Hello team, It looks like I’m no longer able to create an Azure ADCS (Web Enrollment) integration without providing a gateway. It definitely wasn’t the case before, as I have a working Azure ADCS integration without a gateway configured. My Infisical server is on the same network as the ADCS, so I definitely don’t need a gateway. Is this a bug?

hey @Christophe Jauffret! we're checking this out

thanks

this is still in the review and testing phase @Christophe Jauffret. likely end of today or first thing next week!

No urgency. Just curious to know if this is a regression or if I need to start deploying the gateway locally as well?

Yeah this was intentional @Christophe Jauffret since we built out a more native ADCS integration here. All existing external CAs would continue to work but we've disabled the creation of new ones. Given that the native integration requires a gateway at the moment, we recognize that this might indeed be unnecessary friction for self-hosted users. Thus, we're bringing it back

ok perfect

this should be addressed now in the latest release @Christophe Jauffret

congrats, thanks @Sheen Santos Capadngan

oh, use the Azure ADCS app connection @Christophe Jauffret infisical.com/docs/…/azure-adcs https://infisical.com/docs/integrations/app-connections/azure-adcs

@Sheen Santos Capadngan the Azure ADCS was thhe right solution thanks but now we have a second issue, we want to use the sync certificate to push cert to winrm target , but now again he is asking for gateway 😞 in our case host are on the same subnet it need to be optionnal

I agree with @Christophe Jauffret, on having the gateway be an optional setting for certificate sync to facilitate on-prem deployments.

hey @Christophe Jauffret @Tobias Nilsson! we'll explore this further and we'll let you know once there are updates

hello @Sheen Santos Capadngan some improvement , same issue today looks like now sync task is OK without gateway but post sync command are blocked again without gateway, lloks like a bug

Hi @Christophe Jauffret, which release of infisical are you running?

just test again right now v0.162.22

Same here. Thanks for sharing.

hey @Christophe Jauffret @Tobias Nilsson! For now, would it be possible for you to setup the gateway? we're working on some improvements in this aspect by specifically removing the relay requirement so all you have to deploy would be the gateway component

Hello @Sheen Santos Capadngan, hope you are fine ? not sure to make the difference between relay and gateway when we have a private infisical instance, who can talk directly to something, I find it a bit unfortunate to have to install an additional component. Or maybe I misunderstood your question?

Hey @Christophe Jauffret! Apologies for the late response here. As of now, you can only really use post-sync commands via the gateway. This technical limitation is intentional so that actual shell commands are ran in a separate instance to protect your main Infisical instance from noisy workloads and potential security issues. With the latest updates though, you no longer have to run a relay. All you need is to deploy a gateway with direct listen mode configured. Docs here: infisical.com/docs/…/overview#…

Ok, thanks, let me look the doc.