> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Uploading your own certificate

> Store certificate material you already hold — and what you take on by doing it.

## Bringing your own certificate

Store material you already hold. There is no challenge and no wait — the
certificate is `active` immediately.

<Tabs>
  <Tab title="Console">
    On **Create Certificate**, switch the source to **Provide your own
    certificate**, then paste the **Certificate** (PEM-encoded), the
    **Private Key**, and optionally the **Certificate Chain**.
  </Tab>

  <Tab title="API">
    Set `source: "uploaded"`. The response is **`201`** with the certificate
    already `active`.
  </Tab>

  <Tab title="CLI">
    ```bash theme={null}
    basaltic certificate create \
      --name prod-frontend --domains example.com --source uploaded \
      --certificate-pem "$(cat cert.pem)" \
      --private-key-pem "$(cat key.pem)" \
      --chain-pem "$(cat chain.pem)"
    ```
  </Tab>

  <Tab title="Go">
    ```go theme={null}
    crt, err := certificate.New(cfg).CreateCertificate(ctx, &certificate.CertificateIssueRequest{
        Name:           "prod-frontend",
        Domains:        []string{"example.com"},
        Source:         basaltic.String("uploaded"),
        CertificatePEM: basaltic.String(string(certPEM)),
        PrivateKeyPEM:  basaltic.String(string(keyPEM)),
        ChainPEM:       basaltic.String(string(chainPEM)),
    })
    ```
  </Tab>
</Tabs>

<CodeGroup>
  ```json Issued by us (default) theme={null}
  {
    "name": "prod-frontend",
    "domains": ["example.com", "www.example.com"],
    "key_algorithm": "ecdsa-p256"
  }
  ```

  ```json Uploaded theme={null}
  {
    "name": "prod-frontend",
    "domains": ["example.com"],
    "source": "uploaded",
    "certificate_pem": "-----BEGIN CERTIFICATE-----\n...",
    "chain_pem": "-----BEGIN CERTIFICATE-----\n...",
    "private_key_pem": "-----BEGIN PRIVATE KEY-----\n..."
  }
  ```
</CodeGroup>

`certificate_pem` and `private_key_pem` are both required when uploading;
`chain_pem` is optional.

<Warning>
  **Uploaded certificates are never renewed.** Renewal only covers what the
  platform issued, because only then does it hold the authority relationship
  needed to reissue. Track the expiry of an uploaded certificate yourself and
  upload a replacement before `expires_at`.
</Warning>