---
title: "Get a certificate"
method: GET
path: "/v3/global/asset/certificate/{certificate_id}"
tags: ["Global Data"]
---

# Get a certificate

`GET /v3/global/asset/certificate/{certificate_id}`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/global/asset/certificate/{certificate_id}`
- Auth: HTTP bearer

Retrieve information about a single certificate. A certificate ID is its SHA-256 fingerprint.<br><br>In a SOC environment, use this endpoint to look up a certificate by SHA-256 fingerprint to see its subject, issuer, and validity, so you can vet certs seen in TLS logs or alerts.

## Path parameters

- `certificate_id` string, required: The SHA-256 certificate fingerprint.

## Query parameters

- `organization_id` string, uuid: The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. If omitted, the request will be processed using the authenticated user's free wallet where applicable. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

OK

- ResponseEnvelopeCertificateAsset
  - `result` CertificateAsset
    - `extensions` object, required
    - `resource` Certificate, required
      - `added_at` string: When the certificate was added to the Censys dataset.
      - `ct` Ct
        - `entries` object
      - `ever_seen_in_scan` boolean: Whether the certificate has ever been presented by a service during a scan.
      - `fingerprint_md5` string, hex: The MD-5 digest of the entire raw certificate. An identifier used by some systems.
      - `fingerprint_sha1` string, hex: The SHA-1 digest of the entire raw certificate. An identifier used by some systems.
      - `fingerprint_sha256` string, hex: The SHA-256 digest of the entire raw certificate. Its unique identifier, which Censys uses to index certificates records.
      - `modified_at` string: When the certificate record was last modified.
      - `names` string[], nullable: All the names contained in the certificate from various fields.
      - `parent_spki_fingerprint_sha256` string, hex: DEPRECATED: Use parent_spki_subject_fingerprint_sha256
      - `parent_spki_subject_fingerprint_sha256` string, hex: The SHA-256 digest of the parent certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
      - `parse_status` '' | 'success' | 'fail' | 'corrupted'
      - `parsed` CertificateParsed
        - `extensions` CertificateExtensions
          - `authority_info_access` AuthorityInfoAccess
            - `issuer_urls` string[], nullable
            - `ocsp_urls` string[], nullable
          - `authority_key_id` string, hex: A key identifier, usually a digest of the DER-encoded SubjectPublicKeyInfo.
          - `basic_constraints` BasicConstraints
            - `is_ca` boolean: Whether the certificate is permitted to sign other certificates.
            - `max_path_len` integer: When present, provides the maximum number of intermediate certificates that may follow this certificate in a trusted certification path.
          - `cabf_organization_id` CabfOrganizationId
            - `country` string
            - `reference` string
            - `scheme` string
            - `state` string
          - `certificate_policies` CertificatePolicy[], nullable: The parsed id-ce-certificatePolicies extension (OID: 2.5.29.32).
            - `cps` string[], nullable
            - `id` string
            - `user_notice` UserNotice[], nullable
              - …
          - `crl_distribution_points` string[], nullable: The parsed id-ce-cRLDistributionPoints extension (OID: 2.5.29.31). Contents are a list of distributionPoint URLs; other distributionPoint types are omitted).
          - `ct_poison` boolean: Whether the certificate possesses the pre-certificate "poison" extension (OID: 1.3.6.1.4.1.11129.2.4.3).
          - `extended_key_usage` ExtendedKeyUsage
            - `any` boolean
            - `apple_code_signing` boolean
            - `apple_code_signing_development` boolean
            - `apple_code_signing_third_party` boolean
            - `apple_crypto_development_env` boolean
            - `apple_crypto_env` boolean
            - `apple_crypto_maintenance_env` boolean
            - `apple_crypto_production_env` boolean
            - `apple_crypto_qos` boolean
            - `apple_crypto_test_env` boolean
            - `apple_crypto_tier0_qos` boolean
            - `apple_crypto_tier1_qos` boolean
            - `apple_crypto_tier2_qos` boolean
            - `apple_crypto_tier3_qos` boolean
            - `apple_ichat_encryption` boolean
            - `apple_ichat_signing` boolean
            - `apple_resource_signing` boolean
            - `apple_software_update_signing` boolean
            - `apple_system_identity` boolean
            - `client_auth` boolean
            - `code_signing` boolean
            - `dvcs` boolean
            - `eap_over_lan` boolean
            - `eap_over_ppp` boolean
            - `email_protection` boolean
            - `ipsec_end_system` boolean
