> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Internal CA

> Create a Private CA hierarchy to issue certificates for your organization.

Build your Internal PKI through a Private Certificate Authority (CA) hierarchy. This allows you to issue and manage X.509 certificates for internal services without relying on external CAs.

> [!NOTE]
>
> This page is for product admins setting up PKI infrastructure. Teams issuing certificates should see [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md).

```mermaid theme={"dark"}
graph TD
    A[Root CA]
    A --> B[Intermediate CA]
    A --> C[Intermediate CA]
```

## How it works

1. **Create a Root CA** — Or use an existing external root CA
2. **Create Intermediate CA(s)** — Chain them to your root CA
3. **Create Certificate Profiles** — Link CAs to policies for teams to use
4. **Create Applications** — Assign profiles to Applications for teams

> [!NOTE]
>
> You can execute this workflow via the UI or API. For API workflows, you may need to create CSRs and import certificates manually.

## Create a CA hierarchy

Create a simple Private CA hierarchy with a root CA and intermediate CA.

> [tab] Infisical UI
>
> **1. Create a root CA**
>
> If you have an existing external root CA, skip to step 2.
>
> Go to **Certificate Manager → Certificate Authorities → Internal** and click **Create CA**.
>
> Set the **CA Type** to **Root** and fill out details for the root CA:
>
> * Valid Until: The date until which the CA is valid in the date time string format specified [here](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format). For example, the following formats would be valid: `YYYY`, `YYYY-MM`, `YYYY-MM-DD`, `YYYY-MM-DDTHH:mm:ss.sssZ`.
>
> * Path Length: The maximum number of intermediate CAs that can be chained to this CA. A path of `-1` implies no limit; a path of `0` implies no intermediate CAs can be chained.
>
> * Key Algorithm: The algorithm of the CA key pair. The default is `RSA 2048`, and the choices depend on **Key Source**.
>
> * Key Source: Where the CA's signing key is generated and stored. **Infisical** (the default) generates and manages the key for you. **HSM** generates the key inside your own Hardware Security Module through an [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors), and every signing operation the CA performs runs on the HSM. See [HSM-backed Internal CAs](#hsm-backed-internal-cas) below. **AWS KMS** creates the key in your AWS account, and every signing operation runs in [AWS KMS](#aws-kms-backed-internal-cas).
>
> * HSM Connector: The [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors) Infisical uses to reach your HSM. Shown only when **Key Source** is **HSM**. With an HSM key source, the algorithm choices are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384`, `ML-DSA-44`, `ML-DSA-65`, and `ML-DSA-87`.
>
> * AWS Connection: The [AWS connection](https://infisical.com/docs/integrations/app-connections/aws.md) used to create the key and sign with it. Shown only when **Key Source** is **AWS KMS**.
>
> * Region: The AWS region to create the key in. Shown only when **Key Source** is **AWS KMS**.
>
> * Name: A slug-friendly name for the CA.
>
> * Organization (O): The organization name.
>
> * Country (C): The country code.
>
> * State or Province Name: The state or province.
>
> * Locality Name: The city or locality.
>
> * Common Name: The name of the CA.
>
> > [!NOTE]
> >
> > The Organization, Country, State or Province Name, Locality Name, and Common Name make up the **Distinguished Name (DN)** or **subject** of the CA.
> > At least one of these fields must be filled out.
>
> **2. Creating an intermediate CA**
>
> To create an intermediate CA, press **Create CA** again but this time specifying the **CA Type** to be **Intermediate**. Fill out the details for the intermediate CA.
>
> Next, press the **Install CA Certificate** option on the intermediate CA. You will be presented with the installation method selector. Choose how the signing certificate should be issued:
>
> > [tab] Infisical CA
> >
> > Select **Infisical CA** and press **Continue**. This option chains the intermediate CA to a root or intermediate CA managed by Infisical.
> >
> > Set the **Parent CA** to the root CA created in step 1 and configure:
> >
> > * **Parent CA**: The parent CA to chain to (the root CA from step 1).
> > * **Valid Until**: Must be within the validity period of the parent CA.
> > * **Path Length**: Must be less than the parent CA's path length.
> >
> > Press **Install** to chain the intermediate CA to the root CA. This creates a CSR, signs it with the root CA, and imports the certificate.
> >
> > You've successfully created a Private CA hierarchy. Now check out the [Applications section](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) to learn more about issuing certificates.
>
> > [tab] Manual
> >
> > Select **Manual** and press **Continue**. This option allows you to sign the intermediate CA certificate using an external root CA that you manage outside of Infisical.
> >
> > Choose a **Path Length** to generate the CSR. It sets the maximum number of intermediate CAs that can be chained below this CA, where `-1` means no limit. If the CA's current certificate has a path length limit, the CSR keeps that limit and it can't be changed.
> >
> > Use the provided CSR to generate a certificate from your external root CA. Paste the PEM-encoded certificate into **Certificate Body** and the root CA certificate into **Certificate Chain**.
> >
> > Press **Install** to import the certificate.
> >
> > You've successfully created a Private CA hierarchy with an intermediate CA chained to an external root CA. Now check out the [Applications section](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) to learn more about issuing certificates.
>
> > [tab] External CA
> >
> > Select **External CA (Automated)** and press **Continue**. This option connects to a third-party CA provider to handle certificate signing and renewal automatically via API.
> >
> > Infisical currently supports the following external CA providers for signing intermediate CAs:
> >
> > * [Venafi TLS Protect Cloud](https://infisical.com/docs/documentation/platform/pki/ca/venafi.md)
> >
> > * [Microsoft ADCS](https://infisical.com/docs/documentation/platform/pki/ca/adcs.md)
> >
> > > [!NOTE]
> > >
> > > When using an external CA, the certificate issued by the provider **must** correspond to the CSR generated by Infisical.
> > > If the external CA returns a certificate that does not match the CSR (e.g., different subject or key), the installation will fail.
> >
> > Refer to the provider-specific documentation linked above for detailed setup and installation instructions.

