awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor improvements on PKI docs

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-07 12:44:35 -03:00
parent 1b885465b3
commit b779d26e83
15 changed files with 145 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/documentation/platform/pki/ca/private-ca.mdx
View File

@@ -277,9 +277,9 @@ the certificate back to the intermediate CA.
<Tab title="Infisical UI">
Head to the CA Page of the CA you wish you renew and press **Renew CA** on
the left side. ![pki ca renewal
page](/images/platform/pki/ca/ca-renewal.png) Input a new **Valid Until**
page](/images/platform/pki/ca-renewal-page.png) Input a new **Valid Until**
date to be used for the renewed CA certificate and press **Renew** to renew
the CA. ![pki ca renewal. modal](/images/platform/pki/ca/ca-renewal-modal.png)
the CA. ![pki ca renewal. modal](/images/platform/pki/ca-renewal-modal.png)
<Note>
The new **Valid Until** date must be within the validity period of the
parent CA.

18
docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx
View File

@@ -40,7 +40,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
- **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
- **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
5. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
![Configure Details](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png)
@@ -62,20 +62,30 @@ These permissions allow Infisical to list, import, tag, and manage certificates
### Sample request
<Note>
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
If not provided, you can add certificates later using the certificate management endpoints.
</Note>
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/pki/syncs/aws-certificate-manager \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-acm-cert-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example certificate sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination": "aws-certificate-manager",
"isAutoSyncEnabled": true,
"certificateIds": [
"550e8400-e29b-41d4-a716-446655440000",
"660f1234-e29b-41d4-a716-446655440001"
],
"syncOptions": {
"canRemoveCertificates": true,
"preserveArnOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"destinationConfig": {
@@ -99,10 +109,10 @@ These permissions allow Infisical to list, import, tag, and manage certificates
},
"syncOptions": {
"canRemoveCertificates": true,
"preserveArnOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-01-01T00:00:00.000Z",
"updatedAt": "2023-01-01T00:00:00.000Z"
@@ -130,7 +140,7 @@ Your AWS Certificate Manager Certificate Sync will:
## Manual Certificate Sync
You can manually trigger certificate synchronization from your PKI subscriber to AWS Certificate Manager using the sync certificates functionality. This is useful for:
You can manually trigger certificate synchronization to AWS Certificate Manager using the sync certificates functionality. This is useful for:
- Initial setup when you have existing certificates to deploy
- One-time sync of specific certificates

20
docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx
View File

@@ -41,7 +41,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
- **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
<Tip>
**Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
@@ -55,7 +55,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
6. Select which certificates should be synced to AWS Certificate Manager.
6. Select which certificates should be synced to Azure Key Vault.
![Select Certificates](/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png)
7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
@@ -69,20 +69,30 @@ Any role with these permissions would work such as the **Key Vault Certificates
### Sample request
<Note>
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
If not provided, you can add certificates later using the certificate management endpoints.
</Note>
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/pki/syncs/azure-key-vault \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-key-vault-cert-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example certificate sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination": "azure-key-vault",
"isAutoSyncEnabled": true,
"certificateIds": [
"550e8400-e29b-41d4-a716-446655440000",
"660f1234-e29b-41d4-a716-446655440001"
],
"syncOptions": {
"canRemoveCertificates": true,
"enableVersioningOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"destinationConfig": {
@@ -106,10 +116,10 @@ Any role with these permissions would work such as the **Key Vault Certificates
},
"syncOptions": {
"canRemoveCertificates": true,
"enableVersioningOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-01-01T00:00:00.000Z",
"updatedAt": "2023-01-01T00:00:00.000Z"
@@ -137,7 +147,7 @@ Your Azure Key Vault Certificate Sync will:
## Manual Certificate Sync
You can manually trigger certificate synchronization from your PKI subscriber to Azure Key Vault using the sync certificates functionality. This is useful for:
You can manually trigger certificate synchronization to Azure Key Vault using the sync certificates functionality. This is useful for:
- Initial setup when you have existing certificates to deploy
- One-time sync of specific certificates

