mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Address PR comments
This commit is contained in:
Carlos Monastyrski
@@ -1,8 +1,102 @@
|
||||
---
|
||||
sidebarTitle: "Explore Options"
|
||||
description: "Browse and search through all available certificate syncs for Infisical PKI."
|
||||
sidebarTitle: "Certificate Syncs"
|
||||
title: "PKI Certificate Syncs"
|
||||
description: "Automatically synchronize your PKI certificates to external destinations and maintain certificate lifecycle management."
|
||||
---
|
||||
|
||||
# PKI Certificate Syncs
|
||||
|
||||
PKI Certificate Syncs enable automatic synchronization of certificates from Infisical to external destinations like cloud key management services. This ensures your certificates are consistently deployed and managed across your infrastructure.
|
||||
|
||||
## Overview
|
||||
|
||||
Certificate syncs work by:
|
||||
|
||||
1. **Connecting to PKI Subscribers**: Link syncs to PKI subscribers to automatically sync certificates when they're issued
|
||||
2. **Destination Integration**: Configure destinations like Azure Key Vault through app connections
|
||||
3. **Automatic Synchronization**: Certificates are automatically pushed to destinations when issued or when manually triggered
|
||||
4. **Lifecycle Management**: Remove expired or revoked certificates from destinations to maintain security hygiene
|
||||
|
||||
## Supported Destinations
|
||||
|
||||
### Azure Key Vault
|
||||
|
||||
Azure Key Vault integration supports:
|
||||
|
||||
- ✅ **Certificate Upload**: Sync certificates with their private keys to Azure Key Vault
|
||||
- ✅ **Certificate Removal**: Clean up expired or revoked certificates
|
||||
- ✅ **Auto Key Detection**: Automatically detect and configure RSA/ECDSA key properties
|
||||
- ❌ **Certificate Import**: Cannot import certificates from Azure Key Vault to Infisical (Azure security limitation)
|
||||
|
||||
**Key Features:**
|
||||
- Certificates are uploaded with both certificate and private key in PEM format
|
||||
- Key properties (RSA/ECDSA type, key size, curve) are automatically detected from certificates
|
||||
- Certificates are prefixed with "Infisical-" for identification and management
|
||||
- Respects Azure Key Vault rate limits with automatic retry logic
|
||||
|
||||
## Configuration
|
||||
|
||||
### Prerequisites
|
||||
|
||||
1. **App Connection**: Create an Azure Key Vault app connection with appropriate permissions
|
||||
2. **PKI Subscriber**: Set up a PKI subscriber to issue certificates
|
||||
3. **Azure Permissions**: Ensure the connection has certificate create/update/delete permissions in the target Key Vault
|
||||
|
||||
### Setting Up a Sync
|
||||
|
||||
1. Navigate to your project's PKI section
|
||||
2. Go to the Certificate Syncs tab
|
||||
3. Create a new sync:
|
||||
- **Name**: Descriptive name for the sync
|
||||
- **Connection**: Select your Azure Key Vault app connection
|
||||
- **Destination Config**: Specify the Azure Key Vault URL
|
||||
- **PKI Subscriber**: Link to a specific subscriber (optional)
|
||||
- **Auto Sync**: Enable automatic synchronization on certificate issuance
|
||||
- **Certificate Name Schema**: Customize how certificate names are generated (optional)
|
||||
|
||||
### Sync Options
|
||||
|
||||
- **Auto Sync Enabled**: Automatically sync certificates when they're issued
|
||||
- **Manual Sync**: Trigger synchronization on-demand via API or UI
|
||||
- **Selective Removal**: Only remove certificates managed by Infisical
|
||||
|
||||
## API Reference
|
||||
|
||||
All PKI sync operations are available via REST API:
|
||||
|
||||
- **[List PKI Sync Options](/api-reference/endpoints/pki/syncs/options)**: Get available sync destinations
|
||||
- **[List PKI Syncs](/api-reference/endpoints/pki/syncs/list)**: List all syncs for a project
|
||||
- **[Get PKI Sync](/api-reference/endpoints/pki/syncs/get-by-id)**: Get sync details by ID
|
||||
|
||||
### Azure Key Vault Specific
|
||||
|
||||
- **[Create Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create)**
|
||||
- **[Update Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/update)**
|
||||
- **[Delete Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/delete)**
|
||||
- **[Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates)**
