revamp certificate sync docs

docs/docs.json

@@ -765,7 +765,7 @@
                 ]
               },
               {
-                "group": "CA Integrations",
+                "group": "External CA Integrations",
                 "pages": [
                   "documentation/platform/pki/ca/acme-ca",
                   "documentation/platform/pki/ca/azure-adcs"

docs/documentation/platform/pki/ca/acme-ca.mdx

@@ -1,5 +1,5 @@
 ---
-title: "ACME CA"
+title: "ACME-compatible CA"
 description: "Learn how to automatically provision and manage TLS certificates using ACME Certificate Authorities like Let's Encrypt with Infisical PKI"
 ---
 

docs/documentation/platform/pki/ca/azure-adcs.mdx

@@ -1,5 +1,5 @@
 ---
-title: "Azure ADCS"
+title: "Microsoft AD CS"
 description: "Learn how to issue and manage certificates using Microsoft Active Directory Certificate Services (ADCS) with Infisical."
 ---
 
@@ -29,53 +29,53 @@ This section walks you through the complete end-to-end process of setting up Azu
     Page](/images/platform/pki/azure-adcs/azure-adcs-external-ca-page.png)
   </Step>
 
-  <Step title="Create New Azure ADCS Certificate Service CA">
+<Step title="Create New Azure ADCS Certificate Service CA">
-    Click **Create CA** and configure: - **Type**: Choose **Active Directory
+  Click **Create CA** and configure: - **Type**: Choose **Active Directory
-    Certificate Services (AD CS)** - **Name**: Friendly name for this CA (e.g.,
+  Certificate Services (AD CS)** - **Name**: Friendly name for this CA (e.g.,
-    "Production ADCS CA") - **App Connection**: Choose your ADCS connection from
+  "Production ADCS CA") - **App Connection**: Choose your ADCS connection from
-    the dropdown ![External CA
+  the dropdown ![External CA
-    Form](/images/platform/pki/azure-adcs/azure-adcs-external-ca-form.png)
+  Form](/images/platform/pki/azure-adcs/azure-adcs-external-ca-form.png)
-  </Step>
+</Step>
 
-  <Step title="Certificate Authority Created">
+<Step title="Certificate Authority Created">
-    Once created, your Azure ADCS Certificate Authority will appear in the list
+  Once created, your Azure ADCS Certificate Authority will appear in the list
-    and be ready for use. ![External CA
+  and be ready for use. ![External CA
-    Created](/images/platform/pki/azure-adcs/azure-adcs-external-ca-created.png)
+  Created](/images/platform/pki/azure-adcs/azure-adcs-external-ca-created.png)
-  </Step>
+</Step>
 
-  <Step title="Navigate to Subscribers">
+<Step title="Navigate to Subscribers">
-    Go to **Subscribers** to access the subscribers page. ![Subscribers
+  Go to **Subscribers** to access the subscribers page. ![Subscribers
-    Page](/images/platform/pki/azure-adcs/azure-adcs-subscribers-page.png)
+  Page](/images/platform/pki/azure-adcs/azure-adcs-subscribers-page.png)
-  </Step>
+</Step>
 
-  <Step title="Create New Subscriber">
+<Step title="Create New Subscriber">
-    Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
+  Click **Add Subscriber** and configure: - **Name**: Unique subscriber name
-    (e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA
+  (e.g., "web-server-certs") - **Certificate Authority**: Select your ADCS CA -
-    - **Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
+  **Common Name**: Certificate CN (e.g., "api.example.com") - **Certificate
-    Template**: Select from dynamically loaded ADCS templates - **Subject
+  Template**: Select from dynamically loaded ADCS templates - **Subject
-    Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
+  Alternative Names**: DNS names, IP addresses, or email addresses - **TTL**:
-    Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
+  Certificate validity period (e.g., "1y" for 1 year) - **Additional Subject
-    Fields**: Organization, OU, locality, state, country, email (if required by
+  Fields**: Organization, OU, locality, state, country, email (if required by
-    template) ![Subscribers
+  template) ![Subscribers
-    Form](/images/platform/pki/azure-adcs/azure-adcs-subscribers-form.png)
+  Form](/images/platform/pki/azure-adcs/azure-adcs-subscribers-form.png)
-  </Step>
+</Step>
 
