awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Docs improvements

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-09-22 14:21:14 -03:00
parent 3587fbf98b
commit 53176784b3
16 changed files with 12 additions and 1223 deletions
Download Patch File Download Diff File Expand all files Collapse all files

102
docs/documentation/platform/pki/certificate-syncs.mdx
View File

@@ -1,102 +0,0 @@
---
sidebarTitle: "Certificate Syncs"
title: "PKI Certificate Syncs"
description: "Automatically synchronize your PKI certificates to external destinations and maintain certificate lifecycle management."
---
# PKI Certificate Syncs
PKI Certificate Syncs enable automatic synchronization of certificates from Infisical to external destinations like cloud key management services. This ensures your certificates are consistently deployed and managed across your infrastructure.
## Overview
Certificate syncs work by:
1. **Connecting to PKI Subscribers**: Link syncs to PKI subscribers to automatically sync certificates when they're issued
2. **Destination Integration**: Configure destinations like Azure Key Vault through app connections
3. **Automatic Synchronization**: Certificates are automatically pushed to destinations when issued or when manually triggered
4. **Lifecycle Management**: Remove expired or revoked certificates from destinations to maintain security hygiene
## Supported Destinations
### Azure Key Vault
Azure Key Vault integration supports:
- ✅ **Certificate Upload**: Sync certificates with their private keys to Azure Key Vault
- ✅ **Certificate Removal**: Clean up expired or revoked certificates
- ✅ **Auto Key Detection**: Automatically detect and configure RSA/ECDSA key properties
- ❌ **Certificate Import**: Cannot import certificates from Azure Key Vault to Infisical (Azure security limitation)
**Key Features:**
- Certificates are uploaded with both certificate and private key in PEM format
- Key properties (RSA/ECDSA type, key size, curve) are automatically detected from certificates
- Certificates are prefixed with "Infisical-" for identification and management
- Respects Azure Key Vault rate limits with automatic retry logic
## Configuration
### Prerequisites
1. **App Connection**: Create an Azure Key Vault app connection with appropriate permissions
2. **PKI Subscriber**: Set up a PKI subscriber to issue certificates
3. **Azure Permissions**: Ensure the connection has certificate create/update/delete permissions in the target Key Vault
### Setting Up a Sync
1. Navigate to your project's PKI section
2. Go to the Certificate Syncs tab
3. Create a new sync:
- **Name**: Descriptive name for the sync
- **Connection**: Select your Azure Key Vault app connection
- **Destination Config**: Specify the Azure Key Vault URL
- **PKI Subscriber**: Link to a specific subscriber (optional)
- **Auto Sync**: Enable automatic synchronization on certificate issuance
- **Certificate Name Schema**: Customize how certificate names are generated (optional)
### Sync Options
- **Auto Sync Enabled**: Automatically sync certificates when they're issued
- **Manual Sync**: Trigger synchronization on-demand via API or UI
- **Selective Removal**: Only remove certificates managed by Infisical
## API Reference
All PKI sync operations are available via REST API:
- **[List PKI Sync Options](/api-reference/endpoints/pki/syncs/options)**: Get available sync destinations
- **[List PKI Syncs](/api-reference/endpoints/pki/syncs/list)**: List all syncs for a project
- **[Get PKI Sync](/api-reference/endpoints/pki/syncs/get-by-id)**: Get sync details by ID
### Azure Key Vault Specific
- **[Create Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/create)**
- **[Update Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/update)**
- **[Delete Azure Key Vault Sync](/api-reference/endpoints/pki/syncs/azure-key-vault/delete)**
- **[Sync Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/sync-certificates)**
- **[Remove Certificates](/api-reference/endpoints/pki/syncs/azure-key-vault/remove-certificates)**
## Security Considerations
- **Least Privilege**: Grant minimal required permissions to app connections
- **Certificate Prefixing**: Only certificates with "Infisical-" prefix are managed by syncs
- **Audit Logs**: All sync operations are logged and auditable
- **Rate Limiting**: Built-in rate limiting prevents overwhelming destination services
## Monitoring and Troubleshooting
Each PKI sync tracks:
- **Sync Status**: Last sync operation status and message
- **Remove Status**: Last certificate removal status and message
- **Timestamps**: When operations were last performed
- **Error Messages**: Detailed error information for failed operations
Use these fields to monitor sync health and troubleshoot issues.
---
import { CertificateSyncsBrowser } from "/snippets/CertificateSyncsBrowser.jsx";
## Browse Available Syncs
<CertificateSyncsBrowser />