diff --git a/backend/src/services/app-connection/azure-adcs/azure-adcs-connection-fns.ts b/backend/src/services/app-connection/azure-adcs/azure-adcs-connection-fns.ts
index 4e6d466bc..552bd89f5 100644
--- a/backend/src/services/app-connection/azure-adcs/azure-adcs-connection-fns.ts
+++ b/backend/src/services/app-connection/azure-adcs/azure-adcs-connection-fns.ts
@@ -107,13 +107,13 @@ const normalizeAdcsUrl = (url: string): string => {
const createHttpsAgent = (sslRejectUnauthorized: boolean, sslCertificate?: string): https.Agent => {
const agentOptions: https.AgentOptions = {
rejectUnauthorized: sslRejectUnauthorized,
- keepAlive: true // axios-ntlm needs keepAlive for NTLM handshake
+ keepAlive: true, // axios-ntlm needs keepAlive for NTLM handshake
+ ca: sslCertificate ? [sslCertificate.trim()] : undefined,
+ // Disable hostname verification as Microsoft servers by default use local IPs for certificates
+ // which may not match the hostname used to connect
+ checkServerIdentity: () => undefined
};
- if (sslCertificate && sslCertificate.trim()) {
- agentOptions.ca = [sslCertificate.trim()];
- }
-
return new https.Agent(agentOptions);
};
diff --git a/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form-ssl.png b/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form-ssl.png
new file mode 100644
index 000000000..c919a1a87
Binary files /dev/null and b/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form-ssl.png differ
diff --git a/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png b/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png
index 381ca8788..002836a58 100644
Binary files a/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png and b/docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png differ
diff --git a/docs/integrations/app-connections/azure-adcs.mdx b/docs/integrations/app-connections/azure-adcs.mdx
index e5936c5ff..0690304c6 100644
--- a/docs/integrations/app-connections/azure-adcs.mdx
+++ b/docs/integrations/app-connections/azure-adcs.mdx
@@ -30,12 +30,23 @@ Connect Infisical to Microsoft Active Directory Certificate Services (ADCS) for
- **Username**: Domain administrator username (format: `DOMAIN\username` or `username@domain.com`)
- **Password**: Password for the domain administrator account
- **SSL Tab (for HTTPS connections):**
+ **SSL Tab:**
- **SSL Certificate**: Optional PEM certificate for custom CA certificates or self-signed certificates
- - **Reject Unauthorized**: Whether to reject connections with invalid SSL certificates (recommended: keep enabled for production)
+ - **Reject Unauthorized**: Whether to reject connections with invalid SSL certificates (it's recommended to keep it enabled)
+
+
+ **Getting the SSL Certificate**: If your ADCS server uses a self-signed certificate or a certificate from a custom CA, you can obtain the certificate using OpenSSL:
+
+ ```bash
+ openssl s_client -connect your-adcs-server:443 -showcerts
+ ```
+
+ Copy the certificate content (including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines) and paste it into the SSL Certificate field.
+
And click **Connect to ADCS** to establish the connection.
+ 
Your **Azure ADCS Connection** is now available for use in your Infisical projects. 