diff --git a/README.md b/README.md index c5017f8fa..8c7c0e82b 100644 --- a/README.md +++ b/README.md @@ -48,7 +48,7 @@ We're on a mission to make security tooling more accessible to everyone, not jus ### Secrets Management: - **[Dashboard](https://infisical.com/docs/documentation/platform/project)**: Manage secrets across projects and environments (e.g. development, production, etc.) through a user-friendly interface. -- **[Native Integrations](https://infisical.com/docs/integrations/overview)**: Sync secrets to platforms like [GitHub](https://infisical.com/docs/integrations/cicd/githubactions), [Vercel](https://infisical.com/docs/integrations/cloud/vercel), [AWS](https://infisical.com/docs/integrations/cloud/aws-secret-manager), and use tools like [Terraform](https://infisical.com/docs/integrations/frameworks/terraform), [Ansible](https://infisical.com/docs/integrations/platforms/ansible), and more. +- **[Secret Syncs](https://infisical.com/docs/integrations/secret-syncs/overview)**: Sync secrets to platforms like [GitHub](https://infisical.com/docs/integrations/cicd/githubactions), [Vercel](https://infisical.com/docs/integrations/cloud/vercel), [AWS](https://infisical.com/docs/integrations/cloud/aws-secret-manager), and use tools like [Terraform](https://infisical.com/docs/integrations/frameworks/terraform), [Ansible](https://infisical.com/docs/integrations/platforms/ansible), and more. - **[Secret versioning](https://infisical.com/docs/documentation/platform/secret-versioning)** and **[Point-in-Time Recovery](https://infisical.com/docs/documentation/platform/pit-recovery)**: Keep track of every secret and project state; roll back when needed. - **[Secret Rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview)**: Rotate secrets at regular intervals for services like [PostgreSQL](https://infisical.com/docs/documentation/platform/secret-rotation/postgres-credentials), [MySQL](https://infisical.com/docs/documentation/platform/secret-rotation/mysql), [AWS IAM](https://infisical.com/docs/documentation/platform/secret-rotation/aws-iam), and more. - **[Dynamic Secrets](https://infisical.com/docs/documentation/platform/dynamic-secrets/overview)**: Generate ephemeral secrets on-demand for services like [PostgreSQL](https://infisical.com/docs/documentation/platform/dynamic-secrets/postgresql), [MySQL](https://infisical.com/docs/documentation/platform/dynamic-secrets/mysql), [RabbitMQ](https://infisical.com/docs/documentation/platform/dynamic-secrets/rabbit-mq), and more. @@ -56,13 +56,15 @@ We're on a mission to make security tooling more accessible to everyone, not jus - **[Infisical Kubernetes Operator](https://infisical.com/docs/documentation/getting-started/kubernetes)**: Deliver secrets to your Kubernetes workloads and automatically reload deployments. - **[Infisical Agent](https://infisical.com/docs/infisical-agent/overview)**: Inject secrets into applications without modifying any code logic. -### Infisical (Internal) PKI: +### Certificate Management -- **[Private Certificate Authority](https://infisical.com/docs/documentation/platform/pki/private-ca)**: Create CA hierarchies, configure [certificate templates](https://infisical.com/docs/documentation/platform/pki/certificates#guide-to-issuing-certificates) for policy enforcement, and start issuing X.509 certificates. -- **[Certificate Management](https://infisical.com/docs/documentation/platform/pki/certificates)**: Manage the certificate lifecycle from [issuance](https://infisical.com/docs/documentation/platform/pki/certificates#guide-to-issuing-certificates) to [revocation](https://infisical.com/docs/documentation/platform/pki/certificates#guide-to-revoking-certificates) with support for CRL. +- **[Internal CA](https://infisical.com/docs/documentation/platform/pki/private-ca)**: Create and manage a private + CA hierarchy directly within Infisical. +- **[External CA](https://infisical.com/docs/documentation/platform/pki/ca/external-ca)**: Integrate with third-party certificate authorities such as Let’s Encrypt, DigiCert, Microsoft AD CS, and more to leverage existing PKI infrastructure + or issue publicly trusted certificates. +- **[Certificate Lifecycle Management](https://infisical.com/docs/documentation/platform/pki/certificates/overview)**: Create certificate [profiles](https://infisical.com/docs/documentation/platform/pki/certificates/profiles) and [templates](https://infisical.com/docs/documentation/platform/pki/certificates/templates) to control how certificates are issued, including [enrollment methods](https://infisical.com/docs/documentation/platform/pki/enrollment-methods/overview) such as API, ACME, or EST. Manage the full lifecycle from issuance to renewal and [revocation](https://infisical.com/docs/documentation/platform/pki/certificates/certificates#guide-to-revoking-certificates) with