mirror of
https://github.com/Infisical/infisical.git
synced 2026-01-08 23:18:05 -05:00
116 lines
4.4 KiB
Plaintext
116 lines
4.4 KiB
Plaintext
---
|
|
title: "Certificates"
|
|
sidebarTitle: "Certificates"
|
|
description: "Learn how to issue X.509 certificates with Infisical."
|
|
---
|
|
|
|
## Concept
|
|
|
|
Assuming that you've created a Private CA hierarchy with a root CA and an intermediate CA, you can now issue/revoke X.509 certificates using the intermediate CA.
|
|
|
|
<div align="center">
|
|
|
|
```mermaid
|
|
graph TD
|
|
A[Root CA]
|
|
A --> B[Intermediate CA]
|
|
A --> C[Intermediate CA]
|
|
B --> D[Leaf Certificate]
|
|
C --> E[Leaf Certificate]
|
|
```
|
|
|
|
</div>
|
|
|
|
## Workflow
|
|
|
|
The typical workflow for managing certificates consists of the following steps:
|
|
|
|
1. Issuing a certificate under an intermediate CA with details like name and validity period.
|
|
2. Managing certificate lifecycle events such as certificate renewal and revocation. As part of the certificate revocation flow,
|
|
you can also query for a Certificate Revocation List [CRL](https://en.wikipedia.org/wiki/Certificate_revocation_list), a time-stamped, signed
|
|
data structure issued by a CA containing a list of revoked certificates to check if a certificate has been revoked.
|
|
|
|
<Note>
|
|
Note that this workflow can be executed via the Infisical UI or manually such
|
|
as via API.
|
|
</Note>
|
|
|
|
## Guide to Issuing Certificates
|
|
|
|
In the following steps, we explore how to issue a X.509 certificate under a CA using the Infisical UI.
|
|
|
|
<Steps>
|
|
<Step title="Creating a certificate">
|
|
To create a certificate, head to your Project > Internal PKI > Certificates and press **Create Certificate**.
|
|
|
|
|
|
|
|
Here, set the **CA** to the CA you want to issue the certificate under and fill out details for the certificate.
|
|
|
|
|
|
|
|
Here's some guidance on each field:
|
|
|
|
- Issuing CA: The CA under which to issue the certificate.
|
|
- Common Name (CN): The (common) name of the certificate.
|
|
- TTL: The lifetime of the certificate in seconds.
|
|
- Valid Until: The date until which the certificate is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`.
|
|
|
|
</Step>
|
|
<Step title="Copying the certificate details">
|
|
Once you have created the certificate from step 1, you'll be presented with the certificate details including the **Certificate Body**, **Certificate Chain**, and **Private Key**.
|
|
|
|
|
|
|
|
<Note>
|
|
Make sure to download and store the **Private Key** in a secure location as it will only be displayed once at the time of certificate issuance.
|
|
The **Certificate Body** and **Certificate Chain** will remain accessible and can be copied at any time.
|
|
</Note>
|
|
</Step>
|
|
</Steps>
|
|
|
|
## Guide to Revoking Certificates
|
|
|
|
In the following steps, we explore how to revoke a X.509 certificate under a CA and obtain a Certificate Revocation List (CRL) for a CA using the Infisical UI.
|
|
|
|
<Steps>
|
|
<Step title="Revoking a Certificate">
|
|
Assuming that you've issued a certificate under a CA, you can revoke it by
|
|
selecting the **Revoke Certificate** option for it and specifying the reason
|
|
for revocation. Image 1 Image 2
|
|
|
|
|
|
|
|
|
|
|
|
</Step>
|
|
<Step title="Obtaining a CRL">
|
|
In order to check the revocation status of a certificate, you can check it
|
|
against the CRL of a CA by selecting the **View CRL** option under the
|
|
issuing CA and downloading the CRL file.
|
|
|
|
|
|
|
|
|
|
|
|
To verify a certificate against the
|
|
downloaded CRL with OpenSSL, you can use the following command:
|
|
|
|
```bash
|
|
openssl verify -crl_check -CAfile chain.pem -CRLfile crl.pem cert.pem
|
|
```
|
|
|
|
</Step>
|
|
</Steps>
|
|
|
|
## FAQ
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="What is the workflow for renewing a certificate?">
|
|
To renew a certificate, you have to issue a new certificate from the same CA
|
|
with the same common name as the old certificate. The original certificate
|
|
will continue to be valid through its original TTL unless explicitly
|
|
revoked.
|
|
</Accordion>
|
|
</AccordionGroup>
|