awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 11:27:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add PKI docs for ACME Infrastructure Integrations

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-13 21:48:19 -03:00
parent 3f68ec8016
commit 80d95effcc
9 changed files with 742 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/documentation/platform/pki/integration-guides/windows-server-acme.mdx
+181
View File
@@ -0,0 +1,181 @@
---
title: "Windows Server"
description: "Learn how to issue SSL/TLS certificates from Infisical PKI using ACME enrollment on Windows Server with win-acme"
---
This guide will provide a high level overview on how you can use [Infisical PKI](/documentation/platform/pki/overview) and win-acme to issue SSL/TLS certificates for your Windows Server environments using the [ACME protocol](/documentation/platform/pki/enrollment-methods/acme). For more background about the ACME protocol, see the [ACME specification (RFC 8555)](https://tools.ietf.org/html/rfc8555).
## Overview
Win-acme is a feature-rich ACME client designed specifically for Windows environments, offering seamless integration with IIS, Windows Certificate Store, and various other certificate storage options. This integration enables Windows Server environments to leverage Infisical's certificate management capabilities with automated certificate enrollment and renewal.
## Prerequisites
Before proceeding, ensure you have:
- A Windows Server instance running with administrative access
- A [certificate profile](/documentation/platform/pki/certificates/profiles) configured for [ACME enrollment](/documentation/platform/pki/enrollment-methods/acme) in Infisical
- Network connectivity from Windows Server to your Infisical instance
## Guide
<Steps>
<Step title="Obtain ACME Configuration from Infisical">
Navigate to your Infisical PKI project and locate your [certificate profile](/documentation/platform/pki/certificates/profiles) configured for [ACME enrollment](/documentation/platform/pki/enrollment-methods/acme).
![Certificate profile with ACME enrollment option](/images/platform/pki/acme/certificate-profile-acme-option.png)
Click on Reveal ACME EAB option to open the ACME details modal.
![ACME configuration modal showing directory URL and EAB credentials](/images/platform/pki/acme/acme-configuration-modal.png)
<Note>
Keep your EAB credentials secure as they authenticate your ACME client with Infisical PKI. These credentials are unique to each [certificate profile](/documentation/platform/pki/certificates/profiles) and should not be shared.
</Note>
</Step>
<Step title="Install win-acme">
Download and install win-acme on your Windows Server using one of the following methods
<Tabs>
<Tab title="Download from GitHub">
1. Visit the [win-acme releases page](https://github.com/win-acme/win-acme/releases)
2. Download the latest stable release ZIP file
3. Extract the contents to a folder (e.g., `C:\win-acme`)
4. Open Command Prompt or PowerShell as Administrator
5. Navigate to the win-acme folder
```powershell
cd C:\win-acme
```
</Tab>
<Tab title=".NET Tool (Global Install)">
If you have .NET Core installed, you can install win-acme as a global tool:
```powershell
dotnet tool install win-acme --global
```
This makes `wacs` command available system-wide.
</Tab>
</Tabs>
</Step>
<Step title="Request Certificate Using Command Line">
Use the following win-acme command structure to request a certificate from Infisical PKI:
```powershell
wacs.exe --target manual --host <your-certificate-dns> --baseuri "<ACME Directory URL>" --eab-key-identifier "<EAB KID>" --eab-key "<EAB Secret>" --validation selfhosting --store pemfiles --pemfilespath "<your-folder-path>" --verbose
```
**Parameter breakdown:**
- `--target manual`: Specifies manual target configuration
- `--host <domain>`: The domain name for your certificate
- `--baseuri`: Your Infisical ACME directory URL
- `--eab-key-identifier`: Your EAB key identifier from Infisical
- `--eab-key`: Your EAB secret from Infisical
- `--validation selfhosting`: Uses self-hosting validation method
- `--store pemfiles`: Stores certificates as PEM files
- `--pemfilespath`: Directory where certificates will be saved
- `--verbose`: Enables detailed logging
<Note>
Replace the placeholder values with your actual configuration:
- `<your-certificate-dns>`: Your actual domain name
- `<ACME Directory URL>`: Your Infisical ACME endpoint
- `<EAB KID>` and `<EAB Secret>`: Your External Account Binding credentials
- `<your-folder-path>`: Desired certificate storage location
</Note>
</Step>
<Step title="Alternative Storage Options">
Win-acme supports various certificate storage options. Here are common alternatives to PEM files:
<Tabs>
<Tab title="Windows Certificate Store">
Store certificates directly in the Windows Certificate Store:
```powershell
wacs.exe --target manual --host example.infisical.com --baseuri "<ACME Directory URL>" --eab-key-identifier "<EAB KID>" --eab-key "<EAB Secret>" --validation selfhosting --store certificatestore --verbose
```
</Tab>
<Tab title="PFX Files">
Generate PFX files with password protection:
```powershell
wacs.exe --target manual --host example.infisical.com --baseuri "<ACME Directory URL>" --eab-key-identifier "<EAB KID>" --eab-key "<EAB Secret>" --validation selfhosting --store pfxfile --pfxfilepath "C:\certificates" --pfxpassword "your-secure-password" --verbose
```
</Tab>
<Tab title="IIS Central SSL">
For IIS Central SSL store integration:
```powershell
wacs.exe --target manual --host example.infisical.com --baseuri "<ACME Directory URL>" --eab-key-identifier "<EAB KID>" --eab-key "<EAB Secret>" --validation selfhosting --store centralssl --centralsslstore "C:\CentralSSL" --verbose
```
</Tab>
</Tabs>
</Step>
<Step title="Configure Automatic Renewal">
Win-acme can automatically create a Windows Scheduled Task for certificate renewal.
**Option 1: Enable during initial certificate request**
Include the `--setuptaskscheduler` parameter in your initial command:
```powershell
wacs.exe --target manual --host example.infisical.com --baseuri "<ACME Directory URL>" --eab-key-identifier "<EAB KID>" --eab-key "<EAB Secret>" --validation selfhosting --store pemfiles --pemfilespath "C:\certificates" --setuptaskscheduler --verbose
```
**Option 2: Test manual renewal**
You can test the renewal process manually before setting up automation:
```powershell
wacs.exe --renew --force --verbose
```
**Option 3: Verify scheduled task creation**
Check that the scheduled task was created successfully:
```powershell
Get-ScheduledTask -TaskName "*win-acme*"
```
The task will:
- Run under the SYSTEM account
- Check certificates daily for renewal eligibility
- Automatically renew certificates that are within the renewal threshold
- Log renewal activities to Windows Event Viewer and log files
<Note>
Win-acme stores renewal configurations automatically, so once a certificate is created, the renewal process will use the same parameters (ACME endpoint, EAB credentials, storage options) for future renewals.
</Note>
</Step>
<Step title="Verify Certificate Installation">
After successful certificate issuance, verify the certificate files are created:
<Tabs>
<Tab title="PEM Files">
Check your specified PEM files directory:
```powershell
Get-ChildItem "C:\certificates" -Filter "*.pem"
```
You should see files like:
- `example.infisical.com-crt.pem` (certificate)
- `example.infisical.com-key.pem` (private key)
- `example.infisical.com-chain.pem` (complete certificate chain)
- `example.infisical.com-chain-only.pem` (only certificate chain)
![Windows Server Generated PEM files](/images/platform/pki/integrations/windows-server/certificates-created.png)
</Tab>
<Tab title="Windows Certificate Store">
Check the certificate store using PowerShell:
```powershell
Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Subject -like "*example.infisical.com*"}
```
</Tab>
</Tabs>
</Step>
</Steps>