mirror of
https://github.com/hanzoai/kms.git
synced 2026-10-17 11:18:16 +00:00
zeekay
17ed51f8aa
- Merge upstream/main with -X ours strategy to preserve Hanzo customizations - Strip all backend/src/ee/ files reintroduced by upstream (PAM, discovery, sub-org, permissions, etc.) - Create minimal group-dal stub for new upstream service dependency - Preserve MIT-licensed permission, audit-log, rate-limit, license stubs - Keep Hanzo branding, per-org encryption keys, Insights telemetry - Remove backend/package-lock.json (we use npm/pnpm)
52 lines
2.5 KiB
Plaintext
52 lines
2.5 KiB
Plaintext
---
|
||
title: "External CA"
|
||
sidebarTitle: "External CA"
|
||
description: "Learn how to connect External Certificate Authorities with KMS."
|
||
---
|
||
|
||
## Concept
|
||
|
||
KMS lets you integrate with External Certificate Authorities (CAs), allowing you to use existing PKI infrastructure or connect to public CAs to issue certificates for your end-entities.
|
||
|
||
<div align="center">
|
||
|
||
```mermaid
|
||
graph TD
|
||
A1[External Public CA<br>e.g. Let's Encrypt, ZeroSSL, ...] --> KMS
|
||
A2[External Private CA<br>e.g. AWS Private CA, HashiCorp Vault PKI, ...] --> KMS
|
||
```
|
||
|
||
</div>
|
||
|
||
As shown above, these CAs commonly fall under two categories:
|
||
|
||
- External Private CAs: CAs like AWS Private CA, HashiCorp Vault PKI, Azure ADCS, etc. that are privately owned and are used to issue certificates for internal services; these are often either cloud-hosted private CAs or on-prem / enterprise CAs.
|
||
- External Public CAs: CAs like Let's Encrypt, DigiCert, GlobalSign, etc. that are publicly trusted and are used to issue certificates for public-facing services.
|
||
|
||
Note that KMS can act as an _ACME client_, allowing you to integrate upstream with any [ACME-compatible CA](/documentation/platform/pki/ca/acme-ca) to automate certificate issuance and renewal.
|
||
|
||
## Workflow
|
||
|
||
A typical workflow for integrating an External CA with KMS consists of choosing the desired External CA type
|
||
and specifying the configuration or connection details necessary to connect to the CA.
|
||
|
||
The specific steps and requirements vary depending on the External CA type you choose to integrate.
|
||
|
||
## Supported External CA Types
|
||
|
||
KMS currently supports the following External CA types out of the box:
|
||
|
||
- [ACME CA](/documentation/platform/pki/ca/acme-ca): An ACME-compatible CA that supports the ACME protocol, such as Let's Encrypt, ZeroSSL, Buypass, DigiCert, Sectigo, etc.
|
||
- [Azure ADCS](/documentation/platform/pki/ca/azure-adcs): A Microsoft Active Directory Certificate Services (ADCS) that supports the ADCS protocol.
|
||
- [AWS Private CA](/documentation/platform/pki/ca/aws-pca): An AWS Private Certificate Authority (PCA) for cloud-native private certificate management.
|
||
|
||
If you don’t see a specific external CA listed here or need a dedicated integration guide, please reach out to [email protected] and we’ll help you set up the integration for your external CA.
|
||
|
||
## FAQ
|
||
|
||
<AccordionGroup>
|
||
<Accordion title="Can I use both Private CAs and External CAs in the same project?">
|
||
Yes. You can have both Private and External CAs in the same project.
|
||
</Accordion>
|
||
</AccordionGroup>
|