Skip to main content

​
Certificate material

GET /v1/certificates/{certificate_id}/material is the only endpoint that returns the decrypted private key, along with the leaf and the chain. Every other read omits the key.
The IAM action is the only thing protecting this. certificate:GetCertificateMaterial is separate from certificate:GetCertificate, so reading and listing certificates does not reach the key. Nothing else narrows it — any principal holding the action gets the key, so grant it deliberately.
Use it wherever something needs to serve the certificate itself: installing it on a server you run, loading it into software the platform does not manage, or holding a copy alongside the rest of your configuration. The response carries a fingerprint next to the PEM blocks. Check it before replacing what you are currently serving — a renewed certificate has a new fingerprint, so comparing it tells you whether you have the generation you meant to install rather than the one you already had.
The console has no screen for this endpoint. Use the API or the CLI.
The private key is stored encrypted under the regional KMS key, so the ciphertext in the database is not usable on its own.