> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate approval policies

> Add human review workflows before certificates are issued.

Approval workflows add a human review step before certificates are issued. Use them to enforce separation of duties, ensure oversight of sensitive certificates, or meet compliance requirements.

## When to use approvals

> [card] Separation of duties
>
> Different people must request and approve certificate issuance.

> [card] Sensitive certificates
>
> Production or customer-facing certificates need additional review.

> [card] Compliance requirements
>
> Regulatory frameworks require documented approval before issuance.

> [card] Prevent unauthorized issuance
>
> Ensure certificates are only issued after proper validation.

> [!NOTE]
>
> For fully automated workloads (e.g., using [Infisical Agent](https://infisical.com/docs/documentation/platform/pki/reference/infisical-agent.md)), enable the **machine identity bypass** option so automated systems can issue certificates without waiting for approval.

## How approval policies work

An approval policy defines the workflow that must be completed before certificates are issued. Policies are configured per Application and can be scoped to specific profiles attached to that Application. When a certificate request is made through an enrollment method:

1. Request enters **pending** state
2. Approvers receive an in-app notification and an email with a link to the request (if configured)
3. Each approval step must be completed in sequence
4. Once all steps are approved, the certificate is issued

## Create an approval policy

In your Application, go to the **Settings** tab and find the **Approval Policies** section. Select **Create Policy**.

**1. Configure basic settings**

| Field | Description |
| - | - |
| **Policy Name** | A descriptive name like `production-cert-approval` |
| **Max. Request TTL** | How long a request can remain pending before expiring |
| **Certificate Profiles** | Which profiles require approval |
| **Bypass for machine identities** | Allow automated systems to skip approval |

**2. Configure approval steps**

Each step defines who can approve and how many approvals are required:

| Field | Description |
| - | - |
| **Step Name** | Optional name like `Security Team Review` |
| **Approvers** | Users or groups eligible to approve |
| **Required Approvals** | How many must approve (e.g., 2 of 5) |
| **Notify Approvers** | Send an in-app notification and email when approval is needed |

**Example multi-step workflow:**

1. **Team Lead Review** — Requires 1 approval from team leads
2. **Security Review** — Requires 2 approvals from security team

**3. Review and create**

Review your configuration and select **Create**.

## Managing approval requests

### View requests

In the Certificate Manager sidebar, go to **Approval Requests** to see all pending and completed requests:

| Status | Meaning |
| - | - |
| **Open** | Pending approval |
| **Approved** | All steps completed, certificate issued |
| **Rejected** | An approver rejected the request |
| **Cancelled** | Requester cancelled the request |
| **Expired** | Request exceeded max TTL |

### Approve a request

**1. Open the request**

Select a pending request to view details.

**2. Review certificate details**

Verify the request information:

* Requester name and email
* Certificate profile
* Common name and SANs
* Key usages and validity period

**3. Approve**

If you're an eligible approver for the current step, select **Approve**.

Once all required approvals are obtained, the certificate is automatically issued. If issuance fails at that point, for example because the CA is disabled, the certificate request moves to **Failed** and Infisical records a [`certificate-issuance-failed` audit log event](https://infisical.com/docs/documentation/platform/audit-logs#certificate-issuance-failures) with the reason.

### Reject a request

**1. Open the request**

Select a pending request.

**2. Reject with reason**

Select **Reject** and optionally add a comment explaining why.

When a request is rejected, the workflow ends and no certificate is issued.

## FAQ

> [accordion] I approved a request but the certificate wasn't issued
>
> If the policy has multiple steps, your approval may have completed only one step. The certificate is issued only after **all** approval steps are completed. Check the request details to see which step is currently pending.

> [accordion] I don't see the Approve button
>
> The Approve button only appears if:
>
> * You're listed as an approver for the **current** step
> * The request is still pending (not expired or rejected)
> * Previous steps have been completed

> [accordion] Can I use approvals with ACME or EST?
>
> Yes, approval policies work with any enrollment method. However, automated clients like Certbot typically can't wait for human approval. Consider using the machine identity bypass for automated workloads.

> [accordion] What happens when a request expires?
>
> The request moves to **Expired** status and no certificate is issued. The requester must submit a new request.

> [accordion] Can requesters approve their own requests?
>
> By default, yes — if they're listed as an eligible approver. For separation of duties, configure approver groups that exclude potential requesters.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.