Merge branch 'main' of https://github.com/Infisical/infisical into feat/suborg-scope-support

backend/bdd/features/pki/acme/external-ca.feature

@@ -1,6 +1,7 @@
 Feature: External CA
 
-  Scenario: Issue a certificate from an external CA
+  @cloudflare
+  Scenario Outline: Issue a certificate from an external CA with Cloudflare
     Given I create a Cloudflare connection as cloudflare
     Then I memorize cloudflare with jq ".appConnection.id" as app_conn_id
     Given I create a external ACME CA with the following config as ext_ca
@@ -92,9 +93,7 @@ Feature: External CA
     When I create certificate signing request as csr
     Then I add names to certificate signing request csr
       """
-      {
-        "COMMON_NAME": "localhost"
-      }
+      <subject>
       """
     # Pebble has a strict rule to only takes SANs
     Then I add subject alternative name to certificate signing request csr
@@ -177,4 +176,196 @@ Feature: External CA
       [
         "localhost"
       ]
-      """
+      """
+
+    Examples:
+      | subject                      |
+      | {"COMMON_NAME": "localhost"} |
+      | {}                           |
+
+  @dnsme
+  Scenario Outline: Issue a certificate from an external CA with DNS Made Easy
+    Given I create a DNS Made Easy connection as dnsme
+    Then I memorize dnsme with jq ".appConnection.id" as app_conn_id
+    Given I create a external ACME CA with the following config as ext_ca
+      """
+      {
+        "dnsProviderConfig": {
+            "provider": "dns-made-easy",
+            "hostedZoneId": "MOCK_ZONE_ID"
+        },
+        "directoryUrl": "{PEBBLE_URL}",
+        "accountEmail": "fangpen@infisical.com",
+        "dnsAppConnectionId": "{app_conn_id}",
+        "eabKid": "",
+        "eabHmacKey": ""
+      }
+      """
+    Then I memorize ext_ca with jq ".id" as ext_ca_id
+    Given I create a certificate template with the following config as cert_template
+      """
+      {
+        "subject": [
+          {
+            "type": "common_name",
+            "allowed": [
+              "*"
+            ]
+          }
+        ],
+        "sans": [
+          {
+            "type": "dns_name",
+            "allowed": [
+              "*"
+            ]
+          }
+        ],
+        "keyUsages": {
+          "required": [],
+          "allowed": [
+            "digital_signature",
+            "key_encipherment",
+            "non_repudiation",
+            "data_encipherment",
+            "key_agreement",
+            "key_cert_sign",
+            "crl_sign",
+            "encipher_only",
+            "decipher_only"
+          ]
+        },
+        "extendedKeyUsages": {
+          "required": [],
+          "allowed": [
+            "client_auth",
+            "server_auth",
+            "code_signing",
+            "email_protection",
+            "ocsp_signing",
+            "time_stamping"
+          ]
+        },
+        "algorithms": {
+          "signature": [
+            "SHA256-RSA",
+            "SHA512-RSA",
+            "SHA384-ECDSA",
+            "SHA384-RSA",
+            "SHA256-ECDSA",
+            "SHA512-ECDSA"
+          ],
+          "keyAlgorithm": [
+            "RSA-2048",
+            "RSA-4096",
+            "ECDSA-P384",
+            "RSA-3072",
+            "ECDSA-P256",
+            "ECDSA-P521"
+          ]
+        },
+        "validity": {
+          "max": "365d"
+        }
+      }
+      """
+    Then I memorize cert_template with jq ".certificateTemplate.id" as cert_template_id
+    Given I create an ACME profile with ca {ext_ca_id} and template {cert_template_id} as "acme_profile"
+    When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      <subject>
+      """
+    # Pebble has a strict rule to only takes SANs
+    Then I add subject alternative name to certificate signing request csr
+      """
+      [
+        "localhost"
+      ]
+      """
+    And I create a RSA private key pair as cert_key
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I select challenge with type http-01 for domain localhost from order in order as challenge
+    And I serve challenge response for challenge at localhost
+    And I tell ACME server that challenge is ready to be verified
+    Given I intercept outgoing requests
+      """
+      [
+        {
+          "scope": "https://api.dnsmadeeasy.com:443",
+          "method": "POST",
+          "path": "/V2.0/dns/managed/MOCK_ZONE_ID/records",
+          "status": 201,
+          "response": {
+            "gtdLocation": "DEFAULT",
+            "failed": false,
+            "monitor": false,
+            "failover": false,
+            "sourceId": 895364,
+            "dynamicDns": false,
+            "hardLink": false,
+            "ttl": 60,
+            "source": 1,
+            "name": "_acme-challenge",
+            "value": "\"MOCK_HTTP_01_VALUE\"",
+            "id": 12345678,
+            "type": "TXT"
+          },
+          "responseIsBinary": false
+        },
+        {
+          "scope": "https://api.dnsmadeeasy.com:443",
+          "method": "GET",
+          "path": "/V2.0/dns/managed/MOCK_ZONE_ID/records?type=TXT&recordName=_acme-challenge&page=0",
+          "status": 200,
+          "response": {
+            "totalRecords": 1,
+            "totalPages": 1,
+            "data": [
+              {
+                "gtdLocation": "DEFAULT",
+                "failed": false,
+                "monitor": false,
+                "failover": false,
+                "sourceId": 895364,
+                "dynamicDns": false,
+                "hardLink": false,
+                "ttl": 60,
+                "source": 1,
+                "name": "_acme-challenge",
+                "value": "\"MOCK_CHALLENGE_VALUE\"",
+                "id": 1111111,
+                "type": "TXT"
+              }
+            ],
+            "page": 0
+          },
+          "responseIsBinary": false
+        },
+        {
+          "scope": "https://api.dnsmadeeasy.com:443",
+          "method": "DELETE",
+          "path": "/V2.0/dns/managed/MOCK_ZONE_ID/records/1111111",
+          "status": 200,
+          "response": "",
+          "responseIsBinary": false
+        }
+      ]
+      """
+    Then I poll and finalize the ACME order order as finalized_order
+    And the value finalized_order.body with jq ".status" should be equal to "valid"
+    And I parse the full-chain certificate from order finalized_order as cert
+    And the value cert with jq "[.extensions.subjectAltName.general_names.[].value] | sort" should be equal to json
+      """
+      [
+        "localhost"
+      ]
+      """
+
+    Examples:
+      | subject                      |
+      | {"COMMON_NAME": "localhost"} |
+      | {}                           |

backend/bdd/features/steps/pki_acme.py

@@ -147,6 +147,40 @@ def step_impl(context: Context, var_name: str):
     context.vars[var_name] = response
 
 
+@given("I create a DNS Made Easy connection as {var_name}")
+def step_impl(context: Context, var_name: str):
+    jwt_token = context.vars["AUTH_TOKEN"]
+    conn_slug = faker.slug()
+    with with_nocks(
+        context,
+        definitions=[
+            {
+                "scope": "https://api.dnsmadeeasy.com:443",
+                "method": "GET",
+                "path": "/V2.0/dns/managed/",
+                "status": 200,
+                "response": {"totalRecords": 0, "totalPages": 1, "data": [], "page": 0},
+                "responseIsBinary": False,
+            }
+        ],
+    ):
+        response = context.http_client.post(
+            "/api/v1/app-connections/dns-made-easy",
+            headers=dict(authorization="Bearer {}".format(jwt_token)),
+            json={
+                "name": conn_slug,
+                "description": "",
+                "method": "api-key-secret",
+                "credentials": {
+                    "apiKey": "MOCK_API_KEY",
+                    "secretKey": "MOCK_SECRET_KEY",
+                },
+            },
+        )
+    response.raise_for_status()
+    context.vars[var_name] = response
+
+
 @given("I create a external ACME CA with the following config as {var_name}")
 def step_impl(context: Context, var_name: str):
     jwt_token = context.vars["AUTH_TOKEN"]

backend/src/db/migrations/20251121124532_add-issuer-type-to-certificate-profiles.ts

