# Where certificates come from

> InfraNest finds your certificates in several ways and combines them all into one deduplicated inventory. Each certificate is labelled with where it was found.

Source: https://infranest.io/docs/certificate-sources
Last updated: 2026-09-30

---

Understand the different ways InfraNest discovers and imports your certificates, so you know what each label in your inventory means. This is for anyone managing certificates in InfraNest.

## Overview

- InfraNest pulls certificates together from several sources into one deduplicated inventory.
- Each certificate is tagged with where it was found, so you always know its origin.
- Some sources are automatic, others need you to add a certificate yourself.

## Automatic sources

- **SSL monitors** — any SSL/TLS uptime monitor feeds the certificate it sees into the inventory on every check.
- **Connected providers** — import certificates directly from AWS (ACM), Cloudflare, Hetzner, IONOS, TransIP, Namecheap, Porkbun and SSL.com. Turn on the **Certificates** feature when you connect the provider, and they sync in the background.
- **Certificate Transparency logs** — a daily check of public logs finds certificates recently issued for your domains, even ones you didn't add, so you catch anything unexpected (labelled **Unexpected issuance**).

## Add certificates yourself

- Use **Scan an endpoint** or paste in a certificate directly — see the "Add a certificate" article for details.
- An agent can also send many certificates at once from your internal servers, in bulk.

## Import from a provider

1. Go to **Integrations** and connect the provider you want, following its Connect guide.
2. Turn on the **Certificates** feature for that connection.
3. Its certificates import automatically and refresh on a schedule. Use **Sync now** on the connection whenever you want to pull the latest ones immediately.

## Download the certificate files

Some providers can also hand over the actual files — the certificate and its private key — so you can install them on a server.

1. Open the certificate's page.
2. Find the **Certificate files** panel.
3. Select **Fetch from provider**.
4. Copy or download the **Private key** and **Certificate (with chain)** as needed.

<!-- screenshot: certificate-sources -->

<!-- docs-screenshots:start:certificate-sources -->

![Where certificates come from](/media/e635b779-5f6c-44a8-b86b-7cc10f155a16)

<!-- docs-screenshots:end:certificate-sources -->

> [!NOTE]
> InfraNest never stores a copy of your private key. Each time you select **Fetch from provider**, it's requested fresh from the provider, shown to you, and then discarded — reload the page and you'll need to fetch it again. This is deliberate: providers like Porkbun rotate these certificates every couple of months, so a stored key would quickly go stale, and installing a key that no longer matches its certificate can take a site offline.

> [!TIP]
> Every fetch is recorded in your **Audit Log**, so you can always see who downloaded a private key and when.

## Troubleshooting

- **Can't see a Fetch from provider button?** Not every provider offers file downloads — this only appears where it's supported, such as with Porkbun's free certificates.
- **Fetch from provider isn't working for you?** You need permission to make changes in the organization to fetch certificate files. Read-only members can see that a certificate exists but cannot retrieve its private key.