MCPInstall

infisical-pki

by infisicalDevOps & Cloud

Guide for Infisical Certificate Management (PKI) — issuing, renewing, revoking, and distributing X.509 certificates. Covers all 9 certificate authority types (internal root/intermediate CA, ACME including Let's Encrypt, AWS Private CA, AWS ACM Public CA, Microsoft ADCS, Azure ADCS, DigiCert, Venafi TPP, GoDaddy), Applications and Certificate Profiles, all 4 enrollment methods (API, ACME, EST, SCEP), all 12 PKI Syncs for pushing certs to AWS ACM / Azure Key Vault / Cloudflare / load balancers, certificate lifecycle and alerting, code signing with PKCS11 and Windows KSP, certificate discovery, HSM connectors, CRL distribution, and post-quantum ML-DSA and SLH-DSA key algorithms. Use this skill when someone asks about: Infisical PKI, certificate authority, issuing a TLS certificate, mTLS certificates, ACME or Let's Encrypt with Infisical, EST or SCEP enrollment, certificate renewal, revocation, CRL, code signing certificates, or 'how do I manage certificates with Infisical'. For X.509/TLS

Installs
142
Last 24h
—
Trending rank
—
Security
Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/infisical/ai-skills --skill infisical-pki
  1. 01

    Install

    Run the command in your project. The CLI asks which agents to install for.

  2. 02

    Describe the task

    Ask your agent for something this skill covers. It loads infisical-pki automatically when relevant.

  3. 03

    Review the result

    The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Infisical Certificate Management (PKI) Guide

You are a setup assistant helping users run X.509 certificate infrastructure on Infisical — standing up certificate authorities, issuing and renewing certificates, and distributing them to the systems that terminate TLS.

Certificate Management is a separate Infisical product from Secrets Management. It uses its own project type (cert-manager) and its own object model.

Not this skill

If the user wants...Use
To store an existing cert/key as a secret valueinfisical-secret-syncs or infisical-api — that is just a secret
SSH access certificatesinfisical-dynamic-secrets — SSH dynamic secrets, a different subsystem
To encrypt data or sign arbitrary payloads with a managed keyinfisical-kms
To create the App Connection an external CA or PKI Sync needsinfisical-app-connections
To reach an internal ADCS/Venafi serverinfisical-gateway
mTLS into Infisical for a machine identityinfisical-setup — TLS Cert Auth, unrelated to this product

The frequent mix-up is SSH. Infisical issues SSH certificates through SSH dynamic secrets, not through the PKI product. If the user says "SSH certificate," route to infisical-dynamic-secrets.

The object model

Getting this hierarchy right is most of the work:

Certificate Authority        who signs (internal or external)
        +
Certificate Policy           what rules a cert must satisfy
        |
        v
Certificate Profile          a reusable template = CA + Policy + defaults
        |
        v
Application                  a service/workload; consumes profiles,
                             owns enrollment methods, inventory,
                             alerting, approvals, and cert syncs
        |
        v
Certificate                  the issued leaf
  • CA — signs certificates. Internal (Infisical holds the key) or external (a third party signs).
  • Certificate Policy — constraints: allowed key algorithms, key usages, TTL bounds, subject rules.
  • Certificate Profile — a CA plus a Policy plus defaults. Admins define these once; teams consume them. This is the "shape" of a certificate.
  • Application — represents one service or fleet. Teams operate here: request certs, configure enrollment, set alerts, require approvals, sync certs out.
  • Certificate — the issued leaf, with status active, expired, or revoked.

When a user asks "how do I issue a certificate," the answer almost always routes through an Application backed by a Profile — not directly against a CA.

How to use this skill

  1. Establish the trust source — internal CA, or an external one they already have
  2. Create the CA (root, then intermediate, for internal)
  3. Define a Policy and a Profile to encode guardrails
  4. Create an Application for the consuming service
  5. Pick an enrollment method — API, ACME, EST, or SCEP, driven by what the client supports
  6. Set up renewal and alerting so nothing expires silently
  7. Add a PKI Sync if the certificate has to land somewhere specific

Reference files

FileWhen to read
references/certificate-authorities.mdAll 9 CA types, internal root/intermediate hierarchy, CA renewal, CRL distribution, HSM
references/issuance-and-enrollment.mdApplications, Policies, Profiles, the 4 enrollment methods, key algorithms including PQC, key usages, lifecycle
references/pki-syncs-and-distribution.mdAll 12 PKI Syncs, alerting, certificate discovery
references/code-signing.mdCode signing certificates, signers, PKCS#11 module, Windows KSP

Guiding principles

  • Never invent enum values. EC_prime256v1 is the wire value for ECDSA P-256, not ECDSA_P256. Key usages are camelCase (digitalSignature), extended key usages have both a snake_case form (server_auth) and a legacy camelCase form (serverAuth). Read the reference.
  • Internal CAs need a root before an intermediate. A root CA signs itself; an intermediate is signed by a parent. A CA sitting in pending-certificate status has no certificate yet and cannot issue.
  • Match the enrollment method to the client, not to preference. ACME for web servers and cert-manager, EST for network gear and IoT, SCEP for legacy MDM and Windows, API for anything you control.
  • External CAs need an App Connection. ADCS, Azure ADCS, Venafi TPP, DigiCert, AWS PCA and friends all authenticate through one, and the internal ones usually need a Gateway too.
  • Push renewal automation early. The failure mode in PKI is always an expiry nobody noticed. Configure renewal plus alerting in the same conversation as issuance.
  • Private keys stay where they are generated. With ACME/EST/SCEP the client generates the key and Infisical only sees the CSR. Do not tell users Infisical will hand them a private key for those flows.
  • Post-quantum is available today. ML-DSA and SLH-DSA are selectable key algorithms on internal CAs. Offer them for long-lived roots.
  • Never print private key material in examples beyond an obvious placeholder.

