Inventory TLS certificates and export artifacts

This recipe combines three typical operational tasks: listing the full certificate inventory, selecting relevant entries, and downloading the available artifacts in an automated way.

Prerequisites

an API key with access to the TLS endpoints
a target system or directory for PEM or ZIP downloads
clear criteria that define which certificates should be exported
optionally, a downstream process that distributes the exported files

Step 1: Fetch the certificate inventory

Start with the full list of certificates that belong to the authenticated account.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate' \
  --header 'x-api-key: YOUR_API_KEY'

The most relevant fields for further processing are:

id
common_name
status
product
certificate_pem_available

Step 2: Select export candidates

Not every certificate can be downloaded right away. Define a filter first, for example only certificates with a PEM artifact already available.

{
  "includeWhen": {
    "certificate_pem_available": true
  },
  "downloadFormat": "pem"
}

Step 3: Confirm detail state before download

Before exporting, you can fetch individual certificate details again. That is useful if you want to evaluate more status information or provider metadata.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ' \
  --header 'x-api-key: YOUR_API_KEY'

Step 4: Download the certificate as PEM

For many deployment systems, the PEM artifact as plain text is enough.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ/download/pem' \
  --header 'x-api-key: YOUR_API_KEY' \
  --output 'certificate-7K9QW3M2ZT8HJ.pem'

Step 5: Alternatively fetch a ZIP bundle

If a downstream system works better with bundles, you can request the ZIP artifact instead.

curl --request GET \
  --url 'https://api.regfish.com/tls/certificate/7K9QW3M2ZT8HJ/download/zip' \
  --header 'x-api-key: YOUR_API_KEY' \
  --output 'certificate-7K9QW3M2ZT8HJ.zip'

Step 6: Run export as a batch job

In production setups, list, filter, and download are usually combined into a repeatable batch process.

for id in 7K9QW3M2ZT8HJ 8R2XC7M4TH9PK 6Z3PH8T2MX7CR; do
  curl --request GET \
    --url "https://api.regfish.com/tls/certificate/${id}/download/pem" \
    --header 'x-api-key: YOUR_API_KEY' \
    --output "certificate-${id}.pem"
done

Practical notes for production workflows

do not rely only on naming patterns; use status and availability fields
write artifacts to a temporary directory first and move them only after a successful download
log certificate ID, common name, format, and export timestamp
keep export and distribution as separate steps so failures stay isolated
expect some certificates to be visible in the inventory before their download artifact is available

Result

This turns the TLS inventory into a structured export workflow. That is useful for audits, deployments, backups, and any centralized certificate management process.