mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge pull request #4841 from Infisical/pki-alerting-v2-docs
Update Documentation for Certificate Alerting
This commit is contained in:
BlackMagiq
@@ -5,145 +5,21 @@ description: "Learn how to set up alerting for expiring certificates with Infisi
|
||||
|
||||
## Concept
|
||||
|
||||
In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting for expiring CA and leaf certificates in Infisical.
|
||||
|
||||
## Workflow
|
||||
|
||||
A typical alerting workflow for expiring certificates consists of the following steps:
|
||||
|
||||
1. Creating a PKI/Certificate collection and adding certificates that you wish to monitor for expiration to it.
|
||||
2. Creating an alert and binding it to the PKI/Certificate collection. As part of the configuration, you specify when the alert should trigger based on the number of days before certificate expiration and the email addresses of the recipients to notify.
|
||||
In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting in Infisical for expiring CA and leaf certificates based on customizable filters.
|
||||
|
||||
## Guide to Creating an Alert
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Infisical UI">
|
||||
<Steps>
|
||||
<Step title="Creating a PKI/Certificate collection">
|
||||
To create a PKI/Certificate collection, head to your Project > Internal
|
||||
PKI > Alerting > Certificate Collection and press **Create**.
|
||||
|
||||
|
||||
|
||||
Give the collection a name and proceed to create the empty collection.
|
||||
To create an alert, head to your Certificate Management Project > Alerting and press **Create Certificate Alert**.
|
||||
|
||||
|
||||
|
||||
|
||||
Next, in the Collection Page, add the certificate authorities and leaf certificates
|
||||
that you wish to monitor for expiration to the collection.
|
||||
|
||||
|
||||
|
||||
</Step>
|
||||
<Step title="Creating an alert">
|
||||
To create an alert, head to your Project > Internal PKI > Alerting > Alerts and press **Create**.
|
||||
Here's some guidance for each field in the alert configuration sequence:
|
||||
|
||||
|
||||
|
||||
Here, set the **Certificate Collection** to the PKI/Certificate collection you created in the previous step and fill out details for the alert.
|
||||
|
||||
|
||||
|
||||
Here's some guidance on each field:
|
||||
|
||||
- Name: A name for the alert.
|
||||
- Collection Collection: The PKI/Certificate collection to bind the alert to from the previous step.
|
||||
- Alert Before / Unit: The time before certificate expiration to trigger the alert.
|
||||
- Emails to Alert: A comma-delimited list of email addresses to notify when the alert triggers.
|
||||
|
||||
Finally, press **Create** to create the alert.
|
||||
|
||||
|
||||
|
||||
Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificates in the collection. Once the alert triggers, the specified email addresses will be notified.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="API">
|
||||
<Steps>
|
||||
<Step title="Creating a PKI/Certificate collection">
|
||||
1.1. To create a PKI/Certificate collection, make an API request to the [Create PKI Collection](/api-reference/endpoints/pki-collections/create) API endpoint.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections' \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-raw '{
|
||||
"projectId": "<your-project-id>",
|
||||
"name": "My Certificate Collection"
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
id: "<collection-id>",
|
||||
name: "My Certificate Collection",
|
||||
...
|
||||
}
|
||||
```
|
||||
|
||||
1.2. Next, make an API request to the [Add Collection Item](/api-reference/endpoints/pki-collections/add-item) API endpoint to add a certificate to the collection.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections/<collection-id>/items' \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-raw '{
|
||||
"type": "certificate",
|
||||
"itemId": "id-of-certificate"
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
id: "<collection-item-id>",
|
||||
type: "certificate",
|
||||
itemId: "id-of-certificate"
|
||||
...
|
||||
}
|
||||
```
|
||||
</Step>
|
||||
<Step title="Creating an alert">
|
||||
To create an alert, make an API request to the [Create Alert](/api-reference/endpoints/pki-alerts/create) API endpoint, specifying the PKI/Certificate collection to bind the alert to, the alert configuration, and the email addresses to notify.
|
||||
|
||||
### Sample request
|
||||
|
||||
```bash Request
|
||||
curl --location --request POST 'https://app.infisical.com/api/v1/pki/alerts' \
|
||||
--header 'Authorization: Bearer <access-token>' \
|
||||
--header 'Content-Type: application/json' \
|
||||
--data-raw '{
|
||||
"projectId": "<your-project-id>",
|
||||
"pkiCollectionId": "<your-collection-id>",
|
||||
"name": "My Alert",
|
||||
"alertBeforeDays": 30,
|
||||
"emails": ["johndoe@gmail.com", "janedoe@gmail.com"]
|
||||
}'
|
||||
```
|
||||
|
||||
### Sample response
|
||||
|
||||
```bash Response
|
||||
{
|
||||
id: "<alert-id>",
|
||||
name: "My Alert",
|
||||
alertBeforeDays: 30,
|
||||
recipientEmails: "johndoe@gmail.com,janedoe@gmail.com"
|
||||
...
|
||||
}
|
||||
```
|
||||
|
||||
Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificate in the collection. Once the alert triggers, the specified email addresses will be notified.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
- Alert Type: The type of alert to create such as **Certificate Expiration**.
|
||||
- Alert Name: A slug-friendly name for the alert such as `tls-expiry-alert`.
|
||||
- Description: An optional description for the alert.
|
||||
- Alert Before: The time before certificate expiration to trigger the alert such as 30 days denoted by `30d`.
|
||||
- Filters: A list of filters that determine which certificates the alert applies to. Each row includes a **Field**, **Operator**, and **Value** to match against. For example, you can filter for certificates with a common name containing `example.com` by setting the field to **Common Name**, the operator to **Contains**, and the value to `example.com`.
|
||||
- Channels / Email Recipients: A list of email addresses to notify when the alert triggers.
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
---
|
||||
title: "Infisical PKI"
|
||||
title: "Certificate Management"
|
||||
sidebarTitle: "Overview"
|
||||
description: "Learn how to create a Private CA hierarchy and issue X.509 certificates."
|
||||
description: "Manage Certificate Authorities and automate X.509 certificate lifecycle management."
|
||||
---
|
||||
|
||||
Infisical can be used to create and manage Certificate Authorities (CAs) and issue digital X.509 certificates. This allows you to manage PKI infrastructure and issue certificates for end-entities such as load balancers, web servers, devices, and more.
|
||||
|
||||
Reference in New Issue
Block a user