# Litmus Edge Manager 3.0.x - Admin Console: CA Certificates

## List all instance-level CA certificates

**GET** `{{LEM_adminURL}}/admin/v1/ca-certificates`

# List all instance-level CA certificates

Lists the instance-level CA certificates trusted across the installation. These CAs are distributed to edge devices so they can validate server certificates.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/ca-certificates
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

A list of CA certificate records (id, subject, issuer, validity).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
[]
```

---

## Upload CA certificate(s) as a PEM file

**POST** `{{LEM_adminURL}}/admin/v1/ca-certificates/upload`

# Upload CA certificate(s) as a PEM file

Uploads one or more CA certificates from a PEM file and stores them as instance-level trusted CAs. Use `Preview` first to validate the file.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/ca-certificates/upload
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

The PEM file contents (one or more concatenated CA certificates).
## Response

The stored CA certificate record(s).
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---

## Preview CA certificate(s) from a PEM file without storing

**POST** `{{LEM_adminURL}}/admin/v1/ca-certificates/preview`

# Preview CA certificate(s) from a PEM file without storing

Parses a PEM file and returns the CA certificates it contains without storing anything. Use to validate and inspect a file before `Upload`.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/ca-certificates/preview
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Request body

The PEM file contents to parse.
## Response

Parsed certificate details (subject, issuer, validity) for each CA found.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---

## Download a CA certificate as PEM

**GET** `{{LEM_adminURL}}/admin/v1/ca-certificates/{{id}}/download`

# Download a CA certificate as PEM

Downloads a single stored instance-level CA certificate as a PEM file.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/ca-certificates/{id}/download
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| `id` | path | The CA certificate id. |
## Response

The certificate in PEM format.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---

## Delete an instance-level CA certificate

**DELETE** `{{LEM_adminURL}}/admin/v1/ca-certificates/{{id}}`

# Delete an instance-level CA certificate

Deletes a stored instance-level CA certificate. Devices will no longer trust certificates signed by this CA after the change propagates.
## Endpoint

```http
DELETE {{LEM_adminURL}}/admin/v1/ca-certificates/{id}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| `id` | path | The CA certificate id. |
## Response

`ApiResponse` on success.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


---