Where certificates come from

Understand the different ways InfraNest discovers and imports your certificates, so you know what each label in your inventory means. This is for anyone managing certificates in InfraNest.

Overview

• InfraNest pulls certificates together from several sources into one deduplicated inventory.
• Each certificate is tagged with where it was found, so you always know its origin.
• Some sources are automatic, others need you to add a certificate yourself.

Automatic sources

• SSL monitors — any SSL/TLS uptime monitor feeds the certificate it sees into the inventory on every check.
• Connected providers — import certificates directly from AWS (ACM), Cloudflare, Hetzner, IONOS, TransIP, Namecheap, Porkbun and SSL.com. Turn on the Certificates feature when you connect the provider, and they sync in the background.
• Certificate Transparency logs — a daily check of public logs finds certificates recently issued for your domains, even ones you didn't add, so you catch anything unexpected (labelled Unexpected issuance).

Add certificates yourself

• Use Scan an endpoint or paste in a certificate directly — see the "Add a certificate" article for details.
• An agent can also send many certificates at once from your internal servers, in bulk.

Import from a provider

1. Go to Integrations and connect the provider you want, following its Connect guide.
2. Turn on the Certificates feature for that connection.
3. Its certificates import automatically and refresh on a schedule. Use Sync now on the connection whenever you want to pull the latest ones immediately.

Download the certificate files

Some providers can also hand over the actual files — the certificate and its private key — so you can install them on a server.

1. Open the certificate's page.
2. Find the Certificate files panel.
3. Select Fetch from provider.
4. Copy or download the Private key and Certificate (with chain) as needed.

NoteInfraNest never stores a copy of your private key. Each time you select Fetch from provider, it's requested fresh from the provider, shown to you, and then discarded — reload the page and you'll need to fetch it again. This is deliberate: providers like Porkbun rotate these certificates every couple of months, so a stored key would quickly go stale, and installing a key that no longer matches its certificate can take a site offline.

TipEvery fetch is recorded in your Audit Log, so you can always see who downloaded a private key and when.

Troubleshooting

• Can't see a Fetch from provider button? Not every provider offers file downloads — this only appears where it's supported, such as with Porkbun's free certificates.
• Fetch from provider isn't working for you? You need permission to make changes in the organization to fetch certificate files. Read-only members can see that a certificate exists but cannot retrieve its private key.