def get_all_certs_not_attached_to_endpoint_with_autorotate():
    """
    Retrieves all certificates that are not attached to an endpoint, but that have autorotate enabled.

    :return: list of certificates not attached to an endpoint or destination with autorotate
    """
    return (
        Certificate.query.filter(not_(Certificate.endpoints.any()))
        .filter(Certificate.rotation == true())
        .filter(Certificate.revoked == false())
        .filter(Certificate.not_after >= arrow.now())
        .all()  # noqa
    )

    Retrieves all certificates that are not attached to an endpoint, but that have autorotate enabled.

    :return: list of certificates not attached to an endpoint or destination with autorotate
    
lemur/certificates/service.py