            - `ipsec_intermediate_system_usage` boolean
            - `ipsec_tunnel` boolean
            - `ipsec_user` boolean
            - `microsoft_ca_exchange` boolean
            - `microsoft_cert_trust_list_signing` boolean
            - `microsoft_csp_signature` boolean
            - `microsoft_document_signing` boolean
            - `microsoft_drm` boolean
            - `microsoft_drm_individualization` boolean
            - `microsoft_efs_recovery` boolean
            - `microsoft_embedded_nt_crypto` boolean
            - `microsoft_encrypted_file_system` boolean
            - `microsoft_enrollment_agent` boolean
            - `microsoft_kernel_mode_code_signing` boolean
            - `microsoft_key_recovery_21` boolean
            - `microsoft_key_recovery_3` boolean
            - `microsoft_license_server` boolean
            - `microsoft_licenses` boolean
            - `microsoft_lifetime_signing` boolean
            - `microsoft_mobile_device_software` boolean
            - `microsoft_nt5_crypto` boolean
            - `microsoft_oem_whql_crypto` boolean
            - `microsoft_qualified_subordinate` boolean
            - `microsoft_root_list_signer` boolean
            - `microsoft_server_gated_crypto` boolean
            - `microsoft_sgc_serialized` boolean
            - `microsoft_smart_display` boolean
            - `microsoft_smartcard_logon` boolean
            - `microsoft_system_health` boolean
            - `microsoft_system_health_loophole` boolean
            - `microsoft_timestamp_signing` boolean
            - `microsoft_whql_crypto` boolean
            - `netscape_server_gated_crypto` boolean
            - `ocsp_signing` boolean
            - `sbgp_cert_aa_service_auth` boolean
            - `server_auth` boolean
            - `time_stamping` boolean
            - `unknown` string[], nullable
          - `issuer_alt_name` GeneralNames
            - `directory_names` DistinguishedName[], nullable: The parsed directoryName entries in the GeneralName.
              - …
            - `dns_names` string[], nullable: The parsed dNSName entries in the GeneralName.
            - `edi_party_names` EdiPartyName[], nullable: The parsed eDIPartyName entries in the GeneralName.
              - …
            - `email_addresses` string[], nullable: The parsed rfc822Name entries in the GeneralName.
            - `ip_addresses` string[], nullable: The parsed ipAddress entries in the GeneralName.
            - `other_names` OtherName[], nullable: The parsed otherName entries in the GeneralName. An arbitrary binary value identified by an OID.
              - …
            - `registered_ids` string[], nullable: The parsed registeredID entries in the GeneralName. Stored in dotted-decimal format.
            - `uniform_resource_identifiers` string[], nullable: The parsed uniformResourceIdentifier entries in the GeneralName.
          - `key_usage` KeyUsage
            - `certificate_sign` boolean: Whether the keyCertSign bit is set.
            - `content_commitment` boolean: Whether the contentCommitment (formerly called nonRepudiation) bit is set.
            - `crl_sign` boolean: Whether the cRLSign bit is set.
            - `data_encipherment` boolean: Whether the dataEncipherment bit is set.
            - `decipher_only` boolean: Whether the decipherOnly bit is set.
            - `digital_signature` boolean: Whether the digitalSignature bit is set.
            - `encipher_only` boolean: Whether the encipherOnly bit is set.
            - `key_agreement` boolean: Whether the keyAgreement bit is set.
            - `key_encipherment` boolean: Whether the keyEncipherment bit is set.
            - `value` integer: The integer value of the bitmask in the extension.
          - `name_constraints` NameConstraints
            - `critical` boolean
            - `excluded_directory_names` DistinguishedName[], nullable: A record providing excluded names of the type directoryName in leaf certificates whose trust path includes this certificate.
              - …
            - `excluded_edi_party_names` EdiPartyName[], nullable: A record providing excluded names of the type ediPartyName in leaf certificates whose trust path includes this certificate.
              - …
            - `excluded_email_addresses` string[], nullable: A record providing a range of excluded names of the type rfc822Name in leaf certificates whose trust path includes this certificate.
            - `excluded_ip_addresses` GeneralSubtreeIp[], nullable: A record providing a range of excluded names of the type iPAddress in leaf certificates whose trust path includes this certificate.
              - …
            - `excluded_names` string[], nullable: A record providing a range of excluded names of the type dNSName in leaf certificates whose trust path includes this certificate.