@@ -0,0 +1,27 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasIssuerTypeColumn = await knex.schema.hasColumn(TableName.PkiCertificateProfile, "issuerType");
+
+  if (!hasIssuerTypeColumn) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.string("issuerType").notNullable().defaultTo("ca");
+    });
+  }
+
+  await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+    t.uuid("caId").nullable().alter();
+  });
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasIssuerTypeColumn = await knex.schema.hasColumn(TableName.PkiCertificateProfile, "issuerType");
+
+  if (hasIssuerTypeColumn) {
+    await knex.schema.alterTable(TableName.PkiCertificateProfile, (t) => {
+      t.dropColumn("issuerType");
+    });
+  }
+}

backend/src/db/schemas/pki-certificate-profiles.ts

@@ -10,7 +10,7 @@ import { TImmutableDBKeys } from "./models";
 export const PkiCertificateProfilesSchema = z.object({
   id: z.string().uuid(),
   projectId: z.string(),
-  caId: z.string().uuid(),
+  caId: z.string().uuid().nullable().optional(),
   certificateTemplateId: z.string().uuid(),
   slug: z.string(),
   description: z.string().nullable().optional(),
@@ -19,7 +19,8 @@ export const PkiCertificateProfilesSchema = z.object({
   apiConfigId: z.string().uuid().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  acmeConfigId: z.string().uuid().nullable().optional()
+  acmeConfigId: z.string().uuid().nullable().optional(),
+  issuerType: z.string().default("ca")
 });
 
 export type TPkiCertificateProfiles = z.infer<typeof PkiCertificateProfilesSchema>;

backend/src/ee/routes/v2/identity-project-additional-privilege-router.ts

@@ -158,6 +158,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         },
         data: {
           ...req.body,
+          name: req.body.slug,
           ...req.body.type,
           permissions: req.body.permissions || undefined
         }

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -2797,6 +2797,7 @@ interface CreateCertificateProfile {
     name: string;
     projectId: string;
     enrollmentType: string;
+    issuerType: string;
   };
 }
 

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts

@@ -1,10 +1,18 @@
+import { ProjectMembershipRole } from "@app/db/schemas";
 import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue";
+import { getConfig } from "@app/lib/config/env";
+import { applyJitter } from "@app/lib/delay";
 import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+import { TIdentityDALFactory } from "@app/services/identity/identity-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
+import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
+import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TDynamicSecretDALFactory } from "../dynamic-secret/dynamic-secret-dal";
 import { DynamicSecretStatus } from "../dynamic-secret/dynamic-secret-types";
@@ -15,7 +23,12 @@ import { TDynamicSecretLeaseConfig } from "./dynamic-secret-lease-types";
 type TDynamicSecretLeaseQueueServiceFactoryDep = {
   queueService: TQueueServiceFactory;
   dynamicSecretLeaseDAL: Pick<TDynamicSecretLeaseDALFactory, "findById" | "deleteById" | "find" | "updateById">;
-  dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findById" | "deleteById" | "updateById">;
+  smtpService: Pick<TSmtpService, "sendMail">;
+  userDAL: Pick<TUserDALFactory, "findById">;
+  identityDAL: TIdentityDALFactory;
+  dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findById" | "deleteById" | "updateById" | "findOne">;
+  projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findAllProjectMembers">;
+  projectDAL: Pick<TProjectDALFactory, "findById">;
   dynamicSecretProviders: Record<DynamicSecretProviders, TDynamicProviderFns>;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   folderDAL: Pick<TSecretFolderDALFactory, "findById">;
@@ -23,18 +36,24 @@ type TDynamicSecretLeaseQueueServiceFactoryDep = {
 
 export type TDynamicSecretLeaseQueueServiceFactory = {
   pruneDynamicSecret: (dynamicSecretCfgId: string) => Promise<void>;
-  setLeaseRevocation: (leaseId: string, expiryAt: Date) => Promise<void>;
+  setLeaseRevocation: (leaseId: string, dynamicSecretId: string, expiryAt: Date) => Promise<void>;
   unsetLeaseRevocation: (leaseId: string) => Promise<void>;
+  queueFailedRevocation: (leaseId: string, dynamicSecretId: string) => Promise<void>;
   init: () => Promise<void>;
 };
 
+const MAX_REVOCATION_RETRY_COUNT = 10;
+
 export const dynamicSecretLeaseQueueServiceFactory = ({
   queueService,
   dynamicSecretDAL,
   dynamicSecretProviders,
   dynamicSecretLeaseDAL,
   kmsService,
-  folderDAL
+  folderDAL,
+  projectMembershipDAL,
+  projectDAL,
+  smtpService
 }: TDynamicSecretLeaseQueueServiceFactoryDep): TDynamicSecretLeaseQueueServiceFactory => {
   const pruneDynamicSecret = async (dynamicSecretCfgId: string) => {
     await queueService.queuePg<QueueName.DynamicSecretRevocation>(
@@ -48,10 +67,10 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
     );
   };
 
-  const setLeaseRevocation = async (leaseId: string, expiryAt: Date) => {
+  const setLeaseRevocation = async (leaseId: string, dynamicSecretId: string, expiryAt: Date) => {
     await queueService.queuePg<QueueName.DynamicSecretRevocation>(
       QueueJobs.DynamicSecretRevocation,
-      { leaseId },
+      { leaseId, dynamicSecretId },
       {
         id: leaseId,
         singletonKey: leaseId,
@@ -68,10 +87,53 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
     await queueService.stopJobByIdPg(QueueName.DynamicSecretRevocation, leaseId);
   };
 
+  const queueFailedRevocation = async (leaseId: string, dynamicSecretId: string) => {
+    const appConfig = getConfig();
+
+    const retryDelaySeconds = appConfig.isDevelopmentMode ? 1 : Math.floor(applyJitter(3_600_000 * 4) / 1000); // retry every 4 hours with 20% +- jitter (convert ms to seconds for pgboss)
+
+    await queueService.queuePg<QueueName.DynamicSecretRevocation>(
+      QueueJobs.DynamicSecretRevocation,
+      { leaseId, isRetry: true, dynamicSecretId },
+      {
+        singletonKey: `${leaseId}-retry`, // avoid conflicts with scheduled revocation
+        retryDelay: retryDelaySeconds,
+        retryLimit: MAX_REVOCATION_RETRY_COUNT, // we dont want it to ever hit the limit, we want the expireInHours to take effect.
+        expireInHours: 23 // if we set it to 24 hours, pgboss will complain that the expireIn is too high
+      }
+    );
+  };
+
+  const $queueDynamicSecretLeaseRevocationFailedEmail = async (leaseId: string, dynamicSecretId: string) => {
+    const appConfig = getConfig();
+
+    const delay = appConfig.isDevelopmentMode ? 1_000 * 60 : 1_000 * 60 * 15; // 1 minute in development, 15 minutes in production
+
+    await queueService.queue(
+      QueueName.DynamicSecretLeaseRevocationFailedEmail,
+      QueueJobs.DynamicSecretLeaseRevocationFailedEmail,
+      {
+        leaseId
+      },
+      {
+        jobId: `dynamic-secret-lease-revocation-failed-email-${dynamicSecretId}`,
+        delay,
+        attempts: 3,
+        backoff: {
+          type: "exponential",
+          delay: 1000 * 60 // 1 minute
+        },
+        removeOnComplete: true,
+        removeOnFail: true
+      }
+    );
+  };
+
   const $dynamicSecretQueueJob = async (
     jobName: string,
     jobId: string,
-    data: { leaseId: string } | { dynamicSecretCfgId: string }
+    data: { leaseId: string; dynamicSecretId: string; isRetry?: boolean } | { dynamicSecretCfgId: string },
+    retryCount?: number
   ): Promise<void> => {
     try {
       if (jobName === QueueJobs.DynamicSecretRevocation) {
@@ -79,7 +141,9 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
         logger.info("Dynamic secret lease revocation started: ", leaseId, jobId);
 
