# Certificate Management (https://developer.godaddy.com/en/docs/references/rest/ans/certificate-management)

***

title: Certificate Management
description: ''
full: true
\_openapi:
preload:

* ./openapi-specs/specs/external/ans.yaml
  toc:
* depth: 2
  title: Retrieve agent identity certificates
  url: '#retrieve-agent-identity-certificates'
* depth: 2
  title: Submit identity certificate CSR
  url: '#submit-identity-certificate-csr'
* depth: 2
  title: Retrieve agent server certificates
  url: '#retrieve-agent-server-certificates'
* depth: 2
  title: Retrieve pending renewal status
  url: '#retrieve-pending-renewal-status'
* depth: 2
  title: Submit server certificate renewal request
  url: '#submit-server-certificate-renewal-request'
* depth: 2
  title: Cancel pending renewal
  url: '#cancel-pending-renewal'
* depth: 2
  title: Verify ACME challenges for pending server cert renewal
  url: '#verify-acme-challenges-for-pending-server-cert-renewal'
* depth: 2
  title: Get CSR status
  url: '#get-csr-status'
  structuredData:
  headings:
  * content: Retrieve agent identity certificates
    id: retrieve-agent-identity-certificates
  * content: Submit identity certificate CSR
    id: submit-identity-certificate-csr
  * content: Retrieve agent server certificates
    id: retrieve-agent-server-certificates
  * content: Retrieve pending renewal status
    id: retrieve-pending-renewal-status
  * content: Submit server certificate renewal request
    id: submit-server-certificate-renewal-request
  * content: Cancel pending renewal
    id: cancel-pending-renewal
  * content: Verify ACME challenges for pending server cert renewal
    id: verify-acme-challenges-for-pending-server-cert-renewal
  * content: Get CSR status
    id: get-csr-status
    contents:
  * content: Retrieves all identity certificates for the specified agent
    heading: retrieve-agent-identity-certificates
  * content: >
    Submits a Certificate Signing Request (CSR) for the agent's identity
    certificate.

    The response contains a "csrId", that is going to match the same field
    from CertificateResponse.
    heading: submit-identity-certificate-csr
  * content: Retrieves all TLS server certificates for the specified agent
    heading: retrieve-agent-server-certificates
  * content: |
    Returns current renewal status if one exists.
    Used for:
    * Checking if ACME verification is complete
    * Polling for certificate issuance (CSR path)
    * Retrieving challenges if client lost the POST response
    * Getting TLSA record after completion
      heading: retrieve-pending-renewal-status
  * content: >
    Initiates server certificate renewal. Returns ACME challenges; the
    caller must verify domain control via POST verify-acme.

    Supports two paths:

    * CSR path: RA issues a new certificate.

    * BYOC path: Client provides a certificate; RA validates and stores
      it.

    Only one pending renewal is allowed per agent (409 if one already
    exists).
    heading: submit-server-certificate-renewal-request
  * content: |
    Cancels the pending server certificate renewal for this agent.

    Use cases:

    * Client submitted incorrect CSR and wants to retry
    * Client wants to switch from CSR path to BYOC path (or vice versa)
    * Client no longer wishes to complete the renewal

    Side effects:

    * If renewal type is SERVER\_CSR, marks the associated CSR as REJECTED
    * Removes pending renewal from database
    * Client can immediately submit a new renewal request
      heading: cancel-pending-renewal
  * content: >
    Triggers ACME validation for a pending server certificate renewal.

    Verifies:

    * DNS-01 challenge (TXT record at \_acme-challenge.)

    * HTTP-01 challenge (file at /.well-known/acme-challenge/)

    Response depends on renewal type:

    * SERVER\_CSR: Returns 202 (asynchronous certificate issuance).

    * SERVER\_BYOC: Returns 200 (certificate stored; TLSA record ready for
      DNS update).
      heading: verify-acme-challenges-for-pending-server-cert-renewal
  * content: >
    Retrieves the current status of a Certificate Signing Request (CSR).

    This endpoint allows clients to check if a CSR has been signed, is
    still pending,

    or has been rejected. The failureReason field provides additional
    context when

    a CSR is rejected.
    heading: get-csr-status

***