---
title: Retrieve All Node Certificates
description: The REST API can be used to retrieve the node certificate for each
  node in the cluster.
pubDate: 2026-10-19T14:21:08.937Z
meta:
  component:
    title: Operational Insights Enterprise
    version: "3.0"
  topic_type: reference
antora:
  editUrl: https://github.com/couchbaselabs/docs-enterprise-analytics/edit/release/3.0/modules/reference/pages/retrieve-all-node-certs.adoc
  xref: xref:enterprise-analytics:reference:retrieve-all-node-certs.adoc[]
---

[Consult the llms.txt file for a full list of contents](/llms.txt)
[View original HTML](/operational-insights/current/reference/retrieve-all-node-certs.html)

# Retrieve All Node Certificates

> The REST API can be used to retrieve the node certificate for each node in the cluster. 

## [](#http-method-and-uri)Http Method and URI

GET /pools/default/certificates

## [](#description)Description

Retrieves all node certificates in the cluster. Either the Full Admin or the Security Admin role is required.

## [](#curl-syntax)Curl Syntax

The curl syntax for this call is as follows:

curl -X GET http://<ip-address-or-domain-name>:8091/pools/default/certificates
  -u <username>:<password>

## [](#responses)Responses

Success returns `200 OK` and an array, each of whose objects is a node certificate on the cluster.

A malformed URI fails with `404 Object Not Found`; failure to authenticate gives `401 Unauthorized`; and insufficient privileges gives `403 Forbidden`, with an error message such as `{"message":"Forbidden. User needs the following permissions","permissions":["cluster.admin.security!read"]}`. An incorrectly specified IP address or domain name causes the attempted connection to time out, with a `Failed to connect` notification.

## [](#example)Example

The following example returns each node certificate on the cluster of which node `10.144.220.101` is a member. Note that the [jq](https://jqlang.org/) command is used, to facilitate readability of the output.

curl -X GET http://10.144.220.101:8091/pools/default/certificates -u Administrator:password | jq '.'

If successful, the call provides a response such as the following:

