---
updatedAt: 2026-03-01T18:39:47.000Z
agentTools:
  siteIndex: https://techdocs.akamai.com/llms.txt
  projectIndex: https://techdocs.akamai.com/terraform/v9.3/llms.txt
---

# Client certificate

akamai_mtlskeystore_client_certificate

> 📘 Beta
>
> Hello. Just a note to let you know the underlying API on which this data source is built is general release and has been vetted, but because this is a new feature for our Terraform provider, we've given it beta label.
>
> This status just means we've paused for a bit to get [your feedback](https://github.com/akamai/terraform-provider-akamai/issues) to make sure this data source works like you need and expect.

Get details of a client certificate with its versions.

```json Query
data "akamai_mtlskeystore_client_certificate" "my-cert" {
  certificate_id = 123
}

output "my-cert" {
  value = data.akamai_mtlskeystore_client_certificate.my-cert
}
```
```json Standard output: Akamai client cert
my-cert = {
  certificate_id                = 123
  certificate_name              = "my-akamai-client-cert"
  created_by                    = "jsmith@example.com"
  created_date                  = "2025-07-01T10:21:34Z"
  current                       = {
    certificate_block          = {
      certificate   = <<-EOT
        -----BEGIN CERTIFICATE-----
        nMIID <sample - removed for readability> .... nMweq
        -----END CERTIFICATE-----
      EOT
      key_algorithm = "RSA"
      trust_chain   = <<-EOT
        -----BEGIN CERTIFICATE-----
        nMIID <sample - removed for readability> .... nMweq
        -----END CERTIFICATE-----
      EOT
    }
    certificate_submitted_by   = null
    certificate_submitted_date = null
    created_by                 = "jsmith@example.com"
    created_date               = "2025-07-01T10:21:37Z"
    csr_block                  = null
    delete_requested_date      = null
    expiry_date                = "2025-10-01T10:21:36Z"
    issued_date                = "2025-07-01T10:21:36Z"
    issuer                     = "23456 Account CA G1"
    key_algorithm              = "RSA"
    elliptic_curve             = ""
    key_size_in_bytes          = "2048"
    scheduled_delete_date      = null
    signature_algorithm        = "SHA256_WITH_RSA"
    status                     = "DEPLOYED"
    subject                    = "/C=US/O=Akamai Technologies, Inc./OU=23456 A-CCT1234 12345/CN=my-akamai-client-cert/"
    validation                 = {
      errors   = null
      warnings = null
    }
    version                    = 1
    version_guid               = "1abcdef2-g34h-56ij7k-l89m-no0pqr12346"
  }
  geography                     = "CORE"
  key_algorithm                 = "RSA"
  notification_emails           = [
    "jsmith@example.com",
  ]
  previous                      = null
  secure_network                = "STANDARD_TLS"
  signer                        = "AKAMAI"
  subject                       = "/C=US/O=Akamai Technologies, Inc./OU=23456 A-CCT1234 12345/CN=my-akamai-client-cert/"
  versions                      = null
}
```
```json Standard output: Third-party client cert
my-cert = {
  certificate_id                = 987
  certificate_name              = "my-third-party-client-cert"
  created_by                    = "jsmith@example.com"
  created_date                  = "2025-07-28T14:15:03Z"
  current                       = {
    certificate_block          = {
      certificate   = <<-EOT
        -----BEGIN CERTIFICATE-----
        nMIID <sample - removed for readability> .... nMweq
