---
title: "tlscertificate modify"
slug: "tlscertificate-modify"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/tlscertificate-modify"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# tlscertificate modify

This command modifies a TLS certificate.

If you're going to use options that upload files, ensure that the files to be uploaded are available via VAST CLI on the management CNode. To do so:

1. Identify the CNode that hosts the VMS by running the `ssh <username>@<CNode> "docker ps | grep vast_vms"` command for each CNode. The VMS CNode will produce output similar to:

```plaintext
899662f162a2   vastdata.registry.local:5000/dev/orion:release-5-4-0-1947156-vms      "/usr/bin/dumb-init …"   3 days ago    Up 3 days              vast_vms
```
2. Copy the file to be uploaded to the `/vast/bundles` directory on the VMS CNode, for example:

```plaintext
scp <local filepath> <username>@<CNode>:/vast/bundles/
```

## Usage

```plaintext
tlscertificate modify --id ID
                      --protocols NFS|KAFKA
                     [--ca-certificate TEXT|--ca-certificate-file FILEPATH
                     [--ca-certificate-name NAME]
                     [--revocation-list TEXT|--revocation-file FILEPATH]
                     [--revocations-name NAME]
                     [--tenant-associate-param OID]
```

## Required Parameters

| `--id ID` | The ID of the TLS certificate you want to modify. |
| --- | --- |
| `--protocols NFS\|KAFKA` | Determines the protocol to be authenticated with this certificate. Valid values: - `NFS` for NFSv3 and NFSv4 connections. - `KAFKA` for Kafka connections. |

## Options

| `--ca-certificate TEXT` | Use this option to supply the certificate as plain text. |
| --- | --- |
| `--ca-certificate-file&nbsp;FILEPATH` | Use this option to upload the certificate from a file. The file size cannot exceed 1MB. |
| `--ca-certificate-name NAME` | Sets a name for the certificate specified on `--ca-certificate` or `--ca-certificate-file`. |
| `--revocation-list TEXT` | Use this option to supply the list of revoked certificates as plain text. |
| `--revocation-file FILEPATH` | Use this option to specify a path to the CRL file containing the list of revoked certificates. |
| `--revocations-name NAME` | Sets a name for the revocation list specified on `--revocation-list` or `--revocation-file`. |
| `--tenant-associate-param OID` | If specified, the certificate will be used for cluster-wide [mTLS authentication of NFS connections](/docs-5-5/docs/mtls-authentication-for-nfs). This option determines an `otherName` field within the certificate's Subject Alternative Name (SAN) extension that will be used for tenant identification. The cluster will compare the value within this field to the tenant's mTLS identifier. Specify the field with its Object Identifier (OID), for example: `1.3.6.1.2.1.25.2.1.2.3.4.5.6.100`. This value must be unique across the SAN `otherName` fields. |

## Example

To add a CRL file to TLS certificate with ID 12:

```plaintext
vcli: admin> tlscertificate modify --id 12 --revocation_file /home/runner/crl.pem
```