> ## Documentation Index
> Fetch the complete documentation index at: https://docs.basaltic.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate material

> The one endpoint that returns the private key, and the single thing that gates it.

## Certificate material

`GET /v1/certificates/{certificate_id}/material` is the only endpoint that
returns the **decrypted private key**, along with the leaf and the chain. Every
other read omits the key.

<Warning>
  **The IAM action is the only thing protecting this.**
  `certificate:GetCertificateMaterial` is separate from
  `certificate:GetCertificate`, so reading and listing certificates does not
  reach the key. Nothing else narrows it — any principal holding the action
  gets the key, so grant it deliberately.
</Warning>

Use it wherever something needs to serve the certificate itself: installing it
on a server you run, loading it into software the platform does not manage, or
holding a copy alongside the rest of your configuration.

The response carries a `fingerprint` next to the PEM blocks. Check it before
replacing what you are currently serving — a renewed certificate has a new
fingerprint, so comparing it tells you whether you have the generation you
meant to install rather than the one you already had.

<Note>
  The console has no screen for this endpoint. Use the API or the CLI.
</Note>

The private key is stored encrypted under the regional KMS key, so the
ciphertext in the database is not usable on its own.