        -----END CERTIFICATE-----
      EOT
      key_algorithm = "RSA"
      trust_chain   = ""
    }
    certificate_submitted_by   = "jsmith@example.com"
    certificate_submitted_date = "2025-07-29T15:09:43Z"
    created_by                 = "jsmith@example.com"
    created_date               = "2025-07-28T14:15:04Z"
    csr_block                  = {
      csr           = <<-EOT
        -----BEGIN CERTIFICATE REQUEST-----
        nMIID <sample - removed for readability> .... nMweq
        -----END CERTIFICATE REQUEST-----
      EOT
      key_algorithm = "RSA"
    }
    delete_requested_date      = null
    expiry_date                = "2027-10-29T15:02:19Z"
    issued_date                = "2025-07-29T15:02:19Z"
    issuer                     = ""
    key_algorithm              = "RSA"
    elliptic_curve             = ""
    key_size_in_bytes          = "2048"
    properties                 = null
    scheduled_delete_date      = null
    signature_algorithm        = "SHA256_WITH_RSA"
    status                     = "DEPLOYED"
    subject                    = "/CN=my-third-party-client-cert/OU=23456 A-CCT1234 12345/O=Akamai Technologies, Inc./C=US/"
    validation                 = {
      errors   = null
      warnings = null
    }
    version                    = 1
    version_guid               = "1abcdef2-g34h-56ij7k-l89m-no0pqr12346"
  }
  geography                     = "CORE"
  include_associated_properties = null
  key_algorithm                 = "RSA"
  notification_emails           = [
    "jsmith@example.com",
  ]
  previous                      = null
  secure_network                = "STANDARD_TLS"
  signer                        = "THIRD_PARTY"
  subject                       = "/C=US/O=Akamai Technologies, Inc./OU=23456 A-CCT1234 12345/CN=my-third-party-client-cert/"
  versions                      = [
    {
      certificate_block          = {
        certificate   = <<-EOT
          -----BEGIN CERTIFICATE-----
          nMIID <sample - removed for readability> .... nMweq
          -----END CERTIFICATE-----
        EOT
        key_algorithm = "RSA"
        trust_chain   = ""
      }
      certificate_submitted_by   = "jsmith@example.com"
      certificate_submitted_date = "2025-07-29T15:09:43Z"
      created_by                 = "jsmith@example.com"
      created_date               = "2025-07-28T14:15:04Z"
      csr_block                  = {
        csr           = <<-EOT
          -----BEGIN CERTIFICATE REQUEST-----
          nMIID <sample - removed for readability> .... nMweq
          -----END CERTIFICATE REQUEST-----
        EOT
        key_algorithm = "RSA"
      }
      delete_requested_date      = null
      expiry_date                = "2027-10-29T15:02:19Z"
      issued_date                = "2025-07-29T15:02:19Z"
      issuer                     = ""
      key_algorithm              = "RSA"
      elliptic_curve             = ""
      key_size_in_bytes          = "2048"
      properties                 = null
      scheduled_delete_date      = null
      signature_algorithm        = "SHA256_WITH_RSA"
      status                     = "DEPLOYED"
      subject                    = "/CN=my-third-party-client-cert/OU=23456 A-CCT1234 12345/O=Akamai Technologies, Inc./C=US/"
      validation                 = {
        errors   = null
        warnings = null
      }
      version                    = 1
      version_guid               = "9zyxwvu8-t76s-54r3q-p21on-m0lkj98i7654"
    },
  ]
}
```

