# Edge certificates

> List the TLS certificates of a zone and the certificate status of each proxied site.

OpenWAF issues and renews the edge certificates of every proxied name automatically (ACME). This endpoint lists them, never with their private keys, together with the status of each site.

| Operation | Endpoint |
|---|---|
| [List certificates](https://developers.openwaf.dev/api/certificates/#list-certs) | `GET /v1/orgs/{org}/zones/{zone}/certs` |

## List certificates

```http
GET /v1/orgs/{org}/zones/{zone}/certs
```

Lists the TLS certificates of the zone, never with their private keys, with their ACME issuance status, and the certificate status of each proxied site in `sites` (valid, pending or failed issuance, days left).

**Required role:** `readonly` or higher.

#### Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `org` | path | string (uuid) | Yes | Organization id. Every route checks that it is the token's organization (otherwise `404`). |
| `zone` | path | string (uuid) | Yes | Zone id (see [List zones](https://developers.openwaf.dev/api/zones/#list-zones)). |

#### Response

- `200`: Returns an object with the fields below.

| Field | Type | Description |
|---|---|---|
| `items` | array of object |  |
| `items[].id` | string (uuid) | Id. |
| `items[].zone_id` | string (uuid) | Zone id. |
| `items[].hostname` | string |  |
| `items[].cert_pem` | string |  |
| `items[].fingerprint_sha256` | string | SHA-256 fingerprint of the certificate. |
| `items[].not_after` | string (date-time) | End of validity. |
| `items[].source` | string | manual = uploaded by OpenWAF; acme = issued automatically with ACME. One of `manual`, `acme`. |
| `items[].uploaded_by` | string |  |
| `items[].created_at` | string (date-time) | Creation time. |
| `items[].issuance` | [ACMEIssuance](https://developers.openwaf.dev/api/schemas/#acme-issuance) |  |
| `sites` | array of [HostCertStatus](https://developers.openwaf.dev/api/schemas/#host-cert-status) |  |

#### Example

**curl**


```sh
curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/zones/6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d/certs" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```

**TypeScript**


```ts
import { OpenWAF } from "./openwaf";

const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.listCerts({
  zone: "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d"
});
```

**Python**


```py
from openwaf import OpenWAF

owf = OpenWAF(base_url="https://dash.openwaf.dev")  # token from OPENWAF_TOKEN
result = owf.list_certs(zone="6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d")
```



```json
{
  "items": [
    {
      "id": "a5614527-0ce6-43be-ad1d-d012b7394867",
      "zone_id": "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
      "hostname": "www.example.com",
      "cert_pem": "example",
      "fingerprint_sha256": "example",
      "not_after": "2026-10-27T09:30:00Z",
      "source": "manual",
      "created_at": "2026-10-27T09:30:00Z",
      "issuance": {
        "name": "example.com",
        "names": [],
        "state": "pending",
        "challenge": "example",
        "last_error": "",
        "failures": 0,
        "next_attempt_at": "2026-10-27T09:30:00Z",
        "last_attempt_at": "2026-10-27T09:30:00Z",
        "last_success_at": "2026-10-27T09:30:00Z",
        "updated_at": "2026-10-27T09:30:00Z"
      }
    }
  ],
  "sites": [
    {
      "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
      "zone_id": "6f1d2c3b-8a4e-4b7d-9c21-5e3f7a8b9c0d",
      "zone": "example.com",
      "dns_mode": "delegated",
      "hostname": "www.example.com",
      "state": "valid",
      "source": "",
      "cert_id": "2e0a4ad6-9d2a-4999-a9cb-f10436c964f5",
      "cert_name": "example",
      "not_after": "2026-10-27T09:30:00Z",
      "days_left": 0,
      "challenge": "example",
      "last_error": "",
      "failures": 0,
      "next_attempt_at": "2026-10-27T09:30:00Z",
      "last_attempt_at": "2026-10-27T09:30:00Z",
      "warning": ""
    }
  ]
}
```