List All SSL Certificates

GET /apisix/admin/ssls

Interactive request editor loads with JavaScript.

Authorization

X-API-KEY<token>

Admin API key configured in config.yaml under deployment.admin.admin_key. You can also pass the key as a query parameter api_key or cookie x_api_key.

In: header

Query Parameters

label?string

Filter list to resources with the given label key.

page?integer

Page number (1-based).

Range1 <= value

Default1

page_size?integer

Items per page (10–500). When omitted, no pagination is applied and the full list is returned.

Range10 <= value <= 500

Response Body

`application/json`

curl -X GET "http://127.0.0.1:9180/apisix/admin/ssls?label=env&page=1&page_size=20"

Successful response.

{
  "list": [
    {
      "value": {
        "type": "server",
        "key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDh5cAWYXAMPLEbe\nfakekeyForOpenAPISpecPlaceholderOnlyDoNotUseForRealKeysNopeNopeNo\npeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNopeNo\npeNopeNopeNopeNopeNopeNope==\n-----END PRIVATE KEY-----\n",
        "snis": [
          "test.com"
        ],
        "id": "1",
        "create_time": 1684373523,
        "status": 1,
        "cert": "-----BEGIN CERTIFICATE-----\nMIIDazCCAlOgAwIBAgIUJ9hQk3kXgZeZpY/m/0V6RmH1AbcwDQYJKoZIhvcNAQEL\nBQAwRTELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM\nGEludGVybmFsIFJvb3QgQ0EgKGV4YW1wbGUpMB4XDTI1MDEwMTAwMDAwMFoXDTM1\nMDEwMTAwMDAwMFowRTELMAkGA1UEBhMCVVMxEzARBgNVBAgMClNvbWUtU3RhdGUx\nITAfBgNVBAoMGEludGVybmFsIFJvb3QgQ0EgKGV4YW1wbGUpMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4eXAMPLEcaPUBLIcfakeforopeNAPIspecON\nLYexampleCAcontentsoExpandedFakeKeyMaterial==\n-----END CERTIFICATE-----\n",
        "update_time": 1684373523
      },
      "key": "/apisix/ssls/1",
      "modifiedIndex": 133,
      "createdIndex": 133
    }
  ],
  "total": 1
}

**Unauthorized** — The API key is missing, invalid, or lacks permission.

{
  "error_msg": "failed to check token",
  "description": "missing apikey"
}

{
  "error_msg": "failed to check token",
  "description": "wrong apikey"
}

{
  "error_msg": "failed to check token",
  "description": "invalid method for role viewer"
}

Complete operation details and schema variants

GET /apisix/admin/ssls

List All SSL Certificates

Retrieve all configured SSL certificates. Private keys are not included in the response for security.

Parameters

label (query, string, optional): Filter list to resources with the given label key.
page (query, integer, optional): Page number (1-based).
page_size (query, integer, optional): Items per page (10–500). When omitted, no pagination is applied and the full list is returned.

Responses

200: Successful response.
total (integer, required):
list (array, required):
list[].key (string, required):
list[].value (object, required): SSL certificate configuration for TLS termination or mTLS.

Read-only response variant: private keys (key, keys) are stripped from GET responses, so they are not present here.

list[].value.id (object, optional): Unique identifier for the resource. Can be a string (1–64 characters, alphanumeric with -, _, .) or a positive integer.
anyOf variant 1: String ID
anyOf variant 2: Integer ID
list[].value.desc (string, optional): Description.
list[].value.labels (object, optional): Key-value pairs for categorizing and filtering resources. Values must be non-empty strings (max 256 characters).
list[].value.create_time (integer, optional): Unix timestamp of creation. Read-only.
list[].value.update_time (integer, optional): Unix timestamp of last update. Read-only.
list[].value.type (string, optional): Certificate type.
list[].value.sni (string, optional): Server Name Indication (SNI) to match. Supports wildcard prefix (*.example.com). Mutually exclusive with snis.
list[].value.snis (array, optional): Multiple SNI hostnames. Mutually exclusive with sni.
list[].value.cert (string, optional): PEM-encoded server certificate. Can also be a secret reference ($secret://...).
list[].value.key (string, optional): PEM-encoded private key. Can also be a secret reference ($secret://...). Not returned in GET responses for security.
list[].value.certs (array, optional): Additional certificates for certificate chain or alternative key types.
list[].value.keys (array, optional): Additional private keys corresponding to certs.
list[].value.client (object, optional): mTLS client verification settings.
list[].value.client.ca (string, required): PEM-encoded CA certificate for client verification.
list[].value.client.depth (integer, optional): Maximum certificate chain depth.
list[].value.client.skip_mtls_uri_regex (array, optional): URI regex patterns to skip mTLS verification.
list[].value.status (integer, optional): SSL status.
list[].value.ssl_protocols (array, optional): Allowed TLS protocol versions.
list[].createdIndex (integer, optional):
list[].modifiedIndex (integer, optional):
401: Unauthorized — The API key is missing, invalid, or lacks permission.
error_msg (string, required): Authentication error message.
description (string, optional): Detailed reason for the authentication failure.

cURL

curl -X GET 'http://127.0.0.1:9180/apisix/admin/ssls'

List All SSL Certificates

Authorization

Query Parameters

Response Body

200application/json

401application/json

GET /apisix/admin/ssls

Parameters

Responses

cURL

`application/json`

`application/json`