> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CA renewal

> Renew your Certificate Authority certificates before they expire.

Renew a CA certificate to extend its validity period. The renewal process varies depending on how your CA was originally signed.

> [!NOTE]
>
> This page is for product admins managing PKI infrastructure. If you're looking to renew end-entity certificates, see [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md).

## Before you renew

> [!NOTE]
>
> * If renewing an intermediate CA chained to an **Infisical CA**, Infisical will automate the process of generating a new certificate for you.
> * If renewing an intermediate CA signed by an **external CA provider** (e.g., Venafi, Microsoft ADCS), you can configure auto-renewal to automate the process. See [Venafi auto-renewal](https://infisical.com/docs/documentation/platform/pki/ca/venafi.md#auto-renewal) or [Microsoft ADCS auto-renewal](https://infisical.com/docs/documentation/platform/pki/ca/adcs.md).
> * If renewing an intermediate CA chained to an **external parent CA via manual import**, you'll need to generate a new certificate from the external parent CA and manually import it back.

## Renew a CA

> [tab] Infisical UI
>
> **1. Navigate to the CA**
>
> Go to **Certificate Manager → Certificate Authorities → Internal** and select the CA you want to renew.
>
> **2. Start renewal**
>
> Select **Renew CA** on the left side of the CA detail page.
>
> **3. Set new validity**
>
> Input a new **Valid Until** date for the renewed CA certificate and select **Renew**.
>
> > [!NOTE]
> >
> > The new **Valid Until** date must be within the validity period of the parent CA.

> [tab] API
>
> To renew a CA certificate, make an API request to the [Renew CA](https://infisical.com/docs/api-reference/endpoints/certificate-authorities/internal/renew.md) API endpoint, specifying the new `notAfter` date for the CA.
>
> ### Sample request
>
> ```bash theme={"dark"}
> curl --location --request POST 'https://app.infisical.com/api/v1/cert-manager/ca/internal/<ca-id>/renew' \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data-raw '{
>       "type": "existing",
>       "notAfter": "2029-06-12"
>   }'
> ```
>
> ### Sample response
>
> ```json theme={"dark"}
> {
>   "certificate": "...",
>   "certificateChain": "...",
>   "serialNumber": "..."
> }
> ```

## FAQ

> [accordion] Does Infisical support CA renewal via new key pair?
>
> At the moment, Infisical only supports CA renewal via same key pair. We anticipate supporting CA renewal via new key pair in the coming month.

> [accordion] What happens to certificates issued by the old CA certificate?
>
> Certificates issued before the renewal remain valid until their own expiration date. The CA's private key stays the same, so the chain of trust is preserved.

## What's next?

> [card] [CRL Distribution Points](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution.md)
>
> Configure CRL mirrors for your CA.

> [card] [Create CA Hierarchy](https://infisical.com/docs/documentation/platform/pki/ca/private-ca)
>
> Set up root and intermediate CAs.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.