         const dynamicSecretLease = await dynamicSecretLeaseDAL.findById(leaseId);
-        if (!dynamicSecretLease) throw new DisableRotationErrors({ message: "Dynamic secret lease not found" });
+        if (!dynamicSecretLease) {
+          throw new DisableRotationErrors({ message: "Dynamic secret lease not found" });
+        }
 
         const folder = await folderDAL.findById(dynamicSecretLease.dynamicSecret.folderId);
         if (!folder)
@@ -150,7 +214,7 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
       }
       logger.info("Finished dynamic secret job", jobId);
     } catch (error) {
-      logger.error(error);
+      logger.error(error, "Failed to delete dynamic secret");
 
       if (jobName === QueueJobs.DynamicSecretPruning) {
         const { dynamicSecretCfgId } = data as { dynamicSecretCfgId: string };
@@ -161,20 +225,97 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
       }
 
       if (jobName === QueueJobs.DynamicSecretRevocation) {
-        const { leaseId } = data as { leaseId: string };
+        const { leaseId, isRetry, dynamicSecretId } = data as {
+          leaseId: string;
+          isRetry?: boolean;
+          dynamicSecretId: string;
+        };
         await dynamicSecretLeaseDAL.updateById(leaseId, {
           status: DynamicSecretStatus.FailedDeletion,
-          statusDetails: (error as Error)?.message?.slice(0, 255)
+          statusDetails: `${(error as Error)?.message?.slice(0, 255)} - Retrying automatically`
         });
+
+        // only add to retry queue if this is not a retry, and if the error is not a DisableRotationErrors error
+        if (!isRetry && !(error instanceof DisableRotationErrors)) {
+          // if revocation fails, we should stop the job and queue a new job to retry the revocation at a later time.
+          await queueService.stopJobByIdPg(QueueName.DynamicSecretRevocation, jobId);
+          await queueService.stopRepeatableJobByJobId(QueueName.DynamicSecretRevocation, jobId);
+          await queueFailedRevocation(leaseId, dynamicSecretId);
+
+          // if its the last attempt, and the error isn't a DisableRotationErrors error, send an email to the project admins (debounced)
+        } else if (isRetry && !(error instanceof DisableRotationErrors)) {
+          if (retryCount && retryCount === MAX_REVOCATION_RETRY_COUNT) {
+            // if all retries fail, we should also stop the automatic revocation job.
+            // the ID of the revocation job is set to the leaseId, so we can use that to stop the job
+
+            // we dont have to stop the retry job, because if we hit this point, its the last attempt and the retry job will be stopped by pgboss itself after this point,
+            await queueService.stopJobByIdPg(QueueName.DynamicSecretRevocation, leaseId);
+            await queueService.stopRepeatableJobByJobId(QueueName.DynamicSecretRevocation, leaseId);
+
+            await $queueDynamicSecretLeaseRevocationFailedEmail(leaseId, dynamicSecretId);
+          }
+        }
       }
       if (error instanceof DisableRotationErrors) {
         if (jobId) {
           await queueService.stopRepeatableJobByJobId(QueueName.DynamicSecretRevocation, jobId);
           await queueService.stopJobByIdPg(QueueName.DynamicSecretRevocation, jobId);
         }
+      } else {
+        // propagate to next part
+        throw error;
+      }
+    }
+  };
+
+  // send alert email once all revocation attempts have failed
+  const $dynamicSecretLeaseRevocationFailedEmailJob = async (jobId: string, data: { leaseId: string }) => {
+    try {
+      const appCfg = getConfig();
+
+      const { leaseId } = data;
+      logger.info(
+        { leaseId, jobId },
+        "Dynamic secret revocation failed. Notifying project admins about failed revocation."
+      );
+
+      const lease = await dynamicSecretLeaseDAL.findById(leaseId);
+      if (!lease) {
+        throw new DisableRotationErrors({ message: "Dynamic secret lease not found" });
+      }
+
+      const folder = await folderDAL.findById(lease.dynamicSecret.folderId);
+      if (!folder) throw new NotFoundError({ message: `Failed to find folder with ${lease.dynamicSecret.folderId}` });
+
+      const project = await projectDAL.findById(folder.projectId);
+      const projectMembers = await projectMembershipDAL.findAllProjectMembers(project.id);
+
+      const projectAdmins = projectMembers.filter((member) =>
+        member.roles.some((role) => role.role === ProjectMembershipRole.Admin)
+      );
+
+      await smtpService.sendMail({
+        recipients: projectAdmins.map((member) => member.user.email!).filter(Boolean),
+        template: SmtpTemplates.DynamicSecretLeaseRevocationFailed,
+        subjectLine: "Dynamic Secret Lease Revocation Failed",
+        substitutions: {
+          dynamicSecretLeaseUrl: `${appCfg.SITE_URL}/organizations/${project.orgId}/projects/secret-management/${project.id}/secrets/${folder.environment.envSlug}?dynamicSecretId=${lease.dynamicSecret.id}&filterBy=dynamic&search=${lease.dynamicSecret.name}`,
+          dynamicSecretName: lease.dynamicSecret.name,
+          projectName: project.name,
+          environmentSlug: folder.environment.envSlug,
+          errorMessage: lease.statusDetails || "An unknown error occurred"
+        }
+      });
+    } catch (error) {
+      logger.error(error, "Failed to send dynamic secret lease revocation failed email");
+      if (error instanceof DisableRotationErrors) {
+        if (jobId) {
+          await queueService.stopRepeatableJobByJobId(QueueName.DynamicSecretLeaseRevocationFailedEmail, jobId);
+          await queueService.stopJobById(QueueName.DynamicSecretLeaseRevocationFailedEmail, jobId);
+        }
+      } else {
+        throw error;
       }
-      // propogate to next part
-      throw error;
     }
   };
 
@@ -182,14 +323,21 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
     await $dynamicSecretQueueJob(job.name, job.id as string, job.data);
   });
 
+  // we use redis for sending the email because:
+  // 1. we are insensitive to losing the jobs in queue in case of a disaster event
+  // 2. pgboss does not support exclusive job keys on v0.10.x, and upgrading to v0.11.x which supports exclusive jobs comes with a lot of breaking changes, and we would need to manually migrate our existing jobs to the new version
+  queueService.start(QueueName.DynamicSecretLeaseRevocationFailedEmail, async (job) => {
+    await $dynamicSecretLeaseRevocationFailedEmailJob(job.id as string, job.data);
+  });
+
   const init = async () => {
     await queueService.startPg<QueueName.DynamicSecretRevocation>(
       QueueJobs.DynamicSecretRevocation,
       async ([job]) => {
-        await $dynamicSecretQueueJob(job.name, job.id, job.data);
+        await $dynamicSecretQueueJob(job.name, job.id, job.data, job.retryCount);
       },
       {
-        workerCount: 5,
+        workerCount: 10,
         pollingIntervalSeconds: 1
       }
     );
@@ -210,6 +358,7 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
     pruneDynamicSecret,
     setLeaseRevocation,
     unsetLeaseRevocation,
+    queueFailedRevocation,
     init
   };
 };

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -178,7 +178,7 @@ export const dynamicSecretLeaseServiceFactory = ({
       config
     });
 
-    await dynamicSecretQueueService.setLeaseRevocation(dynamicSecretLease.id, expireAt);
+    await dynamicSecretQueueService.setLeaseRevocation(dynamicSecretLease.id, dynamicSecretCfg.id, expireAt);
     return { lease: dynamicSecretLease, dynamicSecret: dynamicSecretCfg, data };
   };
 
@@ -272,7 +272,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     );
 
     await dynamicSecretQueueService.unsetLeaseRevocation(dynamicSecretLease.id);
-    await dynamicSecretQueueService.setLeaseRevocation(dynamicSecretLease.id, expireAt);
+    await dynamicSecretQueueService.setLeaseRevocation(dynamicSecretLease.id, dynamicSecretCfg.id, expireAt);
     const updatedDynamicSecretLease = await dynamicSecretLeaseDAL.updateById(dynamicSecretLease.id, {
       expireAt,
       externalEntityId: entityId
@@ -358,11 +358,13 @@ export const dynamicSecretLeaseServiceFactory = ({
     if ((revokeResponse as { error?: Error })?.error) {
       const { error } = revokeResponse as { error?: Error };
       logger.error(error?.message, "Failed to revoke lease");
-      const deletedDynamicSecretLease = await dynamicSecretLeaseDAL.updateById(dynamicSecretLease.id, {
+      const updatedDynamicSecretLease = await dynamicSecretLeaseDAL.updateById(dynamicSecretLease.id, {
         status: DynamicSecretLeaseStatus.FailedDeletion,
         statusDetails: error?.message?.slice(0, 255)
       });
-      return deletedDynamicSecretLease;
+      // queue a job to retry the revocation at a later time
+      await dynamicSecretQueueService.queueFailedRevocation(dynamicSecretLease.id, dynamicSecretCfg.id);
+      return updatedDynamicSecretLease;
     }
 
     await dynamicSecretQueueService.unsetLeaseRevocation(dynamicSecretLease.id);

backend/src/ee/services/license/license-fns.ts

@@ -15,7 +15,7 @@ export const isOfflineLicenseKey = (licenseKey: string): boolean => {
 
     return "signature" in contents && "license" in contents;
   } catch (error) {
-    return true;
+    return false;
   }
 };
 
@@ -25,7 +25,7 @@ export const getLicenseKeyConfig = (
   const cfg = config || getConfig();
 
   if (!cfg) {
-    return { isValid: true };
+    return { isValid: false };
   }
 
   const licenseKey = cfg.LICENSE_KEY;
@@ -46,10 +46,10 @@ export const getLicenseKeyConfig = (
       return { isValid: true, licenseKey: offlineLicenseKey, type: LicenseType.Offline };
     }
 
-    return { isValid: true };
+    return { isValid: false };
   }
 
-  return { isValid: true };
+  return { isValid: false };
 };
 
 export const getDefaultOnPremFeatures = (): TFeatureSet => ({
@@ -64,56 +64,56 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   environmentsUsed: 0,
   identityLimit: null,
   identitiesUsed: 0,
-  dynamicSecret: true,
+  dynamicSecret: false,
   secretVersioning: true,
-  pitRecovery: true,
-  ipAllowlisting: true,
-  rbac: true,
-  githubOrgSync: true,
-  customRateLimits: true,
-  subOrganization: true,
-  customAlerts: true,
-  secretAccessInsights: true,
-  auditLogs: true,
+  pitRecovery: false,
+  ipAllowlisting: false,
+  rbac: false,
+  githubOrgSync: false,
+  customRateLimits: false,
+  subOrganization: false,
+  customAlerts: false,
+  secretAccessInsights: false,
+  auditLogs: false,
   auditLogsRetentionDays: 0,
-  auditLogStreams: true,
+  auditLogStreams: false,
   auditLogStreamLimit: 3,
-  samlSSO: true,
-  enforceGoogleSSO: true,
-  hsm: true,
-  oidcSSO: true,
-  scim: true,
-  ldap: true,
-  groups: true,
+  samlSSO: false,
+  enforceGoogleSSO: false,
+  hsm: false,
+  oidcSSO: false,
+  scim: false,
+  ldap: false,
+  groups: false,
   status: null,
   trial_end: null,
   has_used_trial: true,
-  secretApproval: true,
-  secretRotation: true,
-  caCrl: true,
-  instanceUserManagement: true,
-  externalKms: true,
+  secretApproval: false,
+  secretRotation: false,
+  caCrl: false,
+  instanceUserManagement: false,
+  externalKms: false,
   rateLimits: {
     readLimit: 60,
     writeLimit: 200,
     secretsLimit: 40
   },
-  pkiEst: true,
-  pkiAcme: true,
-  enforceMfa: true,
-  projectTemplates: true,
-  kmip: true,
-  gateway: true,
-  sshHostGroups: true,
-  secretScanning: true,
-  enterpriseSecretSyncs: true,
-  enterpriseCertificateSyncs: true,
-  enterpriseAppConnections: true,
-  fips: true,
-  eventSubscriptions: true,
-  machineIdentityAuthTemplates: true,
-  pkiLegacyTemplates: true,
-  pam: true
+  pkiEst: false,
+  pkiAcme: false,
+  enforceMfa: false,
+  projectTemplates: false,
+  kmip: false,
+  gateway: false,
+  sshHostGroups: false,
+  secretScanning: false,
+  enterpriseSecretSyncs: false,
+  enterpriseCertificateSyncs: false,
+  enterpriseAppConnections: false,
+  fips: false,
+  eventSubscriptions: false,
+  machineIdentityAuthTemplates: false,
+  pkiLegacyTemplates: false,
+  pam: false
 });
 
 export const setupLicenseRequestWithStore = (

backend/src/ee/services/pki-acme/pki-acme-service.ts

@@ -683,6 +683,13 @@ export const pkiAcmeServiceFactory = ({
     payload: TFinalizeAcmeOrderPayload;
   }): Promise<TAcmeResponse<TAcmeOrderResource>> => {
     const profile = (await certificateProfileDAL.findByIdWithConfigs(profileId))!;
+
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for ACME enrollment"
+      });
+    }
+
     let order = await acmeOrderDAL.findByAccountAndOrderIdWithAuthorizations(accountId, orderId);
     if (!order) {
       throw new NotFoundError({ message: "ACME order not found" });
@@ -729,7 +736,7 @@ export const pkiAcmeServiceFactory = ({
           throw new AcmeBadCSRError({ message: "Invalid CSR: Common name + SANs mismatch with order identifiers" });
         }
 
-        const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
+        const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId!);
         if (!ca) {
           throw new NotFoundError({ message: "Certificate Authority not found" });
         }
@@ -769,7 +776,9 @@ export const pkiAcmeServiceFactory = ({
             const cert = await orderCertificate(
               {
                 caId: certificateAuthority!.id,
-                commonName: certificateRequest.commonName!,
+                // It is possible that the CSR does not have a common name, in which case we use an empty string
+                // (more likely than not for a CSR from a modern ACME client like certbot, cert-manager, etc.)
+                commonName: certificateRequest.commonName ?? "",
                 altNames: certificateRequest.subjectAlternativeNames?.map((san) => san.value),
                 csr: Buffer.from(csrPem),
                 // TODO: not 100% sure what are these columns for, but let's put the values for common website SSL certs for now

backend/src/lib/config/env.ts

@@ -119,6 +119,7 @@ const envSchema = z
         })
         .default("{}")
     ),
+    DNS_MADE_EASY_SANDBOX_ENABLED: zodStrBool.default("false").optional(),
     // smtp options
     SMTP_HOST: zpStr(z.string().optional()),
     SMTP_IGNORE_TLS: zodStrBool.default("false"),

backend/src/lib/delay/index.ts

@@ -2,3 +2,13 @@ export const delay = (ms: number) =>
   new Promise<void>((resolve) => {
     setTimeout(resolve, ms);
   });
+
+export const applyJitter = (delayMs: number) => {
+  const jitterFactor = 0.2;
+
+  // generates random value in [-0.2, +0.2] range
+  const randomFactor = (Math.random() * 2 - 1) * jitterFactor;
+  const jitterAmount = randomFactor * delayMs;
+
+  return delayMs + jitterAmount;
+};

backend/src/queue/queue-service.ts

@@ -61,6 +61,7 @@ export enum QueueName {
   SecretPushEventScan = "secret-push-event-scan",
   UpgradeProjectToGhost = "upgrade-project-to-ghost",
   DynamicSecretRevocation = "dynamic-secret-revocation",
+  DynamicSecretLeaseRevocationFailedEmail = "dynamic-secret-lease-revocation-failed-email",
   CaCrlRotation = "ca-crl-rotation",
   CaLifecycle = "ca-lifecycle", // parent queue to ca-order-certificate-for-subscriber
   SecretReplication = "secret-replication",
@@ -120,6 +121,7 @@ export enum QueueJobs {
   SecretRotationV2RotateSecrets = "secret-rotation-v2-rotate-secrets",
   SecretRotationV2SendNotification = "secret-rotation-v2-send-notification",
   CreateFolderTreeCheckpoint = "create-folder-tree-checkpoint",
+  DynamicSecretLeaseRevocationFailedEmail = "dynamic-secret-lease-revocation-failed-email",
   InvalidateCache = "invalidate-cache",
   SecretScanningV2FullScan = "secret-scanning-v2-full-scan",
   SecretScanningV2DiffScan = "secret-scanning-v2-diff-scan",
@@ -219,11 +221,19 @@ export type TQueueJobTypes = {
     name: QueueJobs.TelemetryInstanceStats;
     payload: undefined;
   };
+  [QueueName.DynamicSecretLeaseRevocationFailedEmail]: {
+    name: QueueJobs.DynamicSecretLeaseRevocationFailedEmail;
+    payload: {
+      leaseId: string;
+    };
+  };
   [QueueName.DynamicSecretRevocation]:
     | {
         name: QueueJobs.DynamicSecretRevocation;
         payload: {
+          isRetry?: boolean;
           leaseId: string;
+          dynamicSecretId: string;
         };
       }
     | {

backend/src/server/plugins/serve-ui.ts

@@ -43,7 +43,9 @@ export const registerServeUI = async (
     const frontendPath = path.join(dir, frontendName);
     await server.register(staticServe, {
       root: frontendPath,
-      wildcard: false
+      wildcard: false,
+      maxAge: "30d",
+      immutable: true
     });
 
     server.route({
@@ -58,11 +60,12 @@ export const registerServeUI = async (
           return;
         }
 
-        // This should help avoid caching any chunks (temp fix)
-        void reply.header("Cache-Control", "no-cache, no-store, must-revalidate, private, max-age=0");
-        void reply.header("Pragma", "no-cache");
-        void reply.header("Expires", "0");
-        return reply.sendFile("index.html");
+        return reply.sendFile("index.html", {
+          immutable: false,
+          maxAge: 0,
+          lastModified: false,
+          etag: false
+        });
       }
     });
   }

backend/src/server/routes/index.ts

@@ -1874,7 +1874,12 @@ export const registerRoutes = async (
     dynamicSecretProviders,
     dynamicSecretDAL,
     folderDAL,
-    kmsService
+    kmsService,
+    smtpService,
+    userDAL,
+    identityDAL,
+    projectMembershipDAL,
+    projectDAL
   });
   const dynamicSecretService = dynamicSecretServiceFactory({
     projectDAL,
@@ -2219,7 +2224,10 @@ export const registerRoutes = async (
     permissionService,
     certificateSyncDAL,
     pkiSyncDAL,
-    pkiSyncQueue
+    pkiSyncQueue,
+    kmsService,
+    projectDAL,
+    certificateBodyDAL
   });
 
   const certificateV3Queue = certificateV3QueueServiceFactory({

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -61,6 +61,10 @@ import {
   DigitalOceanConnectionListItemSchema,
   SanitizedDigitalOceanConnectionSchema
 } from "@app/services/app-connection/digital-ocean";
+import {
+  DNSMadeEasyConnectionListItemSchema,
+  SanitizedDNSMadeEasyConnectionSchema
+} from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-schema";
 import { FlyioConnectionListItemSchema, SanitizedFlyioConnectionSchema } from "@app/services/app-connection/flyio";
 import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
 import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
@@ -170,7 +174,8 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedAzureADCSConnectionSchema.options,
   ...SanitizedRedisConnectionSchema.options,
   ...SanitizedLaravelForgeConnectionSchema.options,
-  ...SanitizedChefConnectionSchema.options
+  ...SanitizedChefConnectionSchema.options,
+  ...SanitizedDNSMadeEasyConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -215,7 +220,8 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   AzureADCSConnectionListItemSchema,
   RedisConnectionListItemSchema,
   LaravelForgeConnectionListItemSchema,
-  ChefConnectionListItemSchema
+  ChefConnectionListItemSchema,
+  DNSMadeEasyConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/dns-made-easy-connection-router.ts

@@ -0,0 +1,51 @@
+import z from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  CreateDNSMadeEasyConnectionSchema,
+  SanitizedDNSMadeEasyConnectionSchema,
+  UpdateDNSMadeEasyConnectionSchema
+} from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-schema";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
+
+export const registerDNSMadeEasyConnectionRouter = async (server: FastifyZodProvider) => {
+  registerAppConnectionEndpoints({
+    app: AppConnection.DNSMadeEasy,
+    server,
+    sanitizedResponseSchema: SanitizedDNSMadeEasyConnectionSchema,
+    createSchema: CreateDNSMadeEasyConnectionSchema,
+    updateSchema: UpdateDNSMadeEasyConnectionSchema
+  });
+
+  // The below endpoints are not exposed and for Infisical App use
+  server.route({
+    method: "GET",
+    url: `/:connectionId/dns-made-easy-zones`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z
+          .object({
+            id: z.string(),
+            name: z.string()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+      const zones = await server.services.appConnection.dnsMadeEasy.listZones(connectionId, req.permission);
+      return zones;
+    }
+  });
+};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -16,6 +16,7 @@ import { registerCamundaConnectionRouter } from "./camunda-connection-router";
 import { registerChecklyConnectionRouter } from "./checkly-connection-router";
 import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
+import { registerDNSMadeEasyConnectionRouter } from "./dns-made-easy-connection-router";
 import { registerDigitalOceanConnectionRouter } from "./digital-ocean-connection-router";
 import { registerFlyioConnectionRouter } from "./flyio-connection-router";
 import { registerGcpConnectionRouter } from "./gcp-connection-router";
@@ -78,6 +79,7 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.Flyio]: registerFlyioConnectionRouter,
     [AppConnection.GitLab]: registerGitLabConnectionRouter,
     [AppConnection.Cloudflare]: registerCloudflareConnectionRouter,
+    [AppConnection.DNSMadeEasy]: registerDNSMadeEasyConnectionRouter,
     [AppConnection.Bitbucket]: registerBitbucketConnectionRouter,
     [AppConnection.Zabbix]: registerZabbixConnectionRouter,
     [AppConnection.Railway]: registerRailwayConnectionRouter,

backend/src/server/routes/v1/certificate-profiles-router.ts

@@ -8,7 +8,7 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CertStatus } from "@app/services/certificate/certificate-types";
-import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
+import { EnrollmentType, IssuerType } from "@app/services/certificate-profile/certificate-profile-types";
 
 export const registerCertificateProfilesRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -23,7 +23,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       body: z
         .object({
           projectId: z.string().min(1),
-          caId: z.string().uuid(),
+          caId: z.string().uuid().optional(),
           certificateTemplateId: z.string().uuid(),
           slug: z
             .string()
@@ -32,6 +32,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
             .regex(new RE2("^[a-z0-9-]+$"), "Slug must contain only lowercase letters, numbers, and hyphens"),
           description: z.string().max(1000).optional(),
           enrollmentType: z.nativeEnum(EnrollmentType),
+          issuerType: z.nativeEnum(IssuerType).default(IssuerType.CA),
           estConfig: z
             .object({
               disableBootstrapCaValidation: z.boolean().default(false),
@@ -50,43 +51,100 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         .refine(
           (data) => {
             if (data.enrollmentType === EnrollmentType.EST) {
-              if (!data.estConfig) {
-                return false;
-              }
-              if (data.apiConfig) {
-                return false;
-              }
-              if (data.acmeConfig) {
-                return false;
-              }
-            }
-            if (data.enrollmentType === EnrollmentType.API) {
-              if (!data.apiConfig) {
-                return false;
-              }
-              if (data.estConfig) {
-                return false;
-              }
-              if (data.acmeConfig) {
-                return false;
-              }
-            }
-            if (data.enrollmentType === EnrollmentType.ACME) {
-              if (!data.acmeConfig) {
-                return false;
-              }
-              if (data.estConfig) {
-                return false;
-              }
-              if (data.apiConfig) {
-                return false;
-              }
+              return !!data.estConfig;
             }
             return true;
           },
           {
-            message:
-              "EST enrollment type requires EST configuration and cannot have API or ACME configuration. API enrollment type requires API configuration and cannot have EST or ACME configuration. ACME enrollment type requires ACME configuration and cannot have EST or API configuration."
+            message: "EST enrollment type requires EST configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.enrollmentType === EnrollmentType.API) {
+              return !!data.apiConfig;
+            }
+            return true;
+          },
+          {
+            message: "API enrollment type requires API configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.enrollmentType === EnrollmentType.ACME) {
+              return !!data.acmeConfig;
+            }
+            return true;
+          },
+          {
+            message: "ACME enrollment type requires ACME configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.enrollmentType === EnrollmentType.EST) {
+              return !data.apiConfig && !data.acmeConfig;
+            }
+            return true;
+          },
+          {
+            message: "EST enrollment type cannot have API or ACME configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.enrollmentType === EnrollmentType.API) {
+              return !data.estConfig && !data.acmeConfig;
+            }
+            return true;
+          },
+          {
+            message: "API enrollment type cannot have EST or ACME configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.enrollmentType === EnrollmentType.ACME) {
+              return !data.estConfig && !data.apiConfig;
+            }
+            return true;
+          },
+          {
+            message: "ACME enrollment type cannot have EST or API configuration"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.issuerType === IssuerType.CA) {
+              return !!data.caId;
+            }
+            return true;
+          },
+          {
+            message: "CA issuer type requires a CA ID"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.issuerType === IssuerType.SELF_SIGNED) {
+              return !data.caId;
+            }
+            return true;
+          },
+          {
+            message: "Self-signed issuer type cannot have a CA ID"
+          }
+        )
+        .refine(
+          (data) => {
+            if (data.issuerType === IssuerType.SELF_SIGNED) {
+              return data.enrollmentType === EnrollmentType.API;
+            }
+            return true;
+          },
+          {
+            message: "Self-signed issuer type only supports API enrollment"
           }
         ),
       response: {
@@ -115,7 +173,8 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
             certificateProfileId: certificateProfile.id,
             name: certificateProfile.slug,
             projectId: certificateProfile.projectId,
-            enrollmentType: certificateProfile.enrollmentType
+            enrollmentType: certificateProfile.enrollmentType,
+            issuerType: certificateProfile.issuerType
           }
         }
       });
@@ -139,6 +198,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         limit: z.coerce.number().min(1).max(100).default(20),
         search: z.string().optional(),
         enrollmentType: z.nativeEnum(EnrollmentType).optional(),
+        issuerType: z.nativeEnum(IssuerType).optional(),
         caId: z.string().uuid().optional()
       }),
       response: {
@@ -339,6 +399,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
             .optional(),
           description: z.string().max(1000).optional(),
           enrollmentType: z.nativeEnum(EnrollmentType).optional(),
+          issuerType: z.nativeEnum(IssuerType).optional(),
           estConfig: z
             .object({
               disableBootstrapCaValidation: z.boolean().default(false),

backend/src/services/app-connection/app-connection-enums.ts

@@ -29,6 +29,7 @@ export enum AppConnection {
   Flyio = "flyio",
   GitLab = "gitlab",
   Cloudflare = "cloudflare",
+  DNSMadeEasy = "dns-made-easy",
   Zabbix = "zabbix",
   Railway = "railway",
   Bitbucket = "bitbucket",

backend/src/services/app-connection/app-connection-fns.ts

@@ -88,6 +88,11 @@ import {
   getDigitalOceanConnectionListItem,
   validateDigitalOceanConnectionCredentials
 } from "./digital-ocean";
+import { DNSMadeEasyConnectionMethod } from "./dns-made-easy/dns-made-easy-connection-enum";
+import {
+  getDNSMadeEasyConnectionListItem,
+  validateDNSMadeEasyConnectionCredentials
+} from "./dns-made-easy/dns-made-easy-connection-fns";
 import { FlyioConnectionMethod, getFlyioConnectionListItem, validateFlyioConnectionCredentials } from "./flyio";
 import { GcpConnectionMethod, getGcpConnectionListItem, validateGcpConnectionCredentials } from "./gcp";
 import { getGitHubConnectionListItem, GitHubConnectionMethod, validateGitHubConnectionCredentials } from "./github";
@@ -171,7 +176,8 @@ const PKI_APP_CONNECTIONS = [
   AppConnection.Cloudflare,
   AppConnection.AzureADCS,
   AppConnection.AzureKeyVault,
-  AppConnection.Chef
+  AppConnection.Chef,
+  AppConnection.DNSMadeEasy
 ];
 
 export const listAppConnectionOptions = (projectType?: ProjectType) => {
@@ -207,6 +213,7 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getFlyioConnectionListItem(),
     getGitLabConnectionListItem(),
     getCloudflareConnectionListItem(),
+    getDNSMadeEasyConnectionListItem(),
     getZabbixConnectionListItem(),
     getRailwayConnectionListItem(),
     getBitbucketConnectionListItem(),
@@ -339,6 +346,7 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Flyio]: validateFlyioConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.GitLab]: validateGitLabConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Cloudflare]: validateCloudflareConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.DNSMadeEasy]: validateDNSMadeEasyConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Zabbix]: validateZabbixConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Railway]: validateRailwayConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Bitbucket]: validateBitbucketConnectionCredentials as TAppConnectionCredentialsValidator,
@@ -395,6 +403,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case OktaConnectionMethod.ApiToken:
     case LaravelForgeConnectionMethod.ApiToken:
       return "API Token";
+    case DNSMadeEasyConnectionMethod.APIKeySecret:
+      return "API Key & Secret";
     case PostgresConnectionMethod.UsernameAndPassword:
     case MsSqlConnectionMethod.UsernameAndPassword:
     case MySqlConnectionMethod.UsernameAndPassword:
@@ -483,6 +493,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Flyio]: platformManagedCredentialsNotSupported,
   [AppConnection.GitLab]: platformManagedCredentialsNotSupported,
   [AppConnection.Cloudflare]: platformManagedCredentialsNotSupported,
+  [AppConnection.DNSMadeEasy]: platformManagedCredentialsNotSupported,
   [AppConnection.Zabbix]: platformManagedCredentialsNotSupported,
   [AppConnection.Railway]: platformManagedCredentialsNotSupported,
   [AppConnection.Bitbucket]: platformManagedCredentialsNotSupported,

backend/src/services/app-connection/app-connection-maps.ts

@@ -32,6 +32,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.Flyio]: "Fly.io",
   [AppConnection.GitLab]: "GitLab",
   [AppConnection.Cloudflare]: "Cloudflare",
+  [AppConnection.DNSMadeEasy]: "DNS Made Easy",
   [AppConnection.Zabbix]: "Zabbix",
   [AppConnection.Railway]: "Railway",
   [AppConnection.Bitbucket]: "Bitbucket",
@@ -77,6 +78,7 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.Flyio]: AppConnectionPlanType.Regular,
   [AppConnection.GitLab]: AppConnectionPlanType.Regular,
   [AppConnection.Cloudflare]: AppConnectionPlanType.Regular,
+  [AppConnection.DNSMadeEasy]: AppConnectionPlanType.Regular,
   [AppConnection.Zabbix]: AppConnectionPlanType.Regular,
   [AppConnection.Railway]: AppConnectionPlanType.Regular,
   [AppConnection.Bitbucket]: AppConnectionPlanType.Regular,

backend/src/services/app-connection/app-connection-service.ts

@@ -72,6 +72,8 @@ import { checklyConnectionService } from "./checkly/checkly-connection-service";
 import { ValidateCloudflareConnectionCredentialsSchema } from "./cloudflare/cloudflare-connection-schema";
 import { cloudflareConnectionService } from "./cloudflare/cloudflare-connection-service";
 import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
+import { ValidateDNSMadeEasyConnectionCredentialsSchema } from "./dns-made-easy/dns-made-easy-connection-schema";
+import { dnsMadeEasyConnectionService } from "./dns-made-easy/dns-made-easy-connection-service";
 import { databricksConnectionService } from "./databricks/databricks-connection-service";
 import { ValidateDigitalOceanConnectionCredentialsSchema } from "./digital-ocean";
 import { digitalOceanAppPlatformConnectionService } from "./digital-ocean/digital-ocean-connection-service";
@@ -167,6 +169,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Flyio]: ValidateFlyioConnectionCredentialsSchema,
   [AppConnection.GitLab]: ValidateGitLabConnectionCredentialsSchema,
   [AppConnection.Cloudflare]: ValidateCloudflareConnectionCredentialsSchema,
+  [AppConnection.DNSMadeEasy]: ValidateDNSMadeEasyConnectionCredentialsSchema,
   [AppConnection.Zabbix]: ValidateZabbixConnectionCredentialsSchema,
   [AppConnection.Railway]: ValidateRailwayConnectionCredentialsSchema,
   [AppConnection.Bitbucket]: ValidateBitbucketConnectionCredentialsSchema,
@@ -875,6 +878,7 @@ export const appConnectionServiceFactory = ({
     flyio: flyioConnectionService(connectAppConnectionById),
     gitlab: gitlabConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     cloudflare: cloudflareConnectionService(connectAppConnectionById),
+    dnsMadeEasy: dnsMadeEasyConnectionService(connectAppConnectionById),
     zabbix: zabbixConnectionService(connectAppConnectionById),
     railway: railwayConnectionService(connectAppConnectionById),
     bitbucket: bitbucketConnectionService(connectAppConnectionById),

backend/src/services/app-connection/app-connection-types.ts

@@ -15,8 +15,8 @@ import {
   TOracleDBConnectionInput,
   TValidateOracleDBConnectionCredentialsSchema
 } from "@app/ee/services/app-connections/oracledb";
-import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
+import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
@@ -106,6 +106,12 @@ import {
   TDigitalOceanConnectionInput,
   TValidateDigitalOceanCredentialsSchema
 } from "./digital-ocean";
+import {
+  TDNSMadeEasyConnection,
+  TDNSMadeEasyConnectionConfig,
+  TDNSMadeEasyConnectionInput,
+  TValidateDNSMadeEasyConnectionCredentialsSchema
+} from "./dns-made-easy/dns-made-easy-connection-types";
 import {
   TFlyioConnection,
   TFlyioConnectionConfig,
@@ -279,6 +285,7 @@ export type TAppConnection = { id: string } & (
   | TGitLabConnection
   | TCloudflareConnection
   | TBitbucketConnection
+  | TDNSMadeEasyConnection
   | TZabbixConnection
   | TRailwayConnection
   | TChecklyConnection
@@ -328,6 +335,7 @@ export type TAppConnectionInput = { id: string } & (
   | TGitLabConnectionInput
   | TCloudflareConnectionInput
   | TBitbucketConnectionInput
+  | TDNSMadeEasyConnectionInput
   | TZabbixConnectionInput
   | TRailwayConnectionInput
   | TChecklyConnectionInput
@@ -395,6 +403,7 @@ export type TAppConnectionConfig =
   | TGitLabConnectionConfig
   | TCloudflareConnectionConfig
   | TBitbucketConnectionConfig
+  | TDNSMadeEasyConnectionConfig
   | TZabbixConnectionConfig
   | TRailwayConnectionConfig
   | TChecklyConnectionConfig
@@ -439,6 +448,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateGitLabConnectionCredentialsSchema
   | TValidateCloudflareConnectionCredentialsSchema
   | TValidateBitbucketConnectionCredentialsSchema
+  | TValidateDNSMadeEasyConnectionCredentialsSchema
   | TValidateZabbixConnectionCredentialsSchema
   | TValidateRailwayConnectionCredentialsSchema
   | TValidateChecklyConnectionCredentialsSchema

backend/src/services/app-connection/dns-made-easy/dns-made-easy-connection-enum.ts

@@ -0,0 +1,3 @@
+export enum DNSMadeEasyConnectionMethod {
+  APIKeySecret = "api-key-secret"
+}

backend/src/services/app-connection/dns-made-easy/dns-made-easy-connection-fns.ts

@@ -0,0 +1,221 @@
+import { AxiosError } from "axios";
+
+import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { DNSMadeEasyConnectionMethod } from "./dns-made-easy-connection-enum";
+import {
+  TDNSMadeEasyConnection,
+  TDNSMadeEasyConnectionConfig,
+  TDNSMadeEasyZone
+} from "./dns-made-easy-connection-types";
+
+interface DNSMadeEasyApiResponse {
+  totalRecords: number;
+  totalPages: number;
+  data: Array<{
+    id: number;
+    name: string;
+    type: string;
+    value: string;
+  }>;
+  page: number;
+}
+
+export const getDNSMadeEasyUrl = (path: string) => {
+  const appCfg = getConfig();
+  return `${appCfg.DNS_MADE_EASY_SANDBOX_ENABLED ? IntegrationUrls.DNS_MADE_EASY_SANDBOX_API_URL : IntegrationUrls.DNS_MADE_EASY_API_URL}${path}`;
+};
+
+export const makeDNSMadeEasyAuthHeaders = (
+  apiKey: string,
+  secretKey: string,
+  currentDate?: Date
+): Record<string, string> => {
+  // Format date as "Day, DD Mon YYYY HH:MM:SS GMT" (e.g., "Mon, 01 Jan 2024 12:00:00 GMT")
+  const requestDate = (currentDate ?? new Date()).toUTCString();
+
+  // Generate HMAC-SHA1 signature
+  const hmac = crypto.nativeCrypto.createHmac("sha1", secretKey);
+  hmac.update(requestDate);
+  const hmacSignature = hmac.digest("hex");
+
+  return {
+    "x-dnsme-apiKey": apiKey,
+    "x-dnsme-hmac": hmacSignature,
+    "x-dnsme-requestDate": requestDate
+  };
+};
+
+export const getDNSMadeEasyConnectionListItem = () => {
+  return {
+    name: "DNS Made Easy" as const,
+    app: AppConnection.DNSMadeEasy as const,
+    methods: Object.values(DNSMadeEasyConnectionMethod) as [DNSMadeEasyConnectionMethod.APIKeySecret]
+  };
+};
+
+export const listDNSMadeEasyZones = async (appConnection: TDNSMadeEasyConnection): Promise<TDNSMadeEasyZone[]> => {
+  if (appConnection.method !== DNSMadeEasyConnectionMethod.APIKeySecret) {
+    throw new BadRequestError({ message: "Unsupported DNS Made Easy connection method" });
+  }
+
+  const {
+    credentials: { apiKey, secretKey }
+  } = appConnection;
+
+  try {
+    const allZones: TDNSMadeEasyZone[] = [];
+    let currentPage = 0;
+    let totalPages = 1;
+
+    // Fetch all pages of zones
+    while (currentPage < totalPages) {
+      // eslint-disable-next-line no-await-in-loop
+      const resp = await request.get<DNSMadeEasyApiResponse>(getDNSMadeEasyUrl("/V2.0/dns/managed/"), {
+        headers: {
+          ...makeDNSMadeEasyAuthHeaders(apiKey, secretKey),
+          Accept: "application/json"
+        },
+        params: {
+          page: currentPage
+        }
+      });
+
+      if (resp.data?.data) {
+        // Map the API response to TDNSMadeEasyZone format
+        const zones = resp.data.data.map((zone) => ({
+          id: String(zone.id),
+          name: zone.name
+        }));
+        allZones.push(...zones);
+
+        // Update pagination info
+        totalPages = resp.data.totalPages || 1;
+        currentPage += 1;
+      } else {
+        break;
+      }
+    }
+
+    return allZones;
+  } catch (error: unknown) {
+    logger.error(error, "Error listing DNS Made Easy zones");
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        message: `Failed to list DNS Made Easy zones: ${error.response?.data?.error?.[0] || error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list DNS Made Easy zones"
+    });
+  }
+};
+
+export const listDNSMadeEasyRecords = async (
+  appConnection: TDNSMadeEasyConnection,
+  options: { zoneId: string; type?: string; name?: string }
+): Promise<DNSMadeEasyApiResponse["data"]> => {
+  if (appConnection.method !== DNSMadeEasyConnectionMethod.APIKeySecret) {
+    throw new BadRequestError({ message: "Unsupported DNS Made Easy connection method" });
+  }
+  const {
+    credentials: { apiKey, secretKey }
+  } = appConnection;
+  const { zoneId, type, name } = options;
+
+  try {
+    const allRecords: DNSMadeEasyApiResponse["data"] = [];
+    let currentPage = 0;
+    let totalPages = 1;
+
+    // Fetch all pages of records
+    while (currentPage < totalPages) {
+      // Build query parameters
+      const queryParams: Record<string, string | number> = {};
+      if (type) {
+        queryParams.type = type;
+      }
+      if (name) {
+        queryParams.recordName = name;
+      }
+      queryParams.page = currentPage;
+
+      // eslint-disable-next-line no-await-in-loop
+      const resp = await request.get<DNSMadeEasyApiResponse>(
+        getDNSMadeEasyUrl(`/V2.0/dns/managed/${encodeURIComponent(zoneId)}/records`),
+        {
+          headers: {
+            ...makeDNSMadeEasyAuthHeaders(apiKey, secretKey),
+            Accept: "application/json"
+          },
+          params: queryParams
+        }
+      );
+
+      if (resp.data?.data) {
+        allRecords.push(...resp.data.data);
+
+        // Update pagination info
+        totalPages = resp.data.totalPages || 1;
+        currentPage += 1;
+      } else {
+        break;
+      }
+    }
+
+    return allRecords;
+  } catch (error: unknown) {
+    logger.error(error, "Error listing DNS Made Easy records");
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        message: `Failed to list DNS Made Easy records: ${error.response?.data?.error?.[0] || error.message || "Unknown error"}`
+      });
+    }
+    throw new BadRequestError({
+      message: "Unable to list DNS Made Easy records"
+    });
+  }
+};
+
+export const validateDNSMadeEasyConnectionCredentials = async (config: TDNSMadeEasyConnectionConfig) => {
+  if (config.method !== DNSMadeEasyConnectionMethod.APIKeySecret) {
+    throw new BadRequestError({ message: "Unsupported DNS Made Easy connection method" });
+  }
+
+  const { apiKey, secretKey } = config.credentials;
+
+  try {
+    const resp = await request.get(getDNSMadeEasyUrl("/V2.0/dns/managed/"), {
+      headers: {
+        ...makeDNSMadeEasyAuthHeaders(apiKey, secretKey),
+        Accept: "application/json"
+      }
+    });
+    if (resp.status !== 200) {
+      throw new BadRequestError({
+        message: "Unable to validate connection: Invalid API credentials provided."
+      });
+    }
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
+        message: `Failed to validate credentials: ${error.response?.data?.error?.[0] || error.message || "Unknown error"}`
+      });
+    }
+    logger.error(error, "Error validating DNS Made Easy connection credentials");
+    throw new BadRequestError({
+      message: "Unable to validate connection: verify credentials"
+    });
+  }
+
+  return config.credentials;
+};

backend/src/services/app-connection/dns-made-easy/dns-made-easy-connection-schema.ts

@@ -0,0 +1,64 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { APP_CONNECTION_NAME_MAP } from "../app-connection-maps";
+import { DNSMadeEasyConnectionMethod } from "./dns-made-easy-connection-enum";
+
+export const DNSMadeEasyConnectionApiKeyCredentialsSchema = z.object({
+  apiKey: z.string().trim().min(1, "API key required").max(256, "API key cannot exceed 256 characters"),
+  secretKey: z.string().trim().min(1, "Secret key required").max(256, "Secret key cannot exceed 256 characters")
+});
+
+const BaseDNSMadeEasyConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.DNSMadeEasy)
+});
+
+export const DNSMadeEasyConnectionSchema = BaseDNSMadeEasyConnectionSchema.extend({
+  method: z.literal(DNSMadeEasyConnectionMethod.APIKeySecret),
+  credentials: DNSMadeEasyConnectionApiKeyCredentialsSchema
+});
+
+export const SanitizedDNSMadeEasyConnectionSchema = z.discriminatedUnion("method", [
+  BaseDNSMadeEasyConnectionSchema.extend({
+    method: z.literal(DNSMadeEasyConnectionMethod.APIKeySecret),
+    credentials: DNSMadeEasyConnectionApiKeyCredentialsSchema.pick({ apiKey: true })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.DNSMadeEasy]} (API Key)` }))
+]);
+
+export const ValidateDNSMadeEasyConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(DNSMadeEasyConnectionMethod.APIKeySecret)
+      .describe(AppConnections.CREATE(AppConnection.DNSMadeEasy).method),
+    credentials: DNSMadeEasyConnectionApiKeyCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.DNSMadeEasy).credentials
+    )
+  })
+]);
+
+export const CreateDNSMadeEasyConnectionSchema = ValidateDNSMadeEasyConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.DNSMadeEasy)
+);
+
+export const UpdateDNSMadeEasyConnectionSchema = z
+  .object({
+    credentials: DNSMadeEasyConnectionApiKeyCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.DNSMadeEasy).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.DNSMadeEasy));
+
+export const DNSMadeEasyConnectionListItemSchema = z
+  .object({
+    name: z.literal("DNS Made Easy"),
+    app: z.literal(AppConnection.DNSMadeEasy),
+    methods: z.nativeEnum(DNSMadeEasyConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.DNSMadeEasy] }));

backend/src/services/app-connection/dns-made-easy/dns-made-easy-connection-service.ts

@@ -0,0 +1,35 @@
+import { BadRequestError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import { listDNSMadeEasyZones } from "./dns-made-easy-connection-fns";
+import { TDNSMadeEasyConnection } from "./dns-made-easy-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TDNSMadeEasyConnection>;
+
+export const dnsMadeEasyConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listZones = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.DNSMadeEasy, connectionId, actor);
+    try {
+      const zones = await listDNSMadeEasyZones(appConnection);
+      return zones;
+    } catch (error) {
+      logger.error(
+        error,
+        `Failed to list DNS Made Easy zones for DNS Made Easy connection [connectionId=${connectionId}]`
+      );
+      throw new BadRequestError({
+        message: `Failed to list DNS Made Easy zones: ${error instanceof Error ? error.message : "Unknown error"}`
+      });
+    }
+  };
+
+  return {
+    listZones
+  };
+};

backend/src/services/app-connection/dns-made-easy/dns-made-easy-connection-types.ts

@@ -0,0 +1,30 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateDNSMadeEasyConnectionSchema,
+  DNSMadeEasyConnectionSchema,
+  ValidateDNSMadeEasyConnectionCredentialsSchema
+} from "./dