awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor improvements on PKI docs

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-07 12:44:35 -03:00
parent 1b885465b3
commit b779d26e83
15 changed files with 145 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.infisicalignore
View File

@@ -53,3 +53,5 @@ docs/integrations/app-connections/railway.mdx:generic-api-key:156
k8-operator/config/samples/universalAuthIdentitySecret.yaml:generic-api-key:8
docs/integrations/app-connections/redis.mdx:generic-api-key:80
backend/src/ee/services/app-connections/chef/chef-connection-fns.ts:private-key:42
docs/documentation/platform/pki/enrollment-methods/api.mdx:generic-api-key:93
docs/documentation/platform/pki/enrollment-methods/api.mdx:private-key:139

4
docs/api-reference/endpoints/certificates/renew.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Renew Certificate"
openapi: "POST /api/v3/certificates/{certificateId}/renew"
---

4
docs/api-reference/endpoints/certificates/update-config.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Update Certificate Config"
openapi: "PATCH /api/v3/certificates/{certificateId}/config"
---

4
docs/api-reference/endpoints/pki/syncs/add-certificates.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Add Certificates to Sync"
openapi: "POST /api/v1/pki/syncs/{pkiSyncId}/certificates"
---

4
docs/api-reference/endpoints/pki/syncs/list-certificates.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List Sync Certificates"
openapi: "GET /api/v1/pki/syncs/{pkiSyncId}/certificates"
---

4
docs/api-reference/endpoints/pki/syncs/remove-certificates.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Remove Certificates from Sync"
openapi: "DELETE /api/v1/pki/syncs/{pkiSyncId}/certificates"
---

20
docs/docs.json
View File

@@ -742,8 +742,10 @@
"group": "Enrollment Methods",
"pages": [
"documentation/platform/pki/enrollment-methods/overview",
"documentation/platform/pki/enrollment-methods/acme",
"documentation/platform/pki/enrollment-methods/api",
"documentation/platform/pki/enrollment-methods/est"
"documentation/platform/pki/enrollment-methods/est",
"documentation/platform/pki/enrollment-methods/scep"
]
},
"documentation/platform/pki/alerting"
@@ -2595,13 +2597,15 @@
"pages": [
"api-reference/endpoints/certificates/list",
"api-reference/endpoints/certificates/read",
"api-reference/endpoints/certificates/issue-certificate",
"api-reference/endpoints/certificates/sign-certificate",
"api-reference/endpoints/certificates/renew",
"api-reference/endpoints/certificates/update-config",
"api-reference/endpoints/certificates/revoke",
"api-reference/endpoints/certificates/delete",
"api-reference/endpoints/certificates/cert-body",
"api-reference/endpoints/certificates/bundle",
"api-reference/endpoints/certificates/private-key",
"api-reference/endpoints/certificates/issue-certificate",
"api-reference/endpoints/certificates/sign-certificate"
"api-reference/endpoints/certificates/private-key"
]
},
{
@@ -2638,10 +2642,13 @@
{
"group": "Certificate Profiles",
"pages": [
"api-reference/endpoints/certificate-profiles/list",
"api-reference/endpoints/certificate-profiles/create",
"api-reference/endpoints/certificate-profiles/update",
"api-reference/endpoints/certificate-profiles/get-by-id",
"api-reference/endpoints/certificate-profiles/delete"
"api-reference/endpoints/certificate-profiles/get-by-slug",
"api-reference/endpoints/certificate-profiles/delete",
"api-reference/endpoints/certificate-profiles/list-certificates"
]
},
{
@@ -2650,6 +2657,9 @@
"api-reference/endpoints/pki/syncs/list",
"api-reference/endpoints/pki/syncs/get-by-id",
"api-reference/endpoints/pki/syncs/options",
"api-reference/endpoints/pki/syncs/list-certificates",
"api-reference/endpoints/pki/syncs/add-certificates",
"api-reference/endpoints/pki/syncs/remove-certificates",
{
"group": "AWS Certificate Manager",
"pages": [

