docs/documentation/platform/pki/applications/enrollment-methods/api.mdx
API enrollment is the default method for issuing certificates through the Infisical UI, the Infisical Agent, or direct API calls. It's the most flexible option — use it for manual one-off requests, automated pipelines, or server-driven auto-renewal where Infisical manages the certificate lifecycle.
<Info> API enrollment is configured on profiles attached to your [Application](/documentation/platform/pki/applications/overview). Product Admins attach [profiles](/documentation/platform/pki/settings/profiles), and Application Admins configure enrollment methods on those profiles. </Info><Note>
Profiles are attached by Product Admins. If you don't see any profiles, ask your Product Admin to attach one.
</Note>
| Setting | Description |
|---------|-------------|
| **Auto-Renewal** | When enabled, eligible certificates are renewed server-side |
| **Renew Before Days** | How many days before expiration to trigger renewal |
<Info>
Auto-renewal only works for certificates with server-managed private keys. Certificates issued via CSR are not eligible.
</Info>
Once API enrollment is configured, you can issue certificates through the UI or API.
<Info> Certificates issued through API enrollment are tied to the Application + Profile pair. The profile determines certificate parameters (CA, policy, defaults), while the Application scopes the certificate to your service. </Info> <Tabs> <Tab title="Infisical UI"> <Steps> <Step title="Open certificate requests"> In your Application, go to the **Certificate Requests** tab and click **Request**. </Step> <Step title="Select profile and request method"> Choose your certificate profile and request method: | Method | Description |
|--------|-------------|
| **Managed** | Infisical generates and manages the private key |
| **CSR** | You provide your own Certificate Signing Request |
</Step>
<Step title="Fill in certificate details">
**For Managed requests:**
- Common Name and SANs
- Key algorithm and signature algorithm
- Validity period (TTL)
- Optional metadata tags
**For CSR requests:**
- Paste your PEM-encoded CSR
- Specify validity period (TTL)
<Note>
When using CSR, subject attributes and key algorithm are extracted from your CSR.
</Note>
</Step>
<Step title="Download the certificate">
After issuance, download the certificate body, chain, and private key (if managed).
<Warning>
The private key is only shown once. Store it securely immediately after issuance.
</Warning>
</Step>
</Steps>
Let Infisical generate the private key:
```bash
curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
-H 'Authorization: Bearer <access-token>' \
-H 'Content-Type: application/json' \
-d '{
"profileId": "<certificate-profile-id>",
"attributes": {
"commonName": "api.example.com",
"ttl": "90d",
"keyAlgorithm": "RSA_2048",
"altNames": [
{ "type": "DNS", "value": "api.example.com" },
{ "type": "DNS", "value": "www.api.example.com" }
]
},
"metadata": [
{ "key": "env", "value": "production" },
{ "key": "service", "value": "payments-api" }
]
}'
```
**Response:**
```json
{
"certificate": {
"certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
"certificateChain": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
"privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
"serialNumber": "123456789012345678",
"certificateId": "cert-abc123"
},
"certificateRequestId": "req-xyz789"
}
```
### Issue with your own CSR
Bring your own private key:
```bash
curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
-H 'Authorization: Bearer <access-token>' \
-H 'Content-Type: application/json' \
-d '{
"profileId": "<certificate-profile-id>",
"csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
"attributes": {
"ttl": "90d"
}
}'
```
<Note>
If the certificate requires approval, the response will include `certificateRequestId` but `certificate` will be `null`. Poll the [Get Certificate Request](/api-reference/endpoints/certificates/certificate-request) endpoint to check status.
</Note>
See the [Issue Certificate API reference](/api-reference/endpoints/certificates/create-certificate) for full details.
When auto-renewal is enabled, Infisical automatically renews certificates before they expire: