Azion CLI csr

Azion CLI commands that create, describe, and delete certificate signing requests (CSRs), with every flag, its type, and its default.

Last updated

View as Markdown Agent setup

The Azion CLI csr commands create, describe, and delete certificate signing requests (CSRs) in Certificate Manager. A CSR is the request you submit to a certificate authority (CA) to obtain a certificate, and the CLI prints it when it creates one. Azion stores a CSR as a digital certificate with status pending, so the CSR and your certificates share one set of IDs. The CLI has no command that lists or updates a CSR: azion list digital-certificate lists it with your certificates, and the digital-certificate commands manage the entry. The options every command accepts, such as --format, --out, and -y, are on Global options.

Create

azion create csr creates a CSR with the subject and the key algorithm you pass, and prints the request:

azion create csr [flags]
FlagShortTypeDefaultDescription
--alternative-names—string—Comma-separated list of Subject Alternative Names (SANs).
--certificate-type—string—Type of the certificate, such as edge_certificate or trusted_ca_certificate. Without it, the CSR gets type edge_certificate.
--common-name—string—Common Name (CN) of the certificate subject.
--country—string—Required unless --file is set. Country code of the certificate subject, such as US or BR. Without it, the command asks for the country code.
--email—string—Contact email address of the certificate subject.
--file—string—Path to a JSON file with the attributes of the CSR. Use - to read the JSON from standard input.
--key-algorithm—string—Algorithm of the key: rsa_2048, rsa_4096, or ecc_384.
--locality—string—City or locality of the certificate subject.
--name—string—Name that identifies the CSR.
--organization—string—Organization name of the certificate subject.
--organization-unity—string—Organizational unit of the certificate subject.
--state—string—State or province of the certificate subject.

A --key-algorithm value outside the three listed is refused with "rsa_1024" is not a valid choice., and a --name that a certificate of your account already uses is refused with This field must be unique. Every name in --common-name and --alternative-names must belong to a domain your account has permission for. The bounds of each field are in Certificates.

This command creates a CSR named my-csr for example.com and www.example.com, with a 2048-bit RSA key:

azion create csr --name my-csr --common-name example.com --country BR --state 'Rio Grande do Sul' --locality 'Porto Alegre' --organization 'Example Corp' --organization-unity Docs --email admin@example.com --alternative-names 'www.example.com' --key-algorithm rsa_2048

The command prints the ID of the CSR, then the request in PEM format, which ends with -----END CERTIFICATE REQUEST-----. The output opens with these lines:

Text
01Created Certificate Signing Request with ID 123481
02-----BEGIN CERTIFICATE REQUEST-----

Describe

azion describe csr prints the settings and the status of one CSR, and the request itself:

azion describe csr [flags]
FlagShortTypeDefaultDescription
--csr-id—int—ID of the CSR to describe.

This command describes the CSR with ID 123481:

azion describe csr --csr-id 123481

The command prints the fields of the CSR, then the request under CSR:, which ends with -----END CERTIFICATE REQUEST-----. The output opens with these lines:

Text
01ID: 123481
02Name: my-csr
03Issuer: null
04Subject Names: []
05Validity: null
06Type: edge_certificate
07Managed: false
08Status: pending
09Status Detail:
10Challenge:
11Authority:
12Key Algorithm: rsa_2048
13Active: true
14Last Editor: you@example.com
15Created At: "2026-01-01T12:00:00.763397Z"
16Last Modified: "2026-01-01T12:00:00.763397Z"
17Renewed At: null
18
19CSR:
20-----BEGIN CERTIFICATE REQUEST-----

With --format json, the command prints the full object: active, authority, certificate, challenge, created_at, csr, id, issuer, key_algorithm, last_editor, last_modified, managed, name, product_version, renewed_at, status, status_detail, subject_name, type, and validity. These are the keys of a digital certificate. The csr value holds the request with each line break written as \n, and certificate stays null. With --out csr-describe.json, the command writes the same object to that file and prints File successfully written to: csr-describe.json.

azion describe csr also accepts the ID of a certificate that did not come from a CSR, and prints that certificate. An ID that does not exist fails with Error: Failed to get the Certificate Signing Request: The given ID or API's endpoint doesn't exist or isn't available., followed by a hint to check your settings.

Delete

azion delete csr deletes a CSR:

azion delete csr [flags]
FlagShortTypeDefaultDescription
--csr-id—int—ID of the CSR to delete.

This command deletes the CSR with ID 123481:

azion delete csr --csr-id 123481

The command confirms the deletion:

Certificate Signing Request 123481 was successfully deleted

Use a JSON file

azion create csr reads the attributes of the CSR from a JSON file with --file. In the file, --common-name, --organization-unity, and --key-algorithm become the keys common_name, organization_unity, and key_algorithm.

This file creates a CSR named my-csr-ecc for api.example.com with the ecc_384 key algorithm:

JSON
01{
02 "name": "my-csr-ecc",
03 "common_name": "api.example.com",
04 "country": "BR",
05 "state": "Rio Grande do Sul",
06 "locality": "Porto Alegre",
07 "organization": "Example Corp",
08 "organization_unity": "Docs",
09 "email": "admin@example.com",
10 "key_algorithm": "ecc_384"
11}

Pass the file to the create command:

azion create csr --file csr-create.json

The command prints the ID of the CSR, then the request in PEM format. The output opens with these lines:

Text
01Created Certificate Signing Request with ID 123482
02-----BEGIN CERTIFICATE REQUEST-----
Global options

The options every command accepts, such as --format, --out, and -y.

Certificates

The fields of a CSR, its bounds, and how to add the certificate the CA signs.

Azion CLI digital-certificate

The commands that list your CSRs with your certificates and manage each entry.

Resource commands

Every resource the CLI manages, and the verbs each one supports.