mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
156 lines
4.9 KiB
Plaintext
156 lines
4.9 KiB
Plaintext
---
|
|
title: "Certificate Enrollment via API"
|
|
sidebarTitle: "API"
|
|
---
|
|
|
|
## Concept
|
|
|
|
The API enrollment method allows you to issue certificates against a specific certificate profile over Web UI or by making an API request to Infisical.
|
|
|
|
## Guide to Certificate Enrollment via API
|
|
|
|
In the following steps, we explore how to issue a X.509 certificate using the API enrollment method.
|
|
|
|
<Tabs>
|
|
<Tab title="Infisical UI">
|
|
|
|
<Steps>
|
|
<Step title="Create a certificate profile">
|
|
Create a [certificate
|
|
profile](/documentation/platform/pki/certificates/profiles) with **API**
|
|
selected as the enrollment method.
|
|
|
|
Notice that the API enrollment method supports an option called **Enable Auto-Renewal By Default**.
|
|
If selected, _eligible_ certificates are automatically considered for server-side auto-renewal based
|
|
on a specified renewal days before expiration threshold at the time of issuance; for more information
|
|
about server-side auto-renewal, refer to the documentation [here](/documentation/platform/pki/certificates/certificates#guide-to-renewing-certificates).
|
|
|
|
</Step>
|
|
<Step title="Issue a certificate">
|
|
To create a certificate, head to your Project > Certificates > Certificates and press **Issue**.
|
|
|
|
TODO: Image
|
|
|
|
Here, select the certificate profile from step 1 that will be used to issue the certificate and fill out the rest of the details for the certificate to be issued.
|
|
|
|
</Step>
|
|
<Step title="Download the certificate details">
|
|
Once you have created the certificate from step 1, you'll be presented with the certificate details including the **Certificate Body**, **Certificate Chain**, and **Private Key**.
|
|
|
|
TODO: Image
|
|
|
|
<Note>
|
|
Make sure to download and store the **Private Key** in a secure location as it
|
|
will only be displayed once at the time of certificate issuance. The
|
|
**Certificate Body** and **Certificate Chain** will remain accessible and can
|
|
be copied at any time.
|
|
</Note>
|
|
|
|
</Step>
|
|
</Steps>
|
|
</Tab>
|
|
<Tab title="API">
|
|
|
|
<Steps>
|
|
<Step title="Create a certificate profile">
|
|
|
|
To create a certificate [profile](/documentation/platform/pki/certificates/profiles), make an API request to the [Create Certificate Profile](/docs/api-reference/endpoints/certificate-profiles/create) API endpoint.
|
|
|
|
### Sample request
|
|
|
|
TODO: update this sample request.
|
|
|
|
```bash Request
|
|
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \
|
|
--header 'Content-Type: application/json' \
|
|
--data-raw '{
|
|
"caId": "<ca-id>",
|
|
"name": "My Certificate Template",
|
|
"commonName": ".*.acme.com",
|
|
"subjectAlternativeName": ".*.acme.com",
|
|
"ttl": "1y",
|
|
}'
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```bash Response
|
|
{
|
|
id: "...",
|
|
caId: "...",
|
|
name: "...",
|
|
commonName: "...",
|
|
subjectAlternativeName: "...",
|
|
ttl: "...",
|
|
}
|
|
```
|
|
|
|
</Step>
|
|
<Step title="Issue a certificate">
|
|
|
|
TODO: update this sample request.
|
|
|
|
To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
|
|
specifying the issuing CA.
|
|
|
|
### Sample request
|
|
|
|
```bash Request
|
|
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/issue-certificate' \
|
|
--header 'Content-Type: application/json' \
|
|
--data-raw '{
|
|
"certificateTemplateId": "<certificate-template-id>",
|
|
"commonName": "service.acme.com",
|
|
"ttl": "1y",
|
|
}'
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```bash Response
|
|
{
|
|
certificate: "...",
|
|
certificateChain: "...",
|
|
issuingCaCertificate: "...",
|
|
privateKey: "...",
|
|
serialNumber: "..."
|
|
}
|
|
```
|
|
|
|
<Note>
|
|
Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
|
|
</Note>
|
|
|
|
TODO: update this sample request.
|
|
|
|
If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA.
|
|
|
|
### Sample request
|
|
|
|
```bash Request
|
|
curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/sign-certificate' \
|
|
--header 'Content-Type: application/json' \
|
|
--data-raw '{
|
|
"certificateTemplateId": "<certificate-template-id>",
|
|
"csr": "...",
|
|
"ttl": "1y",
|
|
}'
|
|
```
|
|
|
|
### Sample response
|
|
|
|
```bash Response
|
|
{
|
|
certificate: "...",
|
|
certificateChain: "...",
|
|
issuingCaCertificate: "...",
|
|
privateKey: "...",
|
|
serialNumber: "..."
|
|
}
|
|
```
|
|
|
|
</Step>
|
|
</Steps>
|
|
</Tab>
|
|
</Tabs>
|