awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

update est docs

Browse Source
This commit is contained in:
Tuan Dang
2025-11-07 16:56:56 -08:00
parent 2b85befc8b
commit 12bcc946cb
7 changed files with 13 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
docs/documentation/platform/pki/enrollment-methods/est.mdx
View File

@@ -14,8 +14,8 @@ Infisical's EST service is based on [RFC 7030](https://datatracker.ietf.org/doc/
- **simpleenroll** - allows an EST client to request a new certificate from Infisical's EST server
- **simplereenroll** - similar to the /simpleenroll endpoint but is used for renewing an existing certificate.
These endpoints are exposed on port 8443 under the .well-known/est path (e.g.
`https://app.infisical.com:8443/.well-known/est/:estLabel/cacerts`).
These EST endpoints are exposed on port 8443 under the .well-known/est path
and structured under `https://app.infisical.com:8443/.well-known/est/{profile_id}/...`
## Prerequisites
@@ -36,6 +36,8 @@ In the following steps, we explore how to issue a X.509 certificate using the ES
Create a [certificate
profile](/documentation/platform/pki/certificates/profiles) with **EST**
selected as the enrollment method and fill in EST-specific configuration.
![pki est config](/images/platform/pki/enrollment-methods/est/est-config.png)
Here's some guidance on each EST-specific configuration field:
@@ -43,17 +45,18 @@ In the following steps, we explore how to issue a X.509 certificate using the ES
- EST Passphrase: This is also used to authenticate your devices with Infisical's EST server. When configuring the clients, use the value defined here as the EST password.
- CA Chain Certificate: This is the certificate chain used to validate your devices' manufacturing/pre-installed certificates. This will be used to authenticate your devices with Infisical's EST server.
Note that forsecurity reasons, Infisical authenticates EST clients using both client certificate and passphrase.
</Step>
<Step title="Obtain the EST label">
Once the configuration of enrollment options is completed, a new EST Label field will appear in the enrollment settings. This is the value to use as label in the URL when configuring the connection of EST clients to Infisical.
Once the EST enrollment method configuration is complete, you can use the ID of the associated certificate profile
`profile_id` as the EST label when enrolling EST clients with Infisical.
![pki est label](/images/platform/pki/enrollment-methods/est/est-label.png)
The complete URL of the supported EST endpoints may look like the following:
The complete URL structure of the supported EST endpoints may look like the following:
- https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/cacerts
- https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simpleenroll
- https://app.infisical.com:8443/.well-known/est/f110f308-9888-40ab-b228-237b12de8b96/simplereenroll
- https://app.infisical.com:8443/.well-known/est/{profile_id}/cacerts
- https://app.infisical.com:8443/.well-known/est/{profile_id}/simpleenroll
- https://app.infisical.com:8443/.well-known/est/{profile_id}/simplereenroll
</Step>
<Step title="Configure EST clients">

2
docs/documentation/platform/pki/overview.mdx
View File

@@ -16,4 +16,4 @@ Core capabilities include:
- Certificate Inventory: Track and monitor issued X.509 certificates, maintaining a comprehensive inventory of all active and expired certificates.
- Certificate Lifecycle Automation: Automate issuance, [renewal](/documentation/platform/pki/certificates/certificates#guide-to-renewing-certificates), and [revocation](/documentation/platform/pki/certificates/certificates#guide-to-revoking-certificates) with policy-based workflows, ensuring certificates remain valid, compliant, and up to date across your infrastructure.
- [Certificate Syncs](/documentation/platform/pki/certificate-syncs/overview): Push certificates to cloud certificate managers like [AWS Certificate Manager](/documentation/platform/pki/certificate-syncs/aws-certificate-manager) and [Azure Key Vault](/documentation/platform/pki/certificate-syncs/azure-key-vault).
- [Certificate Alerts](/documentation/platform/pki/alerting): Receive real-time alerts and webhook events for certificate lifecycle changes such as certificate expiration.
- [Certificate Alerts](/documentation/platform/pki/alerting): Receive alerts and webhook events for certificate lifecycle changes such as certificate expiration.