8
docs/documentation/platform/pki/certificates/certificates.mdx
View File

@@ -24,10 +24,10 @@ To issue a certificate, you must first create a [certificate profile](/documenta
The [enrollment method](/documentation/platform/pki/enrollment-methods/overview) configured on the certificate profile determines how a certificate is issued for it.
Refer to the documentation for each enrollment method below to learn more about how to issue certificates using it.
- [API](/documentation/platform/pki/certificates/api): Issue a certificate over UI or by making an API request to Infisical.
- [EST](/documentation/platform/pki/certificates/est): Issue a certificate over the EST protocol.
- [ACME](/documentation/platform/pki/certificates/acme): Issue a certificate over the ACME protocol.
- [SCEP](/documentation/platform/pki/certificates/scep): Issue a certificate over the SCEP protocol.
- [API](/documentation/platform/pki/enrollment-methods/api): Issue a certificate over UI or by making an API request to Infisical.
- [EST](/documentation/platform/pki/enrollment-methods/est): Issue a certificate over the EST protocol.
- [ACME](/documentation/platform/pki/enrollment-methods/acme): Issue a certificate over the ACME protocol.
- [SCEP](/documentation/platform/pki/enrollment-methods/scep): Issue a certificate over the SCEP protocol.
## Guide to Renewing Certificates

4
docs/documentation/platform/pki/enrollment-methods/acme.mdx
View File

@@ -2,3 +2,7 @@
title: "Certificate Enrollment via ACME"
sidebarTitle: "ACME"
---
<Info>
ACME-based certificate enrollment is currently under development and will be included in a future release.
</Info>

94
docs/documentation/platform/pki/enrollment-methods/api.mdx
View File

@@ -60,17 +60,21 @@ Here, select the certificate profile from step 1 that will be used to issue the
### Sample request
TODO: update this sample request.
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-profiles' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"projectId": "<project-id>",
"caId": "<ca-id>",
"name": "My Certificate Template",
"commonName": ".*.acme.com",
"subjectAlternativeName": ".*.acme.com",
"ttl": "1y",
"certificateTemplateId": "<certificate-template-id>",
"slug": "my-api-profile",
"description": "Certificate profile for API enrollment",
"enrollmentType": "API",
"apiConfig": {
"autoRenew": true,
"renewBeforeDays": 7
}
}'
```
@@ -78,32 +82,50 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
id: "...",
caId: "...",
name: "...",
commonName: "...",
subjectAlternativeName: "...",
ttl: "...",
"certificateProfile": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"projectId": "65f0a4b0-c123-4567-8901-23456789abcd",
"caId": "550e8400-e29b-41d4-a716-446655440000",
"certificateTemplateId": "660f1234-e29b-41d4-a716-446655440001",
"slug": "my-api-profile",
"description": "Certificate profile for API enrollment",
"enrollmentType": "API",
"apiConfigId": "770g2345-e29b-41d4-a716-446655440002",
"createdAt": "2023-01-19T09:44:36.267Z",
"updatedAt": "2023-01-19T09:44:36.267Z"
}
}
```
</Step>
<Step title="Issue a certificate">
TODO: update this sample request.
To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
specifying the issuing CA.
To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-certificate) API endpoint.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/issue-certificate' \
curl --location --request POST 'https://app.infisical.com/api/v3/certificates/issue-certificate' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"certificateTemplateId": "<certificate-template-id>",
"profileId": "<certificate-profile-id>",
"commonName": "service.acme.com",
"ttl": "1y",
"signatureAlgorithm": "RSA-SHA256",
"keyAlgorithm": "RSA_2048",
"keyUsages": ["digital_signature", "key_encipherment"],
"extendedKeyUsages": ["server_auth"],
"altNames": [
{
"type": "DNS",
"value": "service.acme.com"
},
{
"type": "DNS",
"value": "www.service.acme.com"
}
]
}'
```
@@ -111,11 +133,12 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
certificate: "...",
certificateChain: "...",
issuingCaCertificate: "...",
privateKey: "...",
serialNumber: "..."
"certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----",
"serialNumber": "123456789012345678",
"certificateId": "880h3456-e29b-41d4-a716-446655440003"
}
```
@@ -123,19 +146,18 @@ Here, select the certificate profile from step 1 that will be used to issue the
Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
</Note>
TODO: update this sample request.
If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA.
If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/sign-certificate' \
curl --location --request POST 'https://app.infisical.com/api/v3/certificates/sign-certificate' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"certificateTemplateId": "<certificate-template-id>",
"csr": "...",
"ttl": "1y",
"profileId": "<certificate-profile-id>",
"csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBE9oaW8...\n-----END CERTIFICATE REQUEST-----",
"ttl": "1y"
}'
```
@@ -143,11 +165,11 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
certificate: "...",
certificateChain: "...",
issuingCaCertificate: "...",
privateKey: "...",
serialNumber: "..."
"certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"serialNumber": "123456789012345679",
"certificateId": "990i4567-e29b-41d4-a716-446655440004"
}
```

4
docs/documentation/platform/pki/enrollment-methods/scep.mdx
View File

@@ -2,3 +2,7 @@
title: "Certificate Enrollment via SCEP"
sidebarTitle: "SCEP"
---
<Info>
SCEP-based certificate enrollment is currently under development and will be included in a future release.
</Info>