Navigate to **Certificates** to view detailed information about all issued
diff --git a/docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx b/docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx
index de064bf4e..6cc4a5072 100644
--- a/docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx
+++ b/docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx
@@ -5,62 +5,57 @@ description: "Learn how to configure an AWS Certificate Manager Certificate Sync
**Prerequisites:**
-- Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
- Create an [AWS Connection](/integrations/app-connections/aws)
The AWS Certificate Manager Certificate Sync requires the following ACM permissions to be set on the IAM user/role
for Infisical to sync certificates to AWS Certificate Manager: `acm:ListCertificates`, `acm:DescribeCertificate`, `acm:ImportCertificate`, `acm:DeleteCertificate`, and `acm:ListTagsForCertificate`.
- These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
+These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
+
- Certificates synced to AWS Certificate Manager will be stored as imported certificates, preserving both the certificate and private key components.
+ Certificates synced to AWS Certificate Manager will be stored as imported
+ certificates, preserving both the certificate and private key components.
- 1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
- 
+ 1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
+ 
2. Select the **AWS Certificate Manager** option.
- 
+ 
- 3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
- 
+ 3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
+ 
- - **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
+ - **AWS Connection**: The AWS Connection to authenticate with.
+ - **AWS Region**: The AWS region where certificates should be stored.
- 4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
- 
+ 4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
+ 
- - **AWS Connection**: The AWS Connection to authenticate with.
- - **AWS Region**: The AWS region where certificates should be stored.
+ - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
+ - **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
+ - **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
+ - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- 5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
- 
-
- - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- - **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
- - **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
-
-
- **AWS Certificate Manager Certificate Limits**: AWS Certificate Manager has limits on the number of certificates per account and region. Refer to AWS documentation for current limits. Deleted certificates count toward your quota until they are permanently purged by AWS (typically after 30 days).
-
-
- 6. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
- 
+ 5. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
+ 
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
+ 6. Select which certificates should be synced to AWS Certificate Manager.
+ 
+
7. Review your AWS Certificate Manager Certificate Sync configuration, then click **Create Sync**.
- 
+ 
8. If enabled, your AWS Certificate Manager Certificate Sync will begin syncing your certificates to the destination endpoint.
- 
-
+ 
To create an **AWS Certificate Manager Certificate Sync**, make an API request to the [Create AWS Certificate Manager Certificate Sync](/api-reference/endpoints/pki/syncs/aws-certificate-manager/create) API endpoint.
@@ -115,19 +110,22 @@ description: "Learn how to configure an AWS Certificate Manager Certificate Sync
}
```
+
## Certificate Management
Your AWS Certificate Manager Certificate Sync will:
-- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to AWS Certificate Manager
-- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur
-- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled)
+- **Automatic Deployment**: Deploy certificates in Infisical to AWS Certificate Manager.
+- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur.
+- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled).
- **Tagging**: Automatically tag certificates with an InfisicalCertificate tag for easy identification and management
- AWS Certificate Manager Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
+ AWS Certificate Manager Certificate Syncs support both automatic and manual
+ synchronization modes. When auto-sync is enabled, certificates are
+ automatically deployed as they are issued or renewed.
## Manual Certificate Sync
@@ -142,5 +140,8 @@ You can manually trigger certificate synchronization from your PKI subscriber to
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/aws-certificate-manager/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
-AWS Certificate Manager does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from AWS Certificate Manager. Only certificates imported into ACM (not AWS-issued certificates) can be managed by the sync.
-
\ No newline at end of file
+ AWS Certificate Manager does not support importing certificates back into
+ Infisical due to security limitations where private keys cannot be extracted
+ from AWS Certificate Manager. Only certificates imported into ACM (not
+ AWS-issued certificates) can be managed by the sync.
+
diff --git a/docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx b/docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx
index 6190ab3c3..8e342f1a4 100644
--- a/docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx
+++ b/docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx
@@ -5,47 +5,43 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
**Prerequisites:**
- - Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
- - Create an [Azure Key Vault Connection](/integrations/app-connections/azure-key-vault)
- - Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
+- Create an [Azure Key Vault Connection](/integrations/app-connections/azure-key-vault)
+- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
The Azure Key Vault Certificate Sync requires the following certificate permissions to be set on the user / service principal
for Infisical to sync certificates to Azure Key Vault: `certificates/list`, `certificates/get`, `certificates/import`, `certificates/delete`.
- Any role with these permissions would work such as the **Key Vault Certificates Officer** role.
