mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
135 lines
5.4 KiB
Plaintext
135 lines
5.4 KiB
Plaintext
---
|
|
sidebarTitle: "Overview"
|
|
description: "Learn how to sync certificates from Infisical PKI to third-party services."
|
|
---
|
|
|
|
Certificate Syncs enable you to push certificates from Infisical to third-party services using [App Connections](/integrations/app-connections/overview).
|
|
|
|
<Note>
|
|
Certificate Syncs are designed to automatically deploy certificates issued by
|
|
your Certificate Authority to external services, ensuring your certificates
|
|
are always up-to-date across your infrastructure.
|
|
</Note>
|
|
|
|
## Concept
|
|
|
|
Certificate Syncs are a project-level resource used to push certificates, via an [App Connection](/integrations/app-connections/overview), from Infisical
|
|
to a third-party service (destination). When paired with [server-side auto-renewal](/documentation/platform/pki/certificates/certificates#server-driven-certificate-renewal), renewed certificates are automatically synced to the destination,
|
|
ensuring your certificates stay current.
|
|
|
|
<br />
|
|
|
|
<div align="center">
|
|
|
|
```mermaid
|
|
%%{init: {'flowchart': {'curve': 'linear'} } }%%
|
|
graph LR
|
|
A[App Connection]
|
|
B[Certificate Sync]
|
|
C[Certificate 1]
|
|
D[Certificate 2]
|
|
E[Certificate 3]
|
|
F[Third-Party Service]
|
|
G[Certificate 1]
|
|
H[Certificate 2]
|
|
I[Certificate 3]
|
|
|
|
B --> A
|
|
C --> B
|
|
D --> B
|
|
E --> B
|
|
A --> F
|
|
F --> G
|
|
F --> H
|
|
F --> I
|
|
|
|
classDef default fill:#ffffff,stroke:#666,stroke-width:2px,rx:10px,color:black
|
|
classDef connection fill:#FFF2B2,stroke:#E6C34A,stroke-width:2px,color:black,rx:15px
|
|
classDef certificate fill:#E6F4FF,stroke:#0096D6,stroke-width:2px,color:black,rx:15px
|
|
classDef sync fill:#F4FFE6,stroke:#96D600,stroke-width:2px,color:black,rx:15px
|
|
classDef service fill:#E6E6FF,stroke:#6B4E96,stroke-width:2px,color:black,rx:15px
|
|
classDef subscriber fill:#FFE6E6,stroke:#D63F3F,stroke-width:2px,color:black,rx:15px
|
|
|
|
class A connection
|
|
class B sync
|
|
class C,D,E,G,H,I certificate
|
|
class F service
|
|
class J subscriber
|
|
```
|
|
|
|
</div>
|
|
|
|
## Workflow
|
|
|
|
Configuring a Certificate Sync requires three components: The certificates that you'd like to push,
|
|
a <strong>destination</strong> endpoint to deploy certificates to, and <strong>configuration options</strong> to determine how your certificates
|
|
should be synced. Follow these steps to start syncing:
|
|
|
|
<Note>
|
|
For step-by-step guides on syncing to a particular third-party service, refer
|
|
to the Certificate Syncs section in the Navigation Bar.
|
|
</Note>
|
|
|
|
1. <strong>Create App Connection:</strong> If you have not already done so, create
|
|
an [App Connection](/integrations/app-connections/overview) via the UI or API
|
|
for the third-party service you intend to sync certificates to.
|
|
|
|
2. <strong>Create Certificate Sync:</strong> Configure a Certificate Sync in the
|
|
desired project by specifying the following parameters via the UI or API:
|
|
|
|
- <strong>Destination:</strong> The App Connection to utilize and the destination
|
|
endpoint to deploy certificates to such as [AWS Certificate Manager](/documentation/platform/pki/certificate-syncs/aws-certificate-manager)
|
|
or [Azure Key Vault](/documentation/platform/pki/certificate-syncs/azure-key-vault).
|
|
- <strong>Certificates:</strong> The certificates you wish to push to the destination.
|
|
- <strong>Options:</strong> Customize how certificates should be synced, including:
|
|
- Whether certificates should be removed from the destination when they expire.
|
|
- Whether to include the Root CA certificate in the certificate chain.
|
|
- Certificate naming schema to control how certificate names are generated in
|
|
the destination.
|
|
|
|
<Note>
|
|
Only certificates managed by Infisical will be affected during sync
|
|
operations. Certificates not created or managed by Infisical will remain
|
|
untouched, and changes made to Infisical-managed certificates directly in the
|
|
destination service may be overwritten by future syncs.
|
|
</Note>
|
|
|
|
<Info>
|
|
Some third-party services do not support removing expired certificates
|
|
automatically.
|
|
</Info>
|
|
|
|
3. <strong>Utilize Sync:</strong> Selected certificates will now be pushed to the
|
|
destination endpoint and automatically redeployed whenever they are renewed.
|
|
|
|
<Note>
|
|
Infisical is continuously expanding its Certificate Sync third-party service
|
|
support. If the service you need isn't available, contact us at
|
|
team@infisical.com to make a request.
|
|
</Note>
|
|
|
|
## Certificate Naming
|
|
|
|
Certificate Syncs support flexible certificate naming through configurable naming schemas. This allows you to customize how certificate names appear in your destination services.
|
|
|
|
### Default Naming
|
|
|
|
By default, certificates are named using the pattern `Infisical-{certificateId}` where `{certificateId}` is the unique identifier of the certificate with hyphens removed for compatibility with services like Azure Key Vault.
|
|
|
|
### Custom Naming Schema
|
|
|
|
You can customize certificate naming by providing a **Certificate Name Schema** when creating or updating a Certificate Sync. The schema supports the following placeholders:
|
|
|
|
- `{{certificateId}}` - The unique certificate identifier (required)
|
|
|
|
**Examples:**
|
|
|
|
- `myapp-{{certificateId}}` → `myapp-abc123def456`
|
|
- `ssl/{{certificateId}}` → `ssl/abc123def456`
|
|
|
|
**Rules:**
|
|
|
|
- Must include exactly one `{{certificateId}}` placeholder
|
|
- Only alphanumeric characters, dashes (-), underscores (\_), and slashes (/) are allowed
|
|
- Certificate names matching your schema will be managed by Infisical during sync operations
|