awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 06:29:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3583 from Infisical/feat/acme-and-external-ca

Browse Source 
feat: acme and external CA for PKI
This commit is contained in:
Sheen
2025-05-27 03:47:36 +08:00
committed by GitHub
parent be37e27dbf f91bbe1f31
commit 058394f892
128 changed files with 10602 additions and 3021 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/api-docs/constants.ts
+70 -2
View File
@@ -5,6 +5,8 @@ import {
} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-maps";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
import { CERTIFICATE_AUTHORITIES_TYPE_MAP } from "@app/services/certificate-authority/certificate-authority-maps";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import { SECRET_SYNC_CONNECTION_MAP, SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
@@ -1707,6 +1709,19 @@ export const CERTIFICATES = {
certificateChain: "The certificate chain of the certificate.",
serialNumberRes: "The serial number of the certificate.",
privateKey: "The private key of the certificate."
},
IMPORT: {
projectSlug: "Slug of the project to import the certificate into.",
certificatePem: "The PEM-encoded leaf certificate.",
privateKeyPem: "The PEM-encoded private key corresponding to the certificate.",
chainPem: "The PEM-encoded chain of intermediate certificates.",
friendlyName: "A friendly name for the certificate.",
pkiCollectionId: "The ID of the PKI collection to add the certificate to.",
certificate: "The issued certificate.",
certificateChain: "The certificate chain of the issued certificate.",
privateKey: "The private key of the issued certificate.",
serialNumber: "The serial number of the issued certificate."
}
};
@@ -1778,6 +1793,14 @@ export const PKI_SUBSCRIBERS = {
subscriberName: "The name of the PKI subscriber to get.",
projectId: "The ID of the project to get the PKI subscriber for."
},
GET_LATEST_CERT_BUNDLE: {
subscriberName: "The name of the PKI subscriber to get the active certificate bundle for.",
projectId: "The ID of the project to get the active certificate bundle for.",
certificate: "The active certificate for the subscriber.",
certificateChain: "The certificate chain of the active certificate for the subscriber.",
privateKey: "The private key of the active certificate for the subscriber.",
serialNumber: "The serial number of the active certificate for the subscriber."
},
CREATE: {
projectId: "The ID of the project to create the PKI subscriber in.",
caId: "The ID of the CA that will issue certificates for the PKI subscriber.",
@@ -1788,7 +1811,9 @@ export const PKI_SUBSCRIBERS = {
subjectAlternativeNames:
"A list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
keyUsages: "The key usage extension to be used on certificates issued for this subscriber.",
extendedKeyUsages: "The extended key usage extension to be used on certificates issued for this subscriber."
extendedKeyUsages: "The extended key usage extension to be used on certificates issued for this subscriber.",
enableAutoRenewal: "Whether or not to enable auto renewal for the PKI subscriber.",
autoRenewalPeriodInDays: "The period in days to auto renew the PKI subscriber's certificates."
},
UPDATE: {
projectId: "The ID of the project to update the PKI subscriber in.",
@@ -1802,7 +1827,9 @@ export const PKI_SUBSCRIBERS = {
"A comma-delimited list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
keyUsages: "The key usage extension to be used on certificates issued for this subscriber to update to.",
extendedKeyUsages:
"The extended key usage extension to be used on certificates issued for this subscriber to update to."
"The extended key usage extension to be used on certificates issued for this subscriber to update to.",
enableAutoRenewal: "Whether or not to enable auto renewal for the PKI subscriber.",
autoRenewalPeriodInDays: "The period in days to auto renew the PKI subscriber's certificates."
},
DELETE: {
subscriberName: "The name of the PKI subscriber to delete.",
@@ -1991,6 +2018,47 @@ export const ProjectTemplates = {
}
};
export const CertificateAuthorities = {
CREATE: (type: CaType) => ({
name: `The name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to create. Must be slug-friendly.`,
projectId: `The ID of the project to create the Certificate Authority in.`,
enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
status: `The status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
}),
UPDATE: (type: CaType) => ({
caId: `The ID of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to update.`,
projectId: `The ID of the project to update the Certificate Authority in.`,
name: `The updated name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority. Must be slug-friendly.`,
enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
status: `The updated status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
}),
CONFIGURATIONS: {
ACME: {
dnsAppConnectionId: `The ID of the App Connection to use for creating and managing DNS TXT records required for ACME domain validation. This connection must have permissions to create and delete TXT records in your DNS provider (e.g., Route53) for the ACME challenge process.`,
directoryUrl: `The directory URL for the ACME Certificate Authority.`,
accountEmail: `The email address for the ACME Certificate Authority.`,
provider: `The DNS provider for the ACME Certificate Authority.`,
hostedZoneId: `The hosted zone ID for the ACME Certificate Authority.`
},
INTERNAL: {
type: "The type of CA to create.",
friendlyName: "A friendly name for the CA.",
organization: "The organization (O) for the CA.",
ou: "The organization unit (OU) for the CA.",
country: "The country name (C) for the CA.",
province: "The state of province name for the CA.",
locality: "The locality name for the CA.",
commonName: "The common name (CN) for the CA.",
notBefore: "The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.",
notAfter: "The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.",
maxPathLength:
"The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.",
keyAlgorithm:
"The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA."
}
}
};
export const AppConnections = {
GET_BY_ID: (app: AppConnection) => ({
connectionId: `The ID of the ${APP_CONNECTION_NAME_MAP[app]} Connection to retrieve.`