Docs API Issued certs

Issued certs

Fields

  • acme_key_id - Account key that ordered this cert.
  • cert_chain - Array of PEM-formatted intermediate certs.
  • directory_id - Directory to which this cert belongs.
  • expires_at - Cert expiration time.
  • id - CertFu’s ID for the cert, eg: icrt_sample123456.
  • object - Always issued_cert.
  • order_id - Order for this cert.
  • public_cert - PEM-formatted issued cert.
  • revoke_reason - Reason this cert was revoked.
  • signing_cert_id - Intermediate CA cert that signed this cert.
  • state - valid, expired, or revoked.
Required permissions
API Permission
List, Retrieve read
Revoke admin

List issued certs

Query params
  • acme_key_id - Filter by acme_key_id.
  • directory_id - Filter by directory_id.
  • signing_cert_id - Filter by signing_cert_id.
  • state - Filter by state.
  • Plus standard paging params.
    • direction - Default is desc.

At least one of acme_key_id, directory_id, or signing_cert_id is required.

Request
GET /v1/issued_certs?directory_id=dir_sample123456
Response

On success, 200 with 0 or more certs.

{
  "collection": [
    {
      "acme_key_id": "acmk_sample123456",
      "directory_id": "dir_sample123456",
      "expires_at": "2026-01-01T00:00:00Z",
      "id": "icrt_sample123456",
      "object": "issued_cert",
      "order_id": "ordr_sample123456",
      "revoke_reason": null,
      "signing_cert_id": "scrt_sample123456",
      "state": "valid",
      "subjects": [
        "example.com"
      ]
    }
  ],
  "more_results": false
}

Retrieve an issued cert

Request
GET /v1/issued_certs/icrt_sample123456
Response

On success, 200 with the cert.

{
  "acme_key_id": "acmk_sample123456",
  "cert_chain": [
    "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----"
  ],
  "directory_id": "dir_sample123456",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "icrt_sample123456",
  "object": "issued_cert",
  "order_id": "ordr_sample123456",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "revoke_reason": null,
  "signing_cert_id": "scrt_sample123456",
  "state": "valid",
  "subjects": [
    "example.com"
  ]
}

Revoke an issued cert

Params
  • reason - Numeric reason for revocation
  • revoke_reason - String reason for revocation

Only one of reason or revoke_reason should be given. If neither is given, defaults to 0 / unspecified.

Reasons
reason  revoke_reason
   0     unspecified
   1     key_compromise
   2     ca_compromise
   3     affiliation_changed
   4     superseded
   5     cessation_of_operation
   9     privilege_withdrawn
  10     aa_compromise
Request
DELETE /v1/issued_certs/icrt_sample123456

{
  "issued_cert": {
    "reason": 1
  }
}
Response

On success, 200 with the updated cert.

{
  "acme_key_id": "acmk_sample123456",
  "directory_id": "dir_sample123456",
  "expires_at": "2026-01-01T00:00:00Z",
  "id": "icrt_sample123456",
  "object": "issued_cert",
  "order_id": "ordr_sample123456",
  "public_cert": "-----BEGIN CERTIFICATE-----\n(sample)\n-----END CERTIFICATE-----",
  "revoke_reason": "key_compromise",
  "signing_cert_id": "scrt_sample123456",
  "state": "revoked",
  "subjects": [
    "example.com"
  ]
}

On error, 422 with standard error response.