What certificate management and privileged access features does Infisical offer?

Infisical provides two related capabilities on one identity security platform: a PKI module for issuing and tracking certificates, and a privileged access management (PAM) module for controlling and recording privileged sessions. Both appear in the same dashboard as secrets management and agent access, so certificates, sessions, and application credentials can be reviewed together. The features described here are aimed at teams managing infrastructure credentials across cloud, on-prem, and AI workloads; the site presents them as part of an all-in-one stack rather than standalone products.

PKI: certificate issuance, expiry tracking, and auto-renewal

The PKI view lists certificates by common name with a status (Active, Expiring, Expired) and an expiry date, and includes an auto-renew column. In the site's example table, entries such as api.infisical.com show Active with an April 2027 expiry, while vault.internal shows Expiring in June 2026 and infisical.com shows Expired in May 2026. This gives a single place to see which certificates need attention before they lapse.

The practical value is in the status grouping: instead of checking expiry dates across separate systems, you filter to Expiring and act on those first. Auto-renew is shown as a per-certificate attribute, so renewal behavior can be tracked alongside the certificate itself.

PAM: session recording, approval windows, and termination

The PAM view tracks privileged sessions with columns for activity, duration, and status. Example rows include an SSH login to prod-db-01 (1h), a psql prod_accounts session (30m), sudo systemctl restart api (15m), an RDP login to win-bastion (45m), and a kubectl exec into a payments pod (20m). Statuses include Active, Expired, and events like "Read-only window closed" and "Approval window lapsed."

That last status is the key mechanism: access can be time-boxed to an approval window, and when the window lapses the session is terminated rather than left open. Session recording means the activity inside each session is captured, so the duration and commands are auditable after the fact. For a team granting temporary production access, this replaces standing credentials with a recorded, expiring session.

Visibility across active, expiring, and expired states

Both modules use the same three-state model — Active, Expiring, Expired — plus auto-renew and auto-revoke flags. The Agent Vault view applies the same pattern to AI agent identities: each agent has an identity bundle (for example payments-ro or warehouse-rw), an expiry ("in 6d," "in 4h"), and a status, with auto-revoke as an attribute. An expired deploy-agent bundle shows as Expired, which makes stale agent access visible rather than silently persistent.

This consistency matters operationally: certificates, human sessions, and agent credentials all surface the same way, so a single review pass covers all three.

Unified audit of credentials across apps and agents

The secrets view organizes credentials by environment and folder — Development, Staging, Prod–Core, Prod–US, Prod–EU — with entries like stripe_api_key, postgres_connection_url, aws_credentials, and dynamic-db. Because secrets, certificates, sessions, and agent bundles live in one platform with one identity model, the site describes auditing every credential an application or agent uses in one place. Granular access controls scope secrets by environment, path, and identity through fine-grained RBAC, and secret rotation with dynamic secrets is listed as part of secrets management.

How to evaluate it for your team

Start by mapping your current certificate inventory and privileged-access workflows to the status columns shown, then confirm which behaviors (auto-renew, auto-revoke, approval windows) are configurable for your setup. Pricing and plan-level limits are listed on the site's pricing page; check there before assuming a feature is available at your tier.