diff --git a/docs/api-reference/endpoints/certificate-authorities/create.mdx b/docs/api-reference/endpoints/certificate-authorities/create.mdx index 35e758e4b..276015228 100644 --- a/docs/api-reference/endpoints/certificate-authorities/create.mdx +++ b/docs/api-reference/endpoints/certificate-authorities/create.mdx @@ -1,4 +1,8 @@ --- -title: "Create" +title: "Create (Deprecated)" openapi: "POST /api/v1/pki/ca" --- + + + This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/create). + \ No newline at end of file diff --git a/docs/api-reference/endpoints/certificate-authorities/delete.mdx b/docs/api-reference/endpoints/certificate-authorities/delete.mdx index f79b8f458..c4ded070d 100644 --- a/docs/api-reference/endpoints/certificate-authorities/delete.mdx +++ b/docs/api-reference/endpoints/certificate-authorities/delete.mdx @@ -1,4 +1,8 @@ --- -title: "Delete" +title: "Delete (Deprecated)" openapi: "DELETE /api/v1/pki/ca/{caId}" --- + + + This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/delete). + \ No newline at end of file diff --git a/docs/api-reference/endpoints/certificate-authorities/internal/create.mdx b/docs/api-reference/endpoints/certificate-authorities/internal/create.mdx new file mode 100644 index 000000000..babc144f2 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authorities/internal/create.mdx @@ -0,0 +1,4 @@ +--- +title: "Create" +openapi: "POST /api/v1/pki/ca/internal" +--- diff --git a/docs/api-reference/endpoints/certificate-authorities/internal/delete.mdx b/docs/api-reference/endpoints/certificate-authorities/internal/delete.mdx new file mode 100644 index 000000000..b1b7f20a7 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authorities/internal/delete.mdx @@ -0,0 +1,4 @@ +--- +title: "Delete" +openapi: "DELETE /api/v1/pki/ca/internal/{caName}" +--- diff --git a/docs/api-reference/endpoints/certificate-authorities/internal/list.mdx b/docs/api-reference/endpoints/certificate-authorities/internal/list.mdx new file mode 100644 index 000000000..43f2b7108 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authorities/internal/list.mdx @@ -0,0 +1,4 @@ +--- +title: "List" +openapi: "GET /api/v1/pki/ca/internal" +--- diff --git a/docs/api-reference/endpoints/certificate-authorities/internal/read.mdx b/docs/api-reference/endpoints/certificate-authorities/internal/read.mdx new file mode 100644 index 000000000..d269564cf --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authorities/internal/read.mdx @@ -0,0 +1,4 @@ +--- +title: "Read" +openapi: "GET /api/v1/pki/ca/internal/{caName}" +--- diff --git a/docs/api-reference/endpoints/certificate-authorities/internal/update.mdx b/docs/api-reference/endpoints/certificate-authorities/internal/update.mdx new file mode 100644 index 000000000..b01899884 --- /dev/null +++ b/docs/api-reference/endpoints/certificate-authorities/internal/update.mdx @@ -0,0 +1,4 @@ +--- +title: "Update" +openapi: "PATCH /api/v1/pki/ca/internal/{caName}" +--- diff --git a/docs/api-reference/endpoints/certificate-authorities/list.mdx b/docs/api-reference/endpoints/certificate-authorities/list.mdx index ba4a43348..81dd64af6 100644 --- a/docs/api-reference/endpoints/certificate-authorities/list.mdx +++ b/docs/api-reference/endpoints/certificate-authorities/list.mdx @@ -1,4 +1,8 @@ --- -title: "List" +title: "List (Deprecated)" openapi: "GET /api/v2/workspace/{slug}/cas" --- + + + This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/list). + \ No newline at end of file diff --git a/docs/api-reference/endpoints/certificate-authorities/read.mdx b/docs/api-reference/endpoints/certificate-authorities/read.mdx index 54dc26392..bca5121bd 100644 --- a/docs/api-reference/endpoints/certificate-authorities/read.mdx +++ b/docs/api-reference/endpoints/certificate-authorities/read.mdx @@ -1,4 +1,8 @@ --- -title: "Retrieve" +title: "Retrieve (Deprecated)" openapi: "GET /api/v1/pki/ca/{caId}" --- + + + This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/read). + \ No newline at end of file diff --git a/docs/api-reference/endpoints/certificate-authorities/update.mdx b/docs/api-reference/endpoints/certificate-authorities/update.mdx index d18a728bf..0cd88ebf6 100644 --- a/docs/api-reference/endpoints/certificate-authorities/update.mdx +++ b/docs/api-reference/endpoints/certificate-authorities/update.mdx @@ -1,4 +1,8 @@ --- -title: "Update" +title: "Update (Deprecated)" openapi: "PATCH /api/v1/pki/ca/{caId}" --- + + + This endpoint