---
title: "GET /api/v1/cert-manager/certificates/{id}"
method: GET
path: "/api/v1/cert-manager/certificates/{id}"
tags: ["PKI Certificates"]
---

# GET /api/v1/cert-manager/certificates/{id}

`GET /api/v1/cert-manager/certificates/{id}`

Get certificate

## Path parameters

- `id` string, uuid, required

## Response `200`

Default Response

- object
  - `certificate` object, required
    - `id` string, uuid, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `caId` string, uuid, nullable
    - `status` string, required
    - `serialNumber` string, required
    - `friendlyName` string, required
    - `commonName` string, required
    - `notBefore` string, date-time, required
    - `notAfter` string, date-time, required
    - `revokedAt` string, date-time, nullable
    - `revocationReason` number, nullable
    - `altNames` string, nullable
    - `caCertId` string, uuid, nullable
    - `certificateTemplateId` string, uuid, nullable
    - `keyUsages` string[], nullable
    - `extendedKeyUsages` string[], nullable
    - `pkiSubscriberId` string, uuid, nullable
    - `profileId` string, uuid, nullable
    - `renewBeforeDays` number, nullable
    - `renewedFromCertificateId` string, uuid, nullable
    - `renewedByCertificateId` string, uuid, nullable
    - `renewalError` string, nullable
    - `keyAlgorithm` string, nullable
    - `signatureAlgorithm` string, nullable
    - `subjectOrganization` string, nullable
    - `subjectOrganizationalUnit` string, nullable
    - `subjectCountry` string, nullable
    - `subjectState` string, nullable
    - `subjectLocality` string, nullable
    - `fingerprintSha256` string, nullable
    - `fingerprintSha1` string, nullable
    - `isCA` boolean, nullable
    - `pathLength` number, nullable
    - `source` string, nullable
    - `discoveryMetadata` unknown
    - `externalMetadata` unknown
    - `applicationId` string, uuid, nullable
    - `keySource` string
    - `hsmConnectorId` string, uuid, nullable
    - `hsmKeyLabel` string, nullable
    - `hsmPublicKeySpki` unknown
    - `subjectDomainComponents` string, nullable
    - `subject` object
      - `commonName` string
      - `organization` string
      - `organizationalUnit` string
      - `country` string
      - `state` string
      - `locality` string
      - `domainComponents` string[]
    - `fingerprints` object
      - `sha256` string, required
      - `sha1` string
    - `basicConstraints` object
      - `isCA` boolean, required
      - `pathLength` number
    - `caName` string, nullable
    - `caType` 'internal' | 'external', nullable
    - `profileName` string, nullable
    - `applicationName` string, nullable
    - `hasPrivateKey` boolean, required — Whether Infisical holds the private key for this certificate.
    - `latestRenewalCertificateId` string, uuid, nullable — The ID of the newest certificate that has replaced this one through renewal, or null if no newer replacement is available. Revoked certificates are never named, so this is null when this certificate has never been renewed and also when every renewal of it has since been revoked. Use this to follow renewals without walking the chain one certificate at a time.
    - `metadata` object[]
      - `key` string, required
      - `value` string, required

## Other responses

- `400` — Default Response
- `401` — Default Response
- `403` — Default Response
- `404` — Default Response
- `422` — Default Response
- `500` — Default Response

## Changes

- **2026-08-27** `e15904efcbcd` — 1 info
  - added the optional property `certificate/latestRenewalCertificateId` to the response with the `200` status
- **2026-08-23** `d87fa2e5de58` — 1 info
  - added the required property `certificate/hasPrivateKey` to the response with the `200` status
- **2026-08-08** `885aef3e6c11` — 1 breaking
  - for the `path` request parameter `id`, the type/format was changed from `string`/`` to `string`/`uuid`
- **2026-07-21** `5dbb77aad0f5` — 2 info
  - added the optional property `certificate/subject/domainComponents` to the response with the `200` status
  - added the optional property `certificate/subjectDomainComponents` to the response with the `200` status

[Change history](https://skmtc.dev/infisical/apis/infisical-api/changes/api/v1/cert-manager/certificates/:id/get.md)

---

[API](https://skmtc.dev/infisical/apis/infisical-api.md) · [All operations](https://skmtc.dev/infisical/apis/infisical-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/infisical/infisical-api/revisions/763e38e78337/schema)