What is the DTP Advisor?
The DTP Advisor analyzes the unmanaged certificates in your inventory and groups them into clusters that make sense to govern together. For each group it recommends matching existing Domain Trust Profiles, or shows you what a new profile would look like. Access it at Inventory → Advisor.How grouping works
The Advisor groups unmanaged certificates by three attributes:CA display
The Advisor infers the CA from the certificate’s issuer distinguished name. TheO= (Organization) field becomes the primary label — for example, O=Let's Encrypt → Let’s Encrypt. The specific intermediate used (e.g. R10, E6) appears as secondary context: via r10.
When a group is issued by multiple intermediates from the same CA (Let’s Encrypt R10 and R11, for instance), they are merged into one group with a combined “via r10 + r11” label. Certs from different CA organizations are never merged, even if they happen to match the same DTP.
Reading a group card
Each group card shows:CA mismatch warning
If the best-matching DTP’s issuance profile uses a different CA than the certificates in this group, the match row shows an amber warning:⚠ CA differs — will switch on renewalThis means: if you assign these certs to that DTP, they will renew via the DTP’s configured CA, not the one that originally issued them. This is often intentional (migrating from an external provider to your managed CA), but worth being explicit about.
Actions
Assign to existing DTP
Click Assign N certs on a matching DTP row to move all certificates in the group under that profile. CertForge records the governance decision and the certs no longer appear as unmanaged. If you only want to assign a subset of certs from a group:- Click the cert’s subject (it links directly to the Inventory filtered to that hostname).
- Handle the cert individually from Inventory — assign it to a profile or mark it external.
Mark a cert external
For certs you don’t manage (issued by a third party, outside your control), go to Inventory → find the cert → set its governance status to External. External certs are tracked for visibility but excluded from governance reports and advisor groups.Build a new Trust Profile
Click Build new profile instead to open the Trust Profile builder pre-filled with the group’s inferred CA, domains, key type, and validity window.Re-analyze
The Advisor shows results from the most recent discovery run. Click Re-analyze to reprocess the current inventory immediately without waiting for the next scheduled scan.Related
- Certificate Discovery — how certs are found and classified
- Domain Trust Profiles — the policy object that governs each group
- Issuance Profiles — controls which CA and key type the DTP uses for renewal