4
docs/documentation/platform/pki/ca/private-ca.mdx
View File

@@ -277,9 +277,9 @@ the certificate back to the intermediate CA.
<Tab title="Infisical UI">
Head to the CA Page of the CA you wish you renew and press **Renew CA** on
the left side. ![pki ca renewal
page](/images/platform/pki/ca/ca-renewal.png) Input a new **Valid Until**
page](/images/platform/pki/ca-renewal-page.png) Input a new **Valid Until**
date to be used for the renewed CA certificate and press **Renew** to renew
the CA. ![pki ca renewal. modal](/images/platform/pki/ca/ca-renewal-modal.png)
the CA. ![pki ca renewal. modal](/images/platform/pki/ca-renewal-modal.png)
<Note>
The new **Valid Until** date must be within the validity period of the
parent CA.

18
docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx
View File

@@ -40,7 +40,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
- **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
- **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
5. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
![Configure Details](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png)
@@ -62,20 +62,30 @@ These permissions allow Infisical to list, import, tag, and manage certificates
### Sample request
<Note>
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
If not provided, you can add certificates later using the certificate management endpoints.
</Note>
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/pki/syncs/aws-certificate-manager \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-acm-cert-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example certificate sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination": "aws-certificate-manager",
"isAutoSyncEnabled": true,
"certificateIds": [
"550e8400-e29b-41d4-a716-446655440000",
"660f1234-e29b-41d4-a716-446655440001"
],
"syncOptions": {
"canRemoveCertificates": true,
"preserveArnOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"destinationConfig": {
@@ -99,10 +109,10 @@ These permissions allow Infisical to list, import, tag, and manage certificates
},
"syncOptions": {
"canRemoveCertificates": true,
"preserveArnOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-01-01T00:00:00.000Z",
"updatedAt": "2023-01-01T00:00:00.000Z"
@@ -130,7 +140,7 @@ Your AWS Certificate Manager Certificate Sync will:
## Manual Certificate Sync
You can manually trigger certificate synchronization from your PKI subscriber to AWS Certificate Manager using the sync certificates functionality. This is useful for:
You can manually trigger certificate synchronization to AWS Certificate Manager using the sync certificates functionality. This is useful for:
- Initial setup when you have existing certificates to deploy
- One-time sync of specific certificates

20
docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx
View File

@@ -41,7 +41,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
- **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
- **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
- **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
- **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
<Tip>
**Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
@@ -55,7 +55,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
6. Select which certificates should be synced to AWS Certificate Manager.
6. Select which certificates should be synced to Azure Key Vault.
![Select Certificates](/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png)
7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
@@ -69,20 +69,30 @@ Any role with these permissions would work such as the **Key Vault Certificates
### Sample request
<Note>
You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
If not provided, you can add certificates later using the certificate management endpoints.
</Note>
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/pki/syncs/azure-key-vault \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data '{
"name": "my-key-vault-cert-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example certificate sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"destination": "azure-key-vault",
"isAutoSyncEnabled": true,
"certificateIds": [
"550e8400-e29b-41d4-a716-446655440000",
"660f1234-e29b-41d4-a716-446655440001"
],
"syncOptions": {
"canRemoveCertificates": true,
"enableVersioningOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"destinationConfig": {
@@ -106,10 +116,10 @@ Any role with these permissions would work such as the **Key Vault Certificates
},
"syncOptions": {
"canRemoveCertificates": true,
"enableVersioningOnRenewal": true,
"certificateNameSchema": "myapp-{{certificateId}}"
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-01-01T00:00:00.000Z",
"updatedAt": "2023-01-01T00:00:00.000Z"
@@ -137,7 +147,7 @@ Your Azure Key Vault Certificate Sync will:
## Manual Certificate Sync
You can manually trigger certificate synchronization from your PKI subscriber to Azure Key Vault using the sync certificates functionality. This is useful for:
You can manually trigger certificate synchronization to Azure Key Vault using the sync certificates functionality. This is useful for:
- Initial setup when you have existing certificates to deploy
- One-time sync of specific certificates