            - `excluded_registered_ids` string[], nullable: A record providing excluded names of the type registeredID in leaf certificates whose trust path includes this certificate.
            - `excluded_uris` string[], nullable: A record providing a range of excluded uniform resource identifiers in leaf certificates whose trust path includes this certificate.
            - `permitted_directory_names` DistinguishedName[], nullable: A record providing permitted names of the type directoryName in leaf certificates whose trust path includes this certificate.
              - …
            - `permitted_edi_party_names` EdiPartyName[], nullable: A record providing permitted names of the type ediPartyName in leaf certificates whose trust path includes this certificate.
              - …
            - `permitted_email_addresses` string[], nullable: A record providing a range of permitted names of the type rfc822Name in leaf certificates whose trust path includes this certificate.
            - `permitted_ip_addresses` GeneralSubtreeIp[], nullable: A record providing a range of permitted names of the type iPAddress in leaf certificates whose trust path includes this certificate.
              - …
            - `permitted_names` string[], nullable: A record providing a range of permitted names of the type dNSName in leaf certificates whose trust path includes this certificate.
            - `permitted_registered_ids` string[], nullable: A record providing permitted names of the type registeredID in leaf certificates whose trust path includes this certificate.
            - `permitted_uris` string[], nullable: A record providing a range of permitted uniform resource identifiers in leaf certificates whose trust path includes this certificate.
          - `qc_statements` QcStatements
            - `ids` string[], nullable
            - `parsed` QcStatementsParsedStatements
              - …
          - `signed_certificate_timestamps` SignedCertificateTimestamp[], nullable
            - `log_id` string, hex
            - `signature` SignedCertificateTimestampSignature
              - …
            - `timestamp` string
            - `version` integer
          - `subject_alt_name` GeneralNames
            - `directory_names` DistinguishedName[], nullable: The parsed directoryName entries in the GeneralName.
              - …
            - `dns_names` string[], nullable: The parsed dNSName entries in the GeneralName.
            - `edi_party_names` EdiPartyName[], nullable: The parsed eDIPartyName entries in the GeneralName.
              - …
            - `email_addresses` string[], nullable: The parsed rfc822Name entries in the GeneralName.
            - `ip_addresses` string[], nullable: The parsed ipAddress entries in the GeneralName.
            - `other_names` OtherName[], nullable: The parsed otherName entries in the GeneralName. An arbitrary binary value identified by an OID.
              - …
            - `registered_ids` string[], nullable: The parsed registeredID entries in the GeneralName. Stored in dotted-decimal format.
            - `uniform_resource_identifiers` string[], nullable: The parsed uniformResourceIdentifier entries in the GeneralName.
          - `subject_key_id` string, hex: A key identifier, usually a digest of the DER-encoded SubjectPublicKeyInfo..
          - `tor_service_descriptors` TorServiceDescriptor[], nullable
            - `algorithm_name` string
            - `hash` string, hex
            - `hash_bits` integer
            - `onion` string
        - `issuer` DistinguishedName
          - `common_name` string[], nullable: The commonName (CN) elements of the Distinguished Name (OID: 2.5.4.3).
          - `country` string[], nullable: The countryName (C) elements of the Distinguished Name (OID: 2.5.4.6).
          - `domain_component` string[], nullable: The domainComponent (DC) elements of the Distinguished Name (OID: 0.9.2342.19200300.100.1.25).
          - `email_address` string[], nullable: The emailAddress (E) elements of the Distinguished Name (OID: 1.2.840.113549.1.9.1).
          - `given_name` string[], nullable: The givenName (G) elements of the Distinguished Name (OID: 2.5.4.42).
          - `jurisdiction_country` string[], nullable: The jurisdictionCountry elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.3).
          - `jurisdiction_locality` string[], nullable: The jurisdictionLocality elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.1).
          - `jurisdiction_province` string[], nullable: The jurisdictionStateOrProvince elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.2).
          - `locality` string[], nullable: The localityName (L) elements of the Distinguished Name (OID: 2.5.4.7).
          - `organization` string[], nullable: The organizationName (O) elements of the Distinguished Name (OID: 2.5.4.10).
          - `organization_id` string[], nullable
          - `organizational_unit` string[], nullable: The organizationalUnit (OU) elements of the Distinguished Name (OID: 2.5.4.11).
          - `postal_code` string[], nullable: The postalCode elements of the Distinguished Name (OID: 2.5.4.17).
          - `province` string[], nullable: The stateOrProvinceName (ST) elements of the Distinguished Name (OID: 2.5.4.8).
          - `serial_number` string[], nullable: The serialNumber elements of the Distinguished Name (OID: 2.5.4.5).
          - `street_address` string[], nullable: The streetAddress (STREET) elements of the Distinguished Name (OID: 2.5.4.9).
          - `surname` string[], nullable: The surname (SN) elements of the Distinguished Name (OID: 2.5.4.4).
        - `issuer_dn` string: Distinguished Name of the entity that has signed and issued the certificate.
        - `ja4x` string
        - `redacted` boolean
        - `serial_number` string: Issuer-specific identifier of the certificate.
        - `serial_number_hex` string: Issuer-specific identifier of the certificate, represented as hexadecimal.
        - `signature` Signature
          - `self_signed` boolean: Whether the certificate was signed by its own key.
          - `signature_algorithm` KeyAlgorithm
            - `name` string: Name of public key type, such as RSA or ECDSA. Information specific to the key type is available in the named sub-record.
            - `oid` string
          - `valid` boolean: Whether the signature is valid.
          - `value` string, hex: Contents of the signature.
        - `subject` DistinguishedName
          - `common_name` string[], nullable: The commonName (CN) elements of the Distinguished Name (OID: 2.5.4.3).
          - `country` string[], nullable: The countryName (C) elements of the Distinguished Name (OID: 2.5.4.6).
          - `domain_component` string[], nullable: The domainComponent (DC) elements of the Distinguished Name (OID: 0.9.2342.19200300.100.1.25).
          - `email_address` string[], nullable: The emailAddress (E) elements of the Distinguished Name (OID: 1.2.840.113549.1.9.1).
          - `given_name` string[], nullable: The givenName (G) elements of the Distinguished Name (OID: 2.5.4.42).
          - `jurisdiction_country` string[], nullable: The jurisdictionCountry elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.3).
          - `jurisdiction_locality` string[], nullable: The jurisdictionLocality elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.1).
          - `jurisdiction_province` string[], nullable: The jurisdictionStateOrProvince elements of the Distinguished Name (OID: 1.3.6.1.4.1.311.60.2.1.2).
          - `locality` string[], nullable: The localityName (L) elements of the Distinguished Name (OID: 2.5.4.7).
          - `organization` string[], nullable: The organizationName (O) elements of the Distinguished Name (OID: 2.5.4.10).
          - `organization_id` string[], nullable
          - `organizational_unit` string[], nullable: The organizationalUnit (OU) elements of the Distinguished Name (OID: 2.5.4.11).
          - `postal_code` string[], nullable: The postalCode elements of the Distinguished Name (OID: 2.5.4.17).
          - `province` string[], nullable: The stateOrProvinceName (ST) elements of the Distinguished Name (OID: 2.5.4.8).
          - `serial_number` string[], nullable: The serialNumber elements of the Distinguished Name (OID: 2.5.4.5).
          - `street_address` string[], nullable: The streetAddress (STREET) elements of the Distinguished Name (OID: 2.5.4.9).
          - `surname` string[], nullable: The surname (SN) elements of the Distinguished Name (OID: 2.5.4.4).
        - `subject_dn` string: Distinguished Name of the entity associated with the public key.
        - `subject_key_info` SubjectKeyInfo
          - `dsa` DsaPublicKey
            - `g` string, hex
            - `p` string, hex
            - `q` string, hex
            - `y` string, hex
          - `ecdsa` EcdsaPublicKey
            - `b` string, hex
            - `curve` string
            - `gx` string, hex
            - `gy` string, hex
            - `length` integer
            - `n` string, hex
            - `p` string, hex
            - `pub` string, hex
            - `x` string, hex
            - `y` string, hex
          - `fingerprint_sha256` string, hex: The SHA-256 digest of the certificate's DER-encoded SubjectPublicKeyInfo.
          - `key_algorithm` KeyAlgorithm
            - `name` string: Name of public key type, such as RSA or ECDSA. Information specific to the key type is available in the named sub-record.
            - `oid` string
          - `rsa` RsaPublicKey
            - `exponent` integer: The RSA key's public exponent (e).
            - `length` integer: Bit-length of the RSA modulus.
            - `modulus` string, hex: The RSA key's modulus (n) in big-endian encoding.
          - `unrecognized` UnrecognizedPublicKey
            - `raw` string, hex
        - `unknown_extensions` Extension[], nullable
          - `critical` boolean
          - `id` string
          - `value` string, hex
        - `validity_period` ValidityPeriod
          - `length_seconds` integer: The duration of the certificate's validity period, in seconds.
          - `not_after` string: An RFC-3339-formatted timestamp after which the certificate is no longer valid.
          - `not_before` string: An RFC-3339-formatted timestamp before which the certificate is not valid.
        - `version` integer
      - `precert` boolean: Whether the X.509 "poison" extension (OID: 1.3.6.1.4.1.11129.2.4.3) is marked critical, which prohibits the pre-certificate from being trusted.
      - `revocation` CertificateRevocation
        - `crl` CertificateRevocationRevocationInfo
          - `next_update` string
          - `reason` '' | 'unspecified' | 'key_compromise' | 'ca_compromise' | 'affiliation_changed' | 'superseded' | 'cessation_of_operation' | 'certificate_hold' | 'remove_from_crl' | 'privilege_withdrawn' | 'aa_compromise': An enumerated value indicating the issuer-supplied reason for the revocation.
          - `revocation_time` string: The issuer-supplied timestamp indicating when the certificate was revoked.
          - `revoked` boolean: Whether the certificate has been revoked before its expiry date by the issuer.
        - `ocsp` CertificateRevocationRevocationInfo
          - `next_update` string
          - `reason` '' | 'unspecified' | 'key_compromise' | 'ca_compromise' | 'affiliation_changed' | 'superseded' | 'cessation_of_operation' | 'certificate_hold' | 'remove_from_crl' | 'privilege_withdrawn' | 'aa_compromise': An enumerated value indicating the issuer-supplied reason for the revocation.
          - `revocation_time` string: The issuer-supplied timestamp indicating when the certificate was revoked.
          - `revoked` boolean: Whether the certificate has been revoked before its expiry date by the issuer.
      - `revoked` boolean: Whether the certificate has been revoked before its expiry date by the issuer.
      - `spki_fingerprint_sha256` string, hex: DEPRECATED: Use spki_subject_fingerprint_sha256
      - `spki_subject_fingerprint_sha256` string, hex: The SHA-256 digest of the certificate's DER-encoded SubjectPublicKeyInfo concatenated with its Subject.
      - `tbs_fingerprint_sha256` string, hex: The SHA-256 digest of the unsigned certificate's contents.
      - `tbs_no_ct_fingerprint_sha256` string, hex: The SHA-256 digest of the unsigned certificate with the CT Poison extension removed, if present. This represents the shared contents of a certificate and its corresponding pre-certificate.
      - `validated_at` string: When the certificate record's trust was last checked.
      - `validation` Validation
        - `apple` RootStore
          - `chains` RootStoreChain[], nullable: A path of trusted signing certificates up to a root certificate present in a root store, represented as an ordered list of SHA-256 fingerprints.
            - `sha256fp` string[], nullable
          - `ever_valid` boolean: Whether the certificate has ever been considered valid by the root store.
          - `had_trusted_path` boolean: Whether there ever existed a trusted path of signing certificates from a certificate present in the root certificate store.
          - `has_trusted_path` boolean: Whether there currently exists a trusted path of signing certificates from a certificate present in the root certificate store.
          - `in_revocation_set` boolean: Whether the certificate is in the revocation set (e.g. OneCRL) associated with the root store.
          - `is_valid` boolean: Whether the certificate is currently considered valid by the root store: a summary of the trust path, revoked, blocklisted/allowlisted, and expired fields.
          - `parents` string[], nullable: The SHA-256 fingerprints of the certificate's immediate parents in its trust path(s).
          - `type` '' | 'root' | 'intermediate' | 'leaf': The certificate's type. Options include root, intermediate, or leaf.
        - `chrome` RootStore
          - `chains` RootStoreChain[], nullable: A path of trusted signing certificates up to a root certificate present in a root store, represented as an ordered list of SHA-256 fingerprints.
            - `sha256fp` string[], nullable
          - `ever_valid` boolean: Whether the certificate has ever been considered valid by the root store.
          - `had_trusted_path` boolean: Whether there ever existed a trusted path of signing certificates from a certificate present in the root certificate store.
          - `has_trusted_path` boolean: Whether there currently exists a trusted path of signing certificates from a certificate present in the root certificate store.
          - `in_revocation_set` boolean: Whether the certificate is in the revocation set (e.g. OneCRL) associated with the root store.
          - `is_valid` boolean: Whether the certificate is currently considered valid by the root store: a summary of the trust path, revoked, blocklisted/allowlisted, and expired fields.
          - `parents` string[], nullable: The SHA-256 fingerprints of the certificate's immediate parents in its trust path(s).
          - `type` '' | 'root' | 'intermediate' | 'leaf': The certificate's type. Options include root, intermediate, or leaf.
        - `microsoft` RootStore
          - `chains` RootStoreChain[], nullable: A path of trusted signing certificates up to a root certificate present in a root store, represented as an ordered list of SHA-256 fingerprints.
            - `sha256fp` string[], nullable
          - `ever_valid` boolean: Whether the certificate has ever been considered valid by the root store.
          - `had_trusted_path` boolean: Whether there ever existed a trusted path of signing certificates from a certificate present in the root certificate store.
          - `has_trusted_path` boolean: Whether there currently exists a trusted path of signing certificates from a certificate present in the root certificate store.
          - `in_revocation_set` boolean: Whether the certificate is in the revocation set (e.g. OneCRL) associated with the root store.
          - `is_valid` boolean: Whether the certificate is currently considered valid by the root store: a summary of the trust path, revoked, blocklisted/allowlisted, and expired fields.
          - `parents` string[], nullable: The SHA-256 fingerprints of the certificate's immediate parents in its trust path(s).
          - `type` '' | 'root' | 'intermediate' | 'leaf': The certificate's type. Options include root, intermediate, or leaf.
        - `nss` RootStore
          - `chains` RootStoreChain[], nullable: A path of trusted signing certificates up to a root certificate present in a root store, represented as an ordered list of SHA-256 fingerprints.
            - `sha256fp` string[], nullable
          - `ever_valid` boolean: Whether the certificate has ever been considered valid by the root store.
          - `had_trusted_path` boolean: Whether there ever existed a trusted path of signing certificates from a certificate present in the root certificate store.
          - `has_trusted_path` boolean: Whether there currently exists a trusted path of signing certificates from a certificate present in the root certificate store.
          - `in_revocation_set` boolean: Whether the certificate is in the revocation set (e.g. OneCRL) associated with the root store.
          - `is_valid` boolean: Whether the certificate is currently considered valid by the root store: a summary of the trust path, revoked, blocklisted/allowlisted, and expired fields.
          - `parents` string[], nullable: The SHA-256 fingerprints of the certificate's immediate parents in its trust path(s).
          - `type` '' | 'root' | 'intermediate' | 'leaf': The certificate's type. Options include root, intermediate, or leaf.
      - `validation_level` '' | 'dv' | 'ov' | 'ev': The extent to which the certificate's issuer validated the identity of the entity requesting the certificate. Options include Domain validated (DV), Organization Validated (OV), or Extended Validation (EV).
      - `zlint` ZLint
        - `errors_present` boolean: Whether the certificate's attributes triggered any error lints for non-conformance to the X.509 standard.
        - `failed_lints` string[], nullable: A list of lint names which failed, if applicable.
        - `fatals_present` boolean: Whether the certificate's attributes triggered any fatal lints for non-conformance to the X.509 standard.
        - `notices_present` boolean: Whether the certificate's attributes triggered any notice lints for non-conformance to the X.509 standard.
        - `timestamp` string: An RFC-3339-formated timestamp indicating when the certificate was linted.
        - `version` integer: The version of Zlint used to lint the certificate.
        - `warnings_present` boolean: Whether the certificate's attributes triggered any warning lints for non-conformance to the X.509 standard.

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: No certificate found
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 8 breaking
  - the `result/resource/validation/apple/chains/items/sha256fp` response's property format changed from `hex` to no format for status `200`
  - the `result/resource/validation/apple/parents` response's property format changed from `hex` to no format for status `200`
  - the `result/resource/validation/chrome/chains/items/sha256fp` response's property format changed from `hex` to no format for status `200`
  - the `result/resource/validation/chrome/parents` response's property format changed from `hex` to no format for status `200`
  - …4 more

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/global/asset/certificate/:certificate_id/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)