diff --git a/docs/documentation/platform/pki/ca/private-ca.mdx b/docs/documentation/platform/pki/ca/private-ca.mdx index 74913d4cc..21c278ed7 100644 --- a/docs/documentation/platform/pki/ca/private-ca.mdx +++ b/docs/documentation/platform/pki/ca/private-ca.mdx @@ -277,9 +277,9 @@ the certificate back to the intermediate CA. Head to the CA Page of the CA you wish you renew and press **Renew CA** on the left side. ![pki ca renewal - page](/images/platform/pki/ca-renewal-page.png) Input a new **Valid Until** + page](/images/platform/pki/ca/ca-renewal.png) Input a new **Valid Until** date to be used for the renewed CA certificate and press **Renew** to renew - the CA. ![pki ca renewal. modal](/images/platform/pki/ca-renewal-modal.png) + the CA. ![pki ca renewal. modal](/images/platform/pki/ca/ca-renewal-modal.png) The new **Valid Until** date must be within the validity period of the parent CA. diff --git a/docs/documentation/platform/pki/certificates/profiles.mdx b/docs/documentation/platform/pki/certificates/profiles.mdx index 3d4fb9380..ccbef89cd 100644 --- a/docs/documentation/platform/pki/certificates/profiles.mdx +++ b/docs/documentation/platform/pki/certificates/profiles.mdx @@ -13,7 +13,9 @@ You typically request certificates against a certificate profile through its ass To create a certificate profile, head to your Certificate Management Project > Certificates > Certificate Profiles and press **Create Profile**. -TODO: image +![pki certificate profile](/images/platform/pki/certificate/cert-profile.png) + +![pki certificate profile modal](/images/platform/pki/certificate/cert-profile-modal.png) Here's some guidance on each field: diff --git a/docs/documentation/platform/pki/certificates/templates.mdx b/docs/documentation/platform/pki/certificates/templates.mdx index 633123a16..38b5570dd 100644 --- a/docs/documentation/platform/pki/certificates/templates.mdx +++ b/docs/documentation/platform/pki/certificates/templates.mdx @@ -13,11 +13,13 @@ Each certificate requested against a profile is validated against the template b To create a certificate template, head to your Certificate Management Project > Certificates > Certificate Templates and press **Create Template**. -TODO: image +![pki certificate template](/images/platform/pki/certificate/cert-template.png) + +![pki certificate template modal](/images/platform/pki/certificate/cert-template-modal.png) Here's some guidance on each field: -- Template Name: The name of the template such as `tls-server`. +- Template Name: A slug-friendly name for the template such as `tls-server`. - Description: An optional description for the template. - Subject Attributes: A list of common names that can be included in the certificate subject. Each row accepts a fixed value or pattern such as `example.com` or `*.example.com` and whether it is allowed or denied. - Subject Alternative Names (SANs): A list of SANs that can appear in the certificate. Each row accepts a SAN type (e.g. DNS, IP, Email, URI), a fixed value or pattern such as `example.com` or `*.example.com`, and an allow or deny flag. diff --git a/docs/documentation/platform/pki/enrollment-methods/api.mdx b/docs/documentation/platform/pki/enrollment-methods/api.mdx index e628f736c..7522887e2 100644 --- a/docs/documentation/platform/pki/enrollment-methods/api.mdx +++ b/docs/documentation/platform/pki/enrollment-methods/api.mdx @@ -52,15 +52,14 @@ Here, select the certificate profile from step 1 that will be used to issue the - - A certificate template is a set of policies for certificates issued under that template; each template is bound to a specific CA and can also be bound to a certificate collection for alerting such that any certificate issued under the template is automatically added to the collection. + - With certificate templates, you can specify, for example, that issued certificates must have a common name (CN) adhering to a specific format like .*.acme.com or perhaps that the max TTL cannot be more than 1 year. - - To create a certificate template, make an API request to the [Create Certificate Template](/api-reference/endpoints/certificate-templates/create) API endpoint, specifying the issuing CA. + To create a certificate [profile](/documentation/platform/pki/certificates/profiles), make an API request to the [Create Certificate Profile](/docs/api-reference/endpoints/certificate-profiles/create) API endpoint. ### Sample request + TODO: update this sample request. + ```bash Request curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \ --header 'Content-Type: application/json' \ @@ -87,10 +86,13 @@ Here, select the certificate profile from step 1 that will be used to issue the ``` - - To create