Skip to main content
The Infisical Gateway enables secure access to private resources using SSH reverse tunnels, certificate-based authentication, and a comprehensive PKI (Public Key Infrastructure) system. The architecture provides end-to-end encryption and complete tenant isolation through multiple certificate authorities.

​
Security model overview

​
Certificate architecture

The gateway system uses multiple certificate authorities depending on the connection mode and, in relay mode, on who runs the relay. Every configuration uses the Organization Gateway CA for platform to gateway authentication. The relay CAs exist only to authenticate the relay hop, so direct listen needs none of them. For Organizations Using Direct Listen:
  • Organization Gateway Client CA & Server CA - Platform ↔ Gateway authentication, with the gateway’s server certificate issued for its registered listen address
For Organizations Using Infisical-Managed Relays:
  • Instance relay SSH Client CA & Server CA - Gateway ↔ Infisical Relay Server authentication
  • Instance relay PKI Client CA & Server CA - Platform ↔ Infisical Relay Server authentication
  • Organization Gateway Client CA & Server CA - Platform ↔ Gateway authentication
For Organizations Using Customer-Deployed Relays:
  • Organization relay SSH Client CA & Server CA - Gateway ↔ Customer Relay Server authentication
  • Organization relay PKI Client CA & Server CA - Platform ↔ Customer Relay Server authentication
  • Organization Gateway Client CA & Server CA - Platform ↔ Gateway authentication

​
Communication security

​
1. Gateway registration

When a gateway is first deployed, it authenticates with Infisical using its machine identity token and receives the certificates for its connection mode. Relay mode:
  1. Receives SSH certificates for relay server authentication
  2. Establishes SSH reverse tunnel to assigned relay server
  3. Certificate issuance varies by relay configuration:
    • Infisical-managed relay: Receives Instance relay SSH client certificate + Instance relay SSH Server CA
    • Customer-deployed relay: Receives Organization relay SSH client certificate + Organization relay SSH Server CA
Direct listen mode:
  1. Registers the listen address the platform will dial
  2. Receives a server certificate carrying that address in its subject alternative name, issued by the Organization Gateway CA
  3. Listens on that address for inbound mTLS connections from the platform
Both modes receive the Organization Gateway certificates used for mutual TLS with the platform. The relay, where one is used, only routes bytes.

​
2. SSH tunnel authentication (relay mode)

Gateway ↔ Relay Server communication uses SSH certificate authentication:
  • Gateway Authentication:
    • Presents SSH client certificate (Instance or Organization relay SSH Client CA)
    • Certificate contains gateway identification and permissions
    • Relay server validates certificate against appropriate SSH Client CA
  • Relay Server Authentication:
    • Presents SSH server certificate (Instance or Organization relay SSH Server CA)
    • Gateway validates certificate against appropriate SSH Server CA
    • Ensures gateway connects to legitimate relay infrastructure

​
3. Platform-to-Gateway mTLS

Whichever mode carries it, the platform and the gateway authenticate each other with Organization Gateway certificates, and certificate pinning binds the connection to that specific gateway identity. The two modes differ only in who opens the socket underneath. Relay mode:
  • Gateway maintains a persistent outbound SSH tunnel to the relay server
  • Platform connects to the relay server using TCP with TLS
  • Relay routes encrypted traffic between platform and gateway without decrypting it
  • The TLS handshake happens end to end, between platform and gateway, through the relay
  • The gateway accepts no inbound connections
Direct listen mode:
  • Platform connects to the gateway’s registered listen address
  • The gateway presents the server certificate issued for that address, and the platform validates it
  • The platform presents an Organization Gateway client certificate, which the gateway validates against the Organization Gateway Client CA
  • The gateway accepts inbound connections on that address, so the port must be open to the Infisical host
Security properties of both:
  • Certificate-based authentication: Organization Gateway certificates on both ends
  • Tenant isolation: Each organization’s traffic flows through separate authenticated channels
  • No credential exposure to the relay: in relay mode, the relay can decrypt neither the TLS session nor the application data

​
Tenant isolation

​
Multi-layer certificate isolation

The architecture provides tenant isolation through multiple certificate authority layers:
  • Instance-level CAs: Shared relay infrastructure uses instance-level certificates
  • Organization-level CAs: Each organization has unique certificate authorities
  • Relay deployment flexibility: Organizations can choose shared or dedicated relay infrastructure
  • Cryptographic separation: Cross-tenant communication is cryptographically impossible

​
Authentication flows by deployment type

Infisical-Managed Relay Deployments:
  • Gateway authenticates with relay using Instance relay SSH certificates
  • Platform authenticates with relay using Instance relay PKI certificates
  • Platform authenticates with gateway using Organization Gateway certificates
Customer-Deployed Relay Deployments:
  • Gateway authenticates with relay using Organization relay SSH certificates
  • Platform authenticates with relay using Organization relay PKI certificates
  • Platform authenticates with gateway using Organization Gateway certificates
Direct Listen Deployments:
  • No relay is involved, so no relay certificates are issued
  • Gateway authenticates with the platform using the server certificate issued for its listen address
  • Platform authenticates with gateway using Organization Gateway certificates

​
Resource access control

  1. Certificate Validation:
    • All connections require valid certificates from appropriate CAs
    • Embedded certificate details control access permissions
    • Ephemeral certificate validation ensures time-bound access
  2. Network Isolation:
    • Each organization’s traffic flows through isolated certificate-authenticated channels
    • Relay servers route traffic based on certificate validation without content access
    • Gateway validates all incoming connections against Organization Gateway Client CA