> ## Documentation Index > Fetch the complete documentation index at: https://infisical.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Update > Update TLS Certificate Auth configuration on machine identity ## OpenAPI ````yaml PATCH /api/v1/auth/tls-cert-auth/identities/{identityId} openapi: 3.0.3 info: title: Infisical API description: List of all available APIs that can be consumed version: 0.0.1 servers: - url: https://us.infisical.com description: Production server (US) - url: https://eu.infisical.com description: Production server (EU) - url: http://localhost:8080 description: Local server security: [] paths: /api/v1/auth/tls-cert-auth/identities/{identityId}: patch: tags: - TLS Certificate Auth description: Update TLS Certificate Auth configuration on machine identity operationId: updateTlsCertAuth parameters: - schema: type: string in: path name: identityId required: true description: The ID of the machine identity to update the auth method for. requestBody: required: true content: application/json: schema: type: object properties: caCertificate: type: string minLength: 1 maxLength: 10240 description: >- The PEM-encoded CA certificate to validate client certificates. verifyClientCertificateChain: type: boolean description: >- When false (default), the CA certificate must be the direct issuer of the client's leaf certificate. When true, the CA certificate is treated as a trust anchor and the client-presented chain (leaf plus intermediates) is validated up to it, supporting issuers that rotate beneath a stable root such as SPIRE X.509-SVIDs. bindAccessTokenToCertificate: type: boolean description: >- When true, access tokens issued by this auth method only work on requests that present the same client certificate used to log in. Turning this on revokes the identity's existing TLS Certificate Auth access tokens. allowedCommonNames: type: string minLength: 1 nullable: true description: >- The comma-separated list of trusted common names that are allowed to authenticate with Infisical. allowedSubjectAltNames: type: array items: type: string minLength: 1 nullable: true description: >- The comma-separated list of trusted subject alternative names that are allowed to authenticate with Infisical. Prefix entries by type (URI:, DNS:, IP:, EMAIL:). Bare entries are treated as DNS names. accessTokenTrustedIps: type: array items: type: object properties: ipAddress: type: string required: - ipAddress additionalProperties: false minItems: 1 description: >- The new IPs or CIDR ranges that access tokens can be used from. accessTokenTTL: type: integer minimum: 0 maximum: 315360000 description: The new lifetime for an access token in seconds. accessTokenNumUsesLimit: type: integer minimum: 0 description: >- The new maximum number of times that an access token can be used. accessTokenMaxTTL: type: integer minimum: 0 maximum: 315360000 description: The new maximum lifetime for an access token in seconds. additionalProperties: false responses: '200': description: Default Response content: application/json: schema: type: object properties: identityTlsCertAuth: type: object properties: id: type: string format: uuid accessTokenTTL: type: number default: 7200 accessTokenMaxTTL: type: number default: 7200 accessTokenNumUsesLimit: type: number default: 0 accessTokenTrustedIps: {} createdAt: type: string format: date-time updatedAt: type: string format: date-time identityId: type: string format: uuid allowedCommonNames: type: string nullable: true encryptedCaCertificate: {} allowedSubjectAltNames: type: array items: type: string nullable: true verifyClientCertificateChain: type: boolean default: false bindAccessTokenToCertificate: type: boolean default: false required: - id - createdAt - updatedAt - identityId - encryptedCaCertificate - allowedSubjectAltNames additionalProperties: false required: - identityTlsCertAuth additionalProperties: false '400': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 400 message: type: string error: type: string details: {} required: - reqId - statusCode - message - error additionalProperties: false '401': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 401 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '403': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 403 message: type: string details: {} error: type: string required: - reqId - statusCode - message - error additionalProperties: false '404': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 404 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false '422': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 422 message: {} error: type: string required: - reqId - statusCode - error additionalProperties: false '500': description: Default Response content: application/json: schema: type: object properties: reqId: type: string statusCode: type: number enum: - 500 message: type: string error: type: string required: - reqId - statusCode - message - error additionalProperties: false security: - bearerAuth: [] components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: An access token in Infisical ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.