Merge pull request #1939 from Infisical/cert-mgmt

Certificate Management (Internal PKI)
2026-09-22 13:39:35 +00:00 · 2024-06-14 11:41:48 -04:00
parent 5d45237ea5 8fca6b60b3
commit 116e940050
130 changed files with 7543 additions and 40 deletions
--- a/docs/api-reference/endpoints/certificate-authorities/cert.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/cert.mdx
@@ -0,0 +1,4 @@
+---
+title: "Retrieve certificate / chain"
+openapi: "GET /api/v1/pki/ca/{caId}/certificate"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/create.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/create.mdx
@@ -0,0 +1,4 @@
+---
+title: "Create"
+openapi: "POST /api/v1/pki/ca"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/crl.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/crl.mdx
@@ -0,0 +1,4 @@
+---
+title: "Retrieve CRL"
+openapi: "GET /api/v1/pki/ca/{caId}/crl"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/csr.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/csr.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get CSR"
+openapi: "GET /api/v1/pki/ca/{caId}/csr"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/delete.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/pki/ca/{caId}"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/import-cert.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/import-cert.mdx
@@ -0,0 +1,4 @@
+---
+title: "Import certificate"
+openapi: "POST /api/v1/pki/ca/{caId}/import-certificate"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/issue-cert.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/issue-cert.mdx
@@ -0,0 +1,4 @@
+---
+title: "Issue certificate"
+openapi: "POST /api/v1/pki/ca/{caId}/issue-certificate"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/read.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/read.mdx
@@ -0,0 +1,4 @@
+---
+title: "Retrieve"
+openapi: "GET /api/v1/pki/ca/{caId}"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/sign-intermediate.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/sign-intermediate.mdx
@@ -0,0 +1,4 @@
+---
+title: "Sign intermediate certificate"
+openapi: "POST /api/v1/pki/ca/{caId}/sign-intermediate"
+---
--- a/docs/api-reference/endpoints/certificate-authorities/update.mdx
+++ b/docs/api-reference/endpoints/certificate-authorities/update.mdx
@@ -0,0 +1,4 @@
+---
+title: "Update"
+openapi: "PATCH /api/v1/pki/ca/{caId}"
+---
--- a/docs/api-reference/endpoints/certificates/cert-body.mdx
+++ b/docs/api-reference/endpoints/certificates/cert-body.mdx
@@ -0,0 +1,4 @@
+---
+title: "Get Certificate Body / Chain"
+openapi: "GET /api/v1/pki/certificates/{serialNumber}/certificate"
+---
--- a/docs/api-reference/endpoints/certificates/delete.mdx
+++ b/docs/api-reference/endpoints/certificates/delete.mdx
@@ -0,0 +1,4 @@
+---
+title: "Delete"
+openapi: "DELETE /api/v1/pki/certificates/{serialNumber}"
+---
--- a/docs/api-reference/endpoints/certificates/read.mdx
+++ b/docs/api-reference/endpoints/certificates/read.mdx
@@ -0,0 +1,4 @@
+---
+title: "Retrieve"
+openapi: "GET /api/v1/pki/certificates/{serialNumber}"
+---
--- a/docs/api-reference/endpoints/certificates/revoke.mdx
+++ b/docs/api-reference/endpoints/certificates/revoke.mdx
@@ -0,0 +1,4 @@
+---
+title: "Revoke"
+openapi: "POST /api/v1/pki/certificates/{serialNumber}/revoke"
+---
--- a/docs/documentation/platform/pki/certificates.mdx
+++ b/docs/documentation/platform/pki/certificates.mdx
@@ -0,0 +1,211 @@
+---
+title: "Certificates"
+sidebarTitle: "Certificates"
+description: "Learn how to issue X.509 certificates with Infisical."
+---
+
+## Concept
+
+Assuming that you've created a Private CA hierarchy with a root CA and an intermediate CA, you can now issue/revoke X.509 certificates using the intermediate CA.
+
+<div align="center">
+
+```mermaid
+graph TD
+    A[Root CA]
+    A --> B[Intermediate CA]
+    A --> C[Intermediate CA]
+    B --> D[Leaf Certificate]
+    C --> E[Leaf Certificate]
+```
+
+</div>
+
+## Workflow
+
+The typical workflow for managing certificates consists of the following steps:
+
+1. Issuing a certificate under an intermediate CA with details like name and validity period.
+2. Managing certificate lifecycle events such as certificate renewal and revocation. As part of the certificate revocation flow,
+   you can also query for a Certificate Revocation List [CRL](https://en.wikipedia.org/wiki/Certificate_revocation_list), a time-stamped, signed
+   data structure issued by a CA containing a list of revoked certificates to check if a certificate has been revoked.
+
+<Note>
+  Note that this workflow can be executed via the Infisical UI or manually such
+  as via API.
+</Note>
+
+## Guide to Issuing Certificates
+
+In the following steps, we explore how to issue a X.509 certificate under a CA.
+
+<Tabs>
+  <Tab title="Infisical UI">
+
+<Steps>
+  <Step title="Creating a certificate">
+    To create a certificate, head to your Project > Internal PKI > Certificates and press **Create Certificate**.
+
+    ![pki issue certificate](/images/platform/pki/cert-issue.png)
+
+    Here, set the **CA** to the CA you want to issue the certificate under and fill out details for the certificate.
+
+    ![pki issue certificate modal](/images/platform/pki/cert-issue-modal.png)
+
+    Here's some guidance on each field:
+
+    - Issuing CA: The CA under which to issue the certificate.
+    - Friendly Name: A friendly name for the certificate; this is only for display and defaults to the common name of the certificate if left empty.
+    - Common Name (CN): The (common) name of the certificate.
+    - TTL: The lifetime of the certificate in seconds.
+    - Valid Until: The date until which the certificate is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`.
+
+  </Step>
+  <Step title="Copying the certificate details">
+    Once you have created the certificate from step 1, you'll be presented with the certificate details including the **Certificate Body**, **Certificate Chain**, and **Private Key**.
+    
+    ![pki certificate body](/images/platform/pki/cert-body.png)
+    
+    <Note>
+        Make sure to download and store the **Private Key** in a secure location as it will only be displayed once at the time of certificate issuance.
+        The **Certificate Body** and **Certificate Chain** will remain accessible and can be copied at any time.
+    </Note>
+  </Step>
+</Steps>
+  </Tab>
+  <Tab title="API">
+    To create a certificate, make an API request to the [Create Certificate](/api-reference/endpoints/certificate-authorities/sign-intermediate) API endpoint,
+    specifying the issuing CA.
+    
+    ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca/<ca-id>/issue-certificate' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "commonName": "My Certificate",
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      certificate: "...",
+      certificateChain: "...",
+      issuingCaCertificate: "...",
+      privateKey: "...",
+      serialNumber: "..."
+    }
+    ```
+
+    <Note>
+      Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
+    </Note>
+
+  </Tab>
+</Tabs>
+
+## Guide to Revoking Certificates
+
+In the following steps, we explore how to revoke a X.509 certificate under a CA and obtain a Certificate Revocation List (CRL) for a CA.
+
+<Tabs>
+  <Tab title="Infisical UI">
+<Steps>
+  <Step title="Revoking a Certificate">
+    Assuming that you've issued a certificate under a CA, you can revoke it by
+    selecting the **Revoke Certificate** option for it and specifying the reason
+    for revocation.
+
+    ![pki revoke certificate](/images/platform/pki/cert-revoke.png)
+
+    ![pki revoke certificate modal](/images/platform/pki/cert-revoke-modal.png)
+
+  </Step>
+  <Step title="Obtaining a CRL">
+    In order to check the revocation status of a certificate, you can check it
+    against the CRL of a CA by selecting the **View CRL** option under the
+    issuing CA and downloading the CRL file.
+
+    ![pki view crl](/images/platform/pki/ca-crl.png)
+
+    ![pki download crl](/images/platform/pki/ca-crl-modal.png)
+
+    To verify a certificate against the
+    downloaded CRL with OpenSSL, you can use the following command:
+
+```bash
+openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem
+```
+
+  </Step>
+</Steps>
+  </Tab>
+  <Tab title="API">
+    <Steps>
+      <Step title="Revoking a certificate">
+        Assuming that you've issued a certificate under a CA, you can revoke it by making an API request to the [Revoke Certificate](/api-reference/endpoints/certificate-authorities/revoke) API endpoint,
+        specifying the serial number of the certificate and the reason for revocation.
+        
+        ### Sample request
+
+        ```bash Request
+        curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/<cert-serial-number>/revoke' \
+          --header 'Authorization: Bearer <access-token>' \
+          --header 'Content-Type: application/json' \
+          --data-raw '{
+              "revocationReason": "UNSPECIFIED"
+          }'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+          message: "Successfully revoked certificate",
+          serialNumber: "...",
+          revokedAt: "..."
+        }
+        ```
+      </Step>
+      <Step title="Obtaining a CRL">
+        In order to check the revocation status of a certificate, you can check it against the CRL of the issuing CA.
