Fetch the current certificate, with its key when we hold one

For hostnames registered with certificate: "managed" or certificate: "csr". Returns the current chain and when it expires. private_key is present only on managed - on csr the key is yours and we never held it, so the field is absent rather than null.

Delivery is pull: we never connect to your infrastructure, so nothing is ever pushed to you. An expiring certificate is returned rather than withheld - a working agent keeps working through a renewal problem - and only an already-expired one is refused, because serving that would be worse than an error saying why.

A managed response contains a private key and is never cached: Cache-Control: no-store, private.

get/v1/hostnames/{id}/certificate

Request

  • Base URL: https://dnsmint.com/api
  • URL: https://dnsmint.com/api/v1/hostnames/{id}/certificate
  • Auth: HTTP bearer

Path parameters

idstring required

Response

The current certificate

certificatestring

PEM chain, leaf first.

private_keystring

PKCS#8 PEM. Present only on managed, where we generated it - our copy is encrypted at rest under a key separate from every other secret we store, and is replaced at every renewal. Absent on csr, because you hold that key and we never had it.

privateKeystring

Deprecated spelling, still accepted. Use private_key.

namesstring[]
expires_atstring date-time
expiresAtstring date-time

Deprecated spelling, still accepted. Use expires_at.

ca'letsencrypt' | 'google'

Which CA signed this certificate. The issuer, not the preference on the hostname - a renewal can land on a different CA than the original request asked for.

issuerstring

The CA's display name, for a log line or a status page.

mode'csr' | 'managed'

The hostname's certificate mode, so a client can tell whether private_key should be there.

Changes

No recorded changes to this operation across all 1 revision of this API.