# certs

> openwaf-cloud ctl certs list shows a zone's edge certificates and the certificate status of each proxied site.

Edge certificates are the ones visitors see. OpenWAF issues and renews them automatically for every proxied site.

## certs list

```text
certs list <zone> [--json]
```

Prints two tables:

- **Certificates**: hostname, source (`acme` for automatic, or manual), expiry date, SHA-256 fingerprint and id.
- **Sites**: each proxied name with its certificate status (valid, pending or failed issuance), source, expiry, days left and any warning or error.

```sh
openwaf-cloud ctl certs list example.com
```

For certificates on your origin server, signed by the OpenWAF Origin CA, see [`origin-certs`](https://developers.openwaf.dev/cli/reference/origin-certs/).