mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-04 20:26:17 +00:00
Add PKI docs for ACME Infrastructure Integrations
This commit is contained in:
Carlos Monastyrski
@@ -0,0 +1,141 @@
|
||||
---
|
||||
title: "Tomcat"
|
||||
description: "Learn how to issue SSL/TLS certificates from Infisical PKI using ACME enrollment on Tomcat with Certbot"
|
||||
---
|
||||
|
||||
This guide will provide a high level overview on how you can use [Infisical PKI](/documentation/platform/pki/overview) and Certbot to issue SSL/TLS certificates for your Tomcat application server environments using the [ACME protocol](/documentation/platform/pki/enrollment-methods/acme). For more background about the ACME protocol, see the [ACME specification (RFC 8555)](https://tools.ietf.org/html/rfc8555).
|
||||
|
||||
## Overview
|
||||
|
||||
Certbot is a free, open-source software tool for automatically using Let's Encrypt certificates on manually-administrated websites to enable HTTPS. When configured with [Infisical PKI](/documentation/platform/pki/overview), Certbot can automatically obtain certificates from your private PKI infrastructure. Unlike Apache and NGINX, Tomcat doesn't have a native Certbot plugin, so certificates need to be obtained using the standalone authenticator and manually configured in Tomcat.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before proceeding, ensure you have:
|
||||
|
||||
- A Tomcat application server running on a Linux system with administrative access
|
||||
- A [certificate profile](/documentation/platform/pki/certificates/profiles) configured for [ACME enrollment](/documentation/platform/pki/enrollment-methods/acme) in Infisical
|
||||
- Network connectivity from your Tomcat server to your Infisical instance
|
||||
- Port 80 accessible for ACME HTTP-01 validation (Tomcat should be stopped during certificate issuance)
|
||||
|
||||
## Guide
|
||||
|
||||
<Steps>
|
||||
<Step title="Obtain ACME Configuration from Infisical">
|
||||
Navigate to your Infisical PKI project and locate your [certificate profile](/documentation/platform/pki/certificates/profiles) configured for [ACME enrollment](/documentation/platform/pki/enrollment-methods/acme).
|
||||
|
||||
|
||||
Click on Reveal ACME EAB option to open the ACME details modal.
|
||||
|
||||
|
||||
|
||||
From your certificate profile's ACME configuration, you'll need to collect three essential pieces of information:
|
||||
|
||||
1. **ACME Directory URL**: The ACME endpoint URL for your Infisical instance
|
||||
- Format: `https://your-infisical-instance.com/api/v1/pki/certificate-profiles/{profile-id}/acme/directory`
|
||||
|
||||
2. **EAB Key Identifier (KID)**: External Account Binding key identifier
|
||||
|
||||
3. **EAB Secret**: External Account Binding secret key
|
||||
|
||||
<Note>
|
||||
Keep your EAB credentials secure as they authenticate your ACME client with Infisical PKI. These credentials are unique to each [certificate profile](/documentation/platform/pki/certificates/profiles) and should not be shared.
|
||||
</Note>
|
||||
</Step>
|
||||
|
||||
<Step title="Install Certbot">
|
||||
Install Certbot on your Tomcat server by following the official installation instructions:
|
||||
|
||||
Visit the [Certbot installation guide](https://certbot.eff.org/instructions) and select your operating system for detailed installation steps.
|
||||
|
||||
For most Ubuntu/Debian systems, you can use:
|
||||
|
||||
```bash
|
||||
sudo apt install certbot
|
||||
```
|
||||
|
||||
The installation guide provides up-to-date instructions for various Linux distributions and package managers.
|
||||
|
||||
After installation, verify that Certbot is working correctly:
|
||||
|
||||
```bash
|
||||
certbot --version
|
||||
```
|
||||
</Step>
|
||||
|
||||
<Step title="Request Certificate Using Certbot">
|
||||
Since Tomcat doesn't have a native Certbot plugin, use the standalone authenticator to obtain certificates. **Important**: Stop Tomcat before running this command as Certbot needs to bind to port 80.
|
||||
|
||||
```bash
|
||||
sudo systemctl stop tomcat
|
||||
```
|
||||
|
||||
Then request the certificate:
|
||||
|
||||
```bash
|
||||
sudo certbot certonly \
|
||||
--standalone \
|
||||
--server "https://your-infisical-instance.com/api/v1/pki/certificate-profiles/{profile-id}/acme/directory" \
|
||||
--eab-kid "your-eab-key-identifier" \
|
||||
--eab-hmac-key "your-eab-secret" \
|
||||
-d example.infisical.com \
|
||||
--email [email protected] \
|
||||
--agree-tos \
|
||||
--non-interactive
|
||||
```
|
||||
|
||||
**Parameter breakdown:**
|
||||
- `certonly`: Obtain certificate without installing it
|
||||
- `--standalone`: Use standalone authenticator (requires port 80)
|
||||
- `--server`: Your Infisical ACME directory URL
|
||||
- `--eab-kid`: Your EAB key identifier from Infisical
|
||||
- `--eab-hmac-key`: Your EAB secret from Infisical
|
||||
- `-d`: Domain name for your certificate
|
||||
- `--email`: Contact email for important account notifications
|
||||
- `--agree-tos`: Agree to ACME server's Terms of Service
|
||||
- `--non-interactive`: Run in non-interactive mode
|
||||
|
||||
<Note>
|
||||
Replace the placeholder values with your actual configuration:
|
||||
- `https://your-infisical-instance.com/api/v1/pki/certificate-profiles/{profile-id}/acme/directory`: Your Infisical ACME endpoint
|
||||
- `your-eab-key-identifier` and `your-eab-secret`: Your External Account Binding credentials
|
||||
- `example.infisical.com`: Your actual domain name
|
||||
- `[email protected]`: Your contact email
|
||||
</Note>
|
||||
</Step>
|
||||
|
||||
<Step title="Configure Automatic Renewal">
|
||||
To renew certificates, you can test the renewal process manually:
|
||||
|
||||
```bash
|
||||
sudo certbot renew --dry-run
|
||||
```
|
||||
|
||||
Manual renewal process:
|
||||
|
||||
```bash
|
||||
sudo systemctl stop tomcat
|
||||
sudo certbot renew --quiet
|
||||
# Copy certificates to Tomcat configuration directory and restart
|
||||
sudo systemctl start tomcat
|
||||
```
|
||||
|
||||
<Note>
|
||||
Since Tomcat requires manual certificate file copying, automatic renewal requires a custom script. For production environments, consider creating a cron job that stops the server, renews certificates, copies them to the configuration directory, and restarts the server.
|
||||
</Note>
|
||||
</Step>
|
||||
|
||||
<Step title="Verify Certificate Installation">
|
||||
After successful certificate installation, check that certificate files were created:
|
||||
|
||||
```bash
|
||||
sudo ls -la /etc/letsencrypt/live/example.infisical.com/
|
||||
```
|
||||
|
||||
You should see:
|
||||
- `cert.pem` (leaf certificate)
|
||||
- `chain.pem` (intermediate certificate)
|
||||
- `fullchain.pem` (leaf + intermediate certificates)
|
||||
- `privkey.pem` (private key)
|
||||
</Step>
|
||||
</Steps>
|
||||
Reference in New Issue
Block a user