Certificate templates and PKI subscribers date back to the earliest version of Infisical Certificate Manager, before Applications. They have been superseded for a long time and see very little use today. They will be removed on December 15, 2026. Certificate applications replace them.
Timeline
The dates below apply to Infisical Cloud. Self-hosted instances are affected when they upgrade, which is covered further down.
Starting September 24, 2026, certificate templates and subscribers can no longer be created from the UI. Existing ones continue to operate unchanged and remain available to administrators under Certificate Manager → Legacy. The create endpoints remain available in the API until the removal date, so existing automation will not break; we recommend against relying on them and encourage teams to begin migrating now.
On December 15, 2026, both are removed from the product. Certificates already issued through them remain valid and none are revoked. Clients still enrolled against them stop receiving certificates, which includes EST clients configured against a certificate template and subscribers with automatic renewal enabled.
Migrating
An application represents a service or workload and carries its own members, certificates, alerts and syncs, issuing from a shared certificate profile. Enrollment is configured per application and supports API, ACME, EST and SCEP.
Teams that enroll machines should plan for updated enrollment URLs, as EST and SCEP clients now reference an application and a profile rather than a template.
Self-hosted deployments
Both changes arrive through releases, so you control when you take them. The release on September 24, 2026 closes creation in the UI, and the removal itself lands in the release on December 15, 2026. Staying on an earlier release keeps certificate templates and subscribers working on that version. Releases from December 15, 2026 onward will not include them, so we recommend planning the migration rather than deferring the upgrade indefinitely.
Notifications
Organizations that still hold certificate templates or subscribers will receive a monthly reminder by email and in-app, addressed to organization and project administrators. The reminders stop once none remain.
If this affects you
Most organizations will have nothing to do here. If yours still uses either one and something above is unclear, reply in this thread or contact support@infisical.com.