---
title: "Sign an Agent Pool Certificate"
method: POST
path: "/agent-pools/{agent_pool}/actions/sign-csr"
tags: ["agent-pools-mtls-certificates"]
---

# Sign an Agent Pool Certificate

`POST /agent-pools/{agent_pool}/actions/sign-csr`

This endpoint signs a CSR for an agent pool certificate to use
it for agent mTLS connection.

Example CSR generation with OpenSSL (EC P-256)::

    openssl ecparam -genkey -name prime256v1 -noout -out scalr-agent.key
    openssl req -new -key scalr-agent.key -out scalr-agent.csr -subj "/CN=agent-pool"

## Path parameters

- `agent_pool` string, required

## Request body

- CertificateSigningRequest — Request body for agent pool CSR signing.
  - `csr` string, required — PEM-encoded certificate signing request for the agent pool certificate.
  - `not-valid-after` string, date-time — UTC datetime after which the issued certificate expires. Defaults to 1 year from the time of signing.
  - `replace-fingerprints` boolean — Whether the newly issued certificate should immediately replace the currently active agent pool mTLS fingerprint set.

## Response `201`

Certificate signed successfully.

- CertificateSigningResponse — Response body for agent pool CSR signing.
  - `certificate` string, required — PEM-encoded agent pool certificate signed by the Scalr platform.
  - `not-valid-after` string, date-time, required — UTC datetime after which the issued certificate expires.

## Other responses

- `403` — User unauthorized to perform this action.
- `409` — Agent pool already has an active certificate.
- `422` — Malformed request body, invalid CSR, or feature not available for this account.
- `501` — Scalr platform cannot sign the CSR.
- `503` — Scalr platform failed to sign the CSR.
- `4XX` — Client error.
- `5XX` — Server error.

---

[API](https://skmtc.net/scalr/apis/scalr-iacp-api.md) · [All operations](https://skmtc.net/scalr/apis/scalr-iacp-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalr/scalr-iacp-api/revisions/fc927526ad12/schema)