# How to get certificates which were lost?
**URL:** https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438
**Category:** Server
**Created:** [December 1, 2016, 4:12pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438 "2016-12-01T16:12:56Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@porunov](https://community.letsencrypt.org/u/porunov)
#### Post date: [December 1, 2016, 4:12pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/1 "2016-12-01T16:12:56Z")
Hello,
I wonder to know how it is possible to get account’s certificates if I have only account private key. I.e. assuming I have removed everything except account private key. Now I need to get my certificates back. Is it possible?
Sincerely,
Alexandr
---
### Author:  [@cpu](https://community.letsencrypt.org/u/cpu)
#### Post date: [December 1, 2016, 4:55pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/2 "2016-12-01T16:55:05Z")
Hi @porunov
Since all Let’s Encrypt certificates are submitted to Certificate Transparency logs you can use the [crt.sh](https://crt.sh) front-end to find your certificate.
Start with a search for your domain name (e.g. [for helloworld.letsencrypt.org](https://crt.sh/?q=helloworld.letsencrypt.org)). From there, click the [crt.sh](http://crt.sh) ID for one (e.g. [the most recent helloworld](https://crt.sh/?id=52883273)). When viewing the cert details you can click the “Certificate:” label (right above “Data:”) and it will download the certificate as a `.crt` file containing the PEM encoding of the Certificate.
Hope that helps!
---
### Author:  [@tialaramex](https://community.letsencrypt.org/u/tialaramex)
#### Post date: [December 1, 2016, 4:58pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/3 "2016-12-01T16:58:00Z")
If you only have the _account_ private key, you lack the private key that goes with the certificate itself, and without that key the certificate is useless and you must start over. If you’ve only loss the actual certificate then @cpu has the solution for you.
---
### Author:  [@cpu](https://community.letsencrypt.org/u/cpu)
#### Post date: [December 1, 2016, 4:59pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/4 "2016-12-01T16:59:17Z")
Agreed! I misread and thought you had the **certificate** private keys. With only the **account** private keys what I recommend will not work - you will be able to retreive the missing certificates but won’t be able to use them for anything without the corresponding private key. There isn’t a way to recover your certificate private keys with the account key.
Thanks for catching that @tialaramex!
---
### Author:  [@porunov](https://community.letsencrypt.org/u/porunov)
#### Post date: [December 1, 2016, 5:43pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/5 "2016-12-01T17:43:17Z")
Thank you very much for help!
So, I can’t now revoke my certificates? Do you know any solution know how to revoke certificates or remove them or something like that?
Sincerely,
Alexandr
---
### Author:  [@cpu](https://community.letsencrypt.org/u/cpu)
#### Post date: [December 1, 2016, 5:49pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/6 "2016-12-01T17:49:40Z")
> [@porunov](#):
>
> So, I can't now revoke my certificates? Do you know any solution know how to revoke certificates or remove them or something like that?
I don't think revocation is appropriate in this case unless you believe the private keys have been compromised by another party. If you've lost them and don't suspect they are compromised I would just issue new certificates and allow the "lost" ones to expire naturally. Revocation adds load to our service and shouldn't be used unless required.
With that said, on the server-side, since [Boulder #2319](https://github.com/letsencrypt/boulder/pull/2319/commits/78bf030a51f916a7ea1923803a56218dcc28593c) its possible to revoke an existing certificate by setting up valid authorizations for all of the contained domains using a new account key and then asking the server to revoke the existing certificate. Unfortunately I don't think any ACME clients are exposing this functionality so it would be a complex endeavour to utilize it for your certificates.
---
### Author:  [@porunov](https://community.letsencrypt.org/u/porunov)
#### Post date: [December 1, 2016, 6:07pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/7 "2016-12-01T18:07:49Z")
> [@cpu](#):
>
> any ACME clients are exposing this functionality
I don't need a special client for that. If there is an API or something like that which allow us to get certificates by account private key or something like it would be enough. I can use "curl" or java's libraries.
---
### Author:  [@cpu](https://community.letsencrypt.org/u/cpu)
#### Post date: [December 1, 2016, 6:21pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/8 "2016-12-01T18:21:20Z")
> [@porunov](#):
>
> If there is an API or something like that which allow us to get certificates by account private key or something like it would be enough. I can use "curl" or java's libraries.
There isn't an API to "get certificates by account private key". The support I mentioned was strictly for revoking a certificate by using "an account key that is authorized to act for all of the identifier(s) in the certificate." You can read about this API in [the ACME-04 draft, Section 6.6, "Certificate Revocation"](https://tools.ietf.org/html/draft-ietf-acme-acme-04#section-6.6).
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [December 31, 2016, 6:21pm UTC](https://community.letsencrypt.org/t/how-to-get-certificates-which-were-lost/23438/9 "2016-12-31T18:21:20Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.