|
||||
- **[Remove Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates)**
|
||||
|
||||
## Security Considerations
|
||||
|
||||
- **Least Privilege**: Grant minimal required permissions to app connections
|
||||
- **Certificate Prefixing**: Only certificates with "Infisical-" prefix are managed by syncs
|
||||
- **Audit Logs**: All sync operations are logged and auditable
|
||||
- **Rate Limiting**: Built-in rate limiting prevents overwhelming destination services
|
||||
|
||||
## Monitoring and Troubleshooting
|
||||
|
||||
Each PKI sync tracks:
|
||||
- **Sync Status**: Last sync operation status and message
|
||||
- **Remove Status**: Last certificate removal status and message
|
||||
- **Timestamps**: When operations were last performed
|
||||
- **Error Messages**: Detailed error information for failed operations
|
||||
|
||||
Use these fields to monitor sync health and troubleshoot issues.
|
||||
|
||||
---
|
||||
|
||||
import { CertificateSyncsBrowser } from "/snippets/CertificateSyncsBrowser.jsx";
|
||||
|
||||
## Browse Available Syncs
|
||||
|
||||
<CertificateSyncsBrowser />
|
||||
@@ -45,6 +45,7 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
|
||||
|
||||
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
|
||||
- **Enable Certificate Removal**: If enabled, Infisical will remove expired certificates from the destination during sync operations. Disable this option if you intend to manage certificate cleanup manually.
|
||||
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
|
||||
|
||||
6. Configure the **Details** of your Azure Key Vault Certificate Sync, then click **Next**.
|
||||
|
||||
@@ -60,13 +61,13 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
To create an **Azure Key Vault Certificate Sync**, make an API request to the [Create Azure Key Vault Certificate Sync](/api-reference/endpoints/certificate-syncs/azure-key-vault/create) API endpoint.
|
||||
To create an **Azure Key Vault Certificate Sync**, make an API request to the [Create Azure Key Vault Certificate Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --request POST \
|
||||
--url https://app.infisical.com/api/v1/pki-syncs \
|
||||
--url https://app.infisical.com/api/v1/pki/syncs/azure-key-vault \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data '{
|
||||
"name": "my-key-vault-cert-sync",
|
||||
@@ -77,7 +78,8 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
|
||||
"destination": "azure-key-vault",
|
||||
"isAutoSyncEnabled": true,
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"destinationConfig": {
|
||||
"vaultBaseUrl": "https://my-key-vault.vault.azure.net"
|
||||
@@ -99,7 +101,8 @@ description: "Learn how to configure an Azure Key Vault Certificate Sync for Inf
|
||||
"vaultBaseUrl": "https://my-key-vault.vault.azure.net"
|
||||
},
|
||||
"syncOptions": {
|
||||
"canRemoveCertificates": true
|
||||
"canRemoveCertificates": true,
|
||||
"certificateNameSchema": "myapp-{{certificateId}}"
|
||||
},
|
||||
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
|
||||
@@ -125,12 +128,17 @@ Your Azure Key Vault Certificate Sync will:
|
||||
Azure Key Vault Certificate Syncs support both automatic and manual synchronization modes. When auto-sync is enabled, certificates are automatically deployed as they are issued or renewed.
|
||||
</Note>
|
||||
|
||||
## Manual Certificate Import
|
||||
## Manual Certificate Sync
|
||||
|
||||
You can manually import existing certificates from your PKI subscriber to Azure Key Vault using the import certificates functionality. This is useful for:
|
||||
You can manually trigger certificate synchronization from your PKI subscriber to Azure Key Vault using the sync certificates functionality. This is useful for:
|
||||
|
||||
- Initial setup when you have existing certificates to migrate
|
||||
- One-time imports of specific certificates
|
||||
- Initial setup when you have existing certificates to deploy
|
||||
- One-time sync of specific certificates
|
||||
- Testing certificate sync configurations
|
||||
- Force sync after making changes
|
||||
|
||||
To manually import certificates, use the [Import Certificates](/api-reference/endpoints/certificate-syncs/azure-key-vault/import) API endpoint or the manual import option in the Infisical UI.