> [tab] API
>
> **1. Creating a root CA**
>
> If you wish to use an external root CA, you can skip this step and head to step 2 to create an intermediate CA.
>
> To create a root CA, make an API request to the [Create CA](https://infisical.com/docs/api-reference/endpoints/certificate-authorities/internal/create.md) API endpoint, specifying the `type` as `root`.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl --location --request POST 'https://app.infisical.com/api/v1/cert-manager/ca/internal' \
>   --header 'Authorization: Bearer <access-token>' \
>   --header 'Content-Type: application/json' \
>   --data-raw '{
>       "type": "root",
>       "commonName": "My Root CA"
>   }'
> ```
>
> ### Sample response
>
> ```bash Response theme={"dark"}
> {
>   ca: {
>     id: "<root-ca-id>",
>     type: "root",
>     commonName: "My Root CA",
>     ...
>   }
> }
> ```
>
> By default, Infisical creates a root CA with the `RSA_2048` key algorithm, validity period of 10 years, with no restrictions on path length;
> you may override these defaults by specifying your own options when making the API request.
>
> **2. Creating an intermediate CA**
>
> To create an intermediate CA, make an API request to the [Create CA](https://infisical.com/docs/api-reference/endpoints/certificate-authorities/internal/create.md) API endpoint, specifying the `type` as `intermediate`.
>
> ### Sample request
>
> ```bash Request theme={"dark"}
> curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal’ \
>   --header ‘Authorization: Bearer <access-token>’ \
>   --header ‘Content-Type: application/json’ \
>   --data-raw ‘{
>       "type": "intermediate",
>       "commonName": "My Intermediate CA"
>   }’
> ```
>
> ### Sample response
>
> ```json Response theme={"dark"}
> {
>   "ca": {
>     "id": "<intermediate-ca-id>",
>     "type": "intermediate",
>     "commonName": "My Intermediate CA"
>   }
> }
> ```
>
> Next, install a certificate for the intermediate CA using one of the following methods:
>
> > [tab] Infisical CA
> >
> > Get a CSR from the intermediate CA, sign it with the root CA, and import the certificate back.
> >
> > **Get the CSR:**
> >
> > ```bash Request theme={"dark"}
> > curl --location --request GET ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/csr’ \
> >   --header ‘Authorization: Bearer <access-token>’
> > ```
> >
> > **Sign the intermediate certificate using the root CA:**
> >
> > ```bash Request theme={"dark"}
> > curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<root-ca-id>/sign-intermediate’ \
> >   --header ‘Authorization: Bearer <access-token>’ \
> >   --header ‘Content-Type: application/json’ \
> >   --data-raw ‘{
> >       "csr": "<csr>",
> >       "notAfter": "2029-06-12"
> >   }’
> > ```
> >
> > > [!NOTE]
> > >
> > > The `notAfter` value must be within the validity period of the root CA.
> >
> > **Import the signed certificate back to the intermediate CA:**
> >
> > ```bash Request theme={"dark"}
> > curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/import-certificate’ \
> >   --header ‘Authorization: Bearer <access-token>’ \
> >   --header ‘Content-Type: application/json’ \
> >   --data-raw ‘{
> >       "certificate": "<certificate>",
> >       "certificateChain": "<certificate-chain>"
> >   }’
> > ```
> >
> > You’ve successfully created a Private CA hierarchy. Now check out the [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) page to learn more about issuing certificates.
>
> > [tab] Manual
> >
> > Get the CSR from the intermediate CA and use it to generate a certificate from your external root CA.
> >
> > **Get the CSR:**
> >
> > ```bash Request theme={"dark"}
> > curl --location --request GET ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/csr?maxPathLength=0’ \
> >   --header ‘Authorization: Bearer <access-token>’
> > ```
> >
> > The optional `maxPathLength` query parameter sets the path length requested in the CSR, where `-1` means no limit. If the CA's current certificate has a path length limit, the CSR always uses it and a different value is rejected.
> >
> > Use this CSR with your external root CA to generate a signed certificate. Then import the certificate and chain back:
> >
> > ```bash Request theme={"dark"}
> > curl --location --request POST ‘https://app.infisical.com/api/v1/cert-manager/ca/internal/<intermediate-ca-id>/import-certificate’ \
> >   --header ‘Authorization: Bearer <access-token>’ \
> >   --header ‘Content-Type: application/json’ \
> >   --data-raw ‘{
> >       "certificate": "<certificate-from-external-ca>",
> >       "certificateChain": "<external-root-ca-certificate>"
> >   }’
> > ```
> >
> > You’ve successfully chained an intermediate CA to an external root CA. Now check out the [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md) page to learn more about issuing certificates.
>
> > [tab] External CA
> >
> > You can use an external CA provider to automatically sign the intermediate CA certificate via API. See the provider-specific documentation for the full API workflow:
> >
> > * [Venafi TLS Protect Cloud](https://infisical.com/docs/documentation/platform/pki/ca/venafi.md)
> >
> > * [Microsoft ADCS](https://infisical.com/docs/documentation/platform/pki/ca/adcs.md)
> >
> > > [!NOTE]
> > >
> > > When using an external CA, the certificate issued by the provider **must** correspond to the CSR generated by Infisical.
> > > If the external CA returns a certificate that does not match the CSR, the installation will fail.

