Certificate authorities

A Certificate Authority (CA) signs and issues X.509 certificates. Before teams can issue certificates through applications, an admin needs to set up at least one CA, either in Infisical or by connecting one you already use.

Internal CA

Create root and intermediate CAs in Infisical for internal services, mTLS, and private networks.

External CA

Issue from a public CA such as Let’s Encrypt or DigiCert, or from enterprise PKI such as AWS Private CA, Microsoft ADCS, or Venafi.

HSM connectors

Keep internal CA and signer keys in your own HSM.

Which should I use?

Use case	Recommended CA
Internal services, mTLS between microservices	Internal CA
Public-facing websites needing browser trust	External CA (Let’s Encrypt, DigiCert)
Enterprise with existing PKI infrastructure	External CA (AWS Private CA, Microsoft ADCS, Venafi)
IoT devices, internal device fleet	Internal CA
Regulated environments with specific CA requirements	External CA (your approved provider)

Internal CA hierarchy

When you use internal CAs, you typically create a hierarchy:

Root CA (offline, long-lived)
└── Intermediate CA (online, issues certificates)
    └── Leaf Certificates (TLS, mTLS, devices)

Keep your root CA offline or use it as little as possible. Create one or more intermediate CAs to issue day-to-day certificates, so a compromised intermediate CA doesn’t expose the root.

Next steps

Set up an internal CA or connect an external CA.

Create a certificate policy to set the domains, validity periods, and key algorithms that certificates can use.

Create a certificate profile that pairs your CA with the policy, so applications can issue from it.

Get started