Get SSL certificates Generally available; Added in 6.2.0

GET /_ssl/certificates
Api key auth Basic auth Bearer auth

Get information about the X.509 certificates that are used to encrypt communications in the cluster. The API returns a list that includes certificates from all TLS contexts including:

  • Settings for transport and HTTP interfaces
  • TLS settings that are used within authentication realms
  • TLS settings for remote monitoring exporters

The list includes certificates that are used for configuring trust, such as those configured in the xpack.security.transport.ssl.truststore and xpack.security.transport.ssl.certificate_authorities settings. It also includes certificates that are used for configuring server identity, such as xpack.security.http.ssl.keystore and xpack.security.http.ssl.certificate settings.

The list does not include certificates that are sourced from the default SSL context of the Java Runtime Environment (JRE), even if those certificates are in use within Elasticsearch.

NOTE: When a PKCS#11 token is configured as the truststore of the JRE, the API returns all the certificates that are included in the PKCS#11 token irrespective of whether these are used in the Elasticsearch TLS configuration.

If Elasticsearch is configured to use a keystore or truststore, the API output includes all certificates in that store, even though some of the certificates might not be in active use within the cluster.

Required authorization

  • Cluster privileges: monitor
External documentation

Responses

  • 200 application/json
    Hide response attributes Show response attributes object

    • alias string | null Required

      If the path refers to a container file (a jks keystore, or a PKCS#12 file), it is the alias of the certificate. Otherwise, it is null.

      One of:
      string-1 string string-2 string | null

    • expiry string | number Required

      A date and time, either as a string whose format can depend on the context (defaulting to ISO 8601), or a number of milliseconds since the Epoch. Elasticsearch accepts both as input, but will generally output a string representation.

      One of:
      string-1 string UnitMillis number

      Time unit for milliseconds

    • format string Required

      The format of the file. Valid values include jks, PKCS12, and PEM.

    • has_private_key boolean Required

      Indicates whether Elasticsearch has access to the private key for this certificate.

    • issuer string

      The Distinguished Name of the certificate's issuer.

    • path string Required

      The path to the certificate, as configured in the elasticsearch.yml file.

    • serial_number string Required

      The hexadecimal representation of the certificate's serial number.

    • subject_dn string Required

      The Distinguished Name of the certificate's subject.
GET /_ssl/certificates 
GET /_ssl/certificates 
resp = client.ssl.certificates()
const response = await client.ssl.certificates();
response = client.ssl.certificates
$resp = $client->ssl()->certificates();
curl -X GET -H "Authorization: ApiKey $ELASTIC_API_KEY" "$ELASTICSEARCH_URL/_ssl/certificates"
Response examples (200)
A successful response from `GET /_ssl/certificates`, which provides information about the certificates on a single node of Elasticsearch. 
[ { "path": "certs/elastic-certificates.p12", "format": "PKCS12", "alias": "instance", "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA", "serial_number": "a20f0ee901e8f69dc633ff633e5cd5437cdb4137", "has_private_key": false, "expiry": "2021-01-15T20:42:49.000Z" }, { "path": "certs/elastic-certificates.p12", "format": "PKCS12", "alias": "ca", "subject_dn": "CN=Elastic Certificate Tool Autogenerated CA", "serial_number": "a20f0ee901e8f69dc633ff633e5cd5437cdb4137", "has_private_key": false, "expiry": "2021-01-15T20:42:49.000Z" }, { "path": "certs/elastic-certificates.p12", "format": "PKCS12", "alias": "instance", "subject_dn": "CN=instance", "serial_number": "fc1905e1494dc5230218d079c47a617088f84ce0", "has_private_key": true, "expiry": "2021-01-15T20:44:32.000Z" } ]