From 65bc522ae9a0abffbb1c8460b115db3d05425071 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 23 May 2025 03:19:45 -0400 Subject: [PATCH 1/5] feat(smtp-service): Custom CA Certs --- backend/src/lib/config/env.ts | 18 +++++++++++++--- docs/self-hosting/configuration/envars.mdx | 25 ++++++++++++++++------ 2 files changed, 34 insertions(+), 9 deletions(-) diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts index e38dbcfb5..22fb82943 100644 --- a/backend/src/lib/config/env.ts +++ b/backend/src/lib/config/env.ts @@ -69,6 +69,9 @@ const envSchema = z SMTP_PASSWORD: zpStr(z.string().optional()), SMTP_FROM_ADDRESS: zpStr(z.string().optional()), SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")), + SMTP_CUSTOM_CA_CERT: zpStr( + z.string().optional().describe("PEM-encoded custom CA certificate(s) for the SMTP server") + ), COOKIE_SECRET_SIGN_KEY: z .string() .min(32) @@ -298,6 +301,17 @@ export const initEnvConfig = (logger?: CustomLogger) => { }; export const formatSmtpConfig = () => { + const tlsOptions: { + rejectUnauthorized: boolean; + ca?: string | string[]; + } = { + rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED + }; + + if (envCfg.SMTP_CUSTOM_CA_CERT) { + tlsOptions.ca = envCfg.SMTP_CUSTOM_CA_CERT; + } + return { host: envCfg.SMTP_HOST, port: envCfg.SMTP_PORT, @@ -309,8 +323,6 @@ export const formatSmtpConfig = () => { from: `"${envCfg.SMTP_FROM_NAME}" <${envCfg.SMTP_FROM_ADDRESS}>`, ignoreTLS: envCfg.SMTP_IGNORE_TLS, requireTLS: envCfg.SMTP_REQUIRE_TLS, - tls: { - rejectUnauthorized: envCfg.SMTP_TLS_REJECT_UNAUTHORIZED - } + tls: tlsOptions }; }; diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index b63c58d3a..199111e84 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -32,7 +32,7 @@ Used to configure platform-specific security and operational settings Specifies the network interface Infisical will bind to when accepting incoming connections. - By default, Infisical binds to `localhost`, which restricts access to connections from the same machine. + By default, Infisical binds to `localhost`, which restricts access to connections from the same machine. To make the application accessible externally (e.g., for self-hosted deployments), set this to `0.0.0.0`, which tells the server to listen on all network interfaces. @@ -95,7 +95,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching - Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. + Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. Use the command below to encode your certificate: `echo "" | base64` @@ -222,7 +222,7 @@ SMTP_FROM_NAME=Infisical This will be used to verify the email you are sending from. ![Create SES identity](../../images/self-hosting/configuration/email/ses-create-identity.png) - If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies. + If you AWS SES is under sandbox mode, you will only be able to send emails to verified identies. @@ -388,9 +388,9 @@ SMTP_FROM_NAME=Infisical - + 1. Create an account and configure [SMTP2Go](https://www.smtp2go.com/) to send emails. -2. Turn on SMTP authentication +2. Turn on SMTP authentication ``` SMTP_HOST=mail.smtp2go.com SMTP_PORT=You can use one of the following ports: 2525, 80, 25, 8025, or 587 @@ -401,7 +401,7 @@ SMTP_FROM_NAME=Infisical ``` {" "} - + Optional (for TLS/SSL): TLS: Available on the same ports (2525, 80, 25, 8025, or 587) @@ -410,6 +410,19 @@ SSL: Available on ports 465, 8465, and 443 +### Custom CA Certificate for Email Service TLS + +If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables: + +``` +SMTP_PORT=465 # Or your SMTPS/STARTTLS port +SMTP_CUSTOM_CA_CERT='[CERTIFICATE PEM]' + +# Always keep these as true for custom CA +SMTP_REQUIRE_TLS=true +SMTP_TLS_REJECT_UNAUTHORIZED=true +``` + ## Authentication By default, users can only login via email/password based login method. From 12beb0668218db3338bbc9130e8032233478f713 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 23 May 2025 12:33:31 -0400 Subject: [PATCH 2/5] Swap to using base64 --- backend/src/lib/config/env.ts | 2 +- docs/self-hosting/configuration/envars.mdx | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts index 22fb82943..5b1785a66 100644 --- a/backend/src/lib/config/env.ts +++ b/backend/src/lib/config/env.ts @@ -309,7 +309,7 @@ export const formatSmtpConfig = () => { }; if (envCfg.SMTP_CUSTOM_CA_CERT) { - tlsOptions.ca = envCfg.SMTP_CUSTOM_CA_CERT; + tlsOptions.ca = Buffer.from(envCfg.SMTP_CUSTOM_CA_CERT, "base64").toString("utf-8"); } return { diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index 199111e84..9412ff936 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -416,13 +416,17 @@ If your SMTP server uses a certificate signed by a custom Certificate Authority, ``` SMTP_PORT=465 # Or your SMTPS/STARTTLS port -SMTP_CUSTOM_CA_CERT='[CERTIFICATE PEM]' +SMTP_CUSTOM_CA_CERT='[BASE64 ENCODED CERTIFICATE PEM]' # Always keep these as true for custom CA SMTP_REQUIRE_TLS=true SMTP_TLS_REJECT_UNAUTHORIZED=true ``` + + The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format** + + ## Authentication By default, users can only login via email/password based login method. From db44d958d3505714783d6610a905fe582101b7c0 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 23 May 2025 12:41:58 -0400 Subject: [PATCH 3/5] Base64 example for docs --- docs/self-hosting/configuration/envars.