is deprecated. Please use the internal CA endpoint [here](/api-reference/endpoints/certificate-authorities/internal/update). + \ No newline at end of file diff --git a/docs/documentation/platform/pki/acme-ca.mdx b/docs/documentation/platform/pki/acme-ca.mdx new file mode 100644 index 000000000..902655a31 --- /dev/null +++ b/docs/documentation/platform/pki/acme-ca.mdx @@ -0,0 +1,300 @@ +--- +title: "Certificates with ACME" +sidebarTitle: "Certificates with ACME" +description: "Learn how to automatically provision and manage TLS certificates using ACME Certificate Authorities like Let's Encrypt with Infisical PKI" +--- + +## Concept + +The Infisical ACME integration allows you to connect with ACME (Automatic Certificate Management Environment) Certificate Authorities to automatically issue and manage publicly trusted TLS certificates for your [subscribers](/documentation/platform/pki/subscribers). This integration enables you to leverage established public CA infrastructure like Let's Encrypt while centralizing your certificate management within Infisical. + +ACME is a protocol that automates the process of certificate issuance and renewal through domain validation challenges. The integration is perfect for obtaining trusted X.509 certificates for public-facing services and is capable of automatically renewing certificates as needed. + +
+ +```mermaid +graph TD + A[ACME CA Provider
e.g., Let's Encrypt] <-->|ACME v2 Protocol| B[Infisical] + B -->|Creates TXT Records
via Route53| C[DNS Validation] + B -->|Manages Certificates| D[Subscribers] +``` + +
+ +As part of the workflow, you configure DNS provider credentials, register an ACME CA provider with Infisical, and create subscribers to represent the certificates you wish to issue. Each issued certificate is automatically managed through its lifecycle, including renewal before expiration. + +We recommend reading about [ACME protocol](https://tools.ietf.org/html/rfc8555) and [DNS-01 challenges](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge) for a fuller understanding of the underlying technology. + +## Workflow + +A typical workflow for using Infisical with ACME Certificate Authorities consists of the following steps: + +1. Setting up AWS Route53 credentials with appropriate DNS permissions. +2. Creating an AWS connection in Infisical to store the Route53 credentials. +3. Registering an ACME Certificate Authority (like Let's Encrypt) with Infisical. +4. Creating subscribers that use the ACME CA as their issuing authority. +5. Managing certificate lifecycle events such as issuance, renewal, and revocation through Infisical. + +## Understanding ACME DNS-01 Challenge + +The DNS-01 challenge is the method used by ACME CA providers to verify that you control a domain before issuing a certificate. Here's how Infisical handles this process: + +1. **Challenge Request**: When you request a certificate, the ACME provider (like Let's Encrypt) issues a challenge token. + +2. **DNS Record Creation**: Infisical creates a TXT record at `_acme-challenge.` with a value derived from the challenge token. + +3. **DNS Propagation**: The TXT record must propagate through the DNS system (usually takes a few minutes, depending on TTL settings). + +4. **Validation**: The ACME provider checks for the existence of this TXT record to verify domain control. + +5. **Cleanup**: After validation completes successfully, Infisical automatically removes the TXT record from your DNS. + +This automated process eliminates the need for manual intervention in domain validation, streamlining certificate issuance. + +## Guide + +In the following steps, we explore how to set up ACME Certificate Authority integration with Infisical using Let's Encrypt as an example. + + + + Before proceeding with the ACME CA registration, you need to set up an AWS connection with the appropriate permissions for DNS validation: + + 1. Navigate to your Organization Settings > App Connections and create a new AWS connection. + + 2. Ensure your AWS connection has the following minimum permissions for Route53 DNS validation: + + ```json + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": "route53:GetChange", + "Resource": "arn:aws:route53:::change/*" + }, + { + "Effect": "Allow", + "Action": "route53:ListHostedZonesByName", + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "route53:ListResourceRecordSets" + ], + "Resource": [ + "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID" + ] + }, + { + "Effect": "Allow", + "Action": [ + "route53:ChangeResourceRecordSets" + ], + "Resource": [ + "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID" + ], + "Condition": { + "ForAllValues:StringEquals": { + "route53:ChangeResourceRecordSetsRecordTypes": [ + "TXT" + ] + } + } + } + ] + } + ``` + + Replace `YOUR_HOSTED_ZONE_ID` with your actual Route53 hosted zone ID. + + For detailed instructions on setting up an AWS connection, see the [AWS Connection](/integrations/app-connections/aws) documentation. + + + + + + + To register an ACME CA, head to your Project > Internal PKI > Certificate Authorities and press the **+** button in the External Certificate Authorities section. + + ![pki register external ca](/images/platform/pki/ca/external-ca/create-external-ca-button.png) + + Fill out the details for the ACME CA registration: + + ![pki register external ca details](/images/platform/pki/ca/external-ca/create-external-ca-form.png) + + Here's guidance on each field: + + - **Type**: Select "ACME" as the External CA type. + - **Name**: Enter a name for the ACME CA (e.g., "lets-encrypt-production"). + - **DNS App Connection**: Select from available DNS app connections or configure a new one. This connection provides Infisical with the credentials needed to create and remove DNS records for ACME validation. + - **Hosted Zone ID**: Enter your Route53 hosted zone ID (e.g., Z04044I124N1GOOMCOYX1) for the domain(s) you'll be requesting certificates for. + - **Directory URL**: Enter the ACME v2 directory URL for your chosen CA provider (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt). + - **Account Email**: Email address to associate with your ACME account. This email will receive important notifications about your certificates. + - **Enable Direct Issuance**: Toggle on to allow direct certificate issuance without requiring subscribers. + + Finally, press **Create** to register the ACME CA with Infisical. + + + Once registered, your ACME CA will appear in the External Certificate Authorities section. + + ![pki external ca list](/images/platform/pki/ca/external-ca/external-ca-list.png) + + From here, you can: + + - View the status of the ACME CA registration + - Edit the configuration settings + - Disable or re-enable the ACME CA + - Delete the ACME CA registration if no longer needed + + You can now use this ACME CA to issue certificates for your subscribers. + + + + + To register an ACME CA with Infisical using the API, make a request to the Create External CA endpoint: + + ### Sample request + + ```bash Request + curl 'https://app.infisical.com/api/v1/pki/ca/acme' \ + -H 'Authorization: Bearer ' \ + -H 'Content-Type: application/json' \ + --data-raw '{ + "projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6", + "name": "lets-encrypt-production", + "type": "acme", + "status": "active", + "enableDirectIssuance": true, + "configuration": { + "dnsAppConnection": { + "id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", + "name": "acme-dns-test-connection" + }, + "dnsProviderConfig": { + "provider": "route53", + "hostedZoneId": "Z040441124N1GOOMCQYX1" + }, + "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory", + "accountEmail": "admin@example.com", + "dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b" + } + }' + ``` + + ### Sample response + + ```bash Response + { + "id": "c48b701e-a20c-4a9a-8119-68f54e5fbb05", + "name": "lets-encrypt-production", + "type": "acme", + "status": "active", + "projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6", + "enableDirectIssuance": true, + "configuration": { + "accountEmail": "admin@example.com", + "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory", + "dnsAppConnection": { + "id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", + "name": "acme-dns-test-connection" + }, + "dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", + "dnsProviderConfig": { + "provider": "route53", + "hostedZoneId": "Z040441124N1GOOMCQYX1" + } + } + } + ``` + + + + + Next, create a subscriber that uses your ACME CA for certificate issuance. Navigate to your Project > Subscribers and create a new subscriber. + + Configure the subscriber with: + - **Issuing CA**: Select your registered ACME CA + - **Common Name**: The domain for which you want to issue certificates (e.g., `example.com`) + - **Alternative Names**: Additional domains to include in the certificate + + Check out the [Subscribers](/documentation/platform/pki/subscribers) page for detailed instructions on creating and managing subscribers. + + + Once your subscriber is configured, you can issue certificates either through the Infisical UI or programmatically via the API. + + When you request a certificate: + 1. Infisical generates a key pair for the certificate + 2. Sends a Certificate Signing Request (CSR) to the ACME CA + 3. Receives a DNS-01 challenge from the ACME provider + 4. Creates a TXT record in Route53 to satisfy the challenge + 5. Notifies the ACME provider that the challenge is ready for validation + 6. Once validated, the ACME provider issues the certificate + 7. Infisical stores and manages the certificate for your subscriber + + The certificate will be automatically renewed before expiration according to your subscriber configuration. + + + The issued certificate and private key are now available through Infisical and can be: + + - Downloaded directly from the Infisical UI + - Retrieved via the Infisical API for programmatic access using the [latest certificate bundle endpoint](/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle) + + + +## Example: Let's Encrypt Integration + +Let's Encrypt is a free, automated, and open Certificate Authority that provides domain-validated SSL/TLS certificates. Here's how the integration works with Infisical: + +### Production Environment +- **Directory URL**: `https://acme-v02.api.letsencrypt.org/directory` +- **Rate Limits**: 50 certificates per registered domain per week +- **Certificate Validity**: 90 days with automatic renewal +- **Trusted By**: All major browsers and operating systems + +### Staging Environment (for testing) +- **Directory URL**: `https://acme-staging-v02.api.letsencrypt.org/directory` +- **Rate Limits**: Much higher limits for testing +- **Certificate Validity**: 90 days (not trusted by browsers) +- **Use Case**: Testing your ACME integration without hitting production rate limits + + + Always test your ACME integration using Let's Encrypt's staging environment first. This allows you to verify your DNS configuration and certificate issuance process without consuming your production rate limits. + + +## FAQ + + + + Currently, Infisical supports DNS-01 validation through AWS Route53. The DNS-01 challenge method is preferred for ACME integrations because it: + + - Works with wildcard certificates + - Doesn't require your servers to be publicly accessible + - Can be fully automated without manual intervention + + Support for additional DNS providers is planned for future releases. + + + Yes! ACME CAs like Let's Encrypt support wildcard certificates (e.g., `*.example.com`) when using DNS-01 validation. Simply specify the wildcard domain in your subscriber configuration. + + Note that wildcard certificates still require DNS-01 validation - HTTP-01 validation cannot be used for wildcard certificates. + + + Most ACME providers issue certificates with 90-day validity periods. This shorter validity period is designed to: + + - Encourage automation of certificate management + - Reduce the impact of compromised certificates + - Ensure systems stay up-to-date with certificate management practices + + When configured, Infisical automatically handles certificate renewal for subscribers. + + + Yes! You can register multiple ACME CAs in the same project: + + - Different providers for different domains or use cases + - Staging and production environments for the same provider + - Backup providers for redundancy + + Each subscriber can be configured to use a specific ACME CA based on your requirements. + + \ No newline at end of file diff --git a/docs/documentation/platform/pki/external-ca.mdx b/docs/documentation/platform/pki/external-ca.mdx deleted file mode 100644 index aee0de00e..000000000 --- a/docs/documentation/platform/pki/external-ca.mdx +++ /dev/null @@ -1,289 +0,0 @@ ---- -title: "External CA" -sidebarTitle: "External CA" -description: "Learn how to connect External Certificate Authorities with Infisical." ---- - -## Concept - -In addition to creating a Private CA hierarchy, Infisical allows you to integrate with External Certificate Authorities (CAs) to issue digital certificates for your [subscribers](/documentation/platform/pki/subscribers). This integration enables you to leverage established public CA infrastructure while centralizing your certificate management within Infisical. - -
- -```mermaid -graph TD - A[External CA Provider