+Any role with these permissions would work such as the **Key Vault Certificates Officer** role.
+
- Certificates synced to Azure Key Vault will be stored as certificate objects, preserving both the certificate and private key components.
+ Certificates synced to Azure Key Vault will be stored as certificate objects,
+ preserving both the certificate and private key components.
- 1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
- 
+ 1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
+ 
2. Select the **Azure Key Vault** option.
- 
+ 
- 3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
- 
-
- - **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
-
- 4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
- 
+ 3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
+ 
- **Azure Connection**: The Azure Connection to authenticate with.
- **Vault Base URL**: The URL of your Azure Key Vault.
-
- 5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
- 
+ 4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
+ 
- - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- - **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
+ - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
+ - **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
+ - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
**Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
@@ -53,18 +49,20 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
- To resync removed certificates, you must either manually **purge** them from Azure Key Vault or **recover** them through the Azure portal/CLI
- 6. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
- 
+ 5. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
+ 
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
+ 6. Select which certificates should be synced to AWS Certificate Manager.
+ 
+
7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
- 
+ 
8. If enabled, your Azure Key Vault Certificate Sync will begin syncing your certificates to the destination endpoint.
- 
-
+ 
To create an **Azure Key Vault Certificate Sync**, make an API request to the [Create Azure Key Vault Certificate Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create) API endpoint.
@@ -119,19 +117,22 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
}
```
+
## Certificate Management
Your Azure Key Vault Certificate Sync will:
-- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to Azure Key Vault
+- **Automatic Deployment**: Deploy certificates in Infisical to Azure Key Vault.
- **Certificate Updates**: Update certificates in Azure Key Vault when renewals occur
- **Expiration Handling**: Optionally remove expired certificates from Azure Key Vault (if enabled)
- **Format Preservation**: Maintain certificate format and metadata during sync operations
- Azure Key Vault Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
+ Azure Key Vault Certificate Syncs support both automatic and manual
+ synchronization modes. When auto-sync is enabled, certificates are
+ automatically deployed as they are issued or renewed.
## Manual Certificate Sync
@@ -146,5 +147,7 @@ You can manually trigger certificate synchronization from your PKI subscriber to
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
-Azure Key Vault does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from Azure Key Vault.
-
\ No newline at end of file
+ Azure Key Vault does not support importing certificates back into Infisical
+ due to security limitations where private keys cannot be extracted from Azure
+ Key Vault.
+
diff --git a/docs/documentation/platform/pki/certificate-syncs/overview.mdx b/docs/documentation/platform/pki/certificate-syncs/overview.mdx
index db4844a92..d7931d893 100644
--- a/docs/documentation/platform/pki/certificate-syncs/overview.mdx
+++ b/docs/documentation/platform/pki/certificate-syncs/overview.mdx
@@ -3,17 +3,19 @@ sidebarTitle: "Overview"
description: "Learn how to sync certificates from Infisical PKI to third-party services."
---
-Certificate Syncs enable you to sync certificates from Infisical PKI to third-party services using [App Connections](/integrations/app-connections/overview).
+Certificate Syncs enable you to push certificates from Infisical to third-party services using [App Connections](/integrations/app-connections/overview).
- Certificate Syncs are designed to automatically deploy certificates issued by your Certificate Authority to external services, ensuring your certificates are always up-to-date across your infrastructure.
+ Certificate Syncs are designed to automatically deploy certificates issued by
+ your Certificate Authority to external services, ensuring your certificates
+ are always up-to-date across your infrastructure.
## Concept
-Certificate Syncs are a project-level resource used to sync certificates, via an [App Connection](/integrations/app-connections/overview), from a particular PKI subscriber (source)
-to a third-party service (destination). When new certificates are issued or existing certificates are renewed, changes will automatically be propagated to the destination, ensuring
-your certificates are always current.
+Certificate Syncs are a project-level resource used to push certificates, via an [App Connection](/integrations/app-connections/overview), from Infisical
+to a third-party service (destination). When paired with [server-side auto-renewal](/documentation/platform/pki/certificates/certificates#server-driven-certificate-renewal), renewed certificates are automatically synced to the destination,
+ensuring your certificates stay current.
@@ -31,17 +33,15 @@ your certificates are always current.
G[Certificate 1]
H[Certificate 2]
I[Certificate 3]
- J[PKI Subscriber]
B --> A
- C --> J
- D --> J
- E --> J
+ C --> B
+ D --> B
+ E --> B
A --> F
F --> G
F --> H
F --> I
- J --> B
classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
@@ -61,39 +61,50 @@ your certificates are always current.
