Microsoft ADCS Connection

Connect Infisical to Microsoft Active Directory Certificate Services (AD CS) through an Infisical Gateway. The Gateway runs inside your network and communicates with the CA directly, so your AD CS server never needs to be exposed to the internet.

Prerequisites

• A Microsoft Active Directory Certificate Services (AD CS) server (Enterprise CA)
• An Infisical Gateway deployed inside the network that can reach the AD CS server
• A domain account with Enroll permission on the certificate templates you plan to use (and Manage CA / Certificate Manager rights if you want to revoke certificates)
• Network reachability from the Gateway to the AD CS server on:
  • TCP 135 (RPC endpoint mapper) and the server's dynamic RPC port range (default 49152-65535) for MS-WCCE/MS-CSRA over DCOM
  • TCP 445 (SMB) only if you rely on automatic CA-name discovery (reads the CA name over the Remote Registry service)

Connection Setup

<Steps> <Step title="Navigate to App Connections"> Navigate to the **App Connections** tab on the **Organization Settings** page.  </Step> <Step title="Add Connection"> Select the **Microsoft ADCS Connection** option from the connection options modal. </Step> <Step title="Configure Connection Details"> - **Name**: Friendly name for this connection (for example, `production-adcs`) - **CA Host**: The AD CS server hostname or IP reachable from the Gateway (for example, `ca01.corp.example.com`) - **Username**: Domain account in the form `DOMAIN\username` or `[email protected]` - **Password**: Password for the domain account - **Gateway**: The Gateway that can reach the AD CS server </Step> <Step title="Connection Created"> Your **Microsoft ADCS Connection** is now available for use. </Step> </Steps>