CRL and inventory tracking. +- **[Certificate Syncs](https://infisical.com/docs/documentation/platform/pki/certificate-syncs/overview)**: Sync certificates to external platforms like [AWS Certificate Manager](https://infisical.com/docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager) and [Azure Key Vault](https://infisical.com/docs/documentation/platform/pki/certificate-syncs/azure-key-vault). - **[Alerting](https://infisical.com/docs/documentation/platform/pki/alerting)**: Configure alerting for expiring CA and end-entity certificates. -- **[Infisical PKI Issuer for Kubernetes](https://infisical.com/docs/documentation/platform/pki/pki-issuer)**: Deliver TLS certificates to your Kubernetes workloads with automatic renewal. -- **[Enrollment over Secure Transport](https://infisical.com/docs/documentation/platform/pki/est)**: Enroll and manage certificates via EST protocol. ### Infisical Key Management System (KMS): diff --git a/backend/src/server/routes/v1/pki-alert-router.ts b/backend/src/server/routes/v1/pki-alert-router.ts index fde179981..60a906c3a 100644 --- a/backend/src/server/routes/v1/pki-alert-router.ts +++ b/backend/src/server/routes/v1/pki-alert-router.ts @@ -17,7 +17,6 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - hide: false, tags: [ApiDocsTags.PkiAlerting], description: "Create PKI alert", body: z.object({ @@ -72,7 +71,6 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - hide: false, tags: [ApiDocsTags.PkiAlerting], description: "Get PKI alert", params: z.object({ @@ -114,7 +112,6 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - hide: false, tags: [ApiDocsTags.PkiAlerting], description: "Update PKI alert", params: z.object({ @@ -173,7 +170,6 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { - hide: false, tags: [ApiDocsTags.PkiAlerting], description: "Delete PKI alert", params: z.object({ diff --git a/docs/api-reference/endpoints/pki-alerts/create.mdx b/docs/api-reference/endpoints/pki-alerts/create.mdx index 458f0cd48..d4be026a7 100644 --- a/docs/api-reference/endpoints/pki-alerts/create.mdx +++ b/docs/api-reference/endpoints/pki-alerts/create.mdx @@ -1,4 +1,4 @@ --- title: "Create" -openapi: "POST /api/v1/pki/alerts" +openapi: "POST /api/v2/pki/alerts" --- diff --git a/docs/api-reference/endpoints/pki-alerts/delete.mdx b/docs/api-reference/endpoints/pki-alerts/delete.mdx index c0918d1fe..67429049c 100644 --- a/docs/api-reference/endpoints/pki-alerts/delete.mdx +++ b/docs/api-reference/endpoints/pki-alerts/delete.mdx @@ -1,4 +1,4 @@ --- title: "Delete" -openapi: "DELETE /api/v1/pki/alerts/{alertId}" +openapi: "DELETE /api/v2/pki/alerts/{alertId}" --- diff --git a/docs/api-reference/endpoints/pki-alerts/read.mdx b/docs/api-reference/endpoints/pki-alerts/read.mdx index 928afdbc5..0e0547288 100644 --- a/docs/api-reference/endpoints/pki-alerts/read.mdx +++ b/docs/api-reference/endpoints/pki-alerts/read.mdx @@ -1,4 +1,4 @@ --- title: "Retrieve" -openapi: "GET /api/v1/pki/alerts/{alertId}" +openapi: "GET /api/v2/pki/alerts/{alertId}" --- diff --git a/docs/api-reference/endpoints/pki-alerts/update.mdx b/docs/api-reference/endpoints/pki-alerts/update.mdx index 829f8c57b..45f1f1f1f 100644 --- a/docs/api-reference/endpoints/pki-alerts/update.mdx +++ b/docs/api-reference/endpoints/pki-alerts/update.mdx @@ -1,4 +1,4 @@ --- title: "Update" -openapi: "PATCH /api/v1/pki/alerts/{alertId}" +openapi: "PATCH /api/v2/pki/alerts/{alertId}" --- diff --git a/docs/docs.json b/docs/docs.json index dc96c9976..fbd47a7f5 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -703,7 +703,7 @@ ] }, { - "item": "Infisical PKI", + "item": "Certificate Management", "groups": [ { "group": "Certificate Management", @@ -2628,15 +2628,6 @@ "api-reference/endpoints/pki-collections/delete-item" ] }, - { - "group": "PKI Alerting", - "pages": [ - "api-reference/endpoints/pki-alerts/create", - "api-reference/endpoints/pki-alerts/read", - "api-reference/endpoints/pki-alerts/update", - "api-reference/endpoints/pki-alerts/delete" - ] - }, { "group": "Certificate Profiles", "pages": [ diff --git a/docs/documentation/getting-started/overview.mdx b/docs/documentation/getting-started/overview.mdx index f51136278..05ca88b5f 100644 --- a/docs/documentation/getting-started/overview.mdx +++ b/docs/documentation/getting-started/overview.mdx @@ -29,10 +29,10 @@ description: "The open source platform for managing secrets, certificates, and s Automatically detect and alert on hardcoded secrets in source code, CI pipelines, and infrastructure. - Automate the issuance and management of X.509 certificates across your infrastructure using modern protocols like EST. + Automate CA and X.509 certificate lifecycle management across your infrastructure. - - Encrypt and decrypt sensitive data using a centralized