-  <Step title="Subscriber Created">
+<Step title="Subscriber Created">
-    Your subscriber is now created and ready to issue certificates. ![Subscriber
+  Your subscriber is now created and ready to issue certificates. ![Subscriber
-    Created](/images/platform/pki/azure-adcs/azure-adcs-subscribers-created.png)
+  Created](/images/platform/pki/azure-adcs/azure-adcs-subscribers-created.png)
-  </Step>
+</Step>
 
-  <Step title="Issue New Certificate">
+<Step title="Issue New Certificate">
-    Click into your subscriber and click **Order Certificate** to generate a new
+  Click into your subscriber and click **Order Certificate** to generate a new
-    certificate using your ADCS template. ![Issue New
+  certificate using your ADCS template. ![Issue New
-    Certificate](/images/platform/pki/azure-adcs/azure-adcs-subscriber-issue-new-certificate.png)
+  Certificate](/images/platform/pki/azure-adcs/azure-adcs-subscriber-issue-new-certificate.png)
-  </Step>
+</Step>
 
-  <Step title="Certificate Created">
+<Step title="Certificate Created">
-    Your certificate has been successfully issued by the ADCS server and is
+  Your certificate has been successfully issued by the ADCS server and is ready
-    ready for use. ![Certificate
+  for use. ![Certificate
-    Created](/images/platform/pki/azure-adcs/azure-adcs-certificate-created.png)
+  Created](/images/platform/pki/azure-adcs/azure-adcs-certificate-created.png)
-  </Step>
+</Step>
 
   <Step title="View Certificate Details">
     Navigate to **Certificates** to view detailed information about all issued

docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx

@@ -5,62 +5,57 @@ description: "Learn how to configure an AWS Certificate Manager Certificate Sync
 
 **Prerequisites:**
 
-- Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
 - Create an [AWS Connection](/integrations/app-connections/aws)
 
 <Note>
   The AWS Certificate Manager Certificate Sync requires the following ACM permissions to be set on the IAM user/role
   for Infisical to sync certificates to AWS Certificate Manager: `acm:ListCertificates`, `acm:DescribeCertificate`, `acm:ImportCertificate`, `acm:DeleteCertificate`, and `acm:ListTagsForCertificate`.
 
-  These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
+These permissions allow Infisical to list, import, tag, and manage certificates in your AWS Certificate Manager service.
+
 </Note>
 
 <Note>
-  Certificates synced to AWS Certificate Manager will be stored as imported certificates, preserving both the certificate and private key components.
+  Certificates synced to AWS Certificate Manager will be stored as imported
+  certificates, preserving both the certificate and private key components.
 </Note>
 
 <Tabs>
     <Tab title="Infisical UI">
-        1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
+        1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
-        ![Certificate Syncs Tab](/images/certificate-syncs/general/certificate-sync-tab.png)
+        ![Certificate Syncs Tab](/images/platform/pki/certificate-syncs/general/create-certificate-sync.png)
 
         2. Select the **AWS Certificate Manager** option.
-        ![Select ACM](/images/certificate-syncs/aws-certificate-manager/select-acm-option.png)
+        ![Select ACM](/images/platform/pki/certificate-syncs/aws-certificate-manager/select-acm-option.png)
 
-        3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
+        3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
-        ![Configure Source](/images/certificate-syncs/aws-certificate-manager/acm-source.png)
+        ![Configure Destination](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-destination.png)
 
-            - **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
+        - **AWS Connection**: The AWS Connection to authenticate with.
+        - **AWS Region**: The AWS region where certificates should be stored.
 
-        4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
+        4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
-        ![Configure Destination](/images/certificate-syncs/aws-certificate-manager/acm-destination.png)
+        ![Configure Options](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-options.png)
 
-            - **AWS Connection**: The AWS Connection to authenticate with.
+        - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
-            - **AWS Region**: The AWS region where certificates should be stored.
+        - **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
+        - **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
+        - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
 
-        5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
+        5. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
-        ![Configure Options](/images/certificate-syncs/aws-certificate-manager/acm-options.png)
+        ![Configure Details](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png)
-
-            - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
-            - **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
-            - **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
-
-        <Tip>
-            **AWS Certificate Manager Certificate Limits**: AWS Certificate Manager has limits on the number of certificates per account and region. Refer to AWS documentation for current limits. Deleted certificates count toward your quota until they are permanently purged by AWS (typically after 30 days).
-        </Tip>
-
-        6. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
-        ![Configure Details](/images/certificate-syncs/aws-certificate-manager/acm-details.png)
 
             - **Name**: The name of your sync. Must be slug-friendly.
             - **Description**: An optional description for your sync.
 