## Arguments

Pass the certificate ID  in the `data` block to get its details. Optionally, pass the `include_associated_properties` argument to include properties active on production linked to the client certificate's version.

| Argument                        | Required | Description                                                                                                     |
| :------------------------------ | :------: | :-------------------------------------------------------------------------------------------------------------- |
| `certificate_id`                |     ✔    | Your client certificate's ID.                                                                                   |
| `include_associated_properties` |          | When set to `true`, this also lists properties active on production linked to the client certificate's version. |

## Attributes

Returned to you are the details of the client certificate.

<table>
    <thead>
        <tr>
            <th>Attribute</th>
            <th>Description</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td><code>certificate_id</code></td>
            <td>The client certificate's ID.</td>
        </tr>
        <tr>
            <td><code>certificate_name</code></td>
            <td>A descriptive, human-readable name for the client certificate.</td>
        </tr>
         <tr>
            <td><code>include_associated_properties</code></td>
            <td>When <code>true</code>, this lists properties active on production linked to the client certificate's version.</td>
        </tr>
        <tr>
            <td><code>created_by</code></td>
            <td>The user that created the client certificate.</td>
        </tr>
        <tr>
            <td><code>created_date</code></td>
            <td>The ISO 8601 timestamp indicating when the client certificate was created.</td>
        </tr>
        <tr>
            <td><code>geography</code></td>
            <td> Your client certificate's deployment location. Possible values:
                <ul>
                    <li><code>CORE</code>. To specify worldwide deployment, including China and Russia.</li>
                    <li><code>RUSSIA_AND_CORE</code>. To specify worldwide deployment and Russia.</li>
                    <li><code>CHINA_AND_CORE</code>. To specify worldwide deployment and China.</li>
                </ul>
                Any non-core deployment must be enabled on your Akamai contract based on approval from the Chinese or Russian government.
            </td>
        </tr>
         <tr>
            <td><code>key_algorithm</code></td>
            <td>The cryptographic algorithm used for key generation, either <code>RSA</code> or <code>ECDSA</code>.</td>
        </tr>
        <tr>
            <td><code>notification_emails</code></td>
            <td>Email addresses of users that get notified about any issues with the client certificate.</td>
        </tr>
        <tr>
            <td><code>secure_network</code></td>
            <td>The type of security on a deployment network. Possible values:
                <ul>
                    <li><code>STANDARD_TLS</code>. Not PCI compliant.</li>
                    <li><code>ENHANCED_TLS</code>. PCI compliant.</li>
                </ul>
            </td>
        </tr>
         <tr>
            <td><code>subject</code></td>
            <td>The CA certificate’s key value details.</td>
        </tr>
        <tr>
            <td><code>signer</code></td>
            <td>The signing entity of the client certificate. Possible values: <code>AKAMAI</code> or <code>THIRD_PARTY</code>.</td>
        </tr>
        <tr>
            <td><code>current</code>/<code>previous</code></td>
            <td>Details of the current or previous client certificate version, containing an alias version. Includes:
                <ul>
                    <li><code>version</code>. The client certificate's version number.</li>
                    <li><code>version_guid</code>. The client certificate's version ID. Use this argument's value to configure the mutual authentication (mTLS) session between the origin and edge servers in Property Manager's <a href="doc:mtls-origin-keystore">mTLS Origin Keystore</a> behavior.</li>
                    <li><code>status</code>. The client certificate's version status. Possible values:
                        <ul>
                            <li><code>AWAITING_SIGNED_CERTIFICATE</code></li>
                            <li><code>DEPLOYMENT_PENDING</code></li>
                            <li><code>DEPLOYED</code></li>
                            <li><code>DELETE_PENDING</code></li>
                        </ul>
                    </li>
                    <li><code>expiry_date</code>. The ISO 8601 timestamp indicating when the client certificate expires.</li>
                    <li><code>issuer</code>. The signing entity of the client certificate version.</li>
                    <li><code>key_algorithm</code>. The client certificate version's encryption algorithm, either <code>RSA</code> or <code>ECDSA</code>.</li>
                    <li><code>certificate_submitted_by</code>. The user that uploaded the client certificate. Appears as <code>null</code> if not specified.</li>
                    <li><code>certificate_submitted_date</code>. The ISO 8601 timestamp indicating when the client certificate was submitted. Appears as <code>null</code> if the certificate wasn't submitted.</li>
                    <li><code>created_by</code>. The user that created the client certificate's version.</li>
