> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Enrollment methods

> Configure how your services and devices request certificates from Infisical Certificate Management.

Enrollment methods define how certificates are requested from your Application. Each method supports different use cases — from UI-based issuance and the Infisical Agent to standard protocols like ACME that work with existing tooling.

## Choose an enrollment method

> [card] [API](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/api)
>
> **Best for:** Manual UI issuance, Infisical Agent, custom integrations
>
> Issue certificates through the Infisical UI, Agent, or direct API calls. Supports server-driven auto-renewal.

> [card] [ACME](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme)
>
> **Best for:** Web servers, Kubernetes, standard tooling
>
> Works with Certbot, cert-manager, and any ACME-compatible client.

> [card] [EST](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/est.md)
>
> **Best for:** Enterprise device enrollment, IoT
>
> RFC 7030 compliant protocol for secure certificate enrollment and re-enrollment.

> [card] [SCEP](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/scep)
>
> **Best for:** MDM systems, network devices
>
> Legacy protocol supported by Jamf, Intune, and network equipment.

## Comparison

| Method | Protocol | Auto-Renewal | Domain Validation | Best For |
| - | - | - | - | - |
| **API** | REST/HTTP | Server-driven or client-driven | None | UI issuance, Agent, integrations |
| **ACME** | RFC 8555 | Client-driven | HTTP-01 | Web servers, Kubernetes |
| **EST** | RFC 7030 | Re-enrollment | Certificate-based | Enterprise devices |
| **SCEP** | Draft RFC | Re-enrollment | Challenge password | MDM, network devices |

## How enrollment works

**1. Product Admin attaches a profile**

A Product Admin attaches a [Certificate Profile](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md) to the Application. The profile defines certificate parameters (CA, validity, constraints).

**2. Configure enrollment methods on the profile**

In your Application's **Settings** tab, select **Configure** on an attached profile and add enrollment methods (API, ACME, EST, or SCEP).

**3. Point your client to the endpoint**

Configure your service, device, or tooling to use the enrollment endpoint provided by Infisical.

**4. Request a certificate**

Your client requests a certificate. Infisical validates the request against the profile's policy and issues the certificate.

> [!NOTE]
>
> Each enrollment method is tied to a specific profile attached to the Application — meaning the enrollment URL (e.g., ACME directory) is unique to that Application + Profile pair.

## After enrollment

Once certificates are issued, you can:

* **[View and manage certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificates.md)** in your Application's certificate inventory
* **[Sync certificates](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)** to external destinations like [AWS ACM](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/aws-certificate-manager.md), [Azure Key Vault](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/azure-key-vault.md), or [Cloudflare](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/cloudflare-custom-certificate.md)
* **[Set up alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview)** to get notified before certificates expire
* **[Configure approval policies](https://infisical.com/docs/documentation/platform/pki/applications/approvals.md)** to require human review before issuance


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.