key management system. + + Encrypt and decrypt sensitive data using a centralized key management + system. ## Resources - + Explore Infisical’s command-line interface for managing secrets, certificates, and system operations via terminal. - + Browse Infisical’s API documentation to programmatically interact with secrets, access controls, and certificate workflows. - - Learn how to deploy and operate Infisical on your own infrastructure with full - control and data ownership. - + + Learn how to deploy and operate Infisical on your own infrastructure with + full control and data ownership. + diff --git a/docs/documentation/platform/pki/alerting.mdx b/docs/documentation/platform/pki/alerting.mdx index 158c47877..c2342e020 100644 --- a/docs/documentation/platform/pki/alerting.mdx +++ b/docs/documentation/platform/pki/alerting.mdx @@ -5,145 +5,21 @@ description: "Learn how to set up alerting for expiring certificates with Infisi ## Concept -In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting for expiring CA and leaf certificates in Infisical. - -## Workflow - -A typical alerting workflow for expiring certificates consists of the following steps: - -1. Creating a PKI/Certificate collection and adding certificates that you wish to monitor for expiration to it. -2. Creating an alert and binding it to the PKI/Certificate collection. As part of the configuration, you specify when the alert should trigger based on the number of days before certificate expiration and the email addresses of the recipients to notify. +In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting in Infisical for expiring CA and leaf certificates based on customizable filters. ## Guide to Creating an Alert - - - - - To create a PKI/Certificate collection, head to your Project > Internal - PKI > Alerting > Certificate Collection and press **Create**. - - ![pki create collection](/images/platform/pki/alerting/collection-create.png) - - Give the collection a name and proceed to create the empty collection. +To create an alert, head to your Certificate Management Project > Alerting and press **Create Certificate Alert**. - ![pki create collection](/images/platform/pki/alerting/collection-create-2.png) +![pki alerting](/images/platform/pki/alerting/alert-create.png) - Next, in the Collection Page, add the certificate authorities and leaf certificates - that you wish to monitor for expiration to the collection. +![pki alerting modal](/images/platform/pki/alerting/alert-create-modal.png) - ![pki add cert to collection](/images/platform/pki/alerting/collection-add-cert.png) - - - To create an alert, head to your Project > Internal PKI > Alerting > Alerts and press **Create**. +Here's some guidance for each field in the alert configuration sequence: - ![pki create alert](/images/platform/pki/alerting/alert-create.png) - - Here, set the **Certificate Collection** to the PKI/Certificate collection you created in the previous step and fill out details for the alert. - - ![pki create alert](/images/platform/pki/alerting/alert-create-2.png) - - Here's some guidance on each field: - - - Name: A name for the alert. - - Collection Collection: The PKI/Certificate collection to bind the alert to from the previous step. - - Alert Before / Unit: The time before certificate expiration to trigger the alert. - - Emails to Alert: A comma-delimited list of email addresses to notify when the alert triggers. - - Finally, press **Create** to create the alert. - - ![pki alerts](/images/platform/pki/alerting/alerts.png) - - Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificates in the collection. Once the alert triggers, the specified email addresses will be notified. - - - - - - - - 1.1. To create a PKI/Certificate collection, make an API request to the [Create PKI Collection](/api-reference/endpoints/pki-collections/create) API endpoint. - - ### Sample request - - ```bash Request - curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections' \ - --header 'Authorization: Bearer ' \ - --header 'Content-Type: application/json' \ - --data-raw '{ - "projectId": "", - "name": "My Certificate Collection" - }' - ``` - - ### Sample response - - ```bash Response - { - id: "", - name: "My Certificate Collection", - ... - } - ``` - - 1.2. Next, make an API request to the [Add Collection Item](/api-reference/endpoints/pki-collections/add-item) API endpoint to add a certificate to the collection. - - ### Sample request - - ```bash Request - curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections//items' \ - --header 'Authorization: Bearer ' \ - --header 'Content-Type: application/json' \ - --data-raw '{ - "type": "certificate", - "itemId": "id-of-certificate" - }' - ``` - - ### Sample response - - ```bash Response - { - id: "", - type: "certificate", - itemId: "id-of-certificate" - ... - } - ``` - - - To create an alert, make an API request to the [Create Alert](/api-reference/endpoints/pki-alerts/create) API endpoint, specifying the PKI/Certificate collection to bind the alert to, the alert configuration, and the email addresses to notify. - - ### Sample request - - ```bash Request - curl --location --request POST 'https://app.infisical.com/api/v1/pki/alerts' \ - --header 'Authorization: Bearer ' \ - --header 'Content-Type: application/json' \ - --data-raw '{ - "projectId": "", - "pkiCollectionId": "", - "name": "My Alert", - "alertBeforeDays": 30, - "emails": ["johndoe@gmail.com", "janedoe@gmail.com"] - }' - ``` - - ### Sample response - - ```bash Response - { - id: "", - name: "My Alert", - alertBeforeDays: 30, - recipientEmails: "johndoe@gmail.com,janedoe@gmail.com" - ... - } - ``` - - Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificate in the collection. Once the alert triggers, the specified email addresses will be notified. - - - - - +- Alert Type: The type of alert to create such as **Certificate Expiration**. +- Alert Name: A slug-friendly name for the alert such as `tls-expiry-alert`. +- Description: An optional description for the alert. +- Alert Before: The time before certificate expiration to trigger the alert such as 30 days denoted by `30d`. +- Filters: A list of filters that determine which certificates the alert applies to. Each row includes a **Field**, **Operator**, and **Value** to match against. For example, you can filter for certificates with a common name containing `example.com` by setting the field to **Common Name**, the operator to **Contains**, and the value to `example.com`. +- Channels / Email Recipients: A list of email addresses to notify when the alert triggers. diff --git a/docs/documentation/platform/pki/overview.mdx b/docs/documentation/platform/pki/overview.mdx index d31bd96d9..9aba032b1 100644 --- a/docs/documentation/platform/pki/overview.mdx +++ b/docs/documentation/platform/pki/overview.mdx @@ -1,7 +1,7 @@ --- -title: "Infisical PKI" +title: "Certificate Management" sidebarTitle: "Overview" -description: "Learn how to create a Private CA hierarchy and issue X.509 certificates." +description: "Manage Certificate Authorities and automate X.509 certificate lifecycle management." --- Infisical can be used to create and manage Certificate Authorities (CAs) and issue digital X.509 certificates. This allows you to manage PKI infrastructure and issue certificates for end-entities such as load balancers, web servers, devices, and more. diff --git a/docs/images/platform/pki/alerting/alert-create-2.png b/docs/images/platform/pki/alerting/alert-create-2.png deleted file mode 100644 index 812f253f8..000000000 Binary files a/docs/images/platform/pki/alerting/alert-create-2.png and /dev/null differ diff --git a/docs/images/platform/pki/alerting/alert-create-modal.png b/docs/images/platform/pki/alerting/alert-create-modal.png new file mode 100644 index 000000000..f65530ce4 Binary files /dev/null and b/docs/images/platform/pki/alerting/alert-create-modal.png differ diff --git a/docs/images/platform/pki/alerting/alert-create.png b/docs/images/platform/pki/alerting/alert-create.png index 4a7b3227f..620484223 100644 Binary files a/docs/images/platform/pki/alerting/alert-create.png and b/docs/images/platform/pki/alerting/alert-create.png differ diff --git a/docs/images/platform/pki/alerting/alerts.png b/docs/images/platform/pki/alerting/alerts.png deleted file mode 100644 index c7a5096ce..000000000 Binary files a/docs/images/platform/pki/alerting/alerts.png and /dev/null differ diff --git a/docs/images/platform/pki/alerting/collection-add-cert.png b/docs/images/platform/pki/alerting/collection-add-cert.png deleted file mode 100644 index 6300cc892..000000000 Binary files a/docs/images/platform/pki/alerting/collection-add-cert.png and /dev/null differ diff --git a/docs/images/platform/pki/alerting/collection-create-2.png b/docs/images/platform/pki/alerting/collection-create-2.png deleted file mode 100644 index 53378ef05..000000000 Binary files a/docs/images/platform/pki/alerting/collection-create-2.png and /dev/null differ diff --git a/docs/images/platform/pki/alerting/collection-create.png b/docs/images/platform/pki/alerting/collection-create.png deleted file mode 100644 index 7c4883201..000000000 Binary files a/docs/images/platform/pki/alerting/collection-create.png and /dev/null differ diff --git a/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx b/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx index 2b5d0109d..ce76b6275 100644 --- a/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx +++ b/frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2FormSteps.tsx @@ -151,7 +151,7 @@ export const CreatePkiAlertV2FormSteps = () => { <>
-

