diff --git a/openapi/wicketd.json b/openapi/wicketd.json
index 729ac7bafdb..da3b5c993a7 100644
--- a/openapi/wicketd.json
+++ b/openapi/wicketd.json
@@ -440,42 +440,6 @@
         }
       }
     },
-    "/rack-setup/config/cert": {
-      "post": {
-        "summary": "Add an external certificate.",
-        "description": "This must be paired with its private key. They may be posted in either order, but one cannot post two certs in a row (or two keys in a row).",
-        "operationId": "post_rss_config_cert",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "title": "String",
-                "type": "string"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "successful operation",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/CertificateUploadResponse"
-                }
-              }
-            }
-          },
-          "4XX": {
-            "$ref": "#/components/responses/Error"
-          },
-          "5XX": {
-            "$ref": "#/components/responses/Error"
-          }
-        }
-      }
-    },
     "/rack-setup/config/key": {
       "post": {
         "summary": "Add the private key of an external certificate.",
diff --git a/wicket/src/cli/rack_setup.rs b/wicket/src/cli/rack_setup.rs
index d6cc6bcad52..caeb70567ce 100644
--- a/wicket/src/cli/rack_setup.rs
+++ b/wicket/src/cli/rack_setup.rs
@@ -37,6 +37,7 @@ use wicketd_client::types::PutRssRecoveryUserPasswordHash;
 use wicketd_client::types::SetBgpAuthKeyStatus;
 use wicketd_commission_types::rack_setup::BgpAuthKey;
 use wicketd_commission_types::rack_setup::BgpAuthKeyId;
+use wicketd_commission_types::rack_setup::CertificatePem;
 use wicketd_commission_types::rack_setup::CertificateUploadResponse;
 use wicketd_commission_types::rack_setup::PutRssUserConfigInsensitive;
 use zeroize::Zeroizing;
@@ -162,8 +163,8 @@ impl SetupArgs {
                     .context("failed to read certificate from stdin")?;
 
                 slog::info!(log, "uploading cert to wicketd...");
-                let result = client
-                    .post_rss_config_cert(&cert)
+                let result = commission_client
+                    .post_rss_config_cert(&CertificatePem(cert))
                     .await
                     .context("failed to upload cert to wicketd")?
                     .into_inner();
diff --git a/wicketd-api/src/lib.rs b/wicketd-api/src/lib.rs
index f2c5bbe0fce..e8bba535105 100644
--- a/wicketd-api/src/lib.rs
+++ b/wicketd-api/src/lib.rs
@@ -83,19 +83,6 @@ pub trait WicketdApi {
         body: TypedBody<MultirackJoinConfigBaseUserInput>,
     ) -> Result<HttpResponseUpdatedNoContent, HttpError>;
 
-    /// Add an external certificate.
-    ///
-    /// This must be paired with its private key. They may be posted in either
-    /// order, but one cannot post two certs in a row (or two keys in a row).
-    #[endpoint {
-        method = POST,
-        path = "/rack-setup/config/cert"
-    }]
-    async fn post_rss_config_cert(
-        rqctx: RequestContext<Self::Context>,
-        body: TypedBody<String>,
-    ) -> Result<HttpResponseOk<CertificateUploadResponse>, HttpError>;
-
     /// Add the private key of an external certificate.
     ///
     /// This must be paired with its certificate. They may be posted in either
diff --git a/wicketd/src/http_entrypoints.rs b/wicketd/src/http_entrypoints.rs
index 589e731ff7b..3daa1ad2bb0 100644
--- a/wicketd/src/http_entrypoints.rs
+++ b/wicketd/src/http_entrypoints.rs
@@ -159,25 +159,6 @@ impl WicketdApi for WicketdApiImpl {
         Ok(HttpResponseUpdatedNoContent())
     }
 
-    async fn post_rss_config_cert(
-        rqctx: RequestContext<Self::Context>,
-        body: TypedBody<String>,
-    ) -> Result<HttpResponseOk<CertificateUploadResponse>, HttpError> {
-        let ctx = rqctx.context();
-
-        let mut config = ctx.rss_or_multirack_join_config.lock().unwrap();
-
-        let rss_config = config.rss_config_mut_or_conflict(
-            "cannot post certificates when not preparing for RSS",
-        )?;
-
-        let response = rss_config
-            .push_cert(body.into_inner())
-            .map_err(|err| HttpError::for_bad_request(None, err))?;
-
-        Ok(HttpResponseOk(response))
-    }
-
     async fn post_rss_config_key(
         rqctx: RequestContext<Self::Context>,
         body: TypedBody<String>,