Think of a profile as the “shape” of a certificate — it defines the CA that signs it, the rules it must follow, and sensible defaults for common fields.
Why profiles?
Profiles solve a common problem: you want consistency across certificates without requiring every team to understand PKI details.Create a certificate profile
Navigate to Certificate Manager → Certificate Profiles and select Create Profile.Configuration
If Issuer Type is
Self-Signed, the profile only supports API enrollment and issues self-signed certificates.Profile defaults
The Certificate Details tab lets you pre-configure sensible defaults for certificate fields. When a requester doesn’t specify a value, the profile default is applied automatically. This simplifies certificate requests — teams can issue certificates without making decisions about every field. Defaults can be configured for:- TTL (validity period)
- Subject attributes (CN, O, OU, C, ST, L)
- Key algorithm (RSA-2048, ECDSA-P256, etc.)
- Signature algorithm
- Key usages and Extended key usages
- Basic constraints
Combining defaults with policies
Combining defaults with policies
For the simplest requester experience, pair defaults with a tightly scoped policy.Example: If your policy only allows
RSA-4096 and you set RSA-4096 as the default, requesters never need to think about key algorithms. The profile handles it automatically.This pattern works for any field — narrow the policy to one option, set that as the default, and requesters have nothing left to decide.Custom extensions
Set default values for custom X.509 extensions. The certificate policy decides which object identifiers (OIDs) may be emitted, so a request can carry any extension the policy permits, whether or not the profile declares it. A request that supplies a signing request can carry them in the CSR, which is how an MDM enrolling over SCEP sets a per-device value. Set a value and Infisical uses it whenever the request doesn’t supply one. Leave the value empty and the request supplies it, which suits a per-principal value such as an Active Directory security identifier. Either way, Infisical checks the value against the policy’s rule for that OID. Mark an extension Critical when a client that can’t process it must reject the certificate rather than ignore it. Leave it clear otherwise, which is the usual choice. Where an extension’s own specification fixes criticality, or the certificate policy pins it for that OID, the checkbox is read only. Enter the value as you want it read and Infisical encodes it. A few well-known extensions have a shape their specification fixes, so Infisical checks those as you type:
Any other OID takes whatever text you enter.
How profiles are used
Profiles are consumed through Applications. The workflow separates responsibilities between product and application administrators:1
Product Admin creates a profile
Combines a CA + policy + defaults into a reusable template that defines what certificates will look like.
2
Product Admin creates an Application
Creates an Application, attaches one or more profiles to it, and assigns team members (Application Admins, Operators, Auditors).
3
Application Admin configures enrollment
Within the Application, the Application Admin configures enrollment methods (API, ACME, EST, SCEP) for each attached profile. The enrollment URL is unique to the Application + Profile pair.
4
Certificates are issued
Teams request certificates through the configured enrollment method. Requests are validated against the profile’s policy and signed by the profile’s CA.
- Profiles are reusable — one profile can serve many Applications
- Enrollment is scoped — each Application configures its own enrollment methods
- Changes propagate — updating a profile or policy affects all Applications using it
FAQ
What's the difference between a Profile and a Policy?
What's the difference between a Profile and a Policy?
A Policy defines rules — what’s allowed, what’s required, what’s forbidden.A Profile combines a policy with a CA and defaults to create a complete, consumable template.You might have one policy (
strict-tls) used by multiple profiles (web-servers-digicert, web-servers-internal), each pointing to a different CA.Can I change the CA on an existing profile?
Can I change the CA on an existing profile?
Yes, but be careful. Existing certificates remain valid (signed by the old CA), but new certificates will be signed by the new CA. Clients trusting only the old CA won’t trust new certificates.
What happens if I delete a profile?
What happens if I delete a profile?
Applications using that profile can no longer issue new certificates. Existing certificates remain valid until they expire or are revoked.
Next steps
Certificate Policies
Define the rules that profiles enforce.
Applications
See how teams consume profiles through Applications.