e.g., Let's Encrypt] <-->|ACME v2 Protocol| B[Infisical] - B -->|Creates TXT Records
via Route53| C[DNS Validation] - B -->|Manages Certificates| D[Subscribers] -``` - -
- -When you integrate an External CA with Infisical, you benefit from: - -1. **Trust by Default**: Certificates issued by public CAs like Let's Encrypt are trusted by default in browsers and operating systems. -2. **Unified Management**: Manage all certificates—both internally and externally issued—from a single platform. -3. **Automation**: Leverage Infisical's automation capabilities for certificate lifecycle management. -4. **Compliance**: Meet requirements for publicly trusted certificates, especially for public-facing services. - -## Workflow - -A typical workflow for integrating an External CA with Infisical consists of the following steps: - -1. Configuring DNS provider credentials in Infisical to enable automatic domain validation. -2. Registering an External CA provider with Infisical using the ACME v2 protocol. -3. Creating subscribers that use the External CA as their issuing authority. -4. Managing certificate lifecycle events such as certificate issuance, renewal, and revocation. - - - Currently, Infisical supports integrating with External CAs via the ACME v2 protocol with DNS-01 validation through Route53 as the DNS provider. Additional integration methods and DNS providers will be supported in future releases. - - -## Understanding ACME DNS-01 Challenge - -The DNS-01 challenge is one method used by ACME CA providers to verify that you control a domain before issuing a certificate. Here's how Infisical handles this process: - -1. **Challenge Request**: When you request a certificate, Let's Encrypt (or another ACME provider) issues a challenge token. - -2. **DNS Record Creation**: Infisical creates a TXT record at `_acme-challenge.` with a value derived from the challenge token. - -3. **DNS Propagation**: The TXT record must propagate through the DNS system (usually takes a few minutes, depending on TTL settings). - -4. **Validation**: The ACME provider checks for the existence of this TXT record to verify domain control. - -5. **Cleanup**: After validation completes successfully, Infisical automatically removes the TXT record from your DNS. - -This automated process eliminates the need for manual intervention in domain validation, streamlining certificate issuance. - -## Guide to Registering an External CA - -In the following steps, we explore how to register an External CA with Infisical using the ACME v2 protocol with Route53 for DNS-01 validation. - -### Step 1: Set Up AWS Connection with Required Permissions - -Before proceeding with the External CA registration, you need to set up an AWS connection with the appropriate permissions for DNS validation: - -1. Navigate to your Organization Settings > App Connections and create a new AWS connection. - -2. Ensure your AWS connection has the following minimum permissions for Route53 DNS validation: - -```json -{ - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Action": "route53:GetChange", - "Resource": "arn:aws:route53:::change/*" - }, - { - "Effect": "Allow", - "Action": "route53:ListHostedZonesByName", - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "route53:ListResourceRecordSets" - ], - "Resource": [ - "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID" - ] - }, - { - "Effect": "Allow", - "Action": [ - "route53:ChangeResourceRecordSets" - ], - "Resource": [ - "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID" - ], - "Condition": { - "ForAllValues:StringEquals": { - "route53:ChangeResourceRecordSetsRecordTypes": [ - "TXT" - ] - } - } - } - ] -} -``` - -Replace `YOUR_HOSTED_ZONE_ID` with your actual Route53 hosted zone ID. - -For detailed instructions on setting up an AWS connection, see the [AWS Connection](/integrations/app-connections/aws) documentation. - -### Step 2: Create External Certificate Authority - - - - - - To register an External CA, head to your Project > Internal PKI > Certificate Authorities and press the **+** button in the External Certificate Authorities section. - - ![pki register external ca](/images/platform/pki/ca/external-ca/create-external-ca-button.png) - - Fill out the details for the External CA registration: - - ![pki register external ca details](/images/platform/pki/ca/external-ca/create-external-ca-form.png) - - Here's guidance on each field: - - - Type: Select "ACME" as the External CA type. - - Name: Enter a name for the External CA (e.g., "lets-encrypt-production"). - - DNS App Connection: Select from available DNS app connections or configure a new one. This connection provides Infisical with the credentials needed to create and remove DNS records for ACME validation. - - Hosted Zone ID: Enter your Route53 hosted zone ID (e.g., Z04044I124N1GOOMCOYX1) for the domain(s) you'll be requesting certificates for. - - Directory URL: Enter the ACME v2 directory URL for your chosen CA provider (e.g., `https://acme-v02.api.letsencrypt.org/directory` for Let's Encrypt). - - Account Email: Email address to associate with your ACME account. This email will receive important notifications about your certificates. - - Disable Direct Issuance: Toggle on to require subscribers for issuance (recommended). - - Finally, press **Create** to register the External CA with Infisical. - - - Once registered, your External CA will appear in the External Certificate Authorities section. - - ![pki external ca list](/images/platform/pki/ca/external-ca/external-ca-list.png) - - From here, you can: - - - View the status of the External CA registration - - Edit the configuration settings - - Disable or re-enable the External CA - - Delete the External CA registration if no longer needed - - You can now use this External CA to issue certificates for your subscribers directly. - - Check out the [Subscribers](/documentation/platform/pki/subscribers) page to learn more about how to issue X.509 certificates using your registered External CA. - - - - - To register an External CA with Infisical using the API, make a request to the Create External CA endpoint: - - ### Sample request - - ```bash Request - curl 'https://app.infisical.com/api/v1/pki/ca/acme' \ - -H 'Authorization: Bearer ' \ - -H 'Content-Type: application/json' \ - --data-raw '{ - "projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6", - "name": "lets-encrypt-production", - "type": "acme", - "status": "active", - "disableDirectIssuance": false, - "configuration": { - "dnsAppConnection": { - "id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", - "name": "acme-dns-test-connection" - }, - "dnsProviderConfig": { - "provider": "route53", - "hostedZoneId": "Z040441124N1GOOMCQYX1" - }, - "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory", - "accountEmail": "sheen@infisical.com", - "dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b" - } - }' - ``` - - ### Sample response - - ```bash Response - { - "id": "c48b701e-a20c-4a9a-8119-68f54e5fbb05", - "name": "lets-encrypt-production", - "type": "acme", - "status": "active", - "projectId": "0fccb6ee-1381-4ff1-8d5f-0cb93c6cc4d6", - "disableDirectIssuance": false, - "configuration": { - "accountEmail": "sheen@infisical.com", - "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory", - "dnsAppConnection": { - "id": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", - "name": "acme-dns-test-connection" - }, - "dnsAppConnectionId": "1e5f8c0d-09d2-492c-9b28-469acd8e841b", - "dnsProviderConfig": { - "provider": "route53", - "hostedZoneId": "Z040441124N1GOOMCQYX1" - } - } - } - ``` - - - -## Example: Integrating with Let's Encrypt - -Let's Encrypt is one of the most popular free, automated, and open Certificate Authorities. Here's a step-by-step example of integrating Infisical with Let's Encrypt using ACME v2: - -1. **Prepare your Route53 setup**: - - Ensure your domain's DNS is hosted on Route53 - - Note your hosted zone ID from the Route53 console - - Create AWS credentials with appropriate permissions as detailed above - -2. **Configure the integration in Infisical**: - - Type: ACME - - Name: lets-encrypt-production - - Directory URL: `https://acme-v02.api.letsencrypt.org/directory` (Note: this is the ACME v2 endpoint) - - Account Email: Your email address for Let's Encrypt notifications - - Hosted Zone ID: Your Route53 hosted zone ID - -3. **Issue certificates**: - - Create a subscriber in Infisical specifying the Let's Encrypt External CA as the issuing authority - - Request certificates with domains that match records in your Route53 hosted zone - - When a certificate is requested, Infisical will: - 1. Generate a key pair for the certificate - 2. Send a Certificate Signing Request (CSR) to Let's Encrypt - 3. Receive a DNS-01 challenge from Let's Encrypt - 4. Create a TXT record in Route53 to satisfy the challenge - 5. Notify Let's