+        6. Select which certificates should be synced to AWS Certificate Manager.
+        ![Select Certificates](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-certificates.png)
+
         7. Review your AWS Certificate Manager Certificate Sync configuration, then click **Create Sync**.
-        ![Confirm Configuration](/images/certificate-syncs/aws-certificate-manager/acm-review.png)
+        ![Confirm Configuration](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-review.png)
 
         8. If enabled, your AWS Certificate Manager Certificate Sync will begin syncing your certificates to the destination endpoint.
-        ![Sync Certificates](/images/certificate-syncs/aws-certificate-manager/acm-synced.png)
+        ![Sync Certificates](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-synced.png)
-
     </Tab>
     <Tab title="API">
         To create an **AWS Certificate Manager Certificate Sync**, make an API request to the [Create AWS Certificate Manager Certificate Sync](/api-reference/endpoints/pki/syncs/aws-certificate-manager/create) API endpoint.
@@ -115,19 +110,22 @@ description: "Learn how to configure an AWS Certificate Manager Certificate Sync
         }
         ```
     </Tab>
+
 </Tabs>
 
 ## Certificate Management
 
 Your AWS Certificate Manager Certificate Sync will:
 
-- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to AWS Certificate Manager
+- **Automatic Deployment**: Deploy certificates in Infisical to AWS Certificate Manager.
-- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur
+- **Certificate Updates**: Update certificates in AWS Certificate Manager when renewals occur.
-- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled)
+- **Expiration Handling**: Optionally remove expired certificates from AWS Certificate Manager (if enabled).
 - **Tagging**: Automatically tag certificates with an InfisicalCertificate tag for easy identification and management
 
 <Note>
-    AWS Certificate Manager Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
+  AWS Certificate Manager Certificate Syncs support both automatic and manual
+  synchronization modes. When auto-sync is enabled, certificates are
+  automatically deployed as they are issued or renewed.
 </Note>
 
 ## Manual Certificate Sync
@@ -142,5 +140,8 @@ You can manually trigger certificate synchronization from your PKI subscriber to
 To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/aws-certificate-manager/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
 
 <Note>
-AWS Certificate Manager does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from AWS Certificate Manager. Only certificates imported into ACM (not AWS-issued certificates) can be managed by the sync.
+  AWS Certificate Manager does not support importing certificates back into
-</Note>
+  Infisical due to security limitations where private keys cannot be extracted
+  from AWS Certificate Manager. Only certificates imported into ACM (not
+  AWS-issued certificates) can be managed by the sync.
+</Note>

docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx

@@ -5,47 +5,43 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
 
 **Prerequisites:**
 
-        - Set up and configure a [Certificate Authority](/documentation/platform/pki/overview)
+- Create an [Azure Key Vault Connection](/integrations/app-connections/azure-key-vault)
-        - Create an [Azure Key Vault Connection](/integrations/app-connections/azure-key-vault)
+- Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
-        - Ensure your network security policies allow incoming requests from Infisical to this certificate sync provider, if network restrictions apply.
 
 <Note>
   The Azure Key Vault Certificate Sync requires the following certificate permissions to be set on the user / service principal
   for Infisical to sync certificates to Azure Key Vault: `certificates/list`, `certificates/get`, `certificates/import`, `certificates/delete`.
 
