Address PR comments

docs/documentation/platform/pki/certificate-syncs/overview.mdx

@@ -75,13 +75,15 @@ via the UI or API for the third-party service you intend to sync certificates to
 2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the desired project by specifying the following parameters via the UI or API:
     - <strong>Source:</strong> The PKI subscriber you wish to retrieve certificates from.
     - <strong>Destination:</strong> The App Connection to utilize and the destination endpoint to deploy certificates to. These can vary between services.
-    - <strong>Options:</strong> Customize how certificates should be synced, such as whether or not certificates should be removed from the destination when they expire.
+    - <strong>Options:</strong> Customize how certificates should be synced, including:
+      - Whether certificates should be removed from the destination when they expire
+      - Certificate naming schema to control how certificate names are generated in the destination
 
 <Note>
-    Certificate Syncs are the source of truth for connected third-party services. Any certificate,
-    including associated data, not present or managed by Infisical before syncing will be
-    overwritten, and changes made directly in the connected service outside of Infisical may also
-    be overwritten by future syncs.
+    Certificate Syncs manage certificates that are prefixed with "Infisical-" in the destination. Only
+    certificates managed by Infisical will be affected during sync operations. Certificates not created or
+    managed by Infisical will remain untouched, and changes made to Infisical-managed certificates directly
+    in the destination service may be overwritten by future syncs.
 </Note>
 
 <Info>
@@ -95,6 +97,31 @@ via the UI or API for the third-party service you intend to sync certificates to
     contact us at [email protected] to make a request.
 </Note>
 
+## Certificate Naming
+
+Certificate Syncs support flexible certificate naming through configurable naming schemas. This allows you to customize how certificate names appear in your destination services.
+
+### Default Naming
+
+By default, certificates are named using the pattern `Infisical-{certificateId}` where `{certificateId}` is the unique identifier of the certificate with hyphens removed for compatibility with services like Azure Key Vault.
+
+### Custom Naming Schema
+
+You can customize certificate naming by providing a **Certificate Name Schema** when creating or updating a Certificate Sync. The schema supports the following placeholders:
+
+- `{{certificateId}}` - The unique certificate identifier (required)
+- `{{environment}}` - The environment context (always "global" for PKI syncs)
+
+**Examples:**
+- `myapp-{{certificateId}}` → `myapp-abc123def456`
+- `{{environment}}-cert-{{certificateId}}` → `global-cert-abc123def456`
+- `ssl/{{certificateId}}` → `ssl/abc123def456`
+
+**Rules:**
+- Must include exactly one `{{certificateId}}` placeholder
+- Only alphanumeric characters, dashes (-), underscores (_), and slashes (/) are allowed
+- Certificate names matching your schema will be managed by Infisical during sync operations
+
 ## Certificate Management
 
 Certificate Syncs handle the full lifecycle of certificate management: