---
title: "tlscertificate create"
slug: "tlscertificate-create"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/tlscertificate-create"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tlscertificate create

This command adds a TLS certificate to the VMS.

If you're going to use options that upload files, ensure that the files to be uploaded are available via VAST CLI on the management CNode. To do so:

1. Identify the CNode that hosts the VMS by running the `ssh <username>@<CNode> "docker ps | grep vast_vms"` command for each CNode. The VMS CNode will produce output similar to:

```plaintext
899662f162a2   vastdata.registry.local:5000/dev/orion:release-5-4-0-1947156-vms      "/usr/bin/dumb-init …"   3 days ago    Up 3 days              vast_vms
```
2. Copy the file to be uploaded to the `/vast/bundles` directory on the VMS CNode, for example:

```plaintext
scp <local filepath> <username>@<CNode>:/vast/bundles/
```

## Usage

```plaintext
tlscertificate create {--ca-certificate TEXT|--ca-certificate-file FILEPATH}
                      --protocols NFS|KAFKA
                     [--ca-certificate-name NAME]
                     [--revocation-list TEXT|--revocation-file FILEPATH]
                     [--revocations-name NAME]
                     [--tenant-id ID]|[--tenant-associate-param SAN]
```

## Required Parameters

| `--ca-certificate TEXT` or `--ca-certificate-file FILEPATH` | Supply the certificate as plain text on the `--ca-certificate` option, or use the `-ca-certificate-file` option to specify the path to the certificate file. When uploading a file, the file size cannot exceed 1MB. |
| --- | --- |
| `--protocols NFS\|KAFKA` | Determines the protocol to be authenticated with the certificate. Valid values: - `NFS` for NFSv3 and NFSv4 connections. - `KAFKA` for Kafka connections. |

## Options

| `--ca-certificate-name NAME` | Sets a name for the certificate specified on `--ca-certificate` or `--ca-certificate-file`. |
| --- | --- |
| `--revocation-list TEXT` | Use this option to supply the list of revoked certificates as plain text. |
| `--revocation-file FILEPATH` | Use this option to specify a path to the CRL file containing the list of revoked certificates. |
| `--revocations-name NAME` | Sets a name for the revocation list specified on `--revocation-list` or `--revocation-file`. |
| `--tenant-id ID` | If a tenant ID is included in the command, the certificate will be used for tenant-level authentication (applied for the particular tenant only). If no tenant ID is specified, the certificate will be used for cluster-wide authentication (applied to all tenants). The `tenant-id` option cannot be specified together with `--tenant-associate-param`. |
| `--tenant-associate-param OID` | If specified, the certificate will be used for cluster-wide [mTLS authentication of NFS connections](/docs-5-5/docs/mtls-authentication-for-nfs). This option determines an `otherName` field within the certificate's Subject Alternative Name (SAN) extension that will be used for tenant identification. The cluster will compare the value within this field to the tenant's mTLS identifier. Specify the field with its Object Identifier (OID), for example: `1.3.6.1.2.1.25.2.1.2.3.4.5.6.100`. This value must be unique across the SAN `otherName` fields. The `--tenant-associate-param` option cannot be specified together with `--tenant-id`. |

## Example

To add a CA certificate to be used to authenticate NFS connections, together with a CRL file:

```plaintext
vcli: admin> tlscertificate create --protocols NFS --ca-certificate-file /vast/bundles/full-CA.pem --revocation-file /vast/bundles/66.crl
```