certificates

Get Certificate

Return full certificate details for the given SHA-256.

Raw cert bytes were moved out of the hot certificates table in task #66; pass ?include_raw=true to opt in to the join against certificates_raw. Without that flag the route never touches the cold table and never allocates the cert body in memory.

get/v1/certificates/{sha256}

Request

  • Base URL: https://api.ctindex.io
  • URL: https://api.ctindex.io/v1/certificates/{sha256}
  • Auth: one of:
    • API key in header X-API-Key
    • HTTP bearer

Path parameters

sha256string required

Query parameters

include_rawboolean

When true, fetch the raw cert bytes from cold storage and return them as PEM in raw_pem. Defaults to false so the hot detail path stays small (task #66 hot/cold split). A 202 raw_pending response means the upstream fetch continues in the background — retry the same call at most 3 times; a 410 raw_unavailable response is TERMINAL (task #755): stop retrying and fetch the leaf from the upstream CT log via log_id/leaf_index.

include_enrichmentboolean

When true, attach RDAP registration + live DNS + ASN/hosting context for the certificate's primary hostname under enrichment (task #501). Opt-in; a slow/failed source degrades to a partial block and never fails the lookup.

include_parsed_extensionsboolean

When true, parse the raw cert bytes and attach the parsed_extensions view (EKU, SAN types, basic constraints, SCT list — GH #205). Best-effort: when the raw bytes are not in cold storage the view is omitted rather than failing the lookup.

Cookies

ctix_sessionstring nullable

Response

Successful Response

sha256string required
subject_cnstring nullable
subject_ostring nullable
sansstring[]
issuer_cnstring nullable
issuer_ostring nullable
not_beforestring date-time nullable
not_afterstring date-time nullable
is_wildcardboolean
is_precertboolean

True when this row is a CT precertificate (poison-extension log entry), False for a final leaf certificate. Precert and final-leaf twins have different SHA-256 hashes and are returned as separate rows; present on every list and detail row. Exception (GH #262): get_expiring_certs collapses twin pairs to the final leaf by default.

precert_sha256string nullable

SHA-256 fingerprint of the CT precertificate twin that was collapsed into this final-leaf row (get_expiring_certs default twin collapsing, GH #262). Omitted when no twin was collapsed.

key_typestring nullable
key_sizeinteger nullable
signature_algorithmstring nullable
is_weak_cryptoboolean nullable
key_fields_sourcestring nullable
first_seenstring date-time nullable

When CertIndex wrote this certificate to its database (batch-write timestamp). Multiple unrelated certificates often share an identical first_seen within the same ingestion batch. It is not the CT-log append time and is never substituted for a missing logged_at. Compare with logged_at to measure detection latency.

logged_atstring date-time nullable

Timestamp from the CT log entry itself (MerkleTreeLeaf TimestampedEntry.timestamp, RFC 6962 §3.4) — when the log committed this certificate, NOT when CertIndex ingested it. Null for rows indexed before this field shipped, for crt.sh-sourced rows (reconciled_from_crtsh=true), and for any path that could not supply it. A null value means the CT-log timestamp is unavailable for that row; it does not mean the certificate was observed at first_seen, and first_seen is never synthesized into logged_at. Compare with first_seen (CertIndex write time) to measure detection latency. See logged_at_coverage disclosure block.

reconciled_from_crtshboolean nullable
last_seenstring date-time nullable
match_classstring nullable

Attribution class when match_class_filter was supplied on search: first_party, lookalike_candidate, third_party_integration, substring_collision, or shared_hosting. Null on unfiltered search.

match_reasonstring nullable

Semicolon-separated rule=value audit string for match_class. Null on unfiltered search.

from_cold_tierboolean nullable

True when this certificate was served exclusively from the Tier 1 cold ClickHouse index (historical data not present in the hot Neon index). Absent/null for certificates served from the primary index. Cold-sourced rows carry key_fields_source='unavailable' and no raw_pem.

raw_pemstring nullable
log_idstring nullable
leaf_indexinteger nullable

Changes

No recorded changes to this operation across all 1 revision of this API.