awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into chore/contributing-docs-update

Browse Source
This commit is contained in:
Victor Santos
2025-11-11 17:56:42 -03:00
parent eb3b346962 0d43e485b2
commit 8d0c4502ae
42 changed files with 667 additions and 287 deletions
Download Patch File Download Diff File Expand all files Collapse all files

146
docs/documentation/platform/pki/alerting.mdx
View File

@@ -5,145 +5,21 @@ description: "Learn how to set up alerting for expiring certificates with Infisi
## Concept
In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting for expiring CA and leaf certificates in Infisical.
## Workflow
A typical alerting workflow for expiring certificates consists of the following steps:
1. Creating a PKI/Certificate collection and adding certificates that you wish to monitor for expiration to it.
2. Creating an alert and binding it to the PKI/Certificate collection. As part of the configuration, you specify when the alert should trigger based on the number of days before certificate expiration and the email addresses of the recipients to notify.
In order to ensure that your certificates are always up-to-date and not expired, you can set up alerting in Infisical for expiring CA and leaf certificates based on customizable filters.
## Guide to Creating an Alert
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Creating a PKI/Certificate collection">
To create a PKI/Certificate collection, head to your Project > Internal
PKI > Alerting > Certificate Collection and press **Create**.
![pki create collection](/images/platform/pki/alerting/collection-create.png)
Give the collection a name and proceed to create the empty collection.
To create an alert, head to your Certificate Management Project > Alerting and press **Create Certificate Alert**.
![pki create collection](/images/platform/pki/alerting/collection-create-2.png)
![pki alerting](/images/platform/pki/alerting/alert-create.png)
Next, in the Collection Page, add the certificate authorities and leaf certificates
that you wish to monitor for expiration to the collection.
![pki alerting modal](/images/platform/pki/alerting/alert-create-modal.png)
![pki add cert to collection](/images/platform/pki/alerting/collection-add-cert.png)
</Step>
<Step title="Creating an alert">
To create an alert, head to your Project > Internal PKI > Alerting > Alerts and press **Create**.
Here's some guidance for each field in the alert configuration sequence:
![pki create alert](/images/platform/pki/alerting/alert-create.png)
Here, set the **Certificate Collection** to the PKI/Certificate collection you created in the previous step and fill out details for the alert.
![pki create alert](/images/platform/pki/alerting/alert-create-2.png)
Here's some guidance on each field:
- Name: A name for the alert.
- Collection Collection: The PKI/Certificate collection to bind the alert to from the previous step.
- Alert Before / Unit: The time before certificate expiration to trigger the alert.
- Emails to Alert: A comma-delimited list of email addresses to notify when the alert triggers.
Finally, press **Create** to create the alert.
![pki alerts](/images/platform/pki/alerting/alerts.png)
Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificates in the collection. Once the alert triggers, the specified email addresses will be notified.
</Step>
</Steps>
</Tab>
<Tab title="API">
<Steps>
<Step title="Creating a PKI/Certificate collection">
1.1. To create a PKI/Certificate collection, make an API request to the [Create PKI Collection](/api-reference/endpoints/pki-collections/create) API endpoint.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"projectId": "<your-project-id>",
"name": "My Certificate Collection"
}'
```
### Sample response
```bash Response
{
id: "<collection-id>",
name: "My Certificate Collection",
...
}
```
1.2. Next, make an API request to the [Add Collection Item](/api-reference/endpoints/pki-collections/add-item) API endpoint to add a certificate to the collection.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/collections/<collection-id>/items' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"type": "certificate",
"itemId": "id-of-certificate"
}'
```
### Sample response
```bash Response
{
id: "<collection-item-id>",
type: "certificate",
itemId: "id-of-certificate"
...
}
```
</Step>
<Step title="Creating an alert">
To create an alert, make an API request to the [Create Alert](/api-reference/endpoints/pki-alerts/create) API endpoint, specifying the PKI/Certificate collection to bind the alert to, the alert configuration, and the email addresses to notify.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/alerts' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"projectId": "<your-project-id>",
"pkiCollectionId": "<your-collection-id>",
"name": "My Alert",
"alertBeforeDays": 30,
"emails": ["johndoe@gmail.com", "janedoe@gmail.com"]
}'
```
### Sample response
```bash Response
{
id: "<alert-id>",
name: "My Alert",
alertBeforeDays: 30,
recipientEmails: "johndoe@gmail.com,janedoe@gmail.com"
...
}
```
Great! You've successfully created a PKI/Certificate collection and an alert to monitor the expiring certificate in the collection. Once the alert triggers, the specified email addresses will be notified.
</Step>
</Steps>
</Tab>
</Tabs>
- Alert Type: The type of alert to create such as **Certificate Expiration**.
- Alert Name: A slug-friendly name for the alert such as `tls-expiry-alert`.
- Description: An optional description for the alert.
- Alert Before: The time before certificate expiration to trigger the alert such as 30 days denoted by `30d`.
