Skip to main content

Documentation Index

Fetch the complete documentation index at: https://infisical.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

Applications are where teams issue and manage certificates. Within an Application, you can:
  • Issue certificates via API, ACME, EST, or SCEP
  • Automate renewal so certificates never expire unexpectedly
  • Configure alerting for expiration, issuance, and lifecycle events
  • Sync certificates to AWS ACM, Azure Key Vault, Cloudflare, and other destinations
  • Require approvals before high-value certificates are issued
Each Application represents a service or workload in your organization — a payments API, a mobile backend, an IoT device fleet, or an internal web app. Product admins create Applications and assign team members; teams then operate independently within their assigned Applications.

​
What’s in an Application?

Members

Team members with Admin, Operator, or Auditor roles.

Enrollment Methods

How certificates are requested — API, ACME, EST, or SCEP.

Certificate Inventory

All certificates issued for this Application.

Alerting

Notifications for expiration, issuance, renewal, and revocation.

Approval Policies

Optional review workflows before certificates are issued.

Certificate Syncs

Push certificates to AWS, Azure, Cloudflare, and more.

​
Application Roles

Members are assigned to Applications with one of three roles:
RoleCapabilities
AdminFull control — manage enrollment methods, members, alerting, syncs, and approval policies
OperatorIssue and manage certificates within the Application
AuditorRead-only — view certificates and Application configuration
Application roles are simple and direct — just add members and pick a role. Custom roles will be available in a future release.

​
Create an Application

Product Admins create Applications and assign team members to them. If you’re a team member waiting for access, ask your product admin to create an Application and add you.
1

Navigate to Applications

In Certificate Manager, go to Applications and click Create Application.
2

Configure basic settings

  • Name: A descriptive slug like payments-api or device-fleet
  • Description: Optional context about this service
3

Attach a Certificate Profile

Select a certificate profile that defines what certificates will look like — the issuing CA, validity period, allowed domains, and constraints.
4

Configure enrollment

Choose how your service will request certificates:
MethodBest for
APIUI issuance, Infisical Agent, custom integrations
ACMECertbot, cert-manager, standard tooling
ESTEnterprise device enrollment
SCEPNetwork devices, MDM systems
See Enrollment Methods for detailed configuration.
5

Assign team members

Add team members and assign roles. Only people assigned to this Application can view or manage its certificates.

​
FAQ

A Certificate Profile defines what certificates look like — the CA, policy, and constraints. It’s a reusable template created by product admins.An Application is where a team consumes that profile. One profile can be used by many Applications, each with their own members, enrollment methods, and alerting.
Yes. An Application can have multiple profiles attached, allowing you to issue different types of certificates (e.g., short-lived mTLS certs and longer-lived TLS certs) from the same Application.
Go to your Application’s Members tab and invite them with the appropriate role. They’ll only have access to this specific Application, not other Applications in your organization.

​
What’s Next?

Enrollment Methods

Configure how your service requests certificates.

Certificate Syncs

Push certificates to AWS ACM, Azure Key Vault, and other destinations.

Alerting

Get notified when certificates expire or lifecycle events occur.

Approval Policies

Add human review before certificates are issued.