---
type: api
title: Get certificate authority
description: Returns the certificate authority used to sign the certificates of this deployment.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-deployment-certificate-authority
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/operation/operation-get-deployment-certificate-authority
products:
  - Elastic Cloud Enterprise
---

# Get certificate authority

## Paths

- `GET` `/deployments/{deployment_id}/certificate-authority`

- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#basicauth)
- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/cloud-enterprise/v4/authentication#apikey)

#### Path Parameters

- `deployment_id` (string)
  Identifier for the Deployment.

## Description

Returns the certificate authority used to sign the certificates of this deployment.

## Responses

#### `200`

The certificate authority used to sign the certificates of this deployment

`application/json`

- `recommended_trust_restriction` (string)
  The trust restriction expression to use that would provide trust with the Elasticsearch nodes of this deployment
- `public_certificates` ([] PublicCertificate)
  The certificates used by this certificate authority. The active certificate is the one that has been used to sign the current certificates of the Elasticsearch instances. All others are either certificates used in the past or certificates that will be used in the future when the currently active certificate expires.
  - `active` (boolean)
    If true, this certificate is the one which has been used to sign the current certificates. Otherwise, it may be the one that will be used when this certificate expires.
  - `pem` (string)
    The public certificate as string in PEM format.
  - `metadata` ({} CertificateMetaData)
    The certificate MetaData
    - `fingerprint` (string)
      The fingerprint of the certificate
    - `valid_to` (string)
      The expiry date of the certificate in UTC
    - `valid_from` (string)
      The valid from date of the certificate in UTC
    - `also_trusted_by` ([] string)
      Other deployments also trusting this certificate
#### `404`

* The Deployment specified by {deployment_id} cannot be found. (code: `deployments.deployment_not_found`)
* The Elasticsearch Resource cannot be found. (code: `deployments.deployment_resource_not_found`)

`application/json`

- `errors` ([] BasicFailedReplyElement)
  A list of errors that occurred in the failing request
  - `code` (string)
    A structured code representing the error type that occurred
  - `message` (string)
    A human readable message describing the error that occurred
  - `fields` ([] string)
    If the error can be tied to a specific field or fields in the user request, this lists those fields
##### Response Headers

- `x-cloud-error-codes` (enum)
  The error codes associated with the response

## Code Examples

#### Console

```console
GET /deployments/{deployment_id}/certificate-authority
```

#### curl

```curl
curl -X GET "/deployments/{deployment_id}/certificate-authority"
```