# About SSL certificates

> InfraNest keeps a single inventory of all your SSL/TLS certificates — wherever they live and whoever issued them — tracks when they expire, checks they're…

Source: https://infranest.io/docs/ssl-certificates
Last updated: 2026-09-14

---

This article introduces SSL certificate tracking in InfraNest, for anyone who needs to make sure their domains stay securely protected without digging through servers or providers.

## Overview
- Keeps one inventory of every certificate you have, no matter where it lives or who issued it
- Tracks expiry dates and warns you in good time, so an alert really means something needs attention
- Checks certificates are installed correctly and explains any problems in plain language
- Flags weak, misconfigured or unexpected certificates
- Shows which domains aren't covered so you can fix gaps quickly

## See every certificate in one place

InfraNest automatically finds certificates from your monitors, scans, pasted certificates and connected providers, then combines them into a single, deduplicated list. You don't need to add anything yourself for certificates that are already being watched or scanned — they'll show up on their own.

## Track expiry with confidence

1. Open **Certificates** from the sidebar.
2. Look at the **Inventory** tab to see all your certificates and their status.
3. Certificates that renew automatically stay quiet until the very last moment — so if you get an alert about one of these, it means the renewal failed and needs your attention.
4. Certificates with **Nothing will renew this certificate** are worth checking manually before they expire.

## Check a certificate is installed correctly

1. From the **Certificates** page, open the certificate you want to check.
2. Review the **Certificate chain** section — InfraNest rebuilds it for you and shows **Chain served**, **Missing intermediate**, or similar labels.
3. Look at **Health** and **Security posture** for a plain-language summary, including a **Security rating {letter}** and a **{passed} of {total} passed** count.
4. Select **Show the security checks** to see the full breakdown, including **Chain trust**, **Key strength**, **Signature algorithm**, **Validity period** and **Hostname coverage**.
5. If something's wrong, select **How to fix this** for guidance — for example, **Download the issuing intermediate** if the chain is missing one.

## Find and fix coverage gaps

1. Open **Certificates** and switch to the **Coverage** tab.
2. Review the list of domains to see which are protected, expiring, or unprotected.
3. Select **Scan an endpoint** on any domain to check its current certificate.
4. Use **Add SSL monitor** if you want InfraNest to keep watching that domain going forward.

## Understand what a certificate costs

1. Open the certificate you're interested in.
2. Check its **Certificate price** panel — it shows the **Yearly price**.
3. Certificates from an issuer that doesn't sell them — **Let's Encrypt, Cloudflare, Amazon** and **Google Trust Services** — are automatically marked **free from this issuer**, so they won't appear in your **Reports** as an unfilled price.
4. For anything else, select **Add** (or **Edit**) to enter what you actually pay.

> [!NOTE]
> Issuers like ZeroSSL, Sectigo and DigiCert sell both free and paid certificates, so InfraNest won't guess a price for these — a blank price is a question, a wrong zero is a wrong answer.

> [!TIP]
> A price you enter yourself always takes priority and will never be automatically overwritten.

## Tips

- Use **Search subject, issuer or SAN…** on the **Inventory** tab to quickly find a specific certificate.
- Use **Filter** and **Tags** to narrow down long lists, and save your setup with **Save view** for next time.
- Select **Issues only** to see just the certificates that need attention.

<!-- docs-screenshots:start -->

![About SSL certificates](/media/ccc62e7a-9282-44f1-a77f-6516a2adf989)

<!-- docs-screenshots:end -->