## HSM-backed internal CAs

By default, Infisical generates and manages the signing key for an Internal CA. You can instead keep the CA's signing key inside your own Hardware Security Module. When **Key Source** is set to **HSM**, Infisical generates the keypair on the HSM through an [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors) and performs every signing operation the CA does on the HSM. That covers the self-signed root certificate, intermediate CSRs, the certificates the CA issues, and its CRLs.

Both root and intermediate CAs can be HSM-backed. HSM-backed CAs support the `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384`, `ML-DSA-44`, `ML-DSA-65`, and `ML-DSA-87` key algorithms.

To use an ML-DSA key on an HSM, you need:

* An HSM whose PKCS#11 driver supports ML-DSA, such as Fortanix DSM with PKCS#11 client 5.7 or later
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) updated to the latest version

> [!NOTE]
>
> Set up an [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors) before creating an HSM-backed CA. Creating one requires the **Attach** permission on HSM Connectors in addition to permission to create Certificate Authorities.

To create an HSM-backed CA over the API, set `keySource` to `hsm` and supply the `hsmConnectorId` in the request.

```bash Request theme={"dark"}
curl --location --request POST 'https://app.infisical.com/api/v1/cert-manager/ca/internal' \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data-raw '{
      "type": "root",
      "commonName": "My HSM Root CA",
      "keyAlgorithm": "ECDSA_P384",
      "keySource": "hsm",
      "hsmConnectorId": "<hsm-connector-id>"
  }'
```

## AWS KMS-backed internal CAs

If your CA's private key must stay in AWS and you don't run your own HSM, set **Key Source** to **AWS KMS**. The CA's signing key is then created in AWS KMS through an [AWS connection](https://infisical.com/docs/integrations/app-connections/aws.md), and the private key never leaves AWS KMS. AWS KMS signs everything the CA produces: the self-signed root certificate, intermediate CSRs, the certificates the CA issues, its CRLs, and its OCSP responses.

Both root and intermediate CAs can be AWS KMS-backed. They support the `RSA 2048`, `RSA 3072`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384`, `ECDSA P-521`, `ML-DSA-44`, `ML-DSA-65`, and `ML-DSA-87` key algorithms.