8
docs/documentation/platform/pki/certificates/certificates.mdx
View File

@@ -24,10 +24,10 @@ To issue a certificate, you must first create a [certificate profile](/documenta
The [enrollment method](/documentation/platform/pki/enrollment-methods/overview) configured on the certificate profile determines how a certificate is issued for it.
Refer to the documentation for each enrollment method below to learn more about how to issue certificates using it.
- [API](/documentation/platform/pki/certificates/api): Issue a certificate over UI or by making an API request to Infisical.
- [EST](/documentation/platform/pki/certificates/est): Issue a certificate over the EST protocol.
- [ACME](/documentation/platform/pki/certificates/acme): Issue a certificate over the ACME protocol.
- [SCEP](/documentation/platform/pki/certificates/scep): Issue a certificate over the SCEP protocol.
- [API](/documentation/platform/pki/enrollment-methods/api): Issue a certificate over UI or by making an API request to Infisical.
- [EST](/documentation/platform/pki/enrollment-methods/est): Issue a certificate over the EST protocol.
- [ACME](/documentation/platform/pki/enrollment-methods/acme): Issue a certificate over the ACME protocol.
- [SCEP](/documentation/platform/pki/enrollment-methods/scep): Issue a certificate over the SCEP protocol.
## Guide to Renewing Certificates

4
docs/documentation/platform/pki/enrollment-methods/acme.mdx
View File

@@ -2,3 +2,7 @@
title: "Certificate Enrollment via ACME"
sidebarTitle: "ACME"
---
<Info>
ACME-based certificate enrollment is currently under development and will be included in a future release.
</Info>

94
docs/documentation/platform/pki/enrollment-methods/api.mdx
View File

@@ -60,17 +60,21 @@ Here, select the certificate profile from step 1 that will be used to issue the
### Sample request
TODO: update this sample request.
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-profiles' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"projectId": "<project-id>",
"caId": "<ca-id>",
"name": "My Certificate Template",
"commonName": ".*.acme.com",
"subjectAlternativeName": ".*.acme.com",
"ttl": "1y",
"certificateTemplateId": "<certificate-template-id>",
"slug": "my-api-profile",
"description": "Certificate profile for API enrollment",
"enrollmentType": "API",
"apiConfig": {
"autoRenew": true,
"renewBeforeDays": 7
}
}'
```
@@ -78,32 +82,50 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
id: "...",
caId: "...",
name: "...",
commonName: "...",
subjectAlternativeName: "...",
ttl: "...",
"certificateProfile": {
"id": "550e8400-e29b-41d4-a716-446655440000",
"projectId": "65f0a4b0-c123-4567-8901-23456789abcd",
"caId": "550e8400-e29b-41d4-a716-446655440000",
"certificateTemplateId": "660f1234-e29b-41d4-a716-446655440001",
"slug": "my-api-profile",
"description": "Certificate profile for API enrollment",
"enrollmentType": "API",
"apiConfigId": "770g2345-e29b-41d4-a716-446655440002",
"createdAt": "2023-01-19T09:44:36.267Z",
"updatedAt": "2023-01-19T09:44:36.267Z"
}
}
```
</Step>
<Step title="Issue a certificate">
TODO: update this sample request.
To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
specifying the issuing CA.
To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-certificate) API endpoint.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/issue-certificate' \
curl --location --request POST 'https://app.infisical.com/api/v3/certificates/issue-certificate' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"certificateTemplateId": "<certificate-template-id>",
"profileId": "<certificate-profile-id>",
"commonName": "service.acme.com",
"ttl": "1y",
"signatureAlgorithm": "RSA-SHA256",
"keyAlgorithm": "RSA_2048",
"keyUsages": ["digital_signature", "key_encipherment"],
"extendedKeyUsages": ["server_auth"],
"altNames": [
{
"type": "DNS",
"value": "service.acme.com"
},
{
"type": "DNS",
"value": "www.service.acme.com"
}
]
}'
```
@@ -111,11 +133,12 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
certificate: "...",
certificateChain: "...",
issuingCaCertificate: "...",
privateKey: "...",
serialNumber: "..."
"certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----",
"serialNumber": "123456789012345678",
"certificateId": "880h3456-e29b-41d4-a716-446655440003"
}
```
@@ -123,19 +146,18 @@ Here, select the certificate profile from step 1 that will be used to issue the
Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
</Note>
TODO: update this sample request.
If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA.
If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint.
### Sample request
```bash Request
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/sign-certificate' \
curl --location --request POST 'https://app.infisical.com/api/v3/certificates/sign-certificate' \
--header 'Authorization: Bearer <access-token>' \
--header 'Content-Type: application/json' \
--data-raw '{
"certificateTemplateId": "<certificate-template-id>",
"csr": "...",
"ttl": "1y",
"profileId": "<certificate-profile-id>",
"csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBE9oaW8...\n-----END CERTIFICATE REQUEST-----",
"ttl": "1y"
}'
```
@@ -143,11 +165,11 @@ Here, select the certificate profile from step 1 that will be used to issue the
```bash Response
{
certificate: "...",
certificateChain: "...",
issuingCaCertificate: "...",
privateKey: "...",
serialNumber: "..."
"certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
"serialNumber": "123456789012345679",
"certificateId": "990i4567-e29b-41d4-a716-446655440004"
}
```

