> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue your first certificate

> Issue a TLS certificate in under 10 minutes.

Issue a TLS certificate from your own private CA in about 10 minutes. You'll set up a certificate authority, create a policy and profile, then issue your first certificate.

> [!TIP]
>
> Visual learner? Watch an [introduction to certificate management with Infisical](https://www.youtube.com/watch?v=jP-9Ak0tr8A).

## Prerequisites

* Product Admin permissions (to create CAs, policies, and profiles)

## Steps

**1. Create a Certificate Authority**

Go to **Certificate Manager → Certificate Authorities** and select **Create**.

| Field | Value |
| - | - |
| Name | `my-root-ca` |
| Type | Root CA |
| Key Algorithm | EC\_prime256v1 |

[Learn more about CAs →](https://infisical.com/docs/documentation/platform/pki/ca/overview.md)

**2. Create a Certificate Policy**

Go to **Certificate Policies** and select **Create**.

| Field | Value |
| - | - |
| Preset | TLS Server Certificate |
| Name | `tls-server` |

The preset pre-configures all the right settings for standard TLS certificates.

[Learn more about policies →](https://infisical.com/docs/documentation/platform/pki/settings/policies.md)

**3. Create a Certificate Profile**

Go to **Certificate Profiles** and select **Create**.

| Field | Value |
| - | - |
| Name | `web-servers` |
| Certificate Authority | Select `my-root-ca` |
| Certificate Policy | Select `tls-server` |

[Learn more about profiles →](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md)

**4. Create an Application**

Go to **Certificate Manager → Applications** and select **Create**.

| Field | Value |
| - | - |
| Name | `my-first-app` |
| Certificate Profile | Select `web-servers` |

[Learn more about Applications →](https://infisical.com/docs/documentation/platform/pki/applications/overview.md)

**5. Configure Enrollment**

In your Application, go to the **Settings** tab and find the **Certificate Profiles** section. Select **Configure** on the `web-servers` profile, then select **Add enrollment method** and select **API**.

[Learn more about enrollment →](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/overview)

**6. Issue Certificate**

In your Application, go to the **Certificate Requests** tab and select **Request Certificate**.

| Field | Value |
| - | - |
| Profile | Select `web-servers` |
| Common Name | `example.local` |

Click **Request** and download your certificate and private key.

## Result

You now have two files:

* `certificate.pem` — Your TLS certificate
* `private-key.pem` — The private key (keep this secure)

**Verify your certificate:**

```bash theme={"dark"}
openssl x509 -in certificate.pem -text -noout
```

You should see your certificate details including the Common Name (`example.local`), validity period, and that it was signed by `my-root-ca`.

## Next steps

* Set up [ACME enrollment](https://infisical.com/docs/documentation/platform/pki/applications/enrollment-methods/acme) for automatic renewal
* Configure [alerting](https://infisical.com/docs/documentation/platform/pki/applications/alerting/overview) for expiration notifications
* Push certificates to cloud with [Certificate Syncs](https://infisical.com/docs/documentation/platform/pki/applications/certificate-syncs/overview)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.