{
  "id": "certificates",
  "title": "Cluster certificates requests",
  "url": "https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/requests/cluster/certificates/",
  "summary": "Cluster certificates requests",
  "content": "\n| Method | Path | Description |\n|--------|------|-------------|\n| [GET](#get-cluster-certificates) | `/v1/cluster/certificates` | Get cluster certificates |\n| [PUT](#put-cluster-certificates) | `/v1/cluster/certificates` | Update cluster certificates |\n| [PUT](#put-cluster-update_cert) | `/v1/cluster/update_cert` | Update a cluster certificate (deprecated as of Redis Software version 7.22.2) |\n| [DELETE](#delete-cluster-certificate) | `/v1/cluster/certificates/{certificate_name}` | Delete cluster certificate |\n\n## Get cluster certificates {#get-cluster-certificates}\n\n\tGET /v1/cluster/certificates\n\nGet the cluster's certificates.\n\n#### Required permissions\n\n| Permission name |\n|-----------------|\n| [view_cluster_info](https://redis.io/docs/latest/operate/rs/references/rest-api/permissions#view_cluster_info) |\n\n### Request {#get-request} \n\n#### Example HTTP request\n\n\tGET /v1/cluster/certificates \n\n\n#### Request headers\n\n| Key | Value | Description |\n|-----|-------|-------------|\n| Host | cnm.cluster.fqdn | Domain name |\n| Accept | application/json | Accepted media type |\n\n### Response {#get-response} \n\nReturns a JSON object that contains the cluster's certificates and keys.\n\n#### Example JSON body\n\n```json\n{\n    \"api_cert\": \"-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----\",\n    \"api_key\": \"-----BEGIN RSA PRIVATE KEY-----...-----END RSA PRIVATE KEY-----\"\n    \"// additional certificates...\"\n}\n```\n\n### Status codes {#get-status-codes} \n\n| Code | Description |\n|------|-------------|\n| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |\n\n\n## Update cluster certificates {#put-cluster-certificates}\n\n```sh\nPUT /v1/cluster/certificates\n```\n\nReplaces multiple cluster certificates with the provided certificates on all nodes within the cluster. This endpoint validates all provided certificates before actually updating the cluster.\n\nSee the [certificates table](https://redis.io/docs/latest/operate/rs/security/certificates) for the list of cluster certificates and their descriptions.\n\n### Request {#put-certificates-request}\n\n#### Example HTTP request\n\n```sh\nPUT /v1/cluster/certificates\n```\n\n#### Example JSON body\n\n```json\n{\n  \"certificates\": [\n    {\n      \"name\": \"proxy\",\n      \"certificate\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n      \"key\": \"-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----\"\n    },\n    {\n      \"name\": \"api\",\n      \"certificate\": \"-----BEGIN CERTIFICATE-----\\n...\\n-----END CERTIFICATE-----\",\n      \"key\": \"-----BEGIN PRIVATE KEY-----\\n...\\n-----END PRIVATE KEY-----\"\n    }\n  ]\n}\n```\n\n#### Request headers\n\n| Key | Value | Description |\n|-----|-------|-------------|\n| Host | cnm.cluster.fqdn | Domain name |\n| Accept | application/json | Accepted media type |\n\n#### Request body\n\nInclude an array of [certificate objects](https://redis.io/docs/latest/operate/rs/references/rest-api/objects/certificates) in the request body.\n\n### Response {#put-certificates-response}\n\nReturns a `200 OK` status code if all certificates are successfully replaced across the entire cluster.\n\nIf the response returns a failed status code, you should retry updating the certificates in case the cluster is no longer in an optimal state.\n\n### Status codes {#put-certificates-status-codes}\n\n| Code | Description |\n|------|-------------|\n| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |\n| [400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#name-400-bad-request) | Failed, invalid certificate(s) |\n| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, unknown certificate(s) |\n| [406 Not Acceptable](https://www.rfc-editor.org/rfc/rfc9110.html#name-406-not-acceptable) | Failed, expired certificate(s) |\n| [409 Conflict](https://www.rfc-editor.org/rfc/rfc9110.html#name-409-conflict) | Failed, not all nodes have been updated |\n\n## Update cluster certificate {#put-cluster-update_cert}\n\n```sh\nPUT /v1/cluster/update_cert\n```\n\n\nThis REST API path is deprecated as of Redis Software 7.22.2 and will be removed in a future version. Use [`PUT /v1/cluster/certificates`](#put-cluster-certificates) instead.\n\n\nReplaces an existing certificate on all nodes within the cluster with a new certificate. The new certificate must pass validation before it can replace the old certificate.\n\nSee the [certificates table](https://redis.io/docs/latest/operate/rs/security/certificates) for the list of cluster certificates and their descriptions.\n\n### Request {#put-request}\n\n#### Example HTTP request\n\n```sh\nPUT /v1/cluster/update_cert\n```\n\n#### Example JSON body\n\n```json\n{\n    \"name\": \"certificate1\",\n    \"key\": \"-----BEGIN RSA PRIVATE KEY-----\\n[key_content]\\n-----END RSA PRIVATE KEY-----\",\n    \"certificate\": \"-----BEGIN CERTIFICATE-----\\n[cert_content]\\n-----END CERTIFICATE-----\",\n}\n```\n\nReplace `[key_content]` with the content of the private key and `[cert_content]` with the content of the certificate.\n\n### Response {#put-response}\n\nResponds with the `200 OK` status code if the certificate replacement succeeds across the entire cluster.\n\nOtherwise, retry the certificate update in case the failure was due to a temporary issue in the cluster.\n\n### Status codes {#put-status-codes}\n\n| Code | Description |\n|------|-------------|\n| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | No error |\n| [400 Bad Request](https://www.rfc-editor.org/rfc/rfc9110.html#name-400-bad-request) | Failed, invalid certificate. |\n| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, unknown certificate. |\n| [404 Not Found](https://www.rfc-editor.org/rfc/rfc9110.html#name-404-not-found) | Failed, invalid certificate. |\n| [406 Not Acceptable](https://www.rfc-editor.org/rfc/rfc9110.html#name-406-not-acceptable) | Failed, expired certificate. |\n| [409 Conflict](https://www.rfc-editor.org/rfc/rfc9110.html#name-409-conflict) | Failed, not all nodes have been updated. |\n\n\n## Delete cluster certificate {#delete-cluster-certificate}\n\n\tDELETE /v1/cluster/certificates/{string: certificate_name}\n\nRemoves the specified cluster certificate from both CCS and disk\nacross all nodes. Only optional certificates can be deleted through\nthis endpoint. See the [certificates table](https://redis.io/docs/latest/operate/rs/security/certificates) for the list of cluster certificates and their descriptions.\n\n### Request {#delete-request} \n\n#### Example HTTP request\n\n\tDELETE /v1/cluster/certificates/\u003ccertificate_name\u003e\n\n\n#### Request headers\n\n| Key | Value | Description |\n|-----|-------|-------------|\n| Host | cnm.cluster.fqdn | Domain name |\n| Accept | application/json | Accepted media type |\n\n### Response {#delete-response} \n\nReturns a status code that indicates the certificate deletion success or failure.\n\n### Status codes {#delete-status-codes} \n\n| Code | Description |\n|------|-------------|\n| [200 OK](https://www.rfc-editor.org/rfc/rfc9110.html#name-200-ok) | Operation successful |\n| [404 Not Found](https://www.rfc-editor.org/rfc/rfc9110.html#name-404-not-found) | Failed, requested deletion of an unknown certificate |\n| [403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#name-403-forbidden) | Failed, requested deletion of a required certificate |\n| [500 Internal Server Error](https://www.rfc-editor.org/rfc/rfc9110.html#name-500-internal-server-error) | Failed, error while deleting certificate from disk |\n",
  "tags": ["docs","operate","rs"],
  "last_updated": "2026-07-23T12:05:56-05:00",
  "children": [{"id":"rotate","summary":"Rotate cluster certificates requests","title":"Rotate cluster certificates requests","url":"https://redis.io/docs/latest/operate/rs/8.0/references/rest-api/requests/cluster/certificates/rotate/"}]
}