-  Any role with these permissions would work such as the **Key Vault Certificates Officer** role.
+Any role with these permissions would work such as the **Key Vault Certificates Officer** role.
+
 </Note>
 
 <Note>
-  Certificates synced to Azure Key Vault will be stored as certificate objects, preserving both the certificate and private key components.
+  Certificates synced to Azure Key Vault will be stored as certificate objects,
+  preserving both the certificate and private key components.
 </Note>
 
 <Tabs>
     <Tab title="Infisical UI">
-        1. Navigate to **Project** > **Integrations** and select the **Certificate Syncs** tab. Click on the **Add Sync** button.
+        1. Navigate to **Project** > **Integrations** > **Certificate Syncs** and press **Add Sync**.
-        ![Certificate Syncs Tab](/images/certificate-syncs/general/certificate-sync-tab.png)
+        ![Certificate Syncs Tab](/images/platform/pki/certificate-syncs/general/create-certificate-sync.png)
 
         2. Select the **Azure Key Vault** option.
-        ![Select Key Vault](/images/certificate-syncs/azure-key-vault/select-key-vault-option.png)
+        ![Select Key Vault](/images/platform/pki/certificate-syncs/azure-key-vault/select-akv-option.png)
 
-        3. Configure the **Source** from where certificates should be retrieved, then click **Next**.
+        3. Configure the **Destination** to where certificates should be deployed, then click **Next**.
-        ![Configure Source](/images/certificate-syncs/azure-key-vault/vault-source.png)
+        ![Configure Destination](/images/platform/pki/certificate-syncs/azure-key-vault/akv-destination.png)
-
-            - **PKI Subscriber**: The PKI subscriber to retrieve certificates from.
-
-        4. Configure the **Destination** to where certificates should be deployed, then click **Next**.
-        ![Configure Destination](/images/certificate-syncs/azure-key-vault/vault-destination.png)
 
             - **Azure Connection**: The Azure Connection to authenticate with.
             - **Vault Base URL**: The URL of your Azure Key Vault.
-            <p class="height:1px"  />
 
-        5. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
+        4. Configure the **Sync Options** to specify how certificates should be synced, then click **Next**.
-        ![Configure Options](/images/certificate-syncs/azure-key-vault/vault-options.png)
+        ![Configure Options](/images/platform/pki/certificate-syncs/azure-key-vault/akv-options.png)
 
-            - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
+            - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
-            - **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
+            - **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
             - **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
+            - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
 
         <Tip>
             **Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
@@ -53,18 +49,20 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
             - To resync removed certificates, you must either manually **purge** them from Azure Key Vault or **recover** them through the Azure portal/CLI
         </Tip>
 
-        6. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
+        5. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
-        ![Configure Details](/images/certificate-syncs/azure-key-vault/vault-details.png)
+        ![Configure Details](/images/platform/pki/certificate-syncs/azure-key-vault/akv-details.png)
 
             - **Name**: The name of your sync. Must be slug-friendly.
             - **Description**: An optional description for your sync.
 
+        6. Select which certificates should be synced to AWS Certificate Manager.
+        ![Select Certificates](/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png)
+
         7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
-        ![Confirm Configuration](/images/certificate-syncs/azure-key-vault/vault-review.png)
+        ![Confirm Configuration](/images/platform/pki/certificate-syncs/azure-key-vault/akv-review.png)
 
         8. If enabled, your Azure Key Vault Certificate Sync will begin syncing your certificates to the destination endpoint.
-        ![Sync Certificates](/images/certificate-syncs/azure-key-vault/vault-synced.png)
+        ![Sync Certificates](/images/platform/pki/certificate-syncs/azure-key-vault/akv-synced.png)
-
     </Tab>
     <Tab title="API">
         To create an **Azure Key Vault Certificate Sync**, make an API request to the [Create Azure Key Vault Certificate Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create) API endpoint.
@@ -119,19 +117,22 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
         }
         ```
     </Tab>
+
 </Tabs>
 
 ## Certificate Management
 
 Your Azure Key Vault Certificate Sync will:
 
-- **Automatic Deployment**: Deploy new certificates issued by your PKI subscriber to Azure Key Vault
+- **Automatic Deployment**: Deploy certificates in Infisical to Azure Key Vault.
 - **Certificate Updates**: Update certificates in Azure Key Vault when renewals occur
 - **Expiration Handling**: Optionally remove expired certificates from Azure Key Vault (if enabled)
 - **Format Preservation**: Maintain certificate format and metadata during sync operations
 
 <Note>
-    Azure Key Vault Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
+  Azure Key Vault Certificate Syncs support both automatic and manual
+  synchronization modes. When auto-sync is enabled, certificates are
+  automatically deployed as they are issued or renewed.
 </Note>
 
