Add docs for CA renewal

2026-10-04 14:26:25 +00:00 · 2024-08-05 19:49:35 -07:00
parent c70d0a577c e6848828f2
commit 88a4390ea0
70 changed files with 2308 additions and 857 deletions
@@ -0,0 +1,4 @@
+---
+title: "List CA certificates"
+openapi: "GET /api/v1/pki/ca/{caId}/ca-certificates"
+---
@@ -0,0 +1,4 @@
+---
+title: "Renew"
+openapi: "POST /api/v1/pki/ca/{caId}/renew"
+---
@@ -0,0 +1,4 @@
+---
+title: "Sign certificate"
+openapi: "POST /api/v1/pki/ca/{caId}/sign-certificate"
+---
@@ -32,6 +32,6 @@ description: "Change the vault type in Infisical"

 To safeguard your login details when using the CLI, Infisical places them in a system vault or an encrypted text file, protected by a passphrase that only the user knows.

-<Tip>To avoid constantly entering your passphrase when using the `file` vault type, set the `INFISICAL_VAULT_FILE_PASSPHRASE` environment variable with your password in your shell</Tip>
+<Tip>To avoid constantly entering your passphrase when using the `file` vault type, use the `infisical vault set file --passphrase <your-passphrase>` CLI command to specify your password once.</Tip>


@@ -16,7 +16,7 @@ Before you begin, you'll first need to choose a method of authentication with AW
  <Steps>
    <Step title="Create the Managing User IAM Role">
      1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console.
-        ![IAM Role Creation](../../images/integrations/aws/integration-aws-iam-assume-role.png)
+        ![IAM Role Creation](/images/integrations/aws/integration-aws-iam-assume-role.png)

      2. Select **AWS Account** as the **Trusted Entity Type**.
      3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If you are self-hosting, provide the AWS account number where Infisical is hosted.
@@ -74,7 +74,7 @@ In the following steps, we explore how to issue a X.509 certificate under a CA.
 </Steps>
  </Tab>
  <Tab title="API">
-    To create a certificate, make an API request to the [Create Certificate](/api-reference/endpoints/certificate-authorities/sign-intermediate) API endpoint,
+    To create a certificate, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
    specifying the issuing CA.
    
    ### Sample request
@@ -84,6 +84,7 @@ In the following steps, we explore how to issue a X.509 certificate under a CA.
      --header 'Content-Type: application/json' \
      --data-raw '{
          "commonName": "My Certificate",
+          "ttl": "1y",
      }'
    ```

@@ -103,6 +104,31 @@ In the following steps, we explore how to issue a X.509 certificate under a CA.
      Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
    </Note>

+    If you have an external private key, you can also create a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-cert) API endpoint, specifying the issuing CA.
+
+     ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca/<ca-id>/sign-certificate' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "csr": "...",
+          "ttl": "1y",
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      certificate: "...",
+      certificateChain: "...",
+      issuingCaCertificate: "...",
+      privateKey: "...",
+      serialNumber: "..."
+    }
+    ```
+
  </Tab>
 </Tabs>

@@ -36,7 +36,7 @@ A typical workflow for setting up a Private CA hierarchy consists of the followi
  intermediate certificate back to the intermediate CA as part of Step 2.
 </Note>

-## Guide
+## Guide to Creating a CA Hierarchy

 In the following steps, we explore how to create a simple Private CA hierarchy
 consisting of a root CA and an intermediate CA.
@@ -240,6 +240,51 @@ consisting of a root CA and an intermediate CA.
  </Tab>
 </Tabs>

+## Guide to CA Renewal
+
+In the following steps, we explore how to renew a CA certificate via same key pair.
+
+<Tabs>
+  <Tab title="Infisical UI">
+    Head to the CA Page of the CA you wish you renew and press **Renew CA** on
+    the left side. ![pki ca renewal
+    page](/images/platform/pki/ca-renewal-page.png) Input a new **Valid Until**
+    date to be used for the renewed CA certificate and press **Renew** to renew
+    the CA. ![pki ca renewal. modal](/images/platform/pki/ca-renewal-modal.png)
+    <Note>
+      The new **Valid Until** date must be within the validity period of the
+      parent CA.
+    </Note>
+  </Tab>
+  <Tab title="API">
+  
+  To renew a CA certificate, make an API request to the [Renew CA](/api-reference/endpoints/certificate-authorities/renew) API endpoint, specifying the new `notAfter` date for the CA.
+
+    ### Sample request
+
+    ```bash Request
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/ca/<ca-id>/renew' \
+      --header 'Authorization: Bearer <access-token>' \
+      --header 'Content-Type: application/json' \
+      --data-raw '{
+          "type": "existing",
+          "notAfter": "2029-06-12"
+      }'
+    ```
+
+    ### Sample response
+
+    ```bash Response
+    {
+      certificate: "...",
+      certificateChain: "...",
+      serialNumber: "..."
+    }
+    ```
+
+  </Tab>
+</Tabs>
+
 ## FAQ

 <AccordionGroup>
@@ -247,4 +292,8 @@ consisting of a root CA and an intermediate CA.
    Infisical supports `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384` key
    algorithms specified at the time of creating a CA.
  </Accordion>
+  <Accordion title="Does Infisical support CA renewal via new key pair">
+    At the moment, Infisical only supports CA renewal via same key pair. We
+    anticipate supporting CA renewal via new key pair in the coming month.
+  </Accordion>
 </AccordionGroup>
@@ -155,7 +155,7 @@
          ]
        },
        {
-          "group": "Key Management",
+          "group": "Key Management (KMS)",
          "pages": [
            "documentation/platform/kms/overview",
            "documentation/platform/kms/aws-kms",
@@ -667,11 +667,14 @@
            "api-reference/endpoints/certificate-authorities/read",
            "api-reference/endpoints/certificate-authorities/update",
            "api-reference/endpoints/certificate-authorities/delete",
+            "api-reference/endpoints/certificate-authorities/renew",
+            "api-reference/endpoints/certificate-authorities/list-ca-certs",
            "api-reference/endpoints/certificate-authorities/csr",
            "api-reference/endpoints/certificate-authorities/cert",
            "api-reference/endpoints/certificate-authorities/sign-intermediate",
            "api-reference/endpoints/certificate-authorities/import-cert",
            "api-reference/endpoints/certificate-authorities/issue-cert",
+            "api-reference/endpoints/certificate-authorities/sign-cert",
            "api-reference/endpoints/certificate-authorities/crl"
          ]
        },