# About SSL certificates

> InfraNest keeps a single inventory of all your SSL/TLS certificates — wherever they live and whoever issued them — tracks when they expire, checks they're…

Source: https://infranest.io/docs/ssl-certificates
Last updated: 2026-10-26

---

SSL certificates can live on many servers, behind proxies, or with different providers — this guide explains how InfraNest brings them all together into one place so nothing quietly breaks, and who it's for: anyone responsible for keeping their sites and services running securely.

## Overview
- InfraNest keeps a single, deduplicated inventory of every certificate it finds — from your **Monitors**, scans, pasted certificates and connected providers.
- It tracks expiry dates and only alerts you when something actually needs attention — a healthy, auto-renewing certificate stays quiet.
- It checks that certificates are installed correctly, flags weak or misconfigured setups, and shows you any domains that aren't covered.
- It also catches unexpected certificates issued for your domains that you didn't request.

## Check your certificate costs
1. Open a certificate and look at its **Cost** panel — this shows the **Yearly price**.
2. Certificates from issuers that don't sell them (**Let's Encrypt, Cloudflare, Amazon and Google Trust Services**) are automatically marked **free from this issuer** and recorded as free.
3. For any other certificate, select **Edit price** and enter what you actually pay — InfraNest never guesses, since issuers like ZeroSSL, Sectigo and DigiCert sell both free and paid certificates.
4. A price you enter yourself always takes priority and is never overwritten automatically.

> [!NOTE]
Leaving the price blank means the question is still open; entering a wrong zero answers it incorrectly — so only fill it in when you know the real cost.

## Review the Overview tab
1. Go to **Certificates**, then open the **Overview** tab.
2. Read the summary sentence at the top — it tells you how many addresses are fine and how many **need you**.
3. Check the **Needs you** section for cards describing any problems, each with what's wrong, the relevant date, and a **What to do** suggestion.
4. Use **Check now** to recheck an address, or **Fix CAA record** to review a record before adding it.
5. If an automation could catch the same issue next time, look for the **Next time:** note and select **Set it up** to turn it on as a draft.
6. Review **Next 90 days** to see upcoming expiries and renewals on the timeline; select **Add to calendar** to track them in your calendar.
7. Check **Recommendations** for suggestions like assigning an owner or adding monitoring, and use **Review them** to see details, or **Not needed** if a suggestion doesn't apply.

## Browse certificates by address
1. Go to **Certificates**, then open the **Addresses** tab.
2. Use **Search addresses** or the filter chips — **Needs you**, **Renewed by a person**, **Monitored**, provider-specific filters like **Behind Cloudflare**, and **Sites you watch** — to narrow the list.
3. Select a domain to expand it and see its addresses.
4. Select an address to open its details panel, showing how it's connected, what's being served, who renews it, and its certificate history.
5. If an address isn't yours — for example, a site you're only watching — use **This is ours** or **Not ours — only watched** to correct its classification.

## Browse all certificates
1. Go to **Certificates**, then open the **All certificates** tab.
2. Review each certificate's **What it is** status, such as *In use*, *Provider edge*, *Replaced* or *No longer served*.
3. Use search, filters and **Tags** to narrow the list, or select certificates for bulk **Actions**.
4. Select a certificate to view its full details, **Certificate chain**, and **Security posture** checks.

<!-- screenshot: certificates-list -->

<!-- docs-screenshots:start:certificates-list -->

![About SSL certificates](/media/2305ad56-e86e-460c-8b17-bf70aceec649)

<!-- docs-screenshots:end:certificates-list -->

<!-- screenshot: certificates-addresses -->

<!-- docs-screenshots:start:certificates-addresses -->

![About SSL certificates](/media/7cf5e635-19ef-418d-a1e3-45a08a60f481)

<!-- docs-screenshots:end:certificates-addresses -->

<!-- screenshot: certificates-inventory -->

<!-- docs-screenshots:start:certificates-inventory -->

![About SSL certificates](/media/a4c8a9da-0a9b-484c-90a8-64fda6fd1b91)

<!-- docs-screenshots:end:certificates-inventory -->

## Tips
> [!TIP]
If a site sits behind Cloudflare or another proxy, the proxy's edge certificate is managed and renewed automatically — you only need to watch your own origin certificate behind it.

## Troubleshooting
- **An address stopped responding:** if it hasn't answered for a while, it will show as **Not reachable for N days** on **Home**. Select **Check now** to try again — the warning clears once it responds.
- **A renewal didn't go live everywhere:** if the old certificate is still being served somewhere, the card will name the server and explain how to reload it, or suggest connecting the provider if it's not yet connected to InfraNest.
- **An address no longer exists:** if its DNS record is gone and its domain is retired or no longer yours, select **Stop tracking** — you can always reverse this with **Undo**, or later from the **Stopped tracking** list using **Track again**.