docs/documentation/platform/pki/applications/certificates.mdx
The certificate inventory shows all certificates issued within your Application. From here you can inspect details, trigger renewals, revoke certificates, and export in various formats.
<Info> To issue certificates, you'll need an [enrollment method](/documentation/platform/pki/applications/enrollment-methods/overview) configured for your Application. </Info>Click any certificate to view its details:
| Section | What's Included |
|---|---|
| Overview | Common name, status, serial number, validity period |
| Subject | DN components, Organization, OU, Country, SANs |
| Extensions | Basic constraints, Key Usage, Extended Key Usage |
| Cryptographic | Key algorithm, signature algorithm, fingerprints |
| Metadata | Custom key-value pairs for organization and tracking |
Metadata is preserved across renewals and can be used to filter the certificate list.
From the certificate details page, use the Options menu:
| Action | Description |
|---|---|
| Export | Download as PEM (individual files) or PKCS12 (single encrypted bundle) |
| Enable Auto-Renewal | Infisical renews automatically before expiration |
| Renew Now | Manually trigger renewal |
| Manage Syncs | Push to cloud destinations (ACM, Key Vault, etc.) |
| Revoke | Revoke with a reason code; certificate appears in CRL |
| Delete | Remove from inventory |
Go to the Certificate Requests tab and click Request Certificate. Select a certificate profile and choose a request method:
| Method | Description |
|---|---|
| Managed | Infisical generates and stores the private key |
| CSR | You provide your own Certificate Signing Request |
For automated issuance, configure an enrollment method:
| Type | How It Works |
|---|---|
| Client-driven | The client (Certbot, cert-manager, Infisical Agent) monitors expiration and requests renewal |
| Server-driven | Infisical automatically renews before expiration and pushes to syncs |
Server-driven renewal requires API enrollment with Infisical-managed keys. Enable it on the enrollment method or toggle it per-certificate.
| Format | Use Case |
|---|---|
| PEM | Nginx, Apache, Docker, load balancers — separate files for cert, chain, and key |
| PKCS12 | Java apps, Windows IIS, mobile apps — single encrypted file with password |
Revoke a certificate when it's compromised or no longer needed. Specify a reason code (key compromise, superseded, etc.).
Revoked certificates are added to the issuing CA's CRL. Verify revocation status:
openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem