Inventory TLS certificates and export artifacts

This recipe combines three typical operational tasks: listing the full certificate inventory, selecting relevant entries, and downloading the available artifacts in an automated way.

Prerequisites

• an API key with access to the TLS endpoints
• a target system or directory for PEM or ZIP downloads
• clear criteria that define which certificates should be exported
• optionally, a downstream process that distributes the exported files

Step 1: Fetch the certificate inventory

Start with the full list of certificates that belong to the authenticated account.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate' \
  --header 'x-api-key: YOUR_API_KEY'

The most relevant fields for further processing are:

• id
• common_name
• status
• product
• certificate_pem_available

Step 2: Select export candidates

Not every certificate can be downloaded right away. Define a filter first, for example only certificates with a PEM artifact already available.

{
  "includeWhen": {
    "certificate_pem_available": true
  },
  "downloadFormat": "pem"
}

Step 3: Confirm detail state before download

Before exporting, you can fetch individual certificate details again. That is useful if you want to evaluate more status information or provider metadata.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ' \
  --header 'x-api-key: YOUR_API_KEY'

Step 4: Download the certificate as PEM

For many deployment systems, the PEM artifact as plain text is enough.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ/download/pem' \
  --header 'x-api-key: YOUR_API_KEY' \
  --output 'certificate-7K9QW3M2ZT8HJ.pem'

Step 5: Alternatively fetch a ZIP bundle

If a downstream system works better with bundles, you can request the ZIP artifact instead.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ/download/zip' \
  --header 'x-api-key: YOUR_API_KEY' \
  --output 'certificate-7K9QW3M2ZT8HJ.zip'

Step 6: Run export as a batch job

In production setups, list, filter, and download are usually combined into a repeatable batch process.

for id in 7K9QW3M2ZT8HJ 8R2XC7M4TH9PK 6Z3PH8T2MX7CR; do
  curl --request GET \
    --url "https://api.regfish.com/tls/certificate/${id}/download/pem" \
    --header 'x-api-key: YOUR_API_KEY' \
    --output "certificate-${id}.pem"
done

Practical notes for production workflows

• do not rely only on naming patterns; use status and availability fields
• write artifacts to a temporary directory first and move them only after a successful download
• log certificate ID, common name, format, and export timestamp
• keep export and distribution as separate steps so failures stay isolated
• expect some certificates to be visible in the inventory before their download artifact is available

Result

This turns the TLS inventory into a structured export workflow. That is useful for audits, deployments, backups, and any centralized certificate management process.