- Filters: A list of filters that determine which certificates the alert applies to. Each row includes a **Field**, **Operator**, and **Value** to match against. For example, you can filter for certificates with a common name containing `example.com` by setting the field to **Common Name**, the operator to **Contains**, and the value to `example.com`.
- Channels / Email Recipients: A list of email addresses to notify when the alert triggers.

101
docs/documentation/platform/pki/certificates/certificates.mdx
View File

@@ -60,6 +60,107 @@ The following examples demonstrate different approaches to certificate renewal:
- Using the ACME enrollment method, you may use [cert-manager](https://cert-manager.io/) with Infisical to issue and renew certificates for Kubernetes workloads; cert-manager will pursue a client-driven approach and submit certificate requests upon certificate expiration for you, saving renewed certificates back to Kubernetes secrets.
- Using the API enrollment method, you may push and auto-renew certificates to AWS and Azure using [certificate syncs](/documentation/platform/pki/certificate-syncs/overview). Certificates issued over the API enrollment method, where key pairs are generated server-side, are also eligible for server-side auto-renewal; once renewed, certificates are automatically pushed back to their sync destination.
## Guide to Exporting Certificates
In the following steps, we explore how to export certificates from Infisical in different formats for use in your applications and infrastructure.
### Accessing the Export Certificate Modal
To export any certificate, first navigate to your project's certificate inventory and locate the certificate you want to export. Click on the **Export Certificate** option from the certificate's action menu.
![pki export certificate option](/images/platform/pki/certificate/cert-export-option.png)
<Tabs>
<Tab title="PEM Format">
<Steps>
<Step title="Exporting in PEM Format">
In the export modal, choose **PEM** as the format and click **Export**.
![pki export certificate pem](/images/platform/pki/certificate/cert-export-pem.png)
The PEM export modal will display the certificate details including:
- **Serial Number**: The unique identifier for the certificate
- **Certificate Body**: The X.509 certificate in PEM format
- **Certificate Chain**: The intermediate and root CA certificates
- **Private Key**: The private key associated with the certificate (if available)
![pki export certificate pem modal](/images/platform/pki/certificate/cert-export-pem-modal.png)
You can copy each component individually or use the **Copy All** button to copy the complete certificate bundle.
</Step>
<Step title="Using PEM Certificates">
PEM format certificates can be used directly with most web servers and applications:
- **Apache HTTP Server**: Configure SSL certificates in your virtual host
- **Nginx**: Use the certificate and private key files in your server configuration
- **Docker containers**: Mount certificate files for TLS-enabled applications
- **Load balancers**: Upload PEM certificates to AWS ALB, Azure Application Gateway, etc.
Example Nginx configuration:
```nginx
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /path/to/certificate.pem;
ssl_certificate_key /path/to/private-key.pem;
}
```
</Step>
</Steps>
</Tab>
<Tab title="PKCS12 Format">
<Steps>
<Step title="Exporting in PKCS12 Format">
In the export modal, choose **PKCS12** as the format and provide the required configuration:
![pki export certificate pkcs12](/images/platform/pki/certificate/cert-export-pkcs12.png)
- **Password**: A secure password to protect the PKCS12 keystore
- **Alias**: A friendly name for the certificate within the keystore
Click **Export** to generate and download the `.p12` file containing the certificate, certificate chain, and private key.
</Step>
<Step title="Using PKCS12 Certificates">
PKCS12 files (`.p12` extension) are binary keystore files that contain the certificate, certificate chain, and private key in a single encrypted file:
- **Java applications**: Import directly into Java KeyStore (JKS) or use with SSL/TLS
- **Windows IIS**: Import the PKCS12 file for web server SSL configuration
- **Browser certificates**: Install client certificates for authentication
- **Mobile applications**: Deploy certificates to iOS and Android applications
To verify the contents of a PKCS12 file:
```bash
openssl pkcs12 -in certificate.p12 -nokeys -clcerts
```
To extract the private key:
```bash
openssl pkcs12 -in certificate.p12 -nocerts -out private-key.pem
```
<Info>
If you need to convert the PKCS12 file to Java KeyStore (JKS) format for applications running on Java 8 or earlier, use the following keytool command:
```bash
keytool -importkeystore \
-srckeystore certificate.p12 \
-srcstoretype PKCS12 \
-srcstorepass <p12-password> \
-destkeystore certificate.jks \
-deststoretype JKS \
-deststorepass <jks-password>
```
Replace `<p12-password>` with the password you used when exporting the PKCS12 file, and `<jks-password>` with your desired JKS keystore password.
The resulting `.jks` file can then be used with Java applications that require JKS format keystores.
</Info>
</Step>
</Steps>
</Tab>
</Tabs>
## Guide to Revoking Certificates
In the following steps, we explore how to revoke a X.509 certificate and obtain a Certificate Revocation List (CRL) for a CA.

4
docs/documentation/platform/pki/overview.mdx
View File

@@ -1,7 +1,7 @@
---
title: "Infisical PKI"
title: "Certificate Management"
sidebarTitle: "Overview"
description: "Learn how to create a Private CA hierarchy and issue X.509 certificates."
description: "Manage Certificate Authorities and automate X.509 certificate lifecycle management."
---
Infisical can be used to create and manage Certificate Authorities (CAs) and issue digital X.509 certificates. This allows you to manage PKI infrastructure and issue certificates for end-entities such as load balancers, web servers, devices, and more.