docs/documentation/platform/pki/approvals.mdx
Certificate approval workflows add a human review step before certificates are issued, helping organizations enforce security controls and compliance requirements.
Approval workflows are recommended when:
If your use case involves fully automated certificate management for workloads (e.g., using Infisical Agent), you may want to enable the machine identity bypass option instead of requiring approval.
An approval policy defines the workflow that must be completed before certificates can be issued from specific certificate profiles. When a certificate request is made against a profile with an approval policy, the request is placed in a pending state until the required approvers review and approve it.
Key features of approval policies include:
To create an approval policy, head to your Certificate Management Project > Certificate Manager > Approvals > Policies and press Create Policy.
<Steps> <Step title="Configuration"> Configure the basic policy settings:- **Policy Name**: A descriptive name for the policy such as `production-cert-approval`.
- **Max. Request TTL**: The maximum time a request can remain pending before it expires (optional).
- **Certificate Profiles**: Select one or more certificate profiles that this policy applies to. Any certificate request made against these profiles will require approval.
- **Bypass approval for machine identities**: When enabled, machine identities can issue certificates from the selected profiles without requiring approval. This is useful for automated workloads that need certificates without human intervention.
- **Step Name**: An optional name for the step such as `Security Team Review`.
- **Approvers**: Select individual users or groups who are eligible to approve this step. Multiple approvers can be selected.
- **Required Approvals**: The number of approvals needed to complete this step. For example, if you select 5 approvers and require 2 approvals, any 2 of the 5 can approve to complete the step.
- **Notify Approvers**: When enabled, eligible approvers receive a notification when their approval is required.
You can add multiple steps to create a sequential approval workflow. For example:
1. **Team Lead Review**: Requires 1 approval from the team leads group
2. **Security Review**: Requires 2 approvals from the security team
Each step must be completed in order before the certificate is issued.
When a certificate request is made against a profile with an approval policy, an approval request is created. Approvers can then review and approve or reject the request.
Navigate to your Certificate Management Project > Certificate Manager > Approvals > Requests to view all approval requests. You can filter requests by status:
Once all required approvals for all steps are obtained, the certificate is automatically issued.
When a request is rejected, the workflow ends and no certificate is issued.