AWS Certificate Manager
API Reference (API Version 2015-12-08)


Retrieves a certificate specified by an ARN and its certificate chain . The chain is an ordered list of certificates that contains the end entity certificate, intermediate certificates of subordinate CAs, and the root certificate in that order. The certificate and certificate chain are base64 encoded. If you want to decode the certificate to see the individual fields, you can use OpenSSL.

Request Syntax

{ "CertificateArn": "string" }

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.


In the following list, the required parameters are described first.


String that contains a certificate ARN in the following format:


For more information about ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces.

Type: String

Length Constraints: Minimum length of 20. Maximum length of 2048.

Pattern: arn:[\w+=/,.@-]+:[\w+=/,.@-]+:[\w+=/,.@-]*:[0-9]+:[\w+=,.@-]+(/[\w+=,.@-]+)*

Required: Yes

Response Syntax

{ "Certificate": "string", "CertificateChain": "string" }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


String that contains the ACM certificate represented by the ARN specified at input.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 32768.

Pattern: -{5}BEGIN CERTIFICATE-{5}\u000D?\u000A([A-Za-z0-9/+]{64}\u000D?\u000A)*[A-Za-z0-9/+]{1,64}={0,2}\u000D?\u000A-{5}END CERTIFICATE-{5}(\u000D?\u000A)?


The certificate chain that contains the root certificate issued by the certificate authority (CA).

Type: String

Length Constraints: Minimum length of 1. Maximum length of 2097152.

Pattern: (-{5}BEGIN CERTIFICATE-{5}\u000D?\u000A([A-Za-z0-9/+]{64}\u000D?\u000A)*[A-Za-z0-9/+]{1,64}={0,2}\u000D?\u000A-{5}END CERTIFICATE-{5}\u000D?\u000A)*-{5}BEGIN CERTIFICATE-{5}\u000D?\u000A([A-Za-z0-9/+]{64}\u000D?\u000A)*[A-Za-z0-9/+]{1,64}={0,2}\u000D?\u000A-{5}END CERTIFICATE-{5}(\u000D?\u000A)?


For information about the errors that are common to all actions, see Common Errors.


The requested Amazon Resource Name (ARN) does not refer to an existing resource.

HTTP Status Code: 400


The certificate request is in process and the certificate in your account has not yet been issued.

HTTP Status Code: 400


The specified certificate cannot be found in the caller's account or the caller's account cannot be found.

HTTP Status Code: 400


Get an ACM Certificate

Sample Request

POST / HTTP/1.1 Host: X-Amz-Target: CertificateManager.GetCertificate X-Amz-Date: 20151221T210018Z User-Agent: aws-cli/1.9.7 Python/2.7.3 Linux/3.13.0-71-generic botocore/1.3.7 Content-Type: application/x-amz-json-1.1 Authorization: AWS4-HMAC-SHA256 Credential=AKIAI44QH8DHBEXAMPLE/20151221/us-east-1/acm/aws4_request, SignedHeaders=content-type;host;user-agent;x-amz-date;x-amz-target, Signature=b51b4c2d5518473a8552fdab8e313c76254e9ca64e4d8ab69c2ebef83dbd459b { "CertificateArn": "arn:aws:acm:us-east-1:111122223333:certificate/12345678-1234-1234-1234-123456789012" }

Sample Response

HTTP/1.1 200 OK x-amzn-RequestId: d5300b5a-a825-11e5-9141-fbb8a078e3eb Content-Type: application/x-amz-json-1.1 Content-Length: 6506 Date: Mon, 21 Dec 2015 21:00:15 GMT { "Certificate": "------BEGIN CERTIFICATE-----Base64-encoded-----END CERTIFICATE-----", "CertificateChain": "------BEGIN CERTIFICATE-----Base64-encoded-----END CERTIFICATE-----" "------BEGIN CERTIFICATE-----Base64-encoded-----END CERTIFICATE-----" "------BEGIN CERTIFICATE-----Base64-encoded-----END CERTIFICATE-----" }

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: