---
title: "Get full certificate details by SHA-256 fingerprint"
method: GET
path: "/mcp-api/get_certificate/{sha256}"
tags: ["mcp"]
---

# Get full certificate details by SHA-256 fingerprint

`GET /mcp-api/get_certificate/{sha256}`

## Request

- Base URL: `https://api.ctindex.io`
- URL: `https://api.ctindex.io/mcp-api/get_certificate/{sha256}`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Returns the complete certificate record: SANs, issuer info, crypto-hygiene metadata, and CT log metadata (log_id, leaf_index). The `reconciled_from_crtsh` boolean (task #796) is `true` when the record was ingested via the crt.sh reconciliation/backfill path (stored `log_id == 'crt.sh'`) rather than observed directly in a CT log — such records reflect crt.sh's observation timing, not CertIndex's own CT-crawl detection latency.

**Raw bytes (task #586):** by default ``raw_pem`` is null to keep LLM context small. Pass ``include_raw=true`` to fetch the raw certificate bytes from cold storage and receive them as PEM in ``raw_pem``; this also backfills any NULL crypto-hygiene fields (``key_type`` / ``key_size`` / ``signature_algorithm`` / ``is_weak_crypto``) by parsing the DER. A long-expired certificate whose raw bytes were dropped by the retention sweep returns HTTP 410 ``raw_swept`` with a ``log_id`` / ``leaf_index`` pointer so you can re-fetch the leaf from the upstream CT log.

**Null crypto semantics (task #745):** ``is_weak_crypto`` is ``null`` (not ``false``) whenever ``key_type`` / ``key_size`` / ``signature_algorithm`` are all null — the crypto was never assessed for that record. Only a boolean value is an actual assessment.

## Path parameters

- `sha256` string, required

## Query parameters

- `include_raw` boolean: When true, return the cert PEM in ``raw_pem`` (mirrors the REST ``?include_raw=true``). Best-effort: served from cold storage, or materialized on demand from the upstream source when not stored. Also backfills NULL crypto-hygiene fields from the DER. Defaults to false to keep LLM context small.
- `include_enrichment` boolean: When true, attach RDAP + DNS + ASN/hosting context for the certificate's primary hostname under ``enrichment`` (task #501).

## Cookies

- `ctix_session` string, nullable

## Response `200`

Successful Response

- CertificateDetail
  - `sha256` string, required
  - `subject_cn` string, nullable
  - `subject_o` string, nullable
  - `sans` string[]
  - `issuer_cn` string, nullable
  - `issuer_o` string, nullable
  - `not_before` string, date-time, nullable
  - `not_after` string, date-time, nullable
  - `is_wildcard` boolean
  - `is_precert` boolean: True when this row is a CT precertificate (poison-extension log entry), False for a final leaf certificate. Precert and final-leaf twins have different SHA-256 hashes and are returned as separate rows; present on every list and detail row. Exception (GH #262): get_expiring_certs collapses twin pairs to the final leaf by default.
  - `precert_sha256` string, nullable: SHA-256 fingerprint of the CT precertificate twin that was collapsed into this final-leaf row (get_expiring_certs default twin collapsing, GH #262). Omitted when no twin was collapsed.
  - `key_type` string, nullable
  - `key_size` integer, nullable
  - `signature_algorithm` string, nullable
  - `is_weak_crypto` boolean, nullable
  - `key_fields_source` string, nullable
  - `first_seen` string, date-time, nullable: When CertIndex wrote this certificate to its database (batch-write timestamp). Multiple unrelated certificates often share an identical first_seen within the same ingestion batch. It is not the CT-log append time and is never substituted for a missing logged_at. Compare with logged_at to measure detection latency.
  - `logged_at` string, date-time, nullable: Timestamp from the CT log entry itself (MerkleTreeLeaf TimestampedEntry.timestamp, RFC 6962 §3.4) — when the log committed this certificate, NOT when CertIndex ingested it. Null for rows indexed before this field shipped, for crt.sh-sourced rows (reconciled_from_crtsh=true), and for any path that could not supply it. A null value means the CT-log timestamp is unavailable for that row; it does not mean the certificate was observed at first_seen, and first_seen is never synthesized into logged_at. Compare with first_seen (CertIndex write time) to measure detection latency. See logged_at_coverage disclosure block.
  - `reconciled_from_crtsh` boolean, nullable
  - `last_seen` string, date-time, nullable
  - `match_class` string, nullable: Attribution class when match_class_filter was supplied on search: first_party, lookalike_candidate, third_party_integration, substring_collision, or shared_hosting. Null on unfiltered search.
  - `match_reason` string, nullable: Semicolon-separated rule=value audit string for match_class. Null on unfiltered search.
  - `from_cold_tier` boolean, nullable: True when this certificate was served exclusively from the Tier 1 cold ClickHouse index (historical data not present in the hot Neon index). Absent/null for certificates served from the primary index. Cold-sourced rows carry key_fields_source='unavailable' and no raw_pem.
  - `raw_pem` string, nullable
  - `log_id` string, nullable
  - `leaf_index` integer, nullable
  - `enrichment` DomainEnrichment: RDAP + DNS + ASN context for a single domain (task #501).
    - `domain` string, required
    - `registration` EnrichmentRegistration
      - `registrar` string, nullable
      - `created` string, nullable
      - `updated` string, nullable
      - `expires` string, nullable
      - `status` string[]
      - `nameservers` string[]
    - `dns` EnrichmentDNS
      - `a` string[]
      - `aaaa` string[]
      - `mx` EnrichmentMX[]
        - `preference` integer, required
        - `exchange` string, required
      - `ns` string[]
      - `txt` string[]
    - `asn` EnrichmentASN[]
      - `ip` string, required
      - `asn` integer, nullable
      - `prefix` string, nullable
      - `country` string, nullable
      - `network_owner` string, nullable
    - `signals` EnrichmentSignals: Derived attribution signals for a domain. Attached under ``enrichment.signals`` only when the caller passes ``include_signals=true`` AND holds a paid plan (Pro or higher — the free tier gets a 403 ``tier_not_entitled``). Signals are derived from the domain's currently-valid certificates and TXT inventory: issuer diversity, wildcard breadth, third-party vendor fingerprints, and explicit weak-crypto reasons.
      - `issuer_diversity_score` number
      - `distinct_issuers` integer
      - `issuers` string[]
      - `wildcard_breadth` integer
      - `wildcard_names` string[]
      - `third_party_vendors` ThirdPartyVendor[]
        - `vendor` string, required
        - `source` string, required
        - `evidence` string, nullable
      - `weak_crypto_reasons` string[]
      - `certs_considered` integer
      - `certs_capped` boolean
      - `partial` boolean
      - `errors` string, nullable
    - `fetched_at` string, nullable
    - `partial` boolean
    - `errors` object, nullable
    - `cached` boolean
  - `parsed_extensions` ParsedExtensions: Customer-facing extension view parsed from the raw cert bytes (GH #205) — EKU, SAN breakdown by type, basic constraints and the embedded SCT list, so consumers don't have to parse PEM themselves.
    - `extended_key_usage` string[], nullable
    - `san_types` object
    - `basic_constraints` object, nullable
    - `sct_list` object[]
    - `is_precert_poisoned` boolean

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/ctindex/apis/certindex-api.md) · [All operations](https://skmtc.dev/ctindex/apis/certindex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ctindex/apis/certindex-api/revisions/d5bc0ec85bc9?raw)