                    <li><code>created_date</code>. The ISO 8601 timestamp indicating when the client certificate's version was created.</li>
                    <li><code>delete_requested_date</code>. The ISO 8601 timestamp indicating when the request for deleting the client certificate's version was submitted. Appears as <code>null</code> if the delete request wasn't made.</li>
                    <li><code>issued_date</code>. The ISO 8601 timestamp indicating when the client certificate's version was issued.</li>
                    <li><code>elliptic_curve</code>. The key elliptic curve when the <code>ECDSA</code> key algorithm is used.</li>
                    <li><code>key_size_in_bytes</code>. The private key length of the client certificate version when the <code>RSA</code> key algorithm is used.</li>
                    <li><code>scheduled_delete_date</code>. The ISO 8601 timestamp indicating when the client certificate's version is scheduled for deletion. Appears as <code>null</code> if the schedule request wasn't made.</li>
                    <li><code>signature_algorithm</code>. The algorithm that secures the data exchange between the edge server and the origin.</li>
                    <li><code>subject</code>. The public key's entity stored in the client certificate version's subject public key field.</li>
                    <li><code>certificate_block</code>. Details of the certificate block for the client certificate version. Contains:
                        <ul>
                            <li><code>certificate</code>. A text representation of the client certificate in PEM format.</li>
                                <li><code>key_algorithm</code>. The CA certificate's encryption algorithm. The only currently supported value is <code>RSA</code>.</li>
                            <li><code>trust_chain</code>. A text representation of the trust chain in PEM format.</li>
                        </ul>
                    </li>
                    <li><code>csr_block</code>. Details of the certificate signing request (CSR) for the client certificate version. Contains:
                        <ul>
                            <li><code>csr</code>.  A text representation of the CSR in PEM format.</li>
                            <li><code>key_algorithm</code>. The client certificate's encryption algorithm. The only currently supported value is <code>RSA</code>.</li>
                        </ul>
                        <blockquote><strong>Note:</strong> The <code>csr_block</code> attribute returns values only for the <code>THIRD-PARTY</code> client certificate.</blockquote>
                    </li>
                    <li><code>properties</code>. Properties active on production linked to the client certificate version. Each property record includes:
                        <ul>
                            <li><code>asset_id</code>. An alternative ID for the property.</li>
                            <li><code>group_id</code>. The group's ID.</li>
                            <li><code>property_name</code>. The property's name.</li>
                            <li><code>property_version</code>. The property's version number.</li>
                        </ul>
                    </li>
                    <li><code>validation</code>. Validation results for the client certificate version. Includes:
                        <ul>
                            <li><code>errors</code>. Validation errors you need to resolve for the request to succeed. Each error record includes:
                                <ul>
                                    <li><code>message</code>. Details of the error.</li>
                                    <li><code>reason</code>. The root cause of the error.</li>
                                    <li><code>type</code>. The category of the error.</li>
                                </ul>
                            </li>
                            <li><code>warnings</code>. Validation warnings you can resolve. Each warning record includes:
                                <ul>
                                    <li><code>message</code>. Details of the warning.</li>
                                    <li><code>reason</code>. The root cause of the warning.</li>
                                    <li><code>type</code>. The category of the warning.</li>
                                </ul>
                            </li>
                        </ul>
                    </li>
                </ul>
            </td>
        </tr>
        <tr>
            <td><code>versions</code></td>
            <td>The client certificate's versions. Each version record contains:
                <ul>
                    <li><code>version</code>. The client certificate's version number.</li>
                    <li><code>version_guid</code>. The client certificate's version ID. Use this argument's value to configure the mutual authentication (mTLS) session between the origin and edge servers in Property Manager's <a href="doc:mtls-origin-keystore">mTLS Origin Keystore</a> behavior.</li>
                    <li><code>status</code>. The client certificate's version status. Possible values:
                        <ul>
                            <li><code>AWAITING_SIGNED_CERTIFICATE</code></li>
                            <li><code>DEPLOYMENT_PENDING</code></li>
                            <li><code>DEPLOYED</code></li>
                            <li><code>DELETE_PENDING</code></li>
                        </ul>
                    </li>
                    <li><code>expiry_date</code>. The ISO 8601 timestamp indicating when the client certificate expires.</li>
