> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgov.app/llms.txt
> Use this file to discover all available pages before exploring further.

# DTP Advisor

> Automatically analyze unmanaged certificates and get recommendations for organizing them into Domain Trust Profiles.

## What is the DTP Advisor?

The **DTP Advisor** analyzes the unmanaged certificates in your inventory and groups them into clusters that make sense to govern together. For each group it recommends matching existing Domain Trust Profiles, or shows you what a new profile would look like.

Access it at **Inventory → Advisor**.

***

## How grouping works

The Advisor groups unmanaged certificates by three attributes:

| Attribute          | Why it matters                                                                                                                                                              |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **CA**             | Certs from different Certificate Authorities are kept in separate groups — Let's Encrypt and Google Trust Services are distinct CAs even if they issue for the same domain. |
| **Key profile**    | RSA-2048, EC P-256, and Ed25519 certs have different policy implications and should not be mixed in a single DTP.                                                           |
| **Validity range** | Certs expiring soon (≤90 days) vs. long-lived certs belong to different urgency buckets.                                                                                    |

### CA display

The Advisor infers the CA from the certificate's issuer distinguished name. The `O=` (Organization) field becomes the primary label — for example, `O=Let's Encrypt` → **Let's Encrypt**. The specific intermediate used (e.g. R10, E6) appears as secondary context: **via r10**.

When a group is issued by multiple intermediates from the same CA (Let's Encrypt R10 and R11, for instance), they are merged into one group with a combined "via r10 + r11" label. Certs from **different CA organizations are never merged**, even if they happen to match the same DTP.

***

## Reading a group card

Each group card shows:

```
CA                      Let's Encrypt   via r10 + r11
                        ≤90 days  ·  EC P-256  ·  4 certs

CERTIFICATES IN THIS GROUP
  api.example.com         Nov 18, 2026   R10
  nginx.example.com       Nov 30, 2026   R10

IF YOU BUILD A TRUST PROFILE FOR THIS GROUP
  CA: Let's Encrypt  Key: Unknown  Max Validity: 90d  Domains: *.example.com

MATCHING EXISTING TRUST PROFILES
  *.example.com
  LetsEncrypt-Example  ·  Key: EC P-256  ·  ✓ Auto-approve
```

### CA mismatch warning

If the best-matching DTP's issuance profile uses a **different CA** than the certificates in this group, the match row shows an amber warning:

> **⚠ CA differs — will switch on renewal**

This means: if you assign these certs to that DTP, they will renew via the DTP's configured CA, not the one that originally issued them. This is often intentional (migrating from an external provider to your managed CA), but worth being explicit about.

***

## Actions

### Assign to existing DTP

Click **Assign N certs** on a matching DTP row to move all certificates in the group under that profile. CertForge records the governance decision and the certs no longer appear as unmanaged.

If you only want to assign a **subset** of certs from a group:

1. Click the cert's subject (it links directly to the Inventory filtered to that hostname).
2. Handle the cert individually from Inventory — assign it to a profile or mark it external.

### Mark a cert external

For certs you don't manage (issued by a third party, outside your control), go to Inventory → find the cert → set its governance status to **External**. External certs are tracked for visibility but excluded from governance reports and advisor groups.

### Build a new Trust Profile

Click **Build new profile instead** to open the Trust Profile builder pre-filled with the group's inferred CA, domains, key type, and validity window.

***

## Re-analyze

The Advisor shows results from the most recent discovery run. Click **Re-analyze** to reprocess the current inventory immediately without waiting for the next scheduled scan.

***

## Related

* [Certificate Discovery](/concepts/discovery) — how certs are found and classified
* [Domain Trust Profiles](/concepts/domain-trust-profiles) — the policy object that governs each group
* [Issuance Profiles](/concepts/issuance-profiles) — controls which CA and key type the DTP uses for renewal