Encrypt that the challenge is ready for validation - 6. Once validated, Let's Encrypt will issue the certificate - 7. Infisical will store and manage the certificate for your subscriber - - - Let's Encrypt has rate limits that may affect your certificate issuance. For testing purposes, you can use Let's Encrypt's staging environment by setting the Directory URL to `https://acme-staging-v02.api.letsencrypt.org/directory`. Certificates issued through the staging environment are not trusted by browsers but allow you to test your setup without hitting production rate limits. - - -## FAQ - - - - Currently, Infisical supports DNS validation through AWS Route53. Support for additional DNS providers is planned for future releases. - - - Yes. You can have both Private CAs (root and intermediate) and External CAs in the same project, allowing you flexibility in how you issue certificates for different use cases. This hybrid approach enables you to: - - - Use Private CAs for internal services and applications - - Use External CAs for public-facing services - - Apply consistent management practices across all certificate types - - Implement appropriate security controls based on certificate usage - - - The types of certificates you can issue depend on the External CA provider. Most ACME providers support domain validation (DV) certificates. For organization validation (OV) or extended validation (EV) certificates, you may need to use a different integration method which will be supported in future releases. - - - Yes. Certificates issued through External CAs connected to Infisical can be automatically renewed before expiry, ensuring continuous certificate validity without manual intervention. This automation eliminates one of the most common causes of TLS-related outages. - - - Yes. In addition to ACME, Infisical plans to support other integration methods with popular External CA providers in future releases. Stay tuned for updates. - - - Infisical's External CA integration provides a complete certificate lifecycle management solution that offers: - - 1. **Automated renewals**: Certificates are automatically renewed before expiry - 2. **Centralized visibility**: All certificates are tracked in one place - 3. **Audit trails**: Complete history of certificate issuance and revocation - 4. **Programmatic access**: API-driven certificate issuance for automation - 5. **Consistent processes**: Standardized workflows for certificate requests across different CAs - 6. **Deployment**: Integration with your infrastructure for certificate distribution - 7. **Monitoring**: Visibility into certificate status and upcoming expirations - 8. **Revocation**: Centralized management of certificate revocation when needed - - This end-to-end management eliminates common challenges like expired certificates, scattered certificate storage, and manual renewal processes that often lead to outages. - - \ No newline at end of file diff --git a/docs/images/platform/pki/ca/external-ca/create-external-ca-form.png b/docs/images/platform/pki/ca/external-ca/create-external-ca-form.png index ff18f1d6d..ef572bfa7 100644 Binary files a/docs/images/platform/pki/ca/external-ca/create-external-ca-form.png and b/docs/images/platform/pki/ca/external-ca/create-external-ca-form.png differ diff --git a/docs/mint.json b/docs/mint.json index 2f10b2616..09049bf6d 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -112,9 +112,9 @@ "pages": [ "documentation/platform/pki/overview", "documentation/platform/pki/private-ca", - "documentation/platform/pki/external-ca", "documentation/platform/pki/subscribers", "documentation/platform/pki/certificates", + "documentation/platform/pki/acme-ca", "documentation/platform/pki/pki-issuer", "documentation/platform/pki/est", "documentation/platform/pki/alerting" @@ -1538,6 +1538,16 @@ "api-reference/endpoints/certificate-authorities/acme/delete" ] }, + { + "group": "Internal", + "pages": [ + "api-reference/endpoints/certificate-authorities/internal/list", + "api-reference/endpoints/certificate-authorities/internal/create", + "api-reference/endpoints/certificate-authorities/internal/read", + "api-reference/endpoints/certificate-authorities/internal/update", + "api-reference/endpoints/certificate-authorities/internal/delete" + ] + }, "api-reference/endpoints/certificate-authorities/list", "api-reference/endpoints/certificate-authorities/create", "api-reference/endpoints/certificate-authorities/read",