|
||||
To manually sync certificates, use the [Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates) API endpoint or the manual sync option in the Infisical UI.
|
||||
|
||||
<Note>
|
||||
Azure Key Vault does not support importing certificates back into Infisical due to security limitations where private keys cannot be extracted from Azure Key Vault.
|
||||
</Note>
|
||||
@@ -75,13 +75,15 @@ via the UI or API for the third-party service you intend to sync certificates to
|
||||
2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the desired project by specifying the following parameters via the UI or API:
|
||||
- <strong>Source:</strong> The PKI subscriber you wish to retrieve certificates from.
|
||||
- <strong>Destination:</strong> The App Connection to utilize and the destination endpoint to deploy certificates to. These can vary between services.
|
||||
- <strong>Options:</strong> Customize how certificates should be synced, such as whether or not certificates should be removed from the destination when they expire.
|
||||
- <strong>Options:</strong> Customize how certificates should be synced, including:
|
||||
- Whether certificates should be removed from the destination when they expire
|
||||
- Certificate naming schema to control how certificate names are generated in the destination
|
||||
|
||||
<Note>
|
||||
Certificate Syncs are the source of truth for connected third-party services. Any certificate,
|
||||
including associated data, not present or managed by Infisical before syncing will be
|
||||
overwritten, and changes made directly in the connected service outside of Infisical may also
|
||||
be overwritten by future syncs.
|
||||
Certificate Syncs manage certificates that are prefixed with "Infisical-" in the destination. Only
|
||||
certificates managed by Infisical will be affected during sync operations. Certificates not created or
|
||||
managed by Infisical will remain untouched, and changes made to Infisical-managed certificates directly
|
||||
in the destination service may be overwritten by future syncs.
|
||||
</Note>
|
||||
|
||||
<Info>
|
||||
@@ -95,6 +97,31 @@ via the UI or API for the third-party service you intend to sync certificates to
|
||||
contact us at team@infisical.com to make a request.
|
||||
</Note>
|
||||
|
||||
## Certificate Naming
|
||||
|
||||
Certificate Syncs support flexible certificate naming through configurable naming schemas. This allows you to customize how certificate names appear in your destination services.
|
||||
|
||||
### Default Naming
|
||||
|
||||
By default, certificates are named using the pattern `Infisical-{certificateId}` where `{certificateId}` is the unique identifier of the certificate with hyphens removed for compatibility with services like Azure Key Vault.
|
||||
|
||||
### Custom Naming Schema
|
||||
|
||||
You can customize certificate naming by providing a **Certificate Name Schema** when creating or updating a Certificate Sync. The schema supports the following placeholders:
|
||||
|
||||
- `{{certificateId}}` - The unique certificate identifier (required)
|
||||
- `{{environment}}` - The environment context (always "global" for PKI syncs)
|
||||
|
||||
**Examples:**
|
||||
- `myapp-{{certificateId}}` → `myapp-abc123def456`
|
||||
- `{{environment}}-cert-{{certificateId}}` → `global-cert-abc123def456`
|
||||
- `ssl/{{certificateId}}` → `ssl/abc123def456`
|
||||
|
||||
**Rules:**
|
||||
- Must include exactly one `{{certificateId}}` placeholder
|
||||
- Only alphanumeric characters, dashes (-), underscores (_), and slashes (/) are allowed
|
||||
- Certificate names matching your schema will be managed by Infisical during sync operations
|
||||
|
||||
## Certificate Management
|
||||
|
||||
Certificate Syncs handle the full lifecycle of certificate management:
|
||||
|
||||
Reference in New Issue
Block a user