Issuance Profiles - CertForge

An Issuance Profile is a reusable CA + certificate shape configuration. Trust Profiles reference an Issuance Profile as their default; it determines which CA signs the cert and what the cert looks like.

What an Issuance Profile defines

Setting	Description
Certificate Authority	The CA that signs the certificate — Let’s Encrypt (ACME), DigiCert, internal CA, Azure Key Vault.
Key algorithm	`ecdsa-p256` (recommended), `ecdsa-p384`, or `rsa-2048`.
Validity days	Certificate lifetime (e.g., 90 days for Let’s Encrypt, up to 825 for DigiCert).
Renewal threshold	Number of days before expiry to trigger renewal. Default: 30 days.
Allow wildcards	Whether this profile can issue `*.example.com` certs.
DNS account	ACME DNS-01 challenge account used for wildcard validation. Required if wildcards are enabled for ACME CAs.

Create an Issuance Profile

Via the UI

Navigate to Trust Profiles in the sidebar.
Click Issuance Profiles (top tab or sub-navigation).
Click New Issuance Profile.
Select a Certificate Authority from the list. If no CA is configured, set one up first:
- Let’s Encrypt (public ACME): ACME Setup guide
- DigiCert or other commercial CA: CA Connectors guide
- Internal / private CA: Internal CA guide
- Azure Key Vault: AKV guide
Choose Key Algorithm — ecdsa-p256 is recommended for new deployments.
Set Validity Days and Renewal Threshold.
Enable Allow Wildcards if this profile will cover *.domain patterns.
If using ACME with wildcards, select or configure a DNS Account for DNS-01 challenge.
Save.

Recommended settings for public domains

For public domains using Let’s Encrypt:

Setting	Value
CA	Let’s Encrypt (ACME)
Key algorithm	`ecdsa-p256`
Validity days	`90`
Renewal threshold	`30`
Allow wildcards	Enabled (requires DNS-01 account)

ACME and wildcard certificates

Let’s Encrypt wildcard certificates (*.example.com) require DNS-01 challenge validation — Let’s Encrypt must verify you control the domain by checking a TXT record at _acme-challenge.example.com. HTTP-01 challenge cannot issue wildcards. To issue wildcards via ACME:

Configure a DNS account (Route 53, Cloudflare, Azure DNS, etc.) in Settings → DNS Accounts.
On the Issuance Profile, enable Allow Wildcards and select that DNS account.

See DNS Validation for provider-specific setup.

Assigning to a Trust Profile

An Issuance Profile takes effect when it is set as the Default Issuance Profile on a Trust Profile. Multiple Trust Profiles can reference the same Issuance Profile — for example, a single letsencrypt-90d profile shared across all internal domains.

Checking configuration

"List my issuance profiles"
→ list_issuance_profiles()

"Does the trust profile for fun.example.com have a CA configured?"
→ check_domain(domain="fun.example.com")

​What an Issuance Profile defines

​Create an Issuance Profile

​Via the UI

​Recommended settings for public domains

​ACME and wildcard certificates

​Assigning to a Trust Profile

​Checking configuration