[Yandex Cloud documentation](../../../index.md) > [Yandex Certificate Manager](../../index.md) > [Step-by-step guides](../index.md) > Let's Encrypt certificate > Getting the contents of a certificate # Getting the contents of a Let's Encrypt certificate You can save a [certificate](../../concepts/index.md) chain and a private key to use for your own purposes, e.g., when configuring a web server on a [VM](../../../compute/concepts/vm.md). To get the contents of a certificate: {% list tabs group=instructions %} - Management console {#console} 1. In the [management console](https://console.yandex.cloud), select the folder containing the certificate. 1. Navigate to **Certificate Manager**. 1. In the row with the certificate, click ![image](../../../_assets/console-icons/ellipsis.svg) and select ![arrow](../../../_assets/console-icons/arrow-up-from-line.svg) **Export certificate**. You can only export certificates with the `Issued` status. 1. Select one of the export options. The `certificate.pem` file will contain the following data in Base64 encoded text format: * **End-entity certificate and chain**: Certificate chain (end-user and intermediate certificate) and private key with standard framing: ```text -----BEGIN CERTIFICATE----- MIIE5zCCA8+gAwI... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFFjCCAv6gAwIBAg... -----END CERTIFICATE----- -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgk... -----END PRIVATE KEY----- ``` * **Certificate without private key**: Certificate chain (end-user and intermediate certificate): ```text -----BEGIN CERTIFICATE----- MIIE5zCCA8+gAwI... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- MIIFFjCCAv6gAwIBAg... -----END CERTIFICATE----- ``` * **End-entity certificate**: ```text -----BEGIN CERTIFICATE----- MIIFFjCCAv6gAwIBAg... -----END CERTIFICATE-----` ``` * **Private key only**: ```text -----BEGIN PRIVATE KEY----- MIIEvgIBADANBgk... -----END PRIVATE KEY-----` ``` 1. Click **Download certificate**. - CLI {#cli} The command will display a certificate chain and a private key and save their contents to the `--chain` and `--key` files, respectively. * `--id`: Certificate ID; make sure you set either the `--id` or `--name` flag. * `--name`: Certificate name; make sure you set either the `--id` or `--name` flag. * `--chain`: File to save the certificate chain to, in PEM format. This is an optional flag. * `--key`: File to save the private key to, in PEM format. This is an optional flag. ```bash yc certificate-manager certificate content \ --id fpqcsmn76v82******** \ --chain certificate_full_chain.pem \ --key private_key.pem ``` - Terraform {#tf} With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed. Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license. For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md). If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform). To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method. To get the contents of a custom certificate using Terraform: 1. In the Terraform configuration file, describe the resources you want to create: ```hcl data "yandex_cm_certificate_content" "cert_by_id" { certificate_id = "" } output "certificate_chain" { value = data.yandex_cm_certificate_content.cert_by_id.certificates } output "certificate_key" { value = data.yandex_cm_certificate_content.cert_by_id.private_key sensitive = true } ``` Where: * `data "yandex_cm_certificate_content"`: Description of the data source for the certificate contents: * `certificate_id`: Certificate ID. * `output` sections: `certificate_chain` output variables with the certificate chain and the `certificate_key` private key: * `value`: Return value. * `sensitive`: Label data as sensitive. For more information about the `yandex_cm_certificate_content` data source properties, see [this provider guide](../../../terraform/data-sources/cm_certificate_content.md). 1. Create the resources: 1. In the terminal, navigate to the configuration file directory. 1. Make sure the configuration is correct using this command: ```bash terraform validate ``` If the configuration is valid, you will get this message: ```bash Success! The configuration is valid. ``` 1. Run this command: ```bash terraform plan ``` You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration. 1. Apply the configuration changes: ```bash terraform apply ``` 1. Type `yes` and press **Enter** to confirm the changes. Terraform will create all the required resources. To check the result, run these commands: * Get the certificate chain: ```bash terraform output certificate_chain ``` * Get the private key value: ```bash terraform output -raw certificate_key ``` - API {#api} To get the certificate contents, use the [get](../../api-ref/CertificateContent/get.md) REST API method for the [CertificateContent](../../api-ref/CertificateContent/index.md) resource or the [CertificateContentService/Get](../../api-ref/grpc/CertificateContent/get.md) gRPC API call. {% endlist %} For Let's Encrypt certificates, the exported chain contains your domain's end-user certificate and intermediate certificate. The root certificate is not included because it is already built into the trusted stores of operating systems and browsers. This chain is sufficient to configure web servers, such as Nginx or Apache. If you need the full chain with the root certificate, you can download it from the [Let's Encrypt](https://letsencrypt.org/certificates/) website. {% note info %} To read the certificate contents, assign the `certificate-manager.certificates.downloader` [role](../../../iam/concepts/access-control/roles.md) to the service account. {% endnote %}