ca/internal/{caId}/certificate"
tags: ["PKI Certificate Authorities"]
---

# POST /api/v1/cert-manager/ca/internal/{caId}/certificate

`POST /api/v1/cert-manager/ca/internal/{caId}/certificate`

Generate certificate for a Certificate Authority

## Path parameters

- `caId` string, required

## Request body

- object
  - `notBefore` string, required — The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `notAfter` string, required — The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `maxPathLength` number — The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.
  - `parentCaId` string — Parent CA ID for intermediate certificate generation

## Response `200`

Default Response

- object
  - `certificate` string, required — The generated CA certificate.
  - `certificateChain` string, required — The certificate chain of the CA.
  - `serialNumber` string, required — The serial number of the CA certificate.
  - `certId` string, required — Certificate ID

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/885aef3e6c11/schema)