Rotate ICP-Brasil certificate
Prerequisite: this is the first step of the onboarding chain (certificate → readiness → connectivity-test → submit); rotate the certificate before activating it (see activateCertificate), checking readiness (see getReadiness), or submitting any operation. Performs an evidence-emitting hot-reload of the ICP-Brasil/RSFN certificate pair. The new certificate must already exist on disk under the configured base path; this endpoint only swaps the in-memory pointer and emits an audit record. Idempotent — replaying the same X-Idempotency key with the same body returns the cached response. The response NEVER includes the private key path or key material.
Authorizations
JWT bearer token issued by the identity provider.
Headers
Idempotency key (primary).
Idempotency key (legacy alias for X-Idempotency).
Idempotency key TTL in seconds (overrides the configured default).
Body
Operator-supplied reference to the new certificate material (filesystem path or secrets-manager URI), validated against the configured cert directory before any read.
1 - 2048"/etc/lerian/certs/2026-q2/icp-brasil.crt"
Operator-supplied reference to the new private-key material (filesystem path or secrets-manager URI), validated against the configured cert directory before any read.
1 - 2048"/etc/lerian/certs/2026-q2/icp-brasil.key"
Optional operator rationale recorded in the audit evidence (max 512 chars).
512"Quarterly rotation per ICP-Brasil policy"
Response
OK
UUID of the audit record written for this rotation.
"a1b2c3d4-e5f6-7890-abcd-ef1234567890"
State of the certificate after the rotation hot-reload.
Request-scoped correlation identifier echoing X-Request-ID, for pivoting from response to trace.
"req-7a3f9c2e"
Optional post-rotation readiness summary; omitted when readiness lookup is unavailable.

