Skip to main content
Connect Infisical to Microsoft Active Directory Certificate Services (AD CS) through an Infisical Gateway. The Gateway runs inside your network and communicates with the CA directly, so your AD CS server never needs to be exposed to the internet.

​
Prerequisites

  • A Microsoft Active Directory Certificate Services (AD CS) server (Enterprise CA)
  • An Infisical Gateway deployed inside the network that can reach the AD CS server
  • A domain account with Enroll permission on the certificate templates you plan to use (and Manage CA / Certificate Manager rights if you want to revoke certificates)
  • Network reachability from the Gateway to the AD CS server on:
    • TCP 135 (RPC endpoint mapper) and the server’s dynamic RPC port range (default 49152-65535) for MS-WCCE/MS-CSRA over DCOM
    • TCP 445 (SMB) only if you rely on automatic CA-name discovery (reads the CA name over the Remote Registry service)

​
Connection Setup

1

Navigate to App Connections

Navigate to the App Connections tab on the Organization Settings page.App Connections Tab
2

Add Connection

Select the Microsoft ADCS Connection option from the connection options modal.
3

Configure Connection Details

  • Name: Friendly name for this connection (for example, production-adcs)
  • CA Host: The AD CS server hostname or IP reachable from the Gateway (for example, ca01.corp.example.com)
  • Username: Domain account in the form DOMAIN\username or username@domain.com
  • Password: Password for the domain account
  • Gateway: The Gateway that can reach the AD CS server
A Gateway is required. The control plane cannot reach AD CS over DCOM directly, so every operation is relayed through the Gateway.
4

Connection Created

Your Microsoft ADCS Connection is now available for use.