4
docs/documentation/platform/pki/enrollment-methods/scep.mdx
View File

@@ -2,3 +2,7 @@
title: "Certificate Enrollment via SCEP"
sidebarTitle: "SCEP"
---
<Info>
SCEP-based certificate enrollment is currently under development and will be included in a future release.
</Info>

14
frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx
View File

@@ -34,7 +34,7 @@ export const PkiManagerLayout = () => {
return (
<>
<div className="dark hidden h-full w-full flex-col overflow-x-hidden md:flex">
<div className="border-mineshaft-600 bg-mineshaft-900 border-b">
<div className="border-b border-mineshaft-600 bg-mineshaft-900">
<motion.div
key="menu-project-items"
initial={{ x: -150 }}
@@ -92,9 +92,9 @@ export const PkiManagerLayout = () => {
<Tab value={isActive ? "selected" : ""}>App Connections</Tab>
)}
</Link>
{
{showLegacySection && (
<>
{/* {
{(subscription.pkiLegacyTemplates || hasExistingSubscribers) && (
<Link
to="/projects/cert-management/$projectId/subscribers"
params={{
@@ -105,7 +105,7 @@ export const PkiManagerLayout = () => {
<Tab value={isActive ? "selected" : ""}>Subscribers (Legacy)</Tab>
)}
</Link>
} */}
)}
{(subscription.pkiLegacyTemplates || hasExistingTemplates) && (
<Link
to="/projects/cert-management/$projectId/certificate-templates"
@@ -121,7 +121,7 @@ export const PkiManagerLayout = () => {
</Link>
)}
</>
}
)}
<Link
to="/projects/cert-management/$projectId/access-management"
params={{
@@ -163,11 +163,11 @@ export const PkiManagerLayout = () => {
</motion.div>
</div>
{assumedPrivilegeDetails && <AssumePrivilegeModeBanner />}
<div className="bg-bunker-800 flex-1 overflow-y-auto overflow-x-hidden px-12 pb-4 pt-10">
<div className="flex-1 overflow-x-hidden overflow-y-auto bg-bunker-800 px-12 pt-10 pb-4">
<Outlet />
</div>
</div>
<div className="z-200 bg-bunker-800 flex h-screen w-screen flex-col items-center justify-center md:hidden">
<div className="z-200 flex h-screen w-screen flex-col items-center justify-center bg-bunker-800 md:hidden">
<FontAwesomeIcon icon={faMobile} className="mb-8 text-7xl text-gray-300" />
<p className="max-w-sm px-6 text-center text-lg text-gray-200">
{` ${t("common.no-mobile")} `}