# Certificate coverage

> An inventory entry says a certificate exists. The address overview tells you where it is actually served, which is the important question before you rely on…

Source: https://infranest.io/docs/certificate-coverage
Last updated: 2026-10-26

---

This article is for anyone who needs to confirm that a site is actually protected by a certificate, not just that one exists somewhere in InfraNest — helpful if you're troubleshooting a browser warning or auditing what's really live.

## Overview
- An inventory entry only tells you a certificate exists somewhere; it doesn't confirm it's protecting a live site.
- The address overview is the source of truth for what's actually served to visitors — expiry, renewal, and monitors included.
- Checking this before you rely on a certificate helps you catch gaps early, rather than after a browser warning.

## Check what an address serves
1. Go to **Certificates**.
2. Open the **Addresses** tab, then open the domain or search for the hostname.
3. Select an address to see the certificate visitors get, its expiry, who renews it, and what monitors it.
4. Use **All certificates** to find certificates that are stored or listed by a provider but are not yet known to be served. Their presence alone is not proof that a live address uses them.

<!-- screenshot: certificates-list -->

<!-- docs-screenshots:start:certificates-list -->

![Certificate coverage](/media/2305ad56-e86e-460c-8b17-bf70aceec649)

<!-- docs-screenshots:end:certificates-list -->

<!-- screenshot: certificates-addresses -->

<!-- docs-screenshots:start:certificates-addresses -->

![Certificate coverage](/media/7cf5e635-19ef-418d-a1e3-45a08a60f481)

<!-- docs-screenshots:end:certificates-addresses -->

<!-- screenshot: certificates-inventory -->

<!-- docs-screenshots:start:certificates-inventory -->

![Certificate coverage](/media/a4c8a9da-0a9b-484c-90a8-64fda6fd1b91)

<!-- docs-screenshots:end:certificates-inventory -->

## If a site is missing
- **Scan it.** If the site is already live, **Scan** reads whatever certificate it is serving and adds it to your inventory — often there is one, InfraNest just hadn't seen it yet.
- **Add it.** If you already hold the certificate, use **Add certificate** to import it.
- **Check what you host.** A registered domain without a website need not serve a certificate. An HTTPS redirect, however, still needs a valid certificate before the browser can follow it.

> [!TIP]
> Coverage is wildcard-aware: a certificate for `*.example.com` counts for matching subdomains, so you don't need a separate certificate for each one.

> [!NOTE]
> A certificate found by an import or provider and a certificate observed on a live address are different kinds of evidence. Use the address panel to confirm real deployment, including on a non-default port.

## Tips
- Certificates that exist but are close to expiring are a different question — check **Certificate health** for that.
- Use **Search addresses** or **Group by domain** if you're scanning a large list for a specific hostname.