feat: added reading SANs from CSR

backend/src/server/routes/est/certificate-est-router.ts

@@ -149,9 +149,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
       const { rawCertificate } = await server.services.certificateAuthority.signCertFromCa({
         isInternal: true,
         certificateTemplateId: req.params.certificateTemplateId,
-        csr: req.body,
-        altNames: "",
-        ttl: "1h"
+        csr: req.body
       });
 
       void res.header("Content-Type", "application/pkcs7-mime; smime-type=certs-only");

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -1366,6 +1366,8 @@ export const certificateAuthorityServiceFactory = ({
       notAfterDate = new Date(notAfter);
     } else if (ttl) {
       notAfterDate = new Date(new Date().getTime() + ms(ttl));
+    } else if (certificateTemplate?.ttl) {
+      notAfterDate = new Date(new Date().getTime() + ms(certificateTemplate.ttl));
     }
 
     const caCertNotBeforeDate = new Date(caCertObj.notBefore);
@@ -1410,6 +1412,7 @@ export const certificateAuthorityServiceFactory = ({
       await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
     ];
 
+    let altNamesFromCsr: string = "";
     let altNamesArray: {
       type: "email" | "dns";
       value: string;
@@ -1438,7 +1441,24 @@ export const certificateAuthorityServiceFactory = ({
           // If altName is neither a valid email nor a valid hostname, throw an error or handle it accordingly
           throw new Error(`Invalid altName: ${altName}`);
         });
+    } else {
+      // attempt to read from CSR if altNames is not explicitly provided
+      const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
+      if (sanExtension) {
+        const sanNames = new x509.GeneralNames(sanExtension.value);
 
+        altNamesArray = sanNames.items
+          .filter((value) => value.type === "email" || value.type === "dns")
+          .map((name) => ({
+            type: name.type as "email" | "dns",
+            value: name.value
+          }));
+
+        altNamesFromCsr = sanNames.items.map((item) => item.value).join(",");
+      }
+    }
+
+    if (altNamesArray.length) {
       const altNamesExtension = new x509.SubjectAlternativeNameExtension(altNamesArray, false);
       extensions.push(altNamesExtension);
     }
@@ -1484,7 +1504,7 @@ export const certificateAuthorityServiceFactory = ({
           status: CertStatus.ACTIVE,
           friendlyName: friendlyName || csrObj.subject,
           commonName: cn,
-          altNames,
+          altNames: altNamesFromCsr || altNames,
           serialNumber,
           notBefore: notBeforeDate,
           notAfter: notAfterDate

backend/src/services/certificate-authority/certificate-authority-types.ts

@@ -106,8 +106,8 @@ export type TSignCertFromCaDTO =
       pkiCollectionId?: string;
       friendlyName?: string;
       commonName?: string;
-      altNames: string;
-      ttl: string;
+      altNames?: string;
+      ttl?: string;
       notBefore?: string;
       notAfter?: string;
     }

frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateTemplateEnrollmentModal.tsx

@@ -147,7 +147,7 @@ export const CertificateTemplateEnrollmentModal = ({ popUp, handlePopUpToggle }:
           />
           {data && (
             <FormControl label="EST Label">
-              <Input value={data.certificateTemplateId} disabled />
+              <Input value={data.certificateTemplateId} isDisabled className="bg-white/[0.07]" />
             </FormControl>
           )}
           <Controller