---
title: "POST /api/v1/cert-manager/ca/internal/{caId}/sign-intermediate"
method: POST
path: "/api/v1/cert-manager/ca/internal/{caId}/sign-intermediate"
tags: ["PKI Certificate Authorities"]
---

# POST /api/v1/cert-manager/ca/internal/{caId}/sign-intermediate

`POST /api/v1/cert-manager/ca/internal/{caId}/sign-intermediate`

Create intermediate CA certificate from parent CA

## Path parameters

- `caId` string, required

## Request body

- object
  - `csr` string, required — The pem-encoded CSR to sign with the CA.
  - `notBefore` string — The date and time when the intermediate CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `notAfter` string, required — The date and time when the intermediate CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.
  - `maxPathLength` number — The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.

## Response `200`

Default Response

- object
  - `certificate` string, required — The signed intermediate certificate.
  - `certificateChain` string, required — The certificate chain of the intermediate certificate.
  - `issuingCaCertificate` string, required — The certificate of the issuing CA.
  - `serialNumber` string, required — The serial number of the intermediate certificate.

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

---

[API](https://skmtc.net/infisical/apis/infisical-api.md) · [All operations](https://skmtc.net/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/infisical/infisical-api/versions/f10a4f8c1d41/schema)