# Upload a new certificate to the MDM certificate repository

Upload a certificate to the MDM certificate repository. The certificate file must first be uploaded via the file upload API to obtain a file_id. Supports replacing existing certificates and optionally redistributing associated profiles.

## Endpoint

**POST** `/api/v1/mdm/profiles/certificates`

## Request URL

`https://{server-hostname}:8383/api/v1/mdm/profiles/certificates`

## Scope

`MDMDeviceMgmt.CREATE`

## Header

`Authorization: d92d4xxxxxxxxxxxxx15f52`

## Request Parameters

### Request Headers

- **Content-Type** `string` **Mandatory**: `application/json`
- **Accept** `string` **Mandatory**: `application/json`

### Request Body

`application/json`

- **certificate_file_upload** `long` **Mandatory**: File ID of the certificate file obtained from the [file upload API](https://www.manageengine.com/products/desktop-central/help/api/onpremise/files-upload-file-ems.html)
- **certificate_password** `string` Optional: Password for the certificate. Required for identity certificates (.p12, .pfx). Maximum 250 characters
- **certificate_type** `integer` Optional: Type of certificate. Default 0 (CA uploaded certificate)
- **old_certificate_id** `long` Optional: Certificate ID of an existing certificate to replace. When provided, the new certificate replaces the old one in all associated profiles. Obtain from the [Get Certificates](https://www.manageengine.com/products/desktop-central/help/api/onpremise/certificates-get-certificates.html) response
- **redistribute_profiles** `boolean` Optional: If true and old_certificate_id is provided, automatically redistributes profiles that used the old certificate. Default false

## Sample Request

```curl
curl --request POST \
  --url https://appdomain/api/v1/mdm/profiles/certificates \
  --header 'Accept: application/json' \
  --header 'Authorization:  d92d4xxxxxxxxxxxxx15f52' \
  --header 'Content-Type: application/json' \
  --data '{"certificate_password":"mySecurePassword","certificate_type":0,"old_certificate_id":0,"certificate_file_upload":9210,"redistribute_profiles":false}'
```

## Sample Request Body

### Upload a new CA certificate to the repository

```json
{
  "certificate_password": "mySecurePassword",
  "certificate_type": 0,
  "old_certificate_id": 0,
  "certificate_file_upload": 9210,
  "redistribute_profiles": false
}
```

### Replace an existing certificate and redistribute associated profiles

```json
{
  "certificate_password": "newPassword",
  "certificate_type": 0,
  "old_certificate_id": 9007199254741000,
  "certificate_file_upload": 9211,
  "redistribute_profiles": true
}
```

## Response Parameters

### HTTP Code 200

Response Body — `application/json`

- **certificate_id** `long`: Unique identifier of the newly created certificate
- **certificate_name** `string`: Display name of the certificate (extracted from the certificate CN)
- **certificate_serial_number** `string`: Serial number of the certificate
- **certificate_subject_dn** `string`: Full Subject Distinguished Name
- **certificate_issuer_dn** `string`: Full Issuer Distinguished Name
- **certificate_notbefore** `string`: Certificate validity start time in Unix milliseconds
- **certificate_notafter** `string`: Certificate expiry time in Unix milliseconds
- **issuer_org** `string`: Organization name of the issuer
- **issuer_name** `string`: Common Name (CN) of the issuer
- **days_to_expire** `integer`: Number of days until certificate expiry

## Possible Response Codes

- **200**: HTTP code

## Sample Response: HTTP 200

### Certificate successfully uploaded with parsed details

```json
{
  "certificate_id": 9007199254740996,
  "certificate_issuer_dn": "C=US,O=Apple Inc.,OU=Apple Certification Authority,CN=Apple Application Integration 2 Certification Authority",
  "days_to_expire": 364,
  "issuer_org": "Apple Inc.",
  "certificate_notbefore": "1542767387054",
  "certificate_subject_dn": "C=US, CN=APSP:dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a, UID=com.apple.mgmt.External.dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a",
  "certificate_name": "APSP:dee10de6-00c5-4860-b6ec-3ed5ca4a8b3a",
  "certificate_serial_number": "3977386725918465264",
  "certificate_notafter": "1574303387054",
  "issuer_name": "Apple Application Integration 2 Certification Authority"
}
```

![](https://www.zohowebstatic.com/sites/zweb/images/people/ico-help.png)

**Duration:** 1 minute | **Threshold:** 30 | **Lock period:** 5 minutes

Duration - Time window for the threshold.  
Threshold - Number of API calls allowed within the specified duration.  
Lock Period - Wait time before consecutive API requests.