# Upload a new certificate to the MDM certificate repository

Upload a certificate to the MDM certificate repository. The certificate file must first be uploaded via the file upload API to obtain a file_id. Supports replacing existing certificates and optionally redistributing associated profiles.

## Endpoints

**POST** `/api/v1/mdm/profiles/certificates`

## Request URL

`https://{serverurl}/api/v1/mdm/profiles/certificates`

## Scope

`MDMOnDemand.MDMDeviceMgmt.CREATE`

## Header

```
Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52
```

## Request Body

**Content-Type:** `application/json`  
**Type:** JSON object

### Parameters

- **certificate_file_upload** (long) — Mandatory  
  File ID of the certificate file obtained from the [file upload API](https://www.manageengine.com/mobile-device-management/files-upload-file-ems.html)

- **certificate_password** (string) — Optional  
  Password for the certificate. Required for identity certificates (.p12, .pfx). Maximum 250 characters

- **certificate_type** (integer) — Optional  
  Type of certificate. Default 0 (CA uploaded certificate)

- **old_certificate_id** (long) — Optional  
  Certificate ID of an existing certificate to replace. When provided, the new certificate replaces the old one in all associated profiles. Obtain from the [Get Certificates](https://www.manageengine.com/mobile-device-management/certificates-get-certificates.html) response

- **redistribute_profiles** (boolean) — Optional  
  If true and old_certificate_id is provided, automatically redistributes profiles that used the old certificate. Default false

## Sample Request

### Curl

```bash
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/certificates \
  --header 'Authorization: Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52' \
  --header 'content-type: application/json' \
  --data '{"certificate_file_upload":9210}'
```

### Java

```java
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.io.IOException;
import java.net.http.HttpTimeoutException;

public class Main {
  public static void main(String[] args) {

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://appdomain/api/v1/mdm/profiles/certificates"))
        .header("content-type", "application/json")
        .header("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
        .method("POST", HttpRequest.BodyPublishers.ofString("{\"certificate_file_upload\":9210}"))
        .build();
    HttpResponse<string> response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString());
    System.out.println(response.body());

  }
}
```

### Python

```python
import http.client

conn = http.client.HTTPSConnection("appdomain")

payload = "{\"certificate_file_upload\":9210}"

headers = {
    'content-type': "application/json",
    'Authorization': "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52"
    }

conn.request("POST", "/api/v1/mdm/profiles/certificates", payload, headers)

res = conn.getresponse()
data = res.read()

print(data.decode("utf-8"))
```

### Deluge

```javascript
headersMap = Map();
headersMap.put("Content-Type", "application/json");
headersMap.put("Accept", "application/json");

data=Map();
data.put("certificate_file_upload","1");

response = invokeUrl
[
    url: "https://appDomain/api/v1/mdm/profiles/certificates"
    type: POST
    headers: headersMap
    
    body: data
    connection: connection_name
]

info response;
```

### PowerShell

```powershell
$headers=@{}
$headers.Add("content-type", "application/json")
$headers.Add("Authorization", "Zoho-oauthtoken  d92d4xxxxxxxxxxxxx15f52")
$response = Invoke-WebRequest -Uri 'https://appdomain/api/v1/mdm/profiles/certificates' -Method POST -Headers $headers -ContentType 'application/json' -Body '{"certificate_file_upload":9210}'
```

## Sample Request Body

### Upload a new CA certificate to the repository

```json
{
  "certificate_password": "mySecurePassword",
  "certificate_type": 0,
  "old_certificate_id": 0,
  "certificate_file_upload": 9210,
  "redistribute_profiles": false
}
```

### Replace an existing certificate and redistribute associated profiles

```json
{
  "certificate_password": "newPassword",
  "certificate_type": 0,
  "old_certificate_id": 9007199254741000,
  "certificate_file_upload": 9211,
  "redistribute_profiles": true
}
```

## Response Parameters

### HTTP 200

**Response Body:** `application/json`  
**Type:** JSON object

#### Attributes

- **certificate_id** (long)  
  Unique identifier of the newly created certificate

- **certificate_name** (string)  
  Display name of the certificate (extracted from the certificate CN)

- **certificate_serial_number** (string)  
  Serial number of the certificate

- **certificate_subject_dn** (string)  
  Full Subject Distinguished Name

- **certificate_issuer_dn** (string)  
  Full Issuer Distinguished Name

- **certificate_notbefore** (string)  
  Certificate validity start time in Unix milliseconds

- **certificate_notafter** (string)  
  Certificate expiry time in Unix milliseconds

- **issuer_org** (string)  
  Organization name of the issuer

- **issuer_name** (string)  
  Common Name (CN) of the issuer

- **days_to_expire** (integer)  
  Number of days until certificate expiry

## Sample Response: HTTP 200

```json
{
  "certificate_id": 9007199254740996,
  "certificate_issuer_dn": "C=US,O=Apple Inc.,OU=Apple Certification Authority,CN=Apple Application Integration 2 Certification Authority",
  "days_to_expire": 364,
  "issuer_org": "Apple Inc.",
  "certificate_notbefore": "1542767387054",
  "certificate_subject_dn": "C=US, CN=APSP:dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a, UID=com.apple.mgmt.External.dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a",
  "certificate_name": "APSP:dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a",
  "certificate_serial_number": "3977386725918465264",
  "certificate_notafter": "1574303387054",
  "issuer_name": "Apple Application Integration 2 Certification Authority"
}
```

## Possible HTTP Status Codes

- **200** — HTTP code

## Rate Limit

**Duration:** 1 minute  
**Threshold:** 30  
**Lock period:** 5 minutes  

- Duration — Time window for the threshold.  
- Threshold — Number of API calls allowed within the specified duration.  
- Lock Period — Wait time before consecutive API requests.