> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API enrollment

> Issue certificates through the Infisical UI, Agent, or API with optional server-driven auto-renewal.

> [!TIP]
>
> New to Infisical Certificate Management? Start with [Issue Your First Certificate](https://infisical.com/docs/documentation/platform/pki/quick-starts/issue-first-certificate.md).

API enrollment is the default method for issuing certificates through the Infisical UI, the Infisical Agent, or direct API calls. It's the most flexible option — use it for manual one-off requests, automated pipelines, or server-driven auto-renewal where Infisical manages the certificate lifecycle.

> [!NOTE]
>
> API enrollment is configured on profiles attached to your [Application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md). Product Admins attach [profiles](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md), and Application Admins configure enrollment methods on those profiles.

## When to use API enrollment

> [card] Custom Integrations
>
> Build certificate issuance into your own tooling and automation.

> [card] CI/CD Pipelines
>
> Issue certificates as part of deployment workflows.

> [card] Server-Driven Renewal
>
> Let Infisical automatically renew certificates before expiration.

> [card] One-Off Requests
>
> Issue certificates manually through the UI when needed.

## Guides

> [card] [Infisical Agent](https://infisical.com/docs/documentation/platform/pki/guides/applications/infisical-agent.md)
>
> Issue and renew certificates automatically with the Infisical Agent.

> [card] [Infisical Agent reference](https://infisical.com/docs/documentation/platform/pki/reference/infisical-agent.md)
>
> Every configuration option for the Agent's certificate management mode.

> [card] [Kubernetes (Infisical Issuer)](https://infisical.com/docs/documentation/platform/pki/guides/applications/k8s-cert-manager-issuer.md)
>
> Issue and renew Kubernetes TLS certificates with the Infisical cert-manager issuer.

## Configure API enrollment

**1. Navigate to your Application**

Go to **Certificate Manager → Applications** and select your Application.

**2. Configure enrollment on an attached profile**

Go to the **Settings** tab and find the **Certificate Profiles** section. Select **Configure** on the profile you want to enable API enrollment for.

> [!NOTE]
>
> Profiles are attached by Product Admins. If you don't see any profiles, ask your Product Admin to attach one.

**3. Add API enrollment**

In the modal, select **Add enrollment method** and select **API**.

**4. Configure auto-renewal (optional)**

Enable **Auto-Renewal By Default** to have Infisical automatically renew certificates before expiration.

| Setting | Description |
| - | - |
| **Auto-Renewal** | When enabled, eligible certificates are renewed server-side |
| **Renew Before Days** | How many days before expiration to trigger renewal |

> [!NOTE]
>
> Auto-renewal only works for certificates with server-managed private keys. Certificates issued via CSR are not eligible.

## Issue a certificate

Once API enrollment is configured, you can issue certificates through the UI or API.

> [!NOTE]
>
> Certificates issued through API enrollment are tied to the Application + Profile pair. The profile determines certificate parameters (CA, policy, defaults), while the Application scopes the certificate to your service.

> [tab] Infisical UI
>
> **1. Open certificate requests**
>
> In your Application, go to the **Certificate Requests** tab and select **Request**.
>
> **2. Select profile and request method**
>
> Choose your certificate profile and request method:
>
> | Method | Description |
> | - | - |
> | **Managed** | Infisical generates and manages the private key |
> | **CSR** | You provide your own Certificate Signing Request |
>
> **3. Fill in certificate details**
>
> **For Managed requests:**
>
> * Common Name and SANs
> * Key algorithm and signature algorithm
> * Validity period (TTL)
> * Optional metadata tags
>
> **For CSR requests:**
>
> * Paste your PEM-encoded CSR
>
> * Specify validity period (TTL)
>
> > [!NOTE]
> >
> > When using CSR, subject attributes and key algorithm are extracted from your CSR.
>
> **4. Download the certificate**
>
> After issuance, download the certificate body, chain, and private key (if managed).
>
> > [!WARNING]
> >
> > The private key is only shown once. Store it securely immediately after issuance.

> [tab] API
>
> ### Issue with managed key
>
> Let Infisical generate the private key:
>
> ```bash theme={"dark"}
> curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
>   -H 'Authorization: Bearer <access-token>' \
>   -H 'Content-Type: application/json' \
>   -d '{
>     "profileId": "<certificate-profile-id>",
>     "attributes": {
>       "commonName": "api.example.com",
>       "ttl": "90d",
>       "keyAlgorithm": "RSA_2048",
>       "altNames": [
>         { "type": "DNS", "value": "api.example.com" },
>         { "type": "DNS", "value": "www.api.example.com" }
>       ]
>     },
>     "metadata": [
>       { "key": "env", "value": "production" },
>       { "key": "service", "value": "payments-api" }
>     ]
>   }'
> ```
>
> **Response:**
>
> ```json theme={"dark"}
> {
>   "certificate": {
>     "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
>     "certificateChain": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
>     "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
>     "serialNumber": "123456789012345678",
>     "certificateId": "cert-abc123"
>   },
>   "certificateRequestId": "req-xyz789"
> }
> ```
>
> ### Issue with your own CSR
>
> Bring your own private key:
>
> ```bash theme={"dark"}
> curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
>   -H 'Authorization: Bearer <access-token>' \
>   -H 'Content-Type: application/json' \
>   -d '{
>     "profileId": "<certificate-profile-id>",
>     "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
>     "attributes": {
>       "ttl": "90d"
>     }
>   }'
> ```
>
> > [!NOTE]
> >
> > If the certificate requires approval, the response will include `certificateRequestId` but `certificate` will be `null`. Poll the [Get Certificate Request](https://infisical.com/docs/api-reference/endpoints/certificates/certificate-request.md) endpoint to check status.
>
> See the [Issue Certificate API reference](https://infisical.com/docs/api-reference/endpoints/certificates/create-certificate.md) for full details.

## Server-driven auto-renewal

When auto-renewal is enabled, Infisical automatically renews certificates before they expire:

1. Infisical monitors certificate expiration dates
2. When a certificate is within the "Renew Before Days" threshold, Infisical issues a new certificate
3. The new certificate is pushed to any configured [certificate syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)

> [!NOTE]
>
> Auto-renewal only works for certificates with server-managed keys. Certificates issued via CSR must be renewed by the client.

## What's next?

> [card] [ACME Enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme)
>
> Use Certbot, cert-manager, or other ACME clients.

> [card] [Certificate Syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)
>
> Push certificates to AWS ACM, Azure Key Vault, and more.

> [card] [Managing Certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates.md)
>
> View, renew, and revoke certificates in your Application.

> [card] [Alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)
>
> Get notified when certificates are about to expire.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.