> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Certificate authorities

> Set up Certificate Authorities to issue certificates across your organization.

A Certificate Authority (CA) signs and issues X.509 certificates. Before teams can issue certificates through applications, an admin needs to set up at least one CA, either in Infisical or by connecting one you already use.

> [card] [Internal CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca)
>
> Create root and intermediate CAs in Infisical for internal services, mTLS, and private networks.

> [card] [External CA](https://infisical.com/docs/documentation/platform/pki/ca/external-ca)
>
> Issue from a public CA such as Let's Encrypt or DigiCert, or from enterprise PKI such as AWS Private CA, Microsoft ADCS, or Venafi.

> [card] [HSM connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors)
>
> Keep internal CA and signer keys in your own HSM.

## Which should I use?

| Use case | Recommended CA |
| - | - |
| Internal services, mTLS between microservices | Internal CA |
| Public-facing websites needing browser trust | External CA (Let's Encrypt, DigiCert) |
| Enterprise with existing PKI infrastructure | External CA (AWS Private CA, Microsoft ADCS, Venafi) |
| IoT devices, internal device fleet | Internal CA |
| Regulated environments with specific CA requirements | External CA (your approved provider) |

## Internal CA hierarchy

When you use internal CAs, you typically create a hierarchy:

```
Root CA (offline, long-lived)
└── Intermediate CA (online, issues certificates)
    └── Leaf Certificates (TLS, mTLS, devices)
```

> [!NOTE]
>
> Keep your root CA offline or use it as little as possible. Create one or more intermediate CAs to issue day-to-day certificates, so a compromised intermediate CA doesn't expose the root.

## Next steps

**Step 1**

Set up an [internal CA](https://infisical.com/docs/documentation/platform/pki/ca/private-ca) or connect an [external CA](https://infisical.com/docs/documentation/platform/pki/ca/external-ca).

**Step 2**

Create a [certificate policy](https://infisical.com/docs/documentation/platform/pki/settings/policies.md) to set the domains, validity periods, and key algorithms that certificates can use.

**Step 3**

Create a [certificate profile](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md) that pairs your CA with the policy, so applications can issue from it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.