+        To obtain the CRL of the CA, make an API request to the [Get CRL](/api-reference/endpoints/certificate-authorities/crl) API endpoint.
+
+        ### Sample request
+
+        ```bash Request
+        curl --location --request GET 'https://app.infisical.com/api/v1/pki/ca/<ca-id>/crl' \
+          --header 'Authorization: Bearer <access-token>'
+        ```
+
+        ### Sample response
+
+        ```bash Response
+        {
+          crl: "..."
+        }
+        ```
+
+        To verify a certificate against the CRL with OpenSSL, you can use the following command:
+
+        ```bash
+        openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem
+        ```
+      </Step>
+    </Steps>
+
+  </Tab>
+</Tabs>
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="What is the workflow for renewing a certificate?">
+    To renew a certificate, you have to issue a new certificate from the same CA
+    with the same common name as the old certificate. The original certificate
+    will continue to be valid through its original TTL unless explicitly
+    revoked.
+  </Accordion>
+</AccordionGroup>
--- a/docs/documentation/platform/pki/overview.mdx
+++ b/docs/documentation/platform/pki/overview.mdx
@@ -0,0 +1,12 @@
+---
+title: "Internal PKI"
+sidebarTitle: "Overview"
+description: "Learn how to create a Private CA hierarchy and issue X.509 certificates."
+---
+
+Infisical can be used to create a Private Certificate Authority (CA) hierarchy and issue X.509 certificates for internal use. This allows you to manage your own PKI infrastructure and issue digital certificates for services, applications, and devices.
+
+Infisical's internal PKI offering is split into two modules:
+
+- [Private CA](/documentation/platform/pki/private-ca): Infisical lets you create private CAs, including root and intermediary CAs.
+- [Certificates](/documentation/platform/pki/certificates): Infisical allows you to issue X.509 certificates using the private CAs you create.
--- a/docs/documentation/platform/pki/private-ca.mdx
+++ b/docs/documentation/platform/pki/private-ca.mdx
@@ -0,0 +1,250 @@
+---
+title: "Private CA"
+sidebarTitle: "Private CA"
+description: "Learn how to create a Private CA hierarchy with Infisical."
+---
+
+## Concept
+
+The first step to creating your Internal PKI is to create a Private Certificate Authority (CA) hierarchy that is a structure of entities
+used to issue digital certificates for services, applications, and devices.
+
+<div align="center">
+
+```mermaid
+graph TD
+    A[Root CA]
+    A --> B[Intermediate CA]
+    A --> C[Intermediate CA]
+```
+
+</div>
+
+## Workflow
+
+A typical workflow for setting up a Private CA hierarchy consists of the following steps:
+
+1. Configuring a root CA with details like name, validity period, and path length.
+2. Configuring and chaining intermediate CA(s) with details like name, validity period, path length, and imported certificate.
+3. Managing the CA lifecycle events such as CA succession.
+
+<Note>
+  Note that this workflow can be executed via the Infisical UI or manually such
+  as via API. If manually executing the workflow, you may have to create a
+  Certificate Signing Request (CSR) for the intermediate CA, create an
+  intermediate certificate using the root CA private key and CSR, and import the
+  intermediate certificate back to the intermediate CA as part of Step 2.
+</Note>
+
+## Guide
+
+In the following steps, we explore how to create a simple Private CA hierarchy
+consisting of a root CA and an intermediate CA.
+
+<Tabs>
+  <Tab title="Infisical UI">
+<Steps>
+    <Step title="Creating a root CA">
+        To create a root CA, head to your Project > Internal PKI > Certificate Authorities and press **Create CA**.
+
+        ![pki create ca](/images/platform/pki/ca-create.png)
+
+        Here, set the **CA Type** to **Root** and fill out details for the root CA.
+
+        ![pki create root ca](/images/platform/pki/ca-create-root.png)
+
+        Here's some guidance on each field:
+
+        - Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`.
+        - Path Length: The maximum number of intermediate CAs that can be chained to this CA. A path of `-1` implies no limit; a path of `0` implies no intermediate CAs can be chained.
+        - Key Algorithm: The type of public key algorithm and size, in bits, of the key pair that the CA creates when it issues a certificate. Supported key algorithms are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, and `ECDSA P-384` with the default being `RSA 2048`.
+        - Friendly Name: A friendly name for the CA; this is only for display and defaults to the subject of the CA if left empty.
+        - Organization (O): The organization name.
+        - Country (C): The country code.
+        - State or Province Name: The state or province.
+        - Locality Name: The city or locality.
