4 ms·

Show HN: Infisical PKI – Open-Source Private CA and Certificate Management

9 points by vmatsiiako 2y ago

we just released an open source PKI engine [0] as part of the wider Infisical secret management toolset. With Infisical PKI, you can: - create root and intermediary CAs; - issue and revoke x.509 certificates (with support for CRL); - encrypt TLS communication channels and authenticate users, computers, IoT devices, etc. It is available under the MIT license as part of the main Infisical repository [1] [0] https://infisical.com/docs/documentation/platform/pki/overview https://infisical.com/docs/documentation/platform/pki/overvi... [1] https://github.com/Infisical/infisical https://github.com/Infisical/infisical

ringstar 2y ago
If I have a CA hierarchy and my CA is expiring. How would y’all handle the CA renewal process for it?
- dangtony98 2y ago
  We've laid out a pretty flexible foundation for this first release of Infisical PKI. The API is fully exposed, so you'd be able to orchestrate your own CA renewal workflow as you wish. You can't reissue the same CA with a new validity period yet but you can definitely issue new CA(s) as part of your CA succession — This does take some manual work to do at the moment but we do plan to introduce more automated renewal workflows soon involving automatic generation of CSRs to parent CAs, auto-approving + reissuing new certificates, etc. Definitely be on the lookout for that! Happy to expand on some of these plans :)
samejr 2y ago
What if I have an existing CA hierarchy in place already. Is this something I would be able to easily migrate to?
- dangtony98 2y ago
  Not yet but we definitely have ideas for this coming up next on the roadmap. The basic idea would be to allow you to create CAs with external/imported CA options which would assist with a migration. For example, you would be able to "import" in a signed certificate (+chain) from an external parent CA when installing an intermediate CA in Infisical — As you'd expect, Infisical would generate a CSR for the CA to be signed by the parent CA externally.
cvalka 2y ago
Step-CA is much better

9 points by vmatsiiako 2y ago

ringstar 2y ago

If I have a CA hierarchy and my CA is expiring. How would y’all handle the CA renewal process for it?

dangtony98 2y ago
We've laid out a pretty flexible foundation for this first release of Infisical PKI. The API is fully exposed, so you'd be able to orchestrate your own CA renewal workflow as you wish. You can't reissue the same CA with a new validity period yet but you can definitely issue new CA(s) as part of your CA succession — This does take some manual work to do at the moment but we do plan to introduce more automated renewal workflows soon involving automatic generation of CSRs to parent CAs, auto-approving + reissuing new certificates, etc. Definitely be on the lookout for that! Happy to expand on some of these plans :)

samejr 2y ago

What if I have an existing CA hierarchy in place already. Is this something I would be able to easily migrate to?

dangtony98 2y ago
Not yet but we definitely have ideas for this coming up next on the roadmap. The basic idea would be to allow you to create CAs with external/imported CA options which would assist with a migration. For example, you would be able to "import" in a signed certificate (+chain) from an external parent CA when installing an intermediate CA in Infisical — As you'd expect, Infisical would generate a CSR for the CA to be signed by the parent CA externally.

cvalka 2y ago

Step-CA is much better