---
title: "Fetch the current certificate, with its key when we hold one"
method: GET
path: "/v1/hostnames/{id}/certificate"
---

# Fetch the current certificate, with its key when we hold one

`GET /v1/hostnames/{id}/certificate`

## Request

- Base URL: `https://dnsmint.com/api`
- URL: `https://dnsmint.com/api/v1/hostnames/{id}/certificate`
- Auth: HTTP bearer

For hostnames registered with certificate: "managed" or certificate: "csr". Returns the current chain and when it expires. `private_key` is present only on managed - on csr the key is yours and we never held it, so the field is absent rather than null.

Delivery is pull: we never connect to your infrastructure, so nothing is ever pushed to you. An expiring certificate is returned rather than withheld - a working agent keeps working through a renewal problem - and only an already-expired one is refused, because serving that would be worse than an error saying why.

A managed response contains a private key and is never cached: `Cache-Control: no-store, private`.

## Path parameters

- `id` string, required

## Response `200`

The current certificate

- ManagedCertificate
  - `certificate` string: PEM chain, leaf first.
  - `private_key` string: PKCS#8 PEM. Present only on managed, where we generated it - our copy is encrypted at rest under a key separate from every other secret we store, and is replaced at every renewal. Absent on csr, because you hold that key and we never had it.
  - `privateKey` string: Deprecated spelling, still accepted. Use `private_key`.
  - `names` string[]
  - `expires_at` string, date-time
  - `expiresAt` string, date-time: Deprecated spelling, still accepted. Use `expires_at`.
  - `ca` 'letsencrypt' | 'google': Which CA signed this certificate. The issuer, not the preference on the hostname - a renewal can land on a different CA than the original request asked for.
  - `issuer` string: The CA's display name, for a log line or a status page.
  - `mode` 'csr' | 'managed': The hostname's certificate mode, so a client can tell whether private_key should be there.

## Other responses

- `401`: Missing or invalid API key
- `403`: Key lacks hostnames:read, or is narrowed to another hostname
- `404`: Hostname not found, or nothing issued for it yet
- `409`: The hostname is certificate: "self", or the certificate has expired and renewal has not completed

---

[API](https://skmtc.dev/dnsmint/apis/dnsmint-api.md) · [All operations](https://skmtc.dev/dnsmint/apis/dnsmint-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dnsmint/apis/dnsmint-api/revisions/98fb1f87725a?raw)