Trust Profiles - CertForge

A Trust Profile (formally a Domain Trust Policy, or DTP) is CertForge’s governance anchor for a domain or set of domains. Every certificate request must match an active Trust Profile before CertForge will issue.

What a Trust Profile controls

Setting	Description
Domain patterns	Glob patterns like `*.example.com` or `api.example.com`. A request domain must match at least one.
Issuance Profile	Default CA and certificate shape (algorithm, validity, wildcards).
Approval policy	Auto-approve, or require N designated approvers before issuance.
GL code	Default cost attribution code, optionally required on every request.
Allowed SANs	Additional Subject Alternative Names permitted on issued certs.

Create a Trust Profile

Via the UI

Navigate to Trust Profiles in the sidebar.
Click New Trust Profile.
Enter a Name and one or more Domain Patterns (e.g., *.prod.example.com).
Select a default Issuance Profile (CA + cert shape). If none exist, create one first.
Set Approval Policy — enable Auto-Approve for fully automated issuance, or configure required approvers.
Optionally attach a GL Code for cost tracking.
Save.

Via MCP (AI agent)

"Create a trust profile for *.internal.example.com using Let's Encrypt"

The AI calls create_trust_profile in two steps — preview then confirm:

Step 1: Preview shown (dry_run=true)
Step 2: "Looks good, create it" → executes with dry_run=false, confirmed=true

Required parameters: domains, default_issuance_profile_id

Domain pattern matching

Patterns follow standard glob rules:

Pattern	Matches
`example.com`	Only `example.com`
`*.example.com`	`api.example.com`, `www.example.com` — not `example.com` itself
`..example.com`	Two-level wildcards like `us.east.example.com`

A certificate request for fun.example.com matches a Trust Profile containing *.example.com. A request for example.com does not — add example.com explicitly if needed.

Approval workflows

When Auto-Approve is off, requests queue in Approvals (accessible from the sidebar). Designated approvers are notified by email and can approve or deny from the UI or via the API. See Approval Workflow for configuration details.

Auto-Approve and the App Connector

The App Connector initiates certificate requests automatically when a cert nears expiry. If the Trust Profile requires manual approval, the renewal pauses until an approver acts. For fully automated renewal without human intervention, enable Auto-Approve on the Trust Profile.

GL codes

GL codes attribute certificate costs to a budget owner. If a Trust Profile has Require GL Code enabled, every cert request for that domain must include a valid GL code. See GL Codes for setup.

Checking coverage

Use check_domain (MCP) or the Domain Coverage view in the UI to verify a domain has an active Trust Profile, a CA configured, and an application record:

"Check if fun.example.com is ready for auto-issuance"
→ check_domain(domain="fun.example.com")

​What a Trust Profile controls

​Create a Trust Profile

​Via the UI

​Via MCP (AI agent)

​Domain pattern matching

​Approval workflows

​Auto-Approve and the App Connector

​GL codes

​Checking coverage