a certificate under the certificate template, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint, + + + TODO: update this sample request. + + To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint, specifying the issuing CA. - + ### Sample request ```bash Request @@ -115,18 +117,13 @@ Here, select the certificate profile from step 1 that will be used to issue the } ``` - - Note that Infisical PKI supports issuing certificates without certificate templates as well. If this is desired, then you can set the **Certificate Template** field to **None** - and specify the **Issuing CA** and optional **Certificate Collection** fields; the rest of the fields for the issued certificate remain the same. - - That said, we recommend using certificate templates to enforce policies and attach expiration monitoring on issued certificates. - - Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time. - If you have an external private key, you can also create a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA. + TODO: update this sample request. + + If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA. ### Sample request diff --git a/docs/images/platform/pki/ca/ca-create-intermediate.png b/docs/images/platform/pki/ca/ca-create-intermediate.png index ac83db3e9..fe87345e6 100644 Binary files a/docs/images/platform/pki/ca/ca-create-intermediate.png and b/docs/images/platform/pki/ca/ca-create-intermediate.png differ diff --git a/docs/images/platform/pki/ca/ca-create-root.png b/docs/images/platform/pki/ca/ca-create-root.png index a8bf936a3..acf2d6a7a 100644 Binary files a/docs/images/platform/pki/ca/ca-create-root.png and b/docs/images/platform/pki/ca/ca-create-root.png differ diff --git a/docs/images/platform/pki/ca/ca-create.png b/docs/images/platform/pki/ca/ca-create.png index 915ed684c..f8cedd572 100644 Binary files a/docs/images/platform/pki/ca/ca-create.png and b/docs/images/platform/pki/ca/ca-create.png differ diff --git a/docs/images/platform/pki/ca/ca-install-intermediate-csr.png b/docs/images/platform/pki/ca/ca-install-intermediate-csr.png index 77c7df0b9..b35b2ab10 100644 Binary files a/docs/images/platform/pki/ca/ca-install-intermediate-csr.png and b/docs/images/platform/pki/ca/ca-install-intermediate-csr.png differ diff --git a/docs/images/platform/pki/ca/ca-install-intermediate-opt.png b/docs/images/platform/pki/ca/ca-install-intermediate-opt.png index 16afd2f0b..4fdd64af7 100644 Binary files a/docs/images/platform/pki/ca/ca-install-intermediate-opt.png and b/docs/images/platform/pki/ca/ca-install-intermediate-opt.png differ diff --git a/docs/images/platform/pki/ca/ca-install-intermediate.png b/docs/images/platform/pki/ca/ca-install-intermediate.png index 10c9424ff..c0a0adde5 100644 Binary files a/docs/images/platform/pki/ca/ca-install-intermediate.png and b/docs/images/platform/pki/ca/ca-install-intermediate.png differ diff --git a/docs/images/platform/pki/ca/cas.png b/docs/images/platform/pki/ca/cas.png index d3189fd1a..628b03a34 100644 Binary files a/docs/images/platform/pki/ca/cas.png and b/docs/images/platform/pki/ca/cas.png differ diff --git a/docs/images/platform/pki/certificate/cert-profile-modal.png b/docs/images/platform/pki/certificate/cert-profile-modal.png new file mode 100644 index 000000000..29280d01c Binary files /dev/null and b/docs/images/platform/pki/certificate/cert-profile-modal.png differ diff --git a/docs/images/platform/pki/certificate/cert-profile.png b/docs/images/platform/pki/certificate/cert-profile.png new file mode 100644 index 000000000..3337f8065 Binary files /dev/null and b/docs/images/platform/pki/certificate/cert-profile.png differ diff --git a/docs/images/platform/pki/certificate/cert-template-modal.png b/docs/images/platform/pki/certificate/cert-template-modal.png index 2f6c88166..970b2f2f1 100644 Binary files a/docs/images/platform/pki/certificate/cert-template-modal.png and b/docs/images/platform/pki/certificate/cert-template-modal.png differ diff --git a/docs/images/platform/pki/certificate/cert-template.png b/docs/images/platform/pki/certificate/cert-template.png new file mode 100644 index 000000000..88080e7ca Binary files /dev/null and b/docs/images/platform/pki/certificate/cert-template.png differ diff --git a/frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx b/frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx index a2e4871de..19adbcc7f 100644 --- a/frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx +++ b/frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx @@ -94,7 +94,7 @@ export const PkiManagerLayout = () => { { <> - { + {/* { { Subscribers (Legacy) )} - } + } */} {(subscription.pkiLegacyTemplates || hasExistingTemplates) && (