nsindocs Search the docs⌘K
API
  1. Docs
  2. API reference
  3. SSL

List the domain's certificates

gethttps://api.nsin.ir/domains/{domain}/ssl/certificates

Auth: Authorization: Bearer nsin_… or X-Api-Key: nsin_… — see API keys.

A domain can hold more than one certificate at a time: the one NSIN issues and renews for it, and any you upload. Only one of them answers the handshake for a given hostname — in_use_for says which hostnames each certificate is serving right now, and an empty in_use_for means the domain holds it but is serving something else.

covers is the subset of this domain's hostnames the certificate could serve, i.e. what selecting it would switch over. selectable is false when it cannot serve at all — expired, no stored private key, not trusted by browsers, or covering none of the domain's names — and reason says which.

Path parameters

  • domainstringrequiredpath

    The domain name (for example example.com) — not a numeric id.

Responses

200The domain's certificates, the one in use first.

Content type: application/json

  • certificatesarray of DomainCertificate
    Item fields
    • idinteger
    • sourcestring

      Where the certificate came from: acme (issued by NSIN), acme-staging, or uploaded.

      One of: "acme" "acme-staging" "uploaded"
    • managedboolean

      NSIN issues and renews this one.

    • subjectstring

      The certificate's subject.

    • issuerstring

      The certificate's issuer.

    • serial_numberstring

      Serial number, hex.

    • sansarray of string

      Every name on the certificate.

    • signature_algorithmstring

      Signature algorithm.

    • key_sizeinteger

      Public key size in bits.

    • is_wildcardboolean

      The certificate carries a wildcard name.

    • issued_atstring (date-time)

      Start of validity.

    • expires_atstring (date-time)

      End of validity.

    • days_remaininginteger

      Whole days until expiry, rounded up; 0 once expired.

    • expiredboolean

      Validity has ended.

    • trustedboolean

      The certificate chains to a public root. Absent when it has not been evaluated.

    • trust_notestring

      Why browsers would not accept it, phrased for the owner. Present when there is a problem.

    • leaf_onlyboolean

      The bundle carries no intermediate certificate.

    • has_private_keyboolean

      The private key is stored. Without it the edge cannot complete a handshake, so the certificate cannot be selected.

    • in_use_forarray of string

      The domain's hostnames this certificate is serving right now. Empty means the domain holds it but is serving something else.

    • coversarray of string

      The domain's hostnames this certificate could serve — what selecting it would switch over.

    • selectableboolean

      Whether this certificate can be selected right now.

    • reasonstring

      Why it cannot be, when selectable is false.

json
{
  "certificates": [
    {
      "id": 0,
      "source": "acme",
      "managed": true,
      "subject": "string",
      "issuer": "string",
      "serial_number": "string",
      "sans": [
        "string"
      ],
      "signature_algorithm": "string",
      "key_size": 0,
      "is_wildcard": true,
      "issued_at": "2026-01-01T00:00:00Z",
      "expires_at": "2026-01-01T00:00:00Z",
      "days_remaining": 0,
      "expired": true,
      "trusted": true,
      "trust_note": "string",
      "leaf_only": true,
      "has_private_key": true,
      "in_use_for": [
        "string"
      ],
      "covers": [
        "string"
      ],
      "selectable": true,
      "reason": "string"
    }
  ]
}
401Missing, malformed, revoked or expired API key. (A valid key whose account has been deactivated gets 403 account is inactive instead.)

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "invalid API key"
}
404No such domain, or it is not visible to this account. Domains you cannot access are reported as not found rather than forbidden.

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "read-only API key"
}
429The key exceeded its request budget (300 requests per minute by default).

Content type: application/json

  • errorstringrequired

    Human-readable description of what went wrong.

json
{
  "error": "rate limit exceeded"
}

Example request

bash
curl -X GET "https://api.nsin.ir/domains/example.com/ssl/certificates" \
  -H "Authorization: Bearer $NSIN_API_KEY"
esc