Certificate coverage

This article is for anyone who needs to confirm that a certificate is actually protecting a live site, not just sitting in storage somewhere.

#Overview

• An inventory entry saying a certificate exists is not the same as a site serving it.
• The address overview shows where a certificate is actually served, which is the question that matters before you rely on it.
• Coverage checks help you catch sites that are missing a certificate, or certificates that are stored but never deployed.

#Check what an address serves

1. Go to Certificates.
2. Open the Addresses (n) tab, then open the domain or search for the hostname.
3. Select an address to see the certificate visitors get, its expiry, who renews it, and what monitors it.
4. Use All certificates to find certificates that are stored or listed by a provider but not yet known to be served. Their presence alone is not proof that a live address uses them.

#If a site is missing

1. Scan it. If the site is already live, use Scan or Scan an endpoint to read whatever certificate it is currently serving and add it to your inventory — often there is one, InfraNest just hadn't seen it yet.
2. Add it. If you already hold the certificate, use Add certificate or Import certificate to bring it in.
3. Check what you host. A registered domain without a website doesn't need to serve a certificate. An HTTPS redirect, however, still needs a valid certificate before a browser can follow it.

TipCoverage is wildcard-aware — a certificate covering *.example.com counts for matching subdomains, so you don't need a separate certificate for each one.

#Good to know

• A certificate found by an import or provider and a certificate observed on a live address are different kinds of evidence. Use the address panel to confirm real deployment, including on a non-default port.
• Certificates that exist but are close to expiring are a different question — check Certificate health for that.

NoteAll certificates lists every certificate InfraNest knows about, including ones that are Discovered, not monitored or Not seen on an address. Use Addresses (n) when you need to know what's actually live.