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index 9412ff936..e35dc2503 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -424,7 +424,7 @@ SMTP_TLS_REJECT_UNAUTHORIZED=true ``` - The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format** + The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format**. Use the command below to encode your certificate: `echo "" | base64` ## Authentication From db4db04ba63073c34d74f7abee980df2847decb0 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 23 May 2025 13:02:04 -0400 Subject: [PATCH 4/5] Doc updates --- docs/self-hosting/configuration/envars.mdx | 35 ++++++++-------------- 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/docs/self-hosting/configuration/envars.mdx b/docs/self-hosting/configuration/envars.mdx index e35dc2503..8da732d6d 100644 --- a/docs/self-hosting/configuration/envars.mdx +++ b/docs/self-hosting/configuration/envars.mdx @@ -96,8 +96,7 @@ The platform utilizes Postgres to persist all of its data and Redis for caching Configure the SSL certificate for securing a Postgres connection by first encoding it in base64. - Use the command below to encode your certificate: - `echo "" | base64` + Use the following command to encode your certificate: `echo "" | base64` @@ -111,10 +110,9 @@ DB_READ_REPLICAS=[{"DB_CONNECTION_URI":""}] Configure the SSL certificate for securing a Postgres replica connection by first encoding it in base64. - Use the command below to encode your certificate: - `echo "" | base64` + Use the following command to encode your certificate: `echo "" | base64` - If not provided it will use master SSL certificate. + If not provided it will use master SSL certificate. @@ -169,6 +167,16 @@ Without email configuration, Infisical's core functions like sign-up/login and s If this is `true`, Infisical will validate the server's SSL/TLS certificate and reject the connection if the certificate is invalid or not trusted. If set to `false`, the client will accept the server's certificate regardless of its validity, which can be useful in development or testing environments but is not recommended for production use. + + + If your SMTP server uses a certificate signed by a custom Certificate Authority, you should set this variable so that Infisical can trust the custom CA. + + This variable **must be a base64 encoded PEM certificate**. Use the following command to encode your certificate: `echo "" | base64` + + Infisical highly encourages the following variables be used alongside this one for maximum security: + - `SMTP_REQUIRE_TLS=true` + - `SMTP_TLS_REJECT_UNAUTHORIZED=true` + @@ -410,23 +418,6 @@ SSL: Available on ports 465, 8465, and 443 -### Custom CA Certificate for Email Service TLS - -If your SMTP server uses a certificate signed by a custom Certificate Authority, you need to tell Infisical to trust this custom CA. To do this, set the following environment variables: - -``` -SMTP_PORT=465 # Or your SMTPS/STARTTLS port -SMTP_CUSTOM_CA_CERT='[BASE64 ENCODED CERTIFICATE PEM]' - -# Always keep these as true for custom CA -SMTP_REQUIRE_TLS=true -SMTP_TLS_REJECT_UNAUTHORIZED=true -``` - - - The `SMTP_CUSTOM_CA_CERT` environment variable **must be encoded in base64 format**. Use the command below to encode your certificate: `echo "" | base64` - - ## Authentication By default, users can only login via email/password based login method. From b75bb93d83465dacbabc1d53f4253f8562941cc2 Mon Sep 17 00:00:00 2001 From: x032205 Date: Fri, 23 May 2025 13:08:15 -0400 Subject: [PATCH 5/5] Describe fix --- backend/src/lib/config/env.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/lib/config/env.ts b/backend/src/lib/config/env.ts index 5b1785a66..ae5af701e 100644 --- a/backend/src/lib/config/env.ts +++ b/backend/src/lib/config/env.ts @@ -70,7 +70,7 @@ const envSchema = z SMTP_FROM_ADDRESS: zpStr(z.string().optional()), SMTP_FROM_NAME: zpStr(z.string().optional().default("Infisical")), SMTP_CUSTOM_CA_CERT: zpStr( - z.string().optional().describe("PEM-encoded custom CA certificate(s) for the SMTP server") + z.string().optional().describe("Base64 encoded custom CA certificate PEM(s) for the SMTP server") ), COOKIE_SECRET_SIGN_KEY: z .string()