API Enrollment

New to Certificate Manager? Start with Issue Your First Certificate.

API enrollment is the default method for issuing certificates through the Infisical UI, the Infisical Agent, or direct API calls. It’s the most flexible option — use it for manual one-off requests, automated pipelines, or server-driven auto-renewal where Infisical manages the certificate lifecycle.

API enrollment is configured on profiles attached to your Application. Product Admins attach profiles, and Application Admins configure enrollment methods on those profiles.

When to Use API Enrollment

Custom Integrations

Build certificate issuance into your own tooling and automation.

CI/CD Pipelines

Issue certificates as part of deployment workflows.

Server-Driven Renewal

Let Infisical automatically renew certificates before expiration.

One-Off Requests

Issue certificates manually through the UI when needed.

Configure API Enrollment

Navigate to your Application

Go to Certificate Manager → Applications and select your Application.

Configure enrollment on an attached profile

Go to the Settings tab and find the Certificate Profiles section. Click Configure on the profile you want to enable API enrollment for.

Profiles are attached by Product Admins. If you don’t see any profiles, ask your Product Admin to attach one.

Add API enrollment

In the modal, click Add enrollment method and select API.

Configure auto-renewal (optional)

Enable Auto-Renewal By Default to have Infisical automatically renew certificates before expiration.

Setting	Description
Auto-Renewal	When enabled, eligible certificates are renewed server-side
Renew Before Days	How many days before expiration to trigger renewal

Auto-renewal only works for certificates with server-managed private keys. Certificates issued via CSR are not eligible.

Issue a Certificate

Once API enrollment is configured, you can issue certificates through the UI or API.

Certificates issued through API enrollment are tied to the Application + Profile pair. The profile determines certificate parameters (CA, policy, defaults), while the Application scopes the certificate to your service.

Infisical UI
API

Open certificate requests

In your Application, go to the Certificate Requests tab and click Request.

Select profile and request method

Choose your certificate profile and request method:

Method	Description
Managed	Infisical generates and manages the private key
CSR	You provide your own Certificate Signing Request

Fill in certificate details

For Managed requests:

Common Name and SANs
Key algorithm and signature algorithm
Validity period (TTL)
Optional metadata tags

For CSR requests:

Paste your PEM-encoded CSR
Specify validity period (TTL)

When using CSR, subject attributes and key algorithm are extracted from your CSR.

Download the certificate

After issuance, download the certificate body, chain, and private key (if managed).

The private key is only shown once. Store it securely immediately after issuance.

Issue with managed key

Let Infisical generate the private key:

curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
  -H 'Authorization: Bearer <access-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "profileId": "<certificate-profile-id>",
    "attributes": {
      "commonName": "api.example.com",
      "ttl": "90d",
      "keyAlgorithm": "RSA_2048",
      "altNames": [
        { "type": "DNS", "value": "api.example.com" },
        { "type": "DNS", "value": "www.api.example.com" }
      ]
    },
    "metadata": [
      { "key": "env", "value": "production" },
      { "key": "service", "value": "payments-api" }
    ]
  }'

Response:

{
  "certificate": {
    "certificate": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
    "certificateChain": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
    "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----",
    "serialNumber": "123456789012345678",
    "certificateId": "cert-abc123"
  },
  "certificateRequestId": "req-xyz789"
}

Issue with your own CSR

Bring your own private key:

curl -X POST 'https://app.infisical.com/api/v1/cert-manager/certificates' \
  -H 'Authorization: Bearer <access-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "profileId": "<certificate-profile-id>",
    "csr": "-----BEGIN CERTIFICATE REQUEST-----\n...\n-----END CERTIFICATE REQUEST-----",
    "attributes": {
      "ttl": "90d"
    }
  }'

If the certificate requires approval, the response will include certificateRequestId but certificate will be null. Poll the Get Certificate Request endpoint to check status.

See the Issue Certificate API reference for full details.

Server-Driven Auto-Renewal

When auto-renewal is enabled, Infisical automatically renews certificates before they expire:

Infisical monitors certificate expiration dates
When a certificate is within the “Renew Before Days” threshold, Infisical issues a new certificate
The new certificate is pushed to any configured certificate syncs

Auto-renewal only works for certificates with server-managed keys. Certificates issued via CSR must be renewed by the client.

What’s Next?

ACME Enrollment

Use Certbot, cert-manager, or other ACME clients.

Certificate Syncs

Push certificates to AWS ACM, Azure Key Vault, and more.

Managing Certificates

View, renew, and revoke certificates in your Application.

Alerting

Get notified when certificates are about to expire.

Certificate Management

Product Reference

Reference

When to Use API Enrollment

Custom Integrations

CI/CD Pipelines

Server-Driven Renewal

One-Off Requests

Configure API Enrollment

Issue a Certificate

Issue with managed key

Issue with your own CSR

Server-Driven Auto-Renewal

What’s Next?

ACME Enrollment

Certificate Syncs

Managing Certificates

Alerting

Certificate Management

Product Reference

Reference

Documentation Index

​When to Use API Enrollment

Custom Integrations

CI/CD Pipelines

Server-Driven Renewal

One-Off Requests

​Configure API Enrollment

​Issue a Certificate

​Issue with managed key

​Issue with your own CSR

​Server-Driven Auto-Renewal

​What’s Next?

ACME Enrollment

Certificate Syncs

Managing Certificates

Alerting

When to Use API Enrollment

Configure API Enrollment

Issue a Certificate

Issue with managed key

Issue with your own CSR

Server-Driven Auto-Renewal

What’s Next?