                    <li><code>issuer</code>. The signing entity of the client certificate version.</li>
                    <li><code>key_algorithm</code>. The client certificate version's encryption algorithm, either <code>RSA</code> or <code>ECDSA</code>.</li>
                    <li><code>certificate_submitted_by</code>. The user that uploaded the client certificate. Appears as <code>null</code> if not specified.</li>
                    <li><code>certificate_submitted_date</code>. The ISO 8601 timestamp indicating when the client certificate was submitted. Appears as <code>null</code> if the certificate wasn't submitted.</li>
                    <li><code>created_by</code>. The user that created the client certificate's version.</li>
                    <li><code>created_date</code>. The ISO 8601 timestamp indicating when the client certificate's version was created.</li>
                    <li><code>delete_requested_date</code>. The ISO 8601 timestamp indicating when the request for deleting the client certificate's version was submitted. Appears as <code>null</code> if the delete request wasn't made.</li>
                    <li><code>issued_date</code>. The ISO 8601 timestamp indicating when the client certificate's version was issued.</li>
                    <li><code>elliptic_curve</code>. The key elliptic curve when the <code>ECDSA</code> key algorithm is used.</li>
                    <li><code>key_size_in_bytes</code>. The private key length of the client certificate version when the <code>RSA</code> key algorithm is used.</li>
                    <li><code>scheduled_delete_date</code>. The ISO 8601 timestamp indicating when the client certificate's version is scheduled for deletion. Appears as <code>null</code> if the schedule request wasn't made.</li>
                    <li><code>signature_algorithm</code>. The algorithm that secures the data exchange between the edge server and the origin.</li>
                    <li><code>subject</code>. The public key's entity stored in the client certificate version's subject public key field.</li>
                    <li><code>certificate_block</code>. Details of the certificate block for the client certificate version. Contains:
                        <ul>
                            <li><code>certificate</code>. A text representation of the client certificate in PEM format.</li>
                             <li><code>key_algorithm</code>. The CA certificate's encryption algorithm. The only currently supported value is <code>RSA</code>.</li>
                            <li><code>trust_chain</code>. A text representation of the trust chain in PEM format.</li>
                        </ul>
                    </li>
                    <li><code>csr_block</code>. Details of the certificate signing request (CSR) for the client certificate version. Contains:
                        <ul>
                            <li><code>csr</code>.  A text representation of the CSR in PEM format.</li>
                            <li><code>key_algorithm</code>. The client certificate's encryption algorithm. The only currently supported value is <code>RSA</code>.</li>
                        </ul>
                        <blockquote><strong>Note:</strong> The <code>csr_block</code> attribute returns values only for the <code>THIRD-PARTY</code> client certificate.</blockquote>
                    </li>
                    <li><code>properties</code>. Properties active on production linked to the client certificate version. Each property record includes:
                        <ul>
                            <li><code>asset_id</code>. An alternative ID for the property.</li>
                            <li><code>group_id</code>. The group's ID.</li>
                            <li><code>property_name</code>. The property's name.</li>
                            <li><code>property_version</code>. The property's version number.</li>
                        </ul>
                    </li>
                    <li><code>validation</code>. Validation results for the client certificate version. Includes:
                        <ul>
                            <li><code>errors</code>. Validation errors you need to resolve for the request to succeed. Each error record includes:
                                <ul>
                                    <li><code>message</code>. Details of the error.</li>
                                    <li><code>reason</code>. The root cause of the error.</li>
                                    <li><code>type</code>. The category of the error.</li>
                                </ul>
                            </li>
                            <li><code>warnings</code>. Validation warnings you can resolve. Each warning record includes:
                                <ul>
                                    <li><code>message</code>. Details of the warning.</li>
                                    <li><code>reason</code>. The root cause of the warning.</li>
                                    <li><code>type</code>. The category of the warning.</li>
                                </ul>
                            </li>
                        </ul>
                    </li>
                </ul>
            </td>
        </tr>
    </tbody>
</table>

# Sibling pages

* [Account CA certificates](https://techdocs.akamai.com/terraform/v9.3/docs/moks-ds-account-ca-certificates.md)
* [Client certificates](https://techdocs.akamai.com/terraform/v9.3/docs/moks-ds-client-certificates.md)