# Certificate coverage

> Which of your domains have no certificate? InfraNest works that out for you and says so on the certificates list itself — you don't have to compare two lists…

Source: https://infranest.io/docs/certificate-coverage
Last updated: 2026-09-14

---

See at a glance which of your domains don't have a certificate yet, without having to compare lists by hand. This is for anyone managing domains in InfraNest who wants to make sure every site that needs HTTPS actually has it.

## Overview
- InfraNest automatically compares your registered domains against the certificates it knows about.
- Any domain with no matching certificate is called out right on the **Certificates** list — no manual cross-checking needed.
- Coverage checking is wildcard-aware, so one certificate can cover many subdomains.

## Find the domains with no certificate
1. Go to **Certificates**.
2. If any registered domain has no certificate InfraNest knows about, a band at the top says so — for example, "3 domains without a certificate."
3. Select it to narrow the list to just those domains.

<!-- screenshot: certificates-list -->

<!-- docs-screenshots:start:certificates-list -->

![Certificate coverage](/media/ccc62e7a-9282-44f1-a77f-6516a2adf989)

<!-- docs-screenshots:end:certificates-list -->

## Decide what to do about an uncovered domain
1. Check whether the site is already live.
2. If it is, use **Scan an endpoint** — this reads whatever certificate the site is currently serving and adds it to your inventory. Often a certificate already exists; InfraNest just hadn't seen it yet.
3. If you already hold the certificate yourself, use **Add certificate** (or **Import certificate**) to bring it in directly.
4. If the domain doesn't need a certificate at all — for example, it's only a redirect or isn't hosted — you can leave it as is. Not every domain requires one.

> [!NOTE]
> Coverage is wildcard-aware: a certificate for `*.example.com` counts as covering matching subdomains too.

> [!TIP]
> A domain counts as covered no matter where its certificate came from — imported, discovered by scan, connected via a provider, or seen by a monitor.

## Tips
- Coverage only tells you whether a certificate exists, not whether it's healthy. For certificates that exist but are close to expiring or have other problems, check **Certificate health** instead.