The certificate inventory shows all certificates issued within your Application. From here you can inspect details, trigger renewals, revoke certificates, and export in various formats.Documentation Index
Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
Use this file to discover all available pages before exploring further.
To issue certificates, you’ll need an enrollment method configured for your Application.
Certificate Details
Click any certificate to view its details:| Section | What’s Included |
|---|---|
| Overview | Common name, status, serial number, validity period |
| Subject | DN components, Organization, OU, Country, SANs |
| Extensions | Basic constraints, Key Usage, Extended Key Usage |
| Cryptographic | Key algorithm, signature algorithm, fingerprints |
| Metadata | Custom key-value pairs for organization and tracking |
Actions
From the certificate details page, use the Options menu:| Action | Description |
|---|---|
| Export | Download as PEM (individual files) or PKCS12 (single encrypted bundle) |
| Enable Auto-Renewal | Infisical renews automatically before expiration |
| Renew Now | Manually trigger renewal |
| Manage Syncs | Push to cloud destinations (ACM, Key Vault, etc.) |
| Revoke | Revoke with a reason code; certificate appears in CRL |
| Delete | Remove from inventory |
Issuing Certificates
Go to the Certificate Requests tab and click Request Certificate. Select a certificate profile and choose a request method:| Method | Description |
|---|---|
| Managed | Infisical generates and stores the private key |
| CSR | You provide your own Certificate Signing Request |
- API — Direct API calls or Infisical Agent
- ACME — Certbot, cert-manager, and ACME clients
- EST — RFC 7030 enrollment
- SCEP — Mobile device management (Jamf, Intune)
Renewal
| Type | How It Works |
|---|---|
| Client-driven | The client (Certbot, cert-manager, Infisical Agent) monitors expiration and requests renewal |
| Server-driven | Infisical automatically renews before expiration and pushes to syncs |
Export Formats
| Format | Use Case |
|---|---|
| PEM | Nginx, Apache, Docker, load balancers — separate files for cert, chain, and key |
| PKCS12 | Java apps, Windows IIS, mobile apps — single encrypted file with password |
Revocation
Revoke a certificate when it’s compromised or no longer needed. Specify a reason code (key compromise, superseded, etc.). Revoked certificates are added to the issuing CA’s CRL. Verify revocation status:What’s Next?
Certificate Syncs
Push certificates to AWS ACM, Azure Key Vault, and other destinations.
Alerting
Get notified before certificates expire.
Approvals
Require human review before issuance.
Enrollment Methods
Configure how certificates are requested.