+

Choose the event that will trigger this alert notification.

@@ -179,7 +179,7 @@ export const CreatePkiAlertV2FormSteps = () => {
-

+

Configure the name, description, and timing for your alert.

@@ -188,7 +188,7 @@ export const CreatePkiAlertV2FormSteps = () => { name="name" render={({ field, fieldState: { error } }) => ( - + )} /> @@ -228,7 +228,7 @@ export const CreatePkiAlertV2FormSteps = () => {
-

+

Add filter rules to specify which certificates should trigger this alert. Leave empty to monitor all certificates.

@@ -250,10 +250,10 @@ export const CreatePkiAlertV2FormSteps = () => { {watchedFilters?.map((filter, index) => (
-

+

Filter Rule #{index + 1}

{ ))} {(!watchedFilters || watchedFilters.length === 0) && ( -
+
No filter rules configured. This alert will monitor all certificates.
)} @@ -376,7 +376,7 @@ export const CreatePkiAlertV2FormSteps = () => {
-

+

Preview all certificates that match your filter criteria. This shows all non-expired certificates that would be monitored by this alert.

@@ -483,7 +483,7 @@ export const CreatePkiAlertV2FormSteps = () => {
-

+

Set up email notifications to receive alerts when events occur.

@@ -513,13 +513,13 @@ export const CreatePkiAlertV2FormSteps = () => {
-

+

Please review the settings below before creating your alert.

-
- Basic Information +
+ Basic Information
{watch("name") || "Not specified"} @@ -545,8 +545,8 @@ export const CreatePkiAlertV2FormSteps = () => {
-
- Filter Rules +
+ Filter Rules
{watchedFilters && watchedFilters.length > 0 ? ( @@ -574,8 +574,8 @@ export const CreatePkiAlertV2FormSteps = () => {
-
- Notifications +
+ Notifications