## Workflow
-Configuring a Certificate Sync requires three components: a source PKI subscriber to retrieve certificates from,
+Configuring a Certificate Sync requires three components: The certificates that you'd like to push,
a destination endpoint to deploy certificates to, and configuration options to determine how your certificates
should be synced. Follow these steps to start syncing:
- For step-by-step guides on syncing to a particular third-party service, refer to the Certificate Syncs section in the Navigation Bar.
+ For step-by-step guides on syncing to a particular third-party service, refer
+ to the Certificate Syncs section in the Navigation Bar.
-1. Create App Connection: If you have not already done so, create an [App Connection](/integrations/app-connections/overview)
-via the UI or API for the third-party service you intend to sync certificates to.
+1. Create App Connection: If you have not already done so, create
+ an [App Connection](/integrations/app-connections/overview) via the UI or API
+ for the third-party service you intend to sync certificates to.
-2. Create Certificate Sync: Configure a Certificate Sync in the desired project by specifying the following parameters via the UI or API:
- - Source: The PKI subscriber you wish to retrieve certificates from.
- - Destination: The App Connection to utilize and the destination endpoint to deploy certificates to. These can vary between services.
- - Options: Customize how certificates should be synced, including:
- - Whether certificates should be removed from the destination when they expire
- - Certificate naming schema to control how certificate names are generated in the destination
+2. Create Certificate Sync: Configure a Certificate Sync in the
+ desired project by specifying the following parameters via the UI or API:
+
+ - Destination: The App Connection to utilize and the destination
+ endpoint to deploy certificates to such as [AWS Certificate Manager](/documentation/platform/pki/certificate-syncs/aws-certificate-manager)
+ or [Azure Key Vault](/documentation/platform/pki/certificate-syncs/azure-key-vault).
+ - Certificates: The certificates you wish to push to the destination.
+ - Options: Customize how certificates should be synced, including:
+ - Whether certificates should be removed from the destination when they expire.
+ - Certificate naming schema to control how certificate names are generated in
+ the destination.
- Only certificates managed by Infisical will be affected during sync operations. Certificates not created or
- managed by Infisical will remain untouched, and changes made to Infisical-managed certificates directly
- in the destination service may be overwritten by future syncs.
+ Only certificates managed by Infisical will be affected during sync
+ operations. Certificates not created or managed by Infisical will remain
+ untouched, and changes made to Infisical-managed certificates directly in the
+ destination service may be overwritten by future syncs.
- Some third-party services do not support removing expired certificates automatically.
+ Some third-party services do not support removing expired certificates
+ automatically.
-3. Utilize Sync: Any new certificates issued or renewals from the source PKI subscriber will now automatically be propagated to the destination endpoint.
+3. Utilize Sync: Selected certificates will now be pushed to the
+ destination endpoint and automatically redeployed whenever they are renewed.
- Infisical is continuously expanding its Certificate Sync third-party service support. If the service you need isn't available,
- contact us at team@infisical.com to make a request.
+ Infisical is continuously expanding its Certificate Sync third-party service
+ support. If the service you need isn't available, contact us at
+ team@infisical.com to make a request.
## Certificate Naming
@@ -111,32 +122,12 @@ You can customize certificate naming by providing a **Certificate Name Schema**
- `{{certificateId}}` - The unique certificate identifier (required)
**Examples:**
+
- `myapp-{{certificateId}}` → `myapp-abc123def456`
- `ssl/{{certificateId}}` → `ssl/abc123def456`
**Rules:**
+
- Must include exactly one `{{certificateId}}` placeholder
-- Only alphanumeric characters, dashes (-), underscores (_), and slashes (/) are allowed
+- Only alphanumeric characters, dashes (-), underscores (\_), and slashes (/) are allowed
- Certificate names matching your schema will be managed by Infisical during sync operations
-
-## Certificate Management
-
-Certificate Syncs handle the full lifecycle of certificate management:
-
-- **Automatic Deployment**: New certificates are automatically deployed to configured destinations
-- **Renewal Propagation**: Certificate renewals are seamlessly pushed to all connected services
-- **Expiration Handling**: Expired certificates can be automatically removed from destinations (service-dependent)
-- **Certificate Validation**: Certificates are validated before deployment to ensure integrity
-
-
- ```mermaid
- graph LR
- A[Certificate Issued] -->|Deploy| B[Destination Service]
- C[Certificate Renewed] -->|Update| B
- D[Certificate Expired] -->|Remove| B
- style B fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
- style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
- style C fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
- style D fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
- ```
-
\ No newline at end of file
diff --git a/docs/documentation/platform/pki/concepts/certificate-lifecycle.mdx b/docs/documentation/platform/pki/concepts/certificate-lifecycle.mdx
index 6d8ffc587..cf19ac867 100644
--- a/docs/documentation/platform/pki/concepts/certificate-lifecycle.mdx
+++ b/docs/documentation/platform/pki/concepts/certificate-lifecycle.mdx
@@ -29,7 +29,7 @@ Enrollment can be manually completed via API or fully automated using protocols
## Deployment
-Certificate deployment involves installing the issued certificate on the appropriate systems and services, such as web servers, load balancers, or internal endpoints. It can also include distributing or synchronizing certificates to external systems like cloud key stores (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) so they can be securely consumed by workloads running in the cloud.