[
  {
    "node": "10.144.220.101:8091",
    "warnings": [],
    "subject": "CN=Couchbase Server",
    "expires": "2022-11-30T09:44:49.000Z",
    "type": "uploaded",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDgzCCAmugAwIBAgIUISlz/rod5BamUGP815ydZ8VJibEwDQYJKoZIhvcNAQEL\nBQAwHjEcMBoGA1UEAwwTQ291Y2hiYXNlIFJvb3QgQ0EgMTAeFw0yMTExMzAwOTQ0\nNDlaFw0yMjExMzAwOTQ0NDlaMBsxGTAXBgNVBAMMEENvdWNoYmFzZSBTZXJ2ZXIw\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDgQVcD/DRqYs58Z2oQe+UY\nMZSe//5Ik4cevif20OUpgQw4JErC9njThGSnNlFMfby+W8PS5j7gL5n4f2BJ2uGj\nQijxiG02nWT93cWtUJeC31xKst8/CD5QRoivwNEC1lsAAShXO1h1slHk3KJfrhmh\nK2HOKh7KSxdGJp3QdafgT7ZVF6wnOmbEOpv9t5kAYomYlJN67NdgDhWY+BOzSuLr\nR0fHqGeb0PF8Q5wbu7d/3is/nCSJkEmY4NP1mn1ZaqJKvhQ7cJjjVroTJwxArpvd\nuA8r98KY+Q0UbXh/CZYyWIlN2CETucSWddcs/uaSP34UaU8qQvmlPFBcUvRymXdL\nAgMBAAGjgbswgbgwCQYDVR0TBAIwADAdBgNVHQ4EFgQUvZ6zRSW2iD1XQ6+mmdeI\nNqgHtXkwWQYDVR0jBFIwUIAUPky9VMpib76nx7QRW0KZiHMJSzKhIqQgMB4xHDAa\nBgNVBAMME0NvdWNoYmFzZSBSb290IENBIDGCFHryt6nXaaqYhNmt5CSiEKmRIimB\nMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAPBgNVHREECDAGhwQK\nkNxlMA0GCSqGSIb3DQEBCwUAA4IBAQCF5R7U/gq6IfdOwktNTECxTXQP02f5R3Hb\n77zlCTMLLft+pBBfLjBTDf07qfTGfbB6AyLEKFhWJReZB5CVpTlvhUBYcapjgsqN\nrbfsFq3gO1PELOmZP8fmAAXLu4DuSC+gULE5k8DcZOU1sInbAPV+yqBuynThsvqj\nyXgRVrSz+HekGxGyUBW2e3Qzq5nfYmqjQyxtkmY7JSG2F9ym6L00iMRisq1dwpq6\n+eR1DEU+8MjHFqrOkoBfmreWjFE2oN48WJfv7jWzU/D2hRJ/wJEnTBAGpSwQRBOD\naKe+EQvMRtQ+fJEGkVFj794IB6IwGDNYfySRoBgHSX1E7tpCKJ+K\n-----END CERTIFICATE-----\n\n",
    "privateKeyPassphrase": {}
  },
  {
    "node": "10.144.220.102:8091",
    "warnings": [],
    "subject": "CN=Couchbase Server",
    "expires": "2022-11-30T09:50:07.000Z",
    "type": "uploaded",
    "pem": "-----BEGIN CERTIFICATE-----\nMIIDgzCCAmugAwIBAgIUEMpUNCuJ0pyZzC0NVLezxNEHS8IwDQYJKoZIhvcNAQEL\nBQAwHjEcMBoGA1UEAwwTQ291Y2hiYXNlIFJvb3QgQ0EgMjAeFw0yMTExMzAwOTUw\nMDdaFw0yMjExMzAwOTUwMDdaMBsxGTAXBgNVBAMMEENvdWNoYmFzZSBTZXJ2ZXIw\nggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDawYhSc0xmLMm6lD8d3srW\nMuJEekgmToSsvb7PenvXtZciLrqKIbdFMlCUBUSdriCjBaGPFRSgZVde5w+ULHvE\navowSllakEh3WEx1HBzehtvjcl3HpGHSswOJp8SoK+qDAfR6rcPkDnjKSbVUUdHg\nehamEM1sU/FwQB7MKabNntZkLPOY6Bsav3L9ssGItlpoFkyjNN2gcs3ptC/JbWZC\n9+ckgNNz5ujqdhzhaY2bpk5rdZ4A0YfStRSgHQ2QOtzOf6PUwqtsNd/9VXQEx2gg\nHnZkunYaHjjlUMsMGhvmClMPSSff47VREWklCmASmyluS2yVNOBgupKrhUy+0f/L\nAgMBAAGjgbswgbgwCQYDVR0TBAIwADAdBgNVHQ4EFgQUVdtaa74QjG3xTo8WhXdS\naQeq4CUwWQYDVR0jBFIwUIAUh+tOj8zQs1zjQ+VgE1nsU7JoAEWhIqQgMB4xHDAa\nBgNVBAMME0NvdWNoYmFzZSBSb290IENBIDKCFAomhSzYbWZZr2/zWhD5vUSvm3KO\nMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAPBgNVHREECDAGhwQK\nkNxmMA0GCSqGSIb3DQEBCwUAA4IBAQBbv8UTm75is/HG+u9oDHYF2jrvN8mHiWua\nWR8VYkTNHNToZF6ps7W1cOzsTeu9+Bcj5LLfQ3SndvSHLruzYqCtnVcODOEt6xwG\nw6PZfEJNLjzlFszx/lOy4X73OqYBMbxSzovkOw8jAmZLxzrhsUGZjIElDISGd9eg\nMwegJ209zRu6SyHMaIAU/yEvxGZqK7tyYJHjjsTwYWW7CUB9gtKKPd+SVP7iGOu/\ngynUonVxFLP2g9BqmFvd1eEu60cilbj1PN0BjLtpN6h4xn3ueNYTl49X+5s5N1t9\n2d4SKxaWfCtBBEJbsTWWMsoDrM7N8yPTPkc5t7Ql4gsPZQirfico\n-----END CERTIFICATE-----\n\n",
    "privateKeyPassphrase": {}
  }
]

The returned array contains two JSON objects, indicating that two node certificates are defined for the cluster. Each object contains fields for warnings, the Subject Common Name, the expiry date, the type (whether _generated_ by Operational Insights, or _uploaded_ by the administrator), the pem-encoded contents of the node certificate, and the passphrase for the private key (securely displayed as asterisks).

## [](#see-also)See Also

information about uploading and retrieving the cluster's root certificate with the REST API is provided in [Upload and Retrieve the Root Certificate](deprecated-security-apis/upload-retrieve-root-cert.md). A general introduction to certificates is provided in [Certificates](../manage/manage-security/manage-certificates.md). Routines for generating and deploying server and client certificates are provided in [Configure Server Certificates](../manage/manage-security/configure-server-certificates.md) and [Configure Client Certificates](../manage/manage-security/configure-client-certificates.md), respectively.