Issue Client Certificate
Issue a certificate for one device from a CA managed by ngris, for the device's certificate signing request (CSR). The device makes its own key and keeps it: only the signing request is sent, never the key. Every endpoint that trusts the CA then accepts the device.
The ngris client-cert request --ca <CA name> --name <device> command does all of it on the device: it makes the key and the signing request, calls this route and writes <device>.crt, <device>.key and ca.pem. To renew a device, issue a new certificate with the same name (with the CLI, into a new folder: --out-dir); the old one keeps working until it expires or you revoke it.
A certificate file for a browser or phone (with its key and a password) is made in the dashboard only: Security → mTLS → Client certificates → New certificate → Download for a browser or phone. Through the API, send a signing request.
Plan-gated: needs the managed_client_ca entitlement. Each active certificate counts toward plan_limits.max_active_client_certificates on GET /v1/account/plan (0 means none).
Path parameters
Request body
laptop-anna: 1 to 64 letters, digits, dots, dashes or underscores. It becomes the certificate's subject (CN=laptop-anna) and your app receives it in X-Ngris-Client-Cert-Name. Names don't have to be unique.1 to 397. Default 90.-----BEGIN CERTIFICATE REQUEST-----. One request, at most 16 KiB. Only its key is used: the certificate's name, lifetime and uses are set by ngris.Response (201 Created)
Errors
days out of range, a missing or unreadable signing request, or a CA that was uploaded (ngris only issues from the CAs it manages). The message says what to fix.cert:write permission; the plan doesn't include managed_client_ca ("code": "entitlement_required"); or the account has reached its plan's number of active certificates."code": "quota_paused": the CA is paused because the account has more managed CAs than its plan allows. It resumes on its own once the account has room.Retry-After says when to try again."Managed client certificates aren't available right now." Try again later.