# Where certificates come from

> InfraNest finds your certificates in several ways and combines them all into one deduplicated inventory. Each certificate is labelled with where it was found.

Source: https://infranest.io/docs/certificate-sources
Last updated: 2026-09-19

---

Every certificate InfraNest knows about comes from somewhere — a monitor, a connected provider, a scan, or your own upload. This article explains where those come from and how to tell them apart. It's for anyone reviewing the **Certificates** inventory.

## Overview

- InfraNest gathers certificates from several places automatically, plus lets you add them yourself.
- Everything lands in one deduplicated list, and each certificate keeps a record of where it was found (shown as **found by {source}**).
- This means you can spot certificates you didn't even know existed — useful for catching unexpected issuance.

## How certificates are found automatically

1. **SSL monitors** — any SSL/TLS uptime monitor sends in the certificate it sees on every check.
2. **Connected providers** — connect **AWS (ACM)**, **Cloudflare**, **Hetzner**, **IONOS**, **TransIP**, **Namecheap**, **Porkbun** or **SSL.com** under **Integrations**, turn on the **Certificates** feature for that connection, and their certificates sync in the background.
3. **Certificate Transparency logs** — InfraNest checks public logs daily for new certificates issued for your domains, so you'll see even ones you never added yourself.

## Add certificates yourself

1. Use **Scan an endpoint** or paste in a certificate directly — see the **Add a certificate** article for the full walkthrough.
2. For internal servers, an agent can send many certificates at once in a single bulk import.

## Import from a provider

1. Go to **Integrations**, connect the provider you want (follow its Connect guide), and turn on the **Certificates** feature.
2. Certificates import automatically and refresh on a schedule. If you don't want to wait, use **Sync now** on the connection to pull immediately.

## Download the certificate files

Some providers can also hand over the actual files — the certificate and its private key — so you can install them on a server yourself.

1. Open the certificate's page.
2. Find the **Certificate files** panel.
3. Press **Fetch from provider**.

> [!NOTE]
> InfraNest does not store a copy of your private key. Each time you press **Fetch from provider**, we request it fresh from the provider, show it to you, and keep nothing afterward — reload the page and you'll need to fetch it again. This is intentional: these certificates are typically replaced every couple of months, so a stored key would quickly go stale, and installing a mismatched key can take a site offline.

<!-- screenshot: certificate-sources -->

<!-- docs-screenshots:start:certificate-sources -->

![Where certificates come from](/media/59aaa6c4-500a-412e-b505-4f43dcee5b60)

<!-- docs-screenshots:end:certificate-sources -->

> [!WARNING]
> You need permission to make changes in the organization to fetch certificate files. Read-only members can see that a certificate exists but cannot retrieve its private key.

## Tips

- Every fetch of a private key is recorded in your **Audit Log**, so you can always check who downloaded a key and when.
- Porkbun's free certificates are a good example of provider-fetchable files — look for the **Certificate files** panel on their certificate pages.