docs/documentation/platform/pki/applications/certificate-syncs/overview.mdx
Push certificates from your Application to external services automatically. When paired with auto-renewal, renewed certificates are synced to their destinations — keeping your infrastructure current without manual intervention.
<Info> Certificate Syncs are configured per Application. Select which certificates to sync, then configure the destination. </Info>flowchart LR
subgraph Application
C1[Certificate 1]
C2[Certificate 2]
C3[Certificate 3]
end
S[Certificate Sync]
AC[App Connection]
subgraph Destination["Destination Service"]
D1[Certificate 1]
D2[Certificate 2]
D3[Certificate 3]
end
C1 --> S
C2 --> S
C3 --> S
S --> AC
AC --> D1
AC --> D2
AC --> D3
style C1 fill:#e1f5fe,stroke:#01579b
style C2 fill:#e1f5fe,stroke:#01579b
style C3 fill:#e1f5fe,stroke:#01579b
style S fill:#fff9c4,stroke:#f57f17
style AC fill:#e8f5e9,stroke:#2e7d32
style D1 fill:#f3e5f5,stroke:#7b1fa2
style D2 fill:#f3e5f5,stroke:#7b1fa2
style D3 fill:#f3e5f5,stroke:#7b1fa2
Configure:
- **Destination**: Select the App Connection and target endpoint
- **Certificates**: Choose which certificates to sync
- **Options**: Configure sync behavior (see below)
| Option | Description |
|---|---|
| Remove on expiry | Automatically remove expired certificates from the destination |
| Include Root CA | Include the root CA certificate in the chain |
| Certificate naming | Customize how certificates are named in the destination via the Certificate Name Schema (default: Infisical-{{certificateId}}) |
The Certificate Name Schema controls the name each certificate is given in the destination. It is a template that supports the following placeholders, which are resolved per certificate at sync time:
<Note> - `{{certificateId}}` - The unique ID of the certificate. **Required** so that each synced certificate resolves to a unique, stable name. - `{{commonName}}` - The certificate's common name (its FQDN), e.g. `app.example.com`. - `{{profileId}}` - The certificate profile ID. Falls back to the certificate ID when the certificate has no profile. - `{{applicationId}}` - The ID of the application the sync belongs to. </Note>For example, myapp-{{commonName}}-{{certificateId}} produces a name like myapp-app.example.com-1a2b3c....
Each destination enforces its own character and length rules for resource names:
{{commonName}} is sanitized to the destination's allowed character set. For destinations that don't allow dots (e.g. Azure Key Vault, Chef), app.example.com becomes app-example-com; destinations that allow dots (e.g. NetScaler, F5 BIG-IP) keep it as-is.{{certificateId}}, {{profileId}}, {{applicationId}}) each count as 32 characters.Keep {{certificateId}} in the schema to guarantee a unique, stable name per certificate.