+        - Common Name: The name of the CA.
+
+        <Note>
+            The Organization, Country, State or Province Name, Locality Name, and Common Name make up the **Distinguished Name (DN)** or **subject** of the CA.
+            At least one of these fields must be filled out.
+        </Note>
+    </Step>
+    <Step title="Creating an intermediate CA">
+        1.1. To create an intermediate CA, press **Create CA** again but this time specifying the **CA Type** to be **Intermediate**. Fill out the details for the intermediate CA.
+
+        ![pki create intermediate ca](/images/platform/pki/ca-create-intermediate.png)
+
+        1.2. Next, press the **Install Certificate** option on the intermediate CA from step 1.1.
+
+        ![pki install cert opt](/images/platform/pki/ca-install-intermediate-opt.png)
+
+        Here, set the **Parent CA** to the root CA created in step 1 and configure the intended **Valid Until** and **Path Length** fields on the intermediate CA; feel free to use the prefilled values.
+
+        ![pki install cert](/images/platform/pki/ca-install-intermediate.png)
+
+        Here's some guidance on each field:
+
+        - Parent CA: The parent CA to which this intermediate CA will be chained. In this case, it should be the root CA created in step 1.
+        - Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). The date must be within the validity period of the parent CA.
+        - Path Length: The maximum number of intermediate CAs that can be chained to this CA. The path length must be less than the path length of the parent CA.
+
+        Finally, press **Install** to chain the intermediate CA to the root CA; this creates a Certificate Signing Request (CSR) for the intermediate CA, creates an intermediate certificate using the root CA private key and CSR, and imports the signed certificate back to the intermediate CA.
+
+        ![pki cas](/images/platform/pki/cas.png)
+
+        Great! You've successfully created a Private CA hierarchy with a root CA and an intermediate CA.
+        Now check out the [Certificates](/documentation/platform/pki/certificates) page to learn more about how to issue X.509 certificates using the intermediate CA.
+
+</Step>
+</Steps>
+  </Tab>
+  <Tab title="API">
+<Steps>
+  <Step title="Creating a root CA">
+    To create a root CA, make an API request to the [Create CA](/api-reference/endpoints/certificate-authorities/create) API endpoint, specifying the `type` as `root`.
+
+    ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca' \
+      --header 'Authorization: Bearer <access-token>' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "projectSlug": "<your-project-slug>",
+          "type": "root",
+          "commonName": "My Root CA"
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      ca: {
+        id: "<root-ca-id>",
+        type: "root",
+        commonName: "My Root CA",
+        ...
+      }
+    }
+    ```
+
+    By default, Infisical creates a root CA with the `RSA_2048` key algorithm, validity period of 10 years, with no restrictions on path length;
+    you may override these defaults by specifying your own options when making the API request.
+
+  </Step>
+  <Step title="Creating an intermediate CA">
+    2.1. To create an intermediate CA, make an API request to the [Create CA](/api-reference/endpoints/certificate-authorities/create) API endpoint, specifying the `type` as `intermediate`.
+    
+    ### Sample request
+    
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca' \
+      --header 'Authorization: Bearer <access-token>' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "projectSlug": "<your-project-slug>",
+          "type": "intermediate",
+          "commonName": "My Intermediate CA"
+      }'
+    ```
+    
+    ### Sample response
+    
+    ```bash Response
+    {
+      ca: {
+        id: "<intermediate-ca-id>",
+        type: "intermediate",
+        commonName: "My Intermediate CA",
+        ...
+      }
+    }
+    ```
+    
+    2.2. Next, get a certificate signing request from the intermediate CA by making an API request to the [Get CSR](/api-reference/endpoints/certificate-authorities/csr) API endpoint.
+    
+    ### Sample request
+    
+    ```bash Request
+    curl --location --request GET 'https://app.infisical.com/api/v1/pki/ca/<intermediate-ca-id>/csr' \
+      --header 'Authorization: Bearer <access-token>' \
+      --data-raw ''
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      csr: "..."
+    }
+    ```
+
+    2.3. Next, create an intermediate certificate by making an API request to the [Sign Intermediate](/api-reference/endpoints/certificate-authorities/sign-intermediate) API endpoint
+    containing the CSR from step 2.2, referencing the root CA created in step 1.
+
+    ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca/<root-ca-id>/sign-intermediate' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "csr": "<csr>",
+          "notAfter": "2029-06-12"
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      certificate: "...",
+      certificateChain: "...",
+      issuingCaCertificate: "...",
+      serialNumber: "...",
+    }
+    ```
+
+    <Note>
+      The `notAfter` value must be within the validity period of the root CA that is if the root CA is valid until `2029-06-12`, the intermediate CA must be valid until a date before `2029-06-12`.