+Certificate deployment involves installing the issued certificate on the appropriate systems and services, such as web servers, load balancers, or internal endpoints. It can also include distributing or [synchronizing certificates](/documentation/platform/pki/certificate-syncs/overview) to external systems like cloud key stores (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) so they can be securely consumed by workloads running in the cloud.
Deployment can happen manually or through automated mechanisms such as configuration pipelines, agents, or webhook integrations.
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-destination.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-destination.png
deleted file mode 100644
index 42a20fc99..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-destination.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-details.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-details.png
deleted file mode 100644
index 483cee003..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-details.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-options.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-options.png
deleted file mode 100644
index aa08b2d19..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-options.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-review.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-review.png
deleted file mode 100644
index 5f7b216ad..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-review.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-source.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-source.png
deleted file mode 100644
index 0d92fe69e..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-source.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/acm-synced.png b/docs/images/certificate-syncs/aws-certificate-manager/acm-synced.png
deleted file mode 100644
index 7e1ed12c5..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/acm-synced.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/aws-certificate-manager/select-acm-option.png b/docs/images/certificate-syncs/aws-certificate-manager/select-acm-option.png
deleted file mode 100644
index 79515516a..000000000
Binary files a/docs/images/certificate-syncs/aws-certificate-manager/select-acm-option.png and /dev/null differ
diff --git a/docs/images/certificate-syncs/general/certificate-sync-tab.png b/docs/images/certificate-syncs/general/certificate-sync-tab.png
deleted file mode 100644
index f97a10aa3..000000000
Binary files a/docs/images/certificate-syncs/general/certificate-sync-tab.png and /dev/null differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-certificates.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-certificates.png
new file mode 100644
index 000000000..42d83c0f7
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-certificates.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-destination.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-destination.png
new file mode 100644
index 000000000..6d0460601
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-destination.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png
new file mode 100644
index 000000000..8d7757fd0
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-options.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-options.png
new file mode 100644
index 000000000..03254ee9f
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-options.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-review.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-review.png
new file mode 100644
index 000000000..520b5e7f7
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-review.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-synced.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-synced.png
new file mode 100644
index 000000000..f6b40afa7
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-synced.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/select-acm-option.png b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/select-acm-option.png
new file mode 100644
index 000000000..b1b79dda5
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/aws-certificate-manager/select-acm-option.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png
new file mode 100644
index 000000000..04040365a
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-destination.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-destination.png
new file mode 100644
index 000000000..05361ae81
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-destination.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-details.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-details.png
new file mode 100644
index 000000000..642eeef34
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-details.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-options.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-options.png
new file mode 100644
index 000000000..69cd37d21
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-options.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-review.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-review.png
new file mode 100644
index 000000000..ae0c96574
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-review.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-synced.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-synced.png
new file mode 100644
index 000000000..157b4bf32
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/akv-synced.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/azure-key-vault/select-akv-option.png b/docs/images/platform/pki/certificate-syncs/azure-key-vault/select-akv-option.png
new file mode 100644
index 000000000..1fa0c0ca1
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/azure-key-vault/select-akv-option.png differ
diff --git a/docs/images/platform/pki/certificate-syncs/general/create-certificate-sync.png b/docs/images/platform/pki/certificate-syncs/general/create-certificate-sync.png
new file mode 100644
index 000000000..f0f62f386
Binary files /dev/null and b/docs/images/platform/pki/certificate-syncs/general/create-certificate-sync.png differ