Where certificates come from

Every certificate InfraNest knows about comes from somewhere — a monitor, a connected provider, a scan, or your own upload. This article explains where those come from and how to tell them apart. It's for anyone reviewing the Certificates inventory.

Overview

• InfraNest gathers certificates from several places automatically, plus lets you add them yourself.
• Everything lands in one deduplicated list, and each certificate keeps a record of where it was found (shown as found by {source}).
• This means you can spot certificates you didn't even know existed — useful for catching unexpected issuance.

How certificates are found automatically

1. SSL monitors — any SSL/TLS uptime monitor sends in the certificate it sees on every check.
2. Connected providers — connect AWS (ACM), Cloudflare, Hetzner, IONOS, TransIP, Namecheap, Porkbun or SSL.com under Integrations, turn on the Certificates feature for that connection, and their certificates sync in the background.
3. Certificate Transparency logs — InfraNest checks public logs daily for new certificates issued for your domains, so you'll see even ones you never added yourself.

Add certificates yourself

1. Use Scan an endpoint or paste in a certificate directly — see the Add a certificate article for the full walkthrough.
2. For internal servers, an agent can send many certificates at once in a single bulk import.

Import from a provider

1. Go to Integrations, connect the provider you want (follow its Connect guide), and turn on the Certificates feature.
2. Certificates import automatically and refresh on a schedule. If you don't want to wait, use Sync now on the connection to pull immediately.

Download the certificate files

Some providers can also hand over the actual files — the certificate and its private key — so you can install them on a server yourself.

1. Open the certificate's page.
2. Find the Certificate files panel.
3. Press Fetch from provider.

NoteInfraNest does not store a copy of your private key. Each time you press Fetch from provider, we request it fresh from the provider, show it to you, and keep nothing afterward — reload the page and you'll need to fetch it again. This is intentional: these certificates are typically replaced every couple of months, so a stored key would quickly go stale, and installing a mismatched key can take a site offline.

WarningYou need permission to make changes in the organization to fetch certificate files. Read-only members can see that a certificate exists but cannot retrieve its private key.

Tips

• Every fetch of a private key is recorded in your Audit Log, so you can always check who downloaded a key and when.
• Porkbun's free certificates are a good example of provider-fetchable files — look for the Certificate files panel on their certificate pages.