diff --git a/internal/service/certificate.go b/internal/service/certificate.go
index f9cc208..0d44508 100644
--- a/internal/service/certificate.go
+++ b/internal/service/certificate.go
@@ -38,6 +38,15 @@ func (s *CertificateService) ListCertificates(search string, limit int) ([]types
 			Value:     search,
 			Operation: "LIKE",
 		})
+	} else {
+		// EJBCA rejects an empty criteria list ("Invalid criteria value,
+		// cannot be empty"). With no search term, default to listing active
+		// certificates so GET /certs returns a useful result instead of 500.
+		criteria = append(criteria, client.CertSearchCriterion{
+			Property:  "STATUS",
+			Value:     "CERT_ACTIVE",
+			Operation: "EQUAL",
+		})
 	}
 
 	certs, err := s.client.SearchCertificates(&client.CertSearchRequest{