diff --git a/src/apps.js b/src/apps.js
index 0b83dd066..0db61d0c7 100644
--- a/src/apps.js
+++ b/src/apps.js
@@ -44,6 +44,8 @@ exports = module.exports = {
     getLocalLogfilePaths,
     getLogs,
 
+    getCertificate,
+
     start,
     stop,
     restart,
@@ -115,6 +117,7 @@ const appdb = require('./appdb.js'),
     backups = require('./backups.js'),
     BoxError = require('./boxerror.js'),
     constants = require('./constants.js'),
+    database = require('./database.js'),
     debug = require('debug')('box:apps'),
     docker = require('./docker.js'),
     domaindb = require('./domaindb.js'),
@@ -1414,6 +1417,15 @@ function getLogs(app, options, callback) {
     return callback(null, transformStream);
 }
 
+async function getCertificate(subdomain, domain) {
+    assert.strictEqual(typeof subdomain, 'string');
+    assert.strictEqual(typeof domain, 'string');
+
+    const result = await database.query('SELECT certificateJson FROM subdomains WHERE subdomain=? AND domain=?', [ subdomain, domain ]);
+    if (result.length === 0) return null;
+    return JSON.parse(result[0].certificateJson);
+}
+
 // does a re-configure when called from most states. for install/clone errors, it re-installs with an optional manifest
 // re-configure can take a dockerImage but not a manifest because re-configure does not clean up addons
 function repair(app, data, auditSource, callback) {