### Prerequisites

* An [AWS connection](https://infisical.com/docs/integrations/app-connections/aws.md) available to Infisical Certificate Management
* An IAM policy on the connection's IAM role or user that lets the connection create KMS keys and sign with them:

```json theme={"dark"}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["kms:CreateKey", "kms:TagResource", "kms:CreateAlias"],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": ["kms:GetPublicKey", "kms:Sign", "kms:ScheduleKeyDeletion"],
      "Resource": "*",
      "Condition": {
        "StringEquals": { "aws:ResourceTag/purpose": "certificate-authority" }
      }
    }
  ]
}
```

Each CA signing key is created with the `author=infisical` and `purpose=certificate-authority` tags, so the second statement only allows signing with and deleting keys created for CAs. Each key also gets an alias named after the CA, such as `alias/infisical-ca-kms-root-ca-x7k2p`, so you can find it in the AWS KMS console.

### Create the CA

In the **Create Internal CA** wizard, set **Key Source** to **AWS KMS**, then choose the **AWS Connection**, the **Region**, and the **Key Algorithm**. The CA's details page shows the key's ARN once the CA is created.

To create the CA over the API instead, call [the endpoint to create an internal CA](https://infisical.com/docs/api-reference/endpoints/certificate-authorities/internal/create.md) with `keySource` set to `aws-kms`, and include the `appConnectionId` and `region`:

```bash Request theme={"dark"}
curl --location --request POST 'https://app.infisical.com/api/v1/cert-manager/ca/internal' \
  --header 'Authorization: Bearer <access-token>' \
  --header 'Content-Type: application/json' \
  --data-raw '{
      "name": "kms-root-ca",
      "status": "active",
      "configuration": {
        "type": "root",
        "commonName": "My AWS KMS Root CA",
        "keyAlgorithm": "EC_secp384r1",
        "keySource": "aws-kms",
        "appConnectionId": "<aws-connection-id>",
        "region": "us-east-1",
        "notAfter": "2036-01-01"
      }
  }'
```

The response returns the key's ARN in `configuration.externalKeyId`.

### Deleting an AWS KMS-backed CA

Deleting the CA schedules its key for deletion in AWS KMS with a 30-day waiting period. If you still need the key, [cancel the deletion](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html) in AWS KMS within those 30 days, then enable the key again, because AWS KMS leaves a key disabled when you cancel its deletion.

## FAQ

> [accordion] What key algorithms are supported?
>
> Infisical supports `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384` key algorithms specified at the time of creating a CA.

> [accordion] Does Infisical support chaining an Intermediate CA to an external CA?
>
> Yes. You can either manually obtain a CSR and import the signed certificate, or use an integrated external CA provider like [Venafi TLS Protect Cloud](https://infisical.com/docs/documentation/platform/pki/ca/venafi.md) or [Microsoft ADCS](https://infisical.com/docs/documentation/platform/pki/ca/adcs.md) to automate the signing process.

> [accordion] Can the CA signing key be kept in my own HSM?
>
> Yes. Set **Key Source** to **HSM** when creating the CA and pick an [HSM Connector](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors). The keypair is generated on your HSM and every signing operation the CA performs runs there. Both root and intermediate CAs support this. Supported algorithms are `RSA 2048`, `RSA 4096`, `ECDSA P-256`, `ECDSA P-384`, `ML-DSA-44`, `ML-DSA-65`, and `ML-DSA-87`. See [HSM-backed Internal CAs](#hsm-backed-internal-cas).

> [accordion] Can the CA signing key be kept in AWS KMS?
>
> Yes, including post-quantum ML-DSA keys. Set **Key Source** to **AWS KMS** and [create the CA through an AWS connection](#aws-kms-backed-internal-cas).

## What's next?

> [card] [CA renewal](https://infisical.com/docs/documentation/platform/pki/ca/ca-renewal.md)
>
> Renew your CA certificates before they expire.

> [card] [CRL distribution](https://infisical.com/docs/documentation/platform/pki/ca/crl-distribution.md)
>
> Configure CRL mirrors for high availability.

> [card] [OCSP](https://infisical.com/docs/documentation/platform/pki/ca/ocsp.md)
>
> Answer certificate revocation checks in real time.

> [card] [Post-quantum algorithms](https://infisical.com/docs/documentation/platform/pki/reference/pqc-algorithms.md)
>
> Issue certificates with post-quantum signature algorithms.

> [card] [Certificate Profiles](https://infisical.com/docs/documentation/platform/pki/settings/profiles.md)
>
> Link your CA to a policy and create reusable profiles.

> [card] [Applications](https://infisical.com/docs/documentation/platform/pki/applications/overview.md)
>
> Set up Applications to issue certificates.

> [card] [HSM Connectors](https://infisical.com/docs/documentation/platform/pki/settings/hsm-connectors)
>
> Keep the CA signing key inside your own Hardware Security Module.

> [card] [Cross-signing](https://infisical.com/docs/documentation/platform/pki/ca/cross-signed-certificates.md)
>
> Move issuance from your old CA to Infisical before every client trusts your Infisical root.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.