 ## Manual Certificate Sync
@@ -146,5 +147,7 @@ You can manually trigger certificate synchronization from your PKI subscriber to
 To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
 
 <Note>
-Azure Key Vault does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from Azure Key Vault.
+  Azure Key Vault does not support importing certificates back into Infisical
-</Note>
+  due to security limitations where private keys cannot be extracted from Azure
+  Key Vault.
+</Note>

docs/documentation/platform/pki/certificate-syncs/overview.mdx

@@ -3,17 +3,19 @@ sidebarTitle: "Overview"
 description: "Learn how to sync certificates from Infisical PKI to third-party services."
 ---
 
-Certificate Syncs enable you to sync certificates from Infisical PKI to third-party services using [App Connections](/integrations/app-connections/overview).
+Certificate Syncs enable you to push certificates from Infisical to third-party services using [App Connections](/integrations/app-connections/overview).
 
 <Note>
-    Certificate Syncs are designed to automatically deploy certificates issued by your Certificate Authority to external services, ensuring your certificates are always up-to-date across your infrastructure.
+  Certificate Syncs are designed to automatically deploy certificates issued by
+  your Certificate Authority to external services, ensuring your certificates
+  are always up-to-date across your infrastructure.
 </Note>
 
 ## Concept
 
-Certificate Syncs are a project-level resource used to sync certificates, via an [App Connection](/integrations/app-connections/overview), from a particular PKI subscriber (source)
+Certificate Syncs are a project-level resource used to push certificates, via an [App Connection](/integrations/app-connections/overview), from Infisical
-to a third-party service (destination). When new certificates are issued or existing certificates are renewed, changes will automatically be propagated to the destination, ensuring
+to a third-party service (destination). When paired with [server-side auto-renewal](/documentation/platform/pki/certificates/certificates#server-driven-certificate-renewal), renewed certificates are automatically synced to the destination,
-your certificates are always current.
+ensuring your certificates stay current.
 
 <br />
 
@@ -31,17 +33,15 @@ your certificates are always current.
     G[Certificate 1]
     H[Certificate 2]
     I[Certificate 3]
-    J[PKI Subscriber]
 
     B --> A
-    C --> J
+    C --> B
-    D --> J
+    D --> B
-    E --> J
+    E --> B
     A --> F
     F --> G
     F --> H
     F --> I
-    J --> B
 
     classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
     classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
@@ -61,39 +61,50 @@ your certificates are always current.
 
 ## Workflow
 
-Configuring a Certificate Sync requires three components: a <strong>source</strong> PKI subscriber to retrieve certificates from,
+Configuring a Certificate Sync requires three components: The certificates that you'd like to push,
 a <strong>destination</strong> endpoint to deploy certificates to, and <strong>configuration options</strong> to determine how your certificates
 should be synced. Follow these steps to start syncing:
 
 <Note>
-    For step-by-step guides on syncing to a particular third-party service, refer to the Certificate Syncs section in the Navigation Bar.
+  For step-by-step guides on syncing to a particular third-party service, refer
+  to the Certificate Syncs section in the Navigation Bar.
 </Note>
 
-1. <strong>Create App Connection:</strong> If you have not already done so, create an [App Connection](/integrations/app-connections/overview)
+1. <strong>Create App Connection:</strong> If you have not already done so, create
-via the UI or API for the third-party service you intend to sync certificates to.
+   an [App Connection](/integrations/app-connections/overview) via the UI or API
+   for the third-party service you intend to sync certificates to.
 
-2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the desired project by specifying the following parameters via the UI or API:
+2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the
-    - <strong>Source:</strong> The PKI subscriber you wish to retrieve certificates from.
+   desired project by specifying the following parameters via the UI or API:
-    - <strong>Destination:</strong> The App Connection to utilize and the destination endpoint to deploy certificates to. These can vary between services.
+
-    - <strong>Options:</strong> Customize how certificates should be synced, including:
+   - <strong>Destination:</strong> The App Connection to utilize and the destination
-      - Whether certificates should be removed from the destination when they expire
+     endpoint to deploy certificates to such as [AWS Certificate Manager](/documentation/platform/pki/certificate-syncs/aws-certificate-manager)
-      - Certificate naming schema to control how certificate names are generated in the destination
+     or [Azure Key Vault](/documentation/platform/pki/certificate-syncs/azure-key-vault).
+   - <strong>Certificates:</strong> The certificates you wish to push to the destination.
+   - <strong>Options:</strong> Customize how certificates should be synced, including:
+     - Whether certificates should be removed from the destination when they expire.
+     - Certificate naming schema to control how certificate names are generated in
+     the destination.
 