+    </Note>
+
+    2.4. Finally, import the intermediate certificate and certificate chain from step 2.3 back to the intermediate CA by making an API request to the [Import Certificate](/api-reference/endpoints/certificate-authorities/import-cert) API endpoint.
+
+    ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca/<intermediate-ca-id>/import-certificate' \
+      --header 'Authorization: Bearer <access-token>' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "certificate": "<certificate>",
+          "certificateChain": "<certificate-chain>"
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      message: "Successfully imported certificate to CA",
+      caId: "..."
+    }
+    ```
+
+    Great! You’ve successfully created a Private CA hierarchy with a root CA and an intermediate CA. Now check out the Certificates page to learn more about how to issue X.509 certificates using the intermediate CA.
+
+  </Step>
+</Steps>
+  </Tab>
+</Tabs>
+
+## FAQ
+
+<AccordionGroup>
+  <Accordion title="What key algorithms are supported as part of private key generation and certificate signing?">
+    Infisical supports `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384` key
+    algorithms specified at the time of creating a CA.
+  </Accordion>
+</AccordionGroup>
--- a/docs/images/platform/pki/ca-create-intermediate.png
+++ b/docs/images/platform/pki/ca-create-intermediate.png
--- a/docs/images/platform/pki/ca-create-root.png
+++ b/docs/images/platform/pki/ca-create-root.png
--- a/docs/images/platform/pki/ca-create.png
+++ b/docs/images/platform/pki/ca-create.png
--- a/docs/images/platform/pki/ca-crl-modal.png
+++ b/docs/images/platform/pki/ca-crl-modal.png
--- a/docs/images/platform/pki/ca-crl.png
+++ b/docs/images/platform/pki/ca-crl.png
--- a/docs/images/platform/pki/ca-install-intermediate-opt.png
+++ b/docs/images/platform/pki/ca-install-intermediate-opt.png
--- a/docs/images/platform/pki/ca-install-intermediate.png
+++ b/docs/images/platform/pki/ca-install-intermediate.png
--- a/docs/images/platform/pki/cas.png
+++ b/docs/images/platform/pki/cas.png
--- a/docs/images/platform/pki/cert-body.png
+++ b/docs/images/platform/pki/cert-body.png
--- a/docs/images/platform/pki/cert-issue-modal.png
+++ b/docs/images/platform/pki/cert-issue-modal.png
--- a/docs/images/platform/pki/cert-issue.png
+++ b/docs/images/platform/pki/cert-issue.png
--- a/docs/images/platform/pki/cert-revoke-modal.png
+++ b/docs/images/platform/pki/cert-revoke-modal.png
--- a/docs/images/platform/pki/cert-revoke.png
+++ b/docs/images/platform/pki/cert-revoke.png
--- a/docs/images/platform/pki/certs.png
+++ b/docs/images/platform/pki/certs.png
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -102,6 +102,14 @@
            "documentation/platform/webhooks"
          ]
        },
+        {
+          "group": "Internal PKI",
+          "pages": [
+            "documentation/platform/pki/overview ",
+            "documentation/platform/pki/private-ca",
+            "documentation/platform/pki/certificates"
+          ]
+        },
        {
          "group": "Identities",
          "pages": [
@@ -557,6 +565,30 @@
        {
          "group": "Audit Logs",
          "pages": ["api-reference/endpoints/audit-logs/export-audit-log"]
+        },
+        {
+          "group": "Certificate Authorities",
+          "pages": [
+            "api-reference/endpoints/certificate-authorities/create",
+            "api-reference/endpoints/certificate-authorities/read",
+            "api-reference/endpoints/certificate-authorities/update",
+            "api-reference/endpoints/certificate-authorities/delete",
+            "api-reference/endpoints/certificate-authorities/csr",
+            "api-reference/endpoints/certificate-authorities/cert",
+            "api-reference/endpoints/certificate-authorities/sign-intermediate",
+            "api-reference/endpoints/certificate-authorities/import-cert",
+            "api-reference/endpoints/certificate-authorities/issue-cert",
+            "api-reference/endpoints/certificate-authorities/crl"
+          ]
+        },
+        {
+          "group": "Certificates",
+          "pages": [
+            "api-reference/endpoints/certificates/read",
+            "api-reference/endpoints/certificates/revoke",
+            "api-reference/endpoints/certificates/delete",
+            "api-reference/endpoints/certificates/cert-body"
+          ]
        }
      ]
    },