> ## Documentation Index
> Fetch the complete documentation index at: https://docs.certgov.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Trust Profiles

> Domain Trust Policies (DTPs) define who can request certificates for a domain, which CA issues them, what approval is required, and how cost is attributed.

A **Trust Profile** (formally a Domain Trust Policy, or DTP) is CertForge's governance anchor for a domain or set of domains. Every certificate request must match an active Trust Profile before CertForge will issue.

***

## What a Trust Profile controls

| Setting              | Description                                                                                        |
| -------------------- | -------------------------------------------------------------------------------------------------- |
| **Domain patterns**  | Glob patterns like `*.example.com` or `api.example.com`. A request domain must match at least one. |
| **Issuance Profile** | Default CA and certificate shape (algorithm, validity, wildcards).                                 |
| **Approval policy**  | Auto-approve, or require N designated approvers before issuance.                                   |
| **GL code**          | Default cost attribution code, optionally required on every request.                               |
| **Allowed SANs**     | Additional Subject Alternative Names permitted on issued certs.                                    |

***

## Create a Trust Profile

### Via the UI

1. Navigate to **Trust Profiles** in the sidebar.
2. Click **New Trust Profile**.
3. Enter a **Name** and one or more **Domain Patterns** (e.g., `*.prod.example.com`).
4. Select a default **Issuance Profile** (CA + cert shape). If none exist, [create one first](/guides/issuance-profiles).
5. Set **Approval Policy** — enable Auto-Approve for fully automated issuance, or configure required approvers.
6. Optionally attach a **GL Code** for cost tracking.
7. Save.

### Via MCP (AI agent)

```
"Create a trust profile for *.internal.example.com using Let's Encrypt"
```

The AI calls `create_trust_profile` in two steps — preview then confirm:

```
Step 1: Preview shown (dry_run=true)
Step 2: "Looks good, create it" → executes with dry_run=false, confirmed=true
```

Required parameters: `domains`, `default_issuance_profile_id`

***

## Domain pattern matching

Patterns follow standard glob rules:

| Pattern           | Matches                                                             |
| ----------------- | ------------------------------------------------------------------- |
| `example.com`     | Only `example.com`                                                  |
| `*.example.com`   | `api.example.com`, `www.example.com` — **not** `example.com` itself |
| `*.*.example.com` | Two-level wildcards like `us.east.example.com`                      |

A certificate request for `fun.example.com` matches a Trust Profile containing `*.example.com`. A request for `example.com` does not — add `example.com` explicitly if needed.

***

## Approval workflows

When Auto-Approve is off, requests queue in **Approvals** (accessible from the sidebar). Designated approvers are notified by email and can approve or deny from the UI or via the API.

See [Approval Workflow](/guides/approval-workflow) for configuration details.

***

## Auto-Approve and the App Connector

The [App Connector](/guides/app-connector) initiates certificate requests automatically when a cert nears expiry. If the Trust Profile requires manual approval, the renewal pauses until an approver acts. For fully automated renewal without human intervention, enable **Auto-Approve** on the Trust Profile.

***

## GL codes

GL codes attribute certificate costs to a budget owner. If a Trust Profile has **Require GL Code** enabled, every cert request for that domain must include a valid GL code. See [GL Codes](/guides/approval-workflow) for setup.

***

## Checking coverage

Use `check_domain` (MCP) or the **Domain Coverage** view in the UI to verify a domain has an active Trust Profile, a CA configured, and an application record:

```
"Check if fun.example.com is ready for auto-issuance"
→ check_domain(domain="fun.example.com")
```