 <Note>
-    Only certificates managed by Infisical will be affected during sync operations. Certificates not created or
+  Only certificates managed by Infisical will be affected during sync
-    managed by Infisical will remain untouched, and changes made to Infisical-managed certificates directly
+  operations. Certificates not created or managed by Infisical will remain
-    in the destination service may be overwritten by future syncs.
+  untouched, and changes made to Infisical-managed certificates directly in the
+  destination service may be overwritten by future syncs.
 </Note>
 
 <Info>
-    Some third-party services do not support removing expired certificates automatically.
+  Some third-party services do not support removing expired certificates
+  automatically.
 </Info>
 
-3. <strong>Utilize Sync:</strong> Any new certificates issued or renewals from the source PKI subscriber will now automatically be propagated to the destination endpoint.
+3. <strong>Utilize Sync:</strong> Selected certificates will now be pushed to the
+   destination endpoint and automatically redeployed whenever they are renewed.
 
 <Note>
-    Infisical is continuously expanding its Certificate Sync third-party service support. If the service you need isn't available,
+  Infisical is continuously expanding its Certificate Sync third-party service
-    contact us at team@infisical.com to make a request.
+  support. If the service you need isn't available, contact us at
+  team@infisical.com to make a request.
 </Note>
 
 ## Certificate Naming
@@ -111,32 +122,12 @@ You can customize certificate naming by providing a **Certificate Name Schema**
 - `{{certificateId}}` - The unique certificate identifier (required)
 
 **Examples:**
+
 - `myapp-{{certificateId}}` → `myapp-abc123def456`
 - `ssl/{{certificateId}}` → `ssl/abc123def456`
 
 **Rules:**
+
 - Must include exactly one `{{certificateId}}` placeholder
-- Only alphanumeric characters, dashes (-), underscores (_), and slashes (/) are allowed
+- Only alphanumeric characters, dashes (-), underscores (\_), and slashes (/) are allowed
 - Certificate names matching your schema will be managed by Infisical during sync operations
-
-## Certificate Management
-
-Certificate Syncs handle the full lifecycle of certificate management:
-
-- **Automatic Deployment**: New certificates are automatically deployed to configured destinations
-- **Renewal Propagation**: Certificate renewals are seamlessly pushed to all connected services
-- **Expiration Handling**: Expired certificates can be automatically removed from destinations (service-dependent)
-- **Certificate Validation**: Certificates are validated before deployment to ensure integrity
-
-<div align="center">
-    ```mermaid
-    graph LR
-      A[Certificate Issued] -->|Deploy| B[Destination Service]
-      C[Certificate Renewed] -->|Update| B
-      D[Certificate Expired] -->|Remove| B
-      style B fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
-      style A fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
-      style C fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
-      style D fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
-    ```
-</div>

docs/documentation/platform/pki/concepts/certificate-lifecycle.mdx

@@ -29,7 +29,7 @@ Enrollment can be manually completed via API or fully automated using protocols
 
 ## Deployment
 
-Certificate deployment involves installing the issued certificate on the appropriate systems and services, such as web servers, load balancers, or internal endpoints. It can also include distributing or synchronizing certificates to external systems like cloud key stores (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) so they can be securely consumed by workloads running in the cloud.
+Certificate deployment involves installing the issued certificate on the appropriate systems and services, such as web servers, load balancers, or internal endpoints. It can also include distributing or [synchronizing certificates](/documentation/platform/pki/certificate-syncs/overview) to external systems like cloud key stores (e.g., AWS Secrets Manager, Google Secret Manager, Azure Key Vault) so they can be securely consumed by workloads running in the cloud.
 
 Deployment can happen manually or through automated mechanisms such as configuration pipelines, agents, or webhook integrations.