mcp

Get full certificate details by SHA-256 fingerprint

Returns the complete certificate record: SANs, issuer info, crypto-hygiene metadata, and CT log metadata (log_id, leaf_index). The reconciled_from_crtsh boolean (task #796) is true when the record was ingested via the crt.sh reconciliation/backfill path (stored log_id == 'crt.sh') rather than observed directly in a CT log — such records reflect crt.sh's observation timing, not CertIndex's own CT-crawl detection latency.

Raw bytes (task #586): by default raw_pem is null to keep LLM context small. Pass include_raw=true to fetch the raw certificate bytes from cold storage and receive them as PEM in raw_pem; this also backfills any NULL crypto-hygiene fields (key_type / key_size / signature_algorithm / is_weak_crypto) by parsing the DER. A long-expired certificate whose raw bytes were dropped by the retention sweep returns HTTP 410 raw_swept with a log_id / leaf_index pointer so you can re-fetch the leaf from the upstream CT log.

Null crypto semantics (task #745): is_weak_crypto is null (not false) whenever key_type / key_size / signature_algorithm are all null — the crypto was never assessed for that record. Only a boolean value is an actual assessment.

get/mcp-api/get_certificate/{sha256}

Request

  • Base URL: https://api.ctindex.io
  • URL: https://api.ctindex.io/mcp-api/get_certificate/{sha256}
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

sha256string required

Query parameters

include_rawboolean

When true, return the cert PEM in raw_pem (mirrors the REST ?include_raw=true). Best-effort: served from cold storage, or materialized on demand from the upstream source when not stored. Also backfills NULL crypto-hygiene fields from the DER. Defaults to false to keep LLM context small.

include_enrichmentboolean

When true, attach RDAP + DNS + ASN/hosting context for the certificate's primary hostname under enrichment (task #501).

Cookies

ctix_sessionstring nullable

Response

Successful Response

sha256string required
subject_cnstring nullable
subject_ostring nullable
sansstring[]
issuer_cnstring nullable
issuer_ostring nullable
not_beforestring date-time nullable
not_afterstring date-time nullable
is_wildcardboolean
is_precertboolean

True when this row is a CT precertificate (poison-extension log entry), False for a final leaf certificate. Precert and final-leaf twins have different SHA-256 hashes and are returned as separate rows; present on every list and detail row. Exception (GH #262): get_expiring_certs collapses twin pairs to the final leaf by default.

precert_sha256string nullable

SHA-256 fingerprint of the CT precertificate twin that was collapsed into this final-leaf row (get_expiring_certs default twin collapsing, GH #262). Omitted when no twin was collapsed.

key_typestring nullable
key_sizeinteger nullable
signature_algorithmstring nullable
is_weak_cryptoboolean nullable
key_fields_sourcestring nullable
first_seenstring date-time nullable

When CertIndex wrote this certificate to its database (batch-write timestamp). Multiple unrelated certificates often share an identical first_seen within the same ingestion batch. It is not the CT-log append time and is never substituted for a missing logged_at. Compare with logged_at to measure detection latency.

logged_atstring date-time nullable

Timestamp from the CT log entry itself (MerkleTreeLeaf TimestampedEntry.timestamp, RFC 6962 §3.4) — when the log committed this certificate, NOT when CertIndex ingested it. Null for rows indexed before this field shipped, for crt.sh-sourced rows (reconciled_from_crtsh=true), and for any path that could not supply it. A null value means the CT-log timestamp is unavailable for that row; it does not mean the certificate was observed at first_seen, and first_seen is never synthesized into logged_at. Compare with first_seen (CertIndex write time) to measure detection latency. See logged_at_coverage disclosure block.

reconciled_from_crtshboolean nullable
last_seenstring date-time nullable
match_classstring nullable

Attribution class when match_class_filter was supplied on search: first_party, lookalike_candidate, third_party_integration, substring_collision, or shared_hosting. Null on unfiltered search.

match_reasonstring nullable

Semicolon-separated rule=value audit string for match_class. Null on unfiltered search.

from_cold_tierboolean nullable

True when this certificate was served exclusively from the Tier 1 cold ClickHouse index (historical data not present in the hot Neon index). Absent/null for certificates served from the primary index. Cold-sourced rows carry key_fields_source='unavailable' and no raw_pem.

raw_pemstring nullable
log_idstring nullable
leaf_indexinteger nullable

Changes

No recorded changes to this operation across all 1 revision of this API.