---
title: Retrieve All Node Certificates
description: The REST API can be used to retrieve the node certificate for each
  node in the cluster.
pubDate: 2026-08-17T09:53:44.266Z
antora:
  editUrl: https://github.com/couchbaselabs/docs-enterprise-analytics/edit/release/2.0/modules/reference/pages/retrieve-all-node-certs.adoc
  xref: xref:2.0@enterprise-analytics:reference:retrieve-all-node-certs.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/enterprise-analytics/2.0/reference/retrieve-all-node-certs.html)

# Retrieve All Node Certificates

> The REST API can be used to retrieve the node certificate for each node in the cluster. 

## [](#http-method-and-uri)Http Method and URI

GET /pools/default/certificates

## [](#description)Description

Retrieves all node certificates in the cluster. Either the Full Admin or the Security Admin role is required.

This API _can_ be used on clusters that are running one or more nodes whose Couchbase-Server version is less than 7.1: however, such nodes are ignored, and their node certificates are not returned.

## [](#curl-syntax)Curl Syntax

The curl syntax for this call is as follows:

curl -X GET http://<ip-address-or-domain-name>:8091/pools/default/certificates
  -u <username>:<password>

## [](#responses)Responses

Success returns `200 OK` and an array, each of whose objects is a node certificate on the cluster.

A malformed URI fails with `404 Object Not Found`; failure to authenticate gives `401 Unauthorized`; and insufficient privileges gives `403 Forbidden`, with an error message such as `{"message":"Forbidden. User needs the following permissions","permissions":["cluster.admin.security!read"]}`. An incorrectly specified IP address or domain name causes the attempted connection to time out, with a `Failed to connect` notification.

## [](#example)Example

The following example returns each node certificate on the cluster of which node `10.144.220.101` is a member. Note that the [jq](https://stedolan.github.io/jq/) command is used, to facilitate readability of the output.

curl -X GET http://10.144.220.101:8091/pools/default/certificates -u Administrator:password | jq '.'

If successful, the call provides a response such as the following:

[
  {
    "node": "10.144.220.101:8091",
    "warnings": [],
    "subject": "CN=Couchbase Server",
    "expires": "2022-11-30T09:44:49.000Z",
    "type": "uploaded",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDgzCCAmugAwIBAgIUISlz/rod5BamUGP815ydZ8VJibEwDQYJKoZIhvcNAQEL\nBQAwHjEcMBoGA1UEAwwTQ291Y2hiYXNlIFJvb3QgQ0EgMTAeFw0yMTExMzAwOTQ0\nNDlaFw0yMjExMzAwOTQ0NDlaMBsxGTAXBgNVBAMMEENvdWNoYmFzZSBTZXJ2ZXIw\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgQVcD/DRqYs58Z2oQe+UY\nMZSe//5Ik4cevif20OUpgQw4JErC9njThGSnNlFMfby+W8PS5j7gL5n4f2BJ2uGj\nQijxiG02nWT93cWtUJeC31xKst8/CD5QRoivwNEC1lsAAShXO1h1slHk3KJfrhmh\nK2HOKh7KSxdGJp3QdafgT7ZVF6wnOmbEOpv9t5kAYomYlJN67NdgDhWY+BOzSuLr\nR0fHqGeb0PF8Q5wbu7d/3is/nCSJkEmY4NP1mn1ZaqJKvhQ7cJjjVroTJwxArpvd\nuA8r98KY+Q0UbXh/CZYyWIlN2CETucSWddcs/uaSP34UaU8qQvmlPFBcUvRymXdL\nAgMBAAGjgbswgbgwCQYDVR0TBAIwADAdBgNVHQ4EFgQUvZ6zRSW2iD1XQ6+mmdeI\nNqgHtXkwWQYDVR0jBFIwUIAUPky9VMpib76nx7QRW0KZiHMJSzKhIqQgMB4xHDAa\nBgNVBAMME0NvdWNoYmFzZSBSb290IENBIDGCFHryt6nXaaqYhNmt5CSiEKmRIimB\nMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAPBgNVHREECDAGhwQK\nkNxlMA0GCSqGSIb3DQEBCwUAA4IBAQCF5R7U/gq6IfdOwktNTECxTXQP02f5R3Hb\n77zlCTMLLft+pBBfLjBTDf07qfTGfbB6AyLEKFhWJReZB5CVpTlvhUBYcapjgsqN\nrbfsFq3gO1PELOmZP8fmAAXLu4DuSC+gULE5k8DcZOU1sInbAPV+yqBuynThsvqj\nyXgRVrSz+HekGxGyUBW2e3Qzq5nfYmqjQyxtkmY7JSG2F9ym6L00iMRisq1dwpq6\n+eR1DEU+8MjHFqrOkoBfmreWjFE2oN48WJfv7jWzU/D2hRJ/wJEnTBAGpSwQRBOD\naKe+EQvMRtQ+fJEGkVFj794IB6IwGDNYfySRoBgHSX1E7tpCKJ+K\n-----END CERTIFICATE-----\n\n",
    "privateKeyPassphrase": {}
  },
  {
    "node": "10.144.220.102:8091",
    "warnings": [],
    "subject": "CN=Couchbase Server",
    "expires": "2022-11-30T09:50:07.000Z",
    "type": "uploaded",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDgzCCAmugAwIBAgIUEMpUNCuJ0pyZzC0NVLezxNEHS8IwDQYJKoZIhvcNAQEL\nBQAwHjEcMBoGA1UEAwwTQ291Y2hiYXNlIFJvb3QgQ0EgMjAeFw0yMTExMzAwOTUw\nMDdaFw0yMjExMzAwOTUwMDdaMBsxGTAXBgNVBAMMEENvdWNoYmFzZSBTZXJ2ZXIw\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDawYhSc0xmLMm6lD8d3srW\nMuJEekgmToSsvb7PenvXtZciLrqKIbdFMlCUBUSdriCjBaGPFRSgZVde5w+ULHvE\navowSllakEh3WEx1HBzehtvjcl3HpGHSswOJp8SoK+qDAfR6rcPkDnjKSbVUUdHg\nehamEM1sU/FwQB7MKabNntZkLPOY6Bsav3L9ssGItlpoFkyjNN2gcs3ptC/JbWZC\n9+ckgNNz5ujqdhzhaY2bpk5rdZ4A0YfStRSgHQ2QOtzOf6PUwqtsNd/9VXQEx2gg\nHnZkunYaHjjlUMsMGhvmClMPSSff47VREWklCmASmyluS2yVNOBgupKrhUy+0f/L\nAgMBAAGjgbswgbgwCQYDVR0TBAIwADAdBgNVHQ4EFgQUVdtaa74QjG3xTo8WhXdS\naQeq4CUwWQYDVR0jBFIwUIAUh+tOj8zQs1zjQ+VgE1nsU7JoAEWhIqQgMB4xHDAa\nBgNVBAMME0NvdWNoYmFzZSBSb290IENBIDKCFAomhSzYbWZZr2/zWhD5vUSvm3KO\nMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAPBgNVHREECDAGhwQK\nkNxmMA0GCSqGSIb3DQEBCwUAA4IBAQBbv8UTm75is/HG+u9oDHYF2jrvN8mHiWua\nWR8VYkTNHNToZF6ps7W1cOzsTeu9+Bcj5LLfQ3SndvSHLruzYqCtnVcODOEt6xwG\nw6PZfEJNLjzlFszx/lOy4X73OqYBMbxSzovkOw8jAmZLxzrhsUGZjIElDISGd9eg\nMwegJ209zRu6SyHMaIAU/yEvxGZqK7tyYJHjjsTwYWW7CUB9gtKKPd+SVP7iGOu/\ngynUonVxFLP2g9BqmFvd1eEu60cilbj1PN0BjLtpN6h4xn3ueNYTl49X+5s5N1t9\n2d4SKxaWfCtBBEJbsTWWMsoDrM7N8yPTPkc5t7Ql4gsPZQirfico\n-----END CERTIFICATE-----\n\n",
    "privateKeyPassphrase": {}
  }
]

The returned array contains two JSON objects, indicating that two node certificates are defined for the cluster. Each object contains fields for warnings, the Subject Common Name, the expiry date, the type (whether _generated_ by Enterprise Analytics, or _uploaded_ by the administrator), the pem-encoded contents of the node certificate, and the passphrase for the private key (securely displayed as asterisks).

## [](#see-also)See Also

information about uploading and retrieving the cluster's root certificate with the REST API is provided in [Upload and Retrieve the Root Certificate](#reference:upload-retrieve-root-cert.adoc). A general introduction to certificates is provided in [Certificates](#learn:security/certificates.adoc). Routines for generating and deploying server and client certificates are provided in [Configure Server Certificates](../manage/manage-security/configure-server-certificates.md) and [Configure Client Certificates](../manage/manage-security/configure-client-certificates.md), respectively.