FAQ

What does the infisical-pki skill do?

Guide for Infisical Certificate Management (PKI) — issuing, renewing, revoking, and distributing X.509 certificates. Covers all 9 certificate authority types (internal root/intermediate CA, ACME including Let's Encrypt, AWS Private CA, AWS ACM Public CA, Microsoft ADCS, Azure ADCS, DigiCert, Venafi TPP, GoDaddy), Applications and Certificate Profiles, all 4 enrollment methods (API, ACME, EST, SCEP), all 12 PKI Syncs for pushing certs to AWS ACM / Azure Key Vault / Cloudflare / load balancers, certificate lifecycle and alerting, code signing with PKCS11 and Windows KSP, certificate discovery, HSM connectors, CRL distribution, and post-quantum ML-DSA and SLH-DSA key algorithms. Use this skill when someone asks about: Infisical PKI, certificate authority, issuing a TLS certificate, mTLS certificates, ACME or Let's Encrypt with Infisical, EST or SCEP enrollment, certificate renewal, revocation, CRL, code signing certificates, or 'how do I manage certificates with Infisical'. For X.509/TLS

How do I install infisical-pki?

Run npx skills add https://github.com/infisical/ai-skills --skill infisical-pki in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/infisical-pki/ (personal) or .claude/skills/infisical-pki/ (project).

Which AI agents can use infisical-pki?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is infisical-pki safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains infisical-pki?

It is published by infisical in infisical/ai-skills. It has 142 recorded installs.

More from infisical/ai-skills

View all →

infisical-api

infisical/ai-skills

Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).

Backend & APIs985 installs

infisical-secret-syncs

infisical/ai-skills

Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).

DevOps & Cloud909 installs

infisical-user-setup-guide

infisical/ai-skills

Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets ou

DevOps & Cloud881 installs

infisical-agent

infisical/ai-skills

Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor infisical run (infisical-setup).

DevOps & Cloud826 installs

infisical-dynamic-secrets

infisical/ai-skills

Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.

Data & Databases734 installs

infisical-self-host

infisical/ai-skills

Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTIONKEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).

DevOps & Cloud715 installs

Popular devops & cloud skills

View category →

microsoft-foundry

microsoft/azure-skills

Build, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and resources end to end. USE FOR: foundry, azd ai agent, azd provision/deploy, hosted agent scaffold/develop/run/deploy/troubleshoot, prompt agent create, managed harness agent create, GitHub Copilot harness agent, create agent, update agent, add tool to agent, invoke agent, agent insights, evaluate agent, batch eval, continuous eval, continuous monitoring, agent CI/CD, optimize prompt, improve prompt, optimize agent instructions, Agent Optimizer scaffold, dataset curation from traces, deploy model, model fine-tuning (SFT/DPO/RFT), Foundry project, RBAC, role assignment, permissions, quota, capacity, region, deployment failure, AI Services, create Foundry resource, knowledge index, customize deployment, onboard, availability, training-data, grader, distillation, large file upload. DO NOT USE FOR: Azure Functions, App Service, general Azure deploy (use azure-deploy), general Azure prep (use azure

OfficialDevOps & Cloud579.1K installs

azure-diagnostics

microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe triage. WHEN: debug production issues, troubleshoot app service, app service high CPU, app service deployment failure, troubleshoot container apps, container app 503 or target port mismatch, troubleshoot functions, function telemetry missing or stopped after a config/connection-string change, troubleshoot AKS, VM RDP, Linux SSH, VM black screen, can't connect to VM, reset VM password, NSG or firewall blocking, kubectl cannot connect, kube-system/CoreDNS failures, pod pending, crashloop, node not ready, upgrade failures, analyze logs, KQL, insights, image pull failures, cold start issues, health probe failures, resource health, root cause of errors, troubleshoot event hubs, troubleshoot service bus, messaging SDK error, AMQP connection failure, message lock lost, lock renewal during long-running processing, service bus dead letter.

OfficialDevOps & Cloud569.8K installs

azure-prepare

microsoft/azure-skills

Prepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wants to use azd as the deployment tool, or the project already has an azure.yaml file. DO NOT USE FOR: non-azd deployments, Python App Service code-only deploys (use python-appservice-deploy), or cross-cloud migration (use azure-cloud-migrate). WHEN: prepare app for azd, create azure.yaml, set up azd infrastructure, modernize app for Azure with azd, deploy with azd, function app, timer trigger, service bus trigger, event-driven function, managed identity, generate Bicep, generate Terraform, create and deploy to Azure.

OfficialDevOps & Cloud569K installs

azure-ai

microsoft/azure-skills

Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.

OfficialDevOps & Cloud568.8K installs

azure-deploy

microsoft/azure-skills

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

OfficialDevOps & Cloud568.6K installs

azure-validate

microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check deployment readiness, run preflight checks, verify configuration, check if ready to deploy, validate azure.yaml, validate Bicep, test before deploying, troubleshoot deployment errors, validate Azure Functions, validate function app, validate serverless deployment, verify RBAC roles, check role assignments, review managed identity permissions, what-if analysis, validate Container Apps deployment.

OfficialDevOps & Cloud568K installs