---
title: "Allows the current identity to recieve a new certificate associated with a certificate based authenticator"
method: POST
path: "/current-identity/authenticators/{id}/extend"
tags: ["Current API Session", "Enroll", "Extend Enrollment"]
---

# Allows the current identity to recieve a new certificate associated with a certificate based authenticator

`POST /current-identity/authenticators/{id}/extend`

This endpoint only functions for certificates issued by the controller. 3rd party certificates are not handled.
Allows an identity to extend its certificate's expiration date by using its current and valid client certificate to submit a CSR. This CSR may be passed in using a new private key, thus allowing private key rotation.
The response from this endpoint is a new client certificate which the client must  be verified via the /authenticators/{id}/extend-verify endpoint.
After verification is completion any new connections must be made with new certificate. Prior to verification the old client certificate remains active.

## Path parameters

- `id` string, required

## Request body

- IdentityExtendEnrollmentRequest
  - `clientCertCsr` string, required

## Response `200`

A response containg the identity's new certificate

- IdentityExtendEnrollmentEnvelope
  - `data` IdentityExtendCerts
    - `ca` string — A PEM encoded set of CA certificates
    - `clientCert` string — A PEM encoded client certificate
  - `meta` Meta
    - `apiEnrollmentVersion` string
    - `apiVersion` string
    - `filterableFields` string[]
    - `pagination` Pagination
      - `limit` number, required
      - `offset` number, required
      - `totalCount` number, required

## Other responses

- `401` — The supplied session does not have the correct access rights to request this resource

---

[API](https://skmtc.net/openziti/apis/ziti-edge-client.md) · [All operations](https://skmtc.net/openziti/apis/ziti-edge-client/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openziti/ziti-edge-client/revisions/25da9a73a095/schema)