> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Automate certificates with Infisical Agent

> Set up automatic certificate management using the Infisical Agent.

Automatically request, persist, and renew certificates on a server using the Infisical Agent.

## Prerequisites

* An [Application](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) with [API enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/api) configured
* A [machine identity](https://infisical.com/docs/documentation/platform/identities/machine-identities.md) added to the Application as an Operator

## Steps

**1. Install Infisical CLI**

```bash theme={"dark"}
# macOS
brew install infisical/get-cli/infisical

# Linux (Debian/Ubuntu)
curl -1sLf 'https://artifacts.infisical.com/setup.deb.sh' | sudo -E bash
sudo apt-get install infisical
```

**2. Create Agent Configuration**

Save your machine identity's client ID and client secret into files on the target machine, then create `/etc/infisical/agent-config.yaml` pointing at them:

```yaml theme={"dark"}
version: v2

infisical:
  address: "https://app.infisical.com"

auth:
  type: "universal-auth"
  config:
    client-id: "/etc/infisical/client-id" # Path to a file containing the client ID
    client-secret: "/etc/infisical/client-secret" # Path to a file containing the client secret

certificates:
  - application-name: "my-first-app"
    profile-name: "web-servers"
    attributes:
      common-name: "api.example.com"
      ttl: "90d"
    lifecycle:
      renew-before-expiry: "14d"
    file-output:
      private-key:
        path: "/etc/ssl/private/api.key"
        permission: "0600"
      certificate:
        path: "/etc/ssl/certs/api.crt"
        permission: "0644"
    post-hooks:
      on-renewal:
        command: "systemctl reload nginx"
```

| Field | Description |
| - | - |
| `application-name` | The Application containing your certificate profile |
| `profile-name` | The certificate profile to use for issuance |

**3. Start the Agent**

```bash theme={"dark"}
infisical cert-manager agent --config /etc/infisical/agent-config.yaml
```

## Result

The agent will:

* Authenticate with Infisical using your machine identity
* Request a certificate and save it to the configured paths
* Automatically renew it before expiration
* Execute post-hooks (like reloading NGINX) after renewal

## Next steps

* See the [Infisical Agent reference](https://infisical.com/docs/documentation/platform/pki/reference/infisical-agent.md) for all configuration options
* Set up [alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) for expiration notifications


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.