---
type: api
title: Get SSL certificates
description: Get information about the X.509 certificates that are used to encrypt communications in the cluster.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ssl-certificates
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-ssl-certificates
products:
  - Elasticsearch
---

# Get SSL certificates

Availability: 6.2+

## Paths

- `GET` `/_ssl/certificates`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

## Description

Get information about the X.509 certificates that are used to encrypt communications in the cluster.
The API returns a list that includes certificates from all TLS contexts including:

- Settings for transport and HTTP interfaces
- TLS settings that are used within authentication realms
- TLS settings for remote monitoring exporters

The list includes certificates that are used for configuring trust, such as those configured in the `xpack.security.transport.ssl.truststore` and `xpack.security.transport.ssl.certificate_authorities` settings.
It also includes certificates that are used for configuring server identity, such as `xpack.security.http.ssl.keystore` and `xpack.security.http.ssl.certificate settings`.

The list does not include certificates that are sourced from the default SSL context of the Java Runtime Environment (JRE), even if those certificates are in use within Elasticsearch.

NOTE: When a PKCS#11 token is configured as the truststore of the JRE, the API returns all the certificates that are included in the PKCS#11 token irrespective of whether these are used in the Elasticsearch TLS configuration.

If Elasticsearch is configured to use a keystore or truststore, the API output includes all certificates in that store, even though some of the certificates might not be in active use within the cluster.

## Required authorization

* Cluster privileges: `monitor`

[About setting up transport tls](https://www.elastic.co/docs/deploy-manage/security/set-up-basic-security#encrypt-internode-communication)

## Response

`application/json`

Type: `[] CertificateInformation`

- `alias` (union string) — nullable
  If the path refers to a container file (a jks keystore, or a PKCS#12 file), it is the alias of the certificate.
Otherwise, it is null.
  One of: `string`
- `expiry` (DateTime)
  The ISO formatted date of the certificate's expiry (not-after) date.
- `format` (string)
  The format of the file.
Valid values include `jks`, `PKCS12`, and `PEM`.
- `has_private_key` (boolean)
  Indicates whether Elasticsearch has access to the private key for this certificate.
- `issuer` (string)
  The Distinguished Name of the certificate's issuer.
- `path` (string)
  The path to the certificate, as configured in the `elasticsearch.yml` file.
- `serial_number` (string)
  The hexadecimal representation of the certificate's serial number.
- `subject_dn` (string)
  The Distinguished Name of the certificate's subject.
## Code Examples

#### Console

```console
GET /_ssl/certificates
```

#### JavaScript

```javascript
const response = await client.ssl.certificates();
```

#### Python

```python
resp = client.ssl.certificates()
```

#### curl

```curl
curl -X GET "$ELASTICSEARCH_URL/_ssl/certificates" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"
```

#### Java

```java
client.ssl().certificates();
```

#### C#

```c#
var response = await client.Certificates.CertificatesAsync();
```

#### PHP

```php
$resp = $client->ssl()->certificates();
```

#### Ruby

```ruby
response = client.ssl.certificates
```

## Response Examples

#### Get certificates response example1

A successful response from `GET /_ssl/certificates`, which provides information about the certificates on a single node of Elasticsearch.

```json
[
  {
    "path": "certs/elastic-certificates.p12",
    "format": "PKCS12",
    "alias": "instance",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "a20f0ee901e8f69dc633ff633e5cd5437cdb4137",
    "has_private_key": false,
    "expiry": "2021-01-15T20:42:49.000Z"
  },
  {
    "path": "certs/elastic-certificates.p12",
    "format": "PKCS12",
    "alias": "ca",
    "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA",
    "serial_number": "a20f0ee901e8f69dc633ff633e5cd5437cdb4137",
    "has_private_key": false,
    "expiry": "2021-01-15T20:42:49.000Z"
  },
  {
    "path": "certs/elastic-certificates.p12",
    "format": "PKCS12",
    "alias": "instance",
    "subject_dn": "CN=instance",
    "serial_number": "fc1905e1494dc5230218d079c47a617088f84ce0",
    "has_private_key": true,
    "expiry": "2021-01-15T20:44:32.000Z"
  }
]
```