Sign in

v50

latestOpenAPI 3.1.0Apache 2.0raw.githubusercontent.com2026-07-068428533.0 MB
Certificates

Upsert a Certificate

Create or Update Certificate using ID.

put/v2/control-planes/{controlPlaneId}/core-entities/certificates/{CertificateId}

Request body

certstring nullable

PEM-encoded public certificate chain of the SSL key pair. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

cert_altstring nullable

PEM-encoded public certificate chain of the alternate SSL key pair. This should only be set if you have both RSA and ECDSA types of certificate available and would like Kong to prefer serving using ECDSA certs when client advertises support for it. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

created_atinteger nullable

Unix epoch when the resource was created.

descriptionstring nullable

User-defined entity description. Konnect only field, not synced to the Gateway.

idstring nullable

A string representing a UUID (universally unique identifier).

keystring nullable

PEM-encoded private key of the SSL key pair. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

key_altstring nullable

PEM-encoded private key of the alternate SSL key pair. This should only be set if you have both RSA and ECDSA types of certificate available and would like Kong to prefer serving using ECDSA certs when client advertises support for it. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

managed_byobject nullable

Arbitrary JSON data for client responsible for managing the entity. Konnect only field, not synced to the Gateway.

snisstring[] nullable
tagsstring[] nullable

An optional set of strings associated with the Certificate for grouping and filtering.

updated_atinteger nullable

Unix epoch when the resource was last updated.

vaultstring nullable

Shorthand that expands into cert and key; when both vault and cert/key are provided, the vault expansion takes precedence.

vault_altstring nullable

Shorthand that expands into cert_alt and key_alt; when both vault_alt and cert_alt/key_alt are provided, the vault_alt expansion takes precedence.

Response

Successfully upserted Certificate

certstring required

PEM-encoded public certificate chain of the SSL key pair. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

cert_altstring nullable

PEM-encoded public certificate chain of the alternate SSL key pair. This should only be set if you have both RSA and ECDSA types of certificate available and would like Kong to prefer serving using ECDSA certs when client advertises support for it. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

created_atinteger nullable

Unix epoch when the resource was created.

idstring nullable

A string representing a UUID (universally unique identifier).

keystring required

PEM-encoded private key of the SSL key pair. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

key_altstring nullable

PEM-encoded private key of the alternate SSL key pair. This should only be set if you have both RSA and ECDSA types of certificate available and would like Kong to prefer serving using ECDSA certs when client advertises support for it. This field is referenceable, which means it can be securely stored as a secret in a vault. References must follow a specific format.

snisstring[] nullable
tagsstring[] nullable

An optional set of strings associated with the Certificate for grouping and filtering.

updated_atinteger nullable

Unix epoch when the resource was last updated.

Example response

{
  "cert": "-----BEGIN CERTIFICATE-----\ncertificate-content\n-----END CERTIFICATE-----",
  "id": "b2f34145-0343-41a4-9602-4c69dec2f269",
  "key": "-----BEGIN PRIVATE KEY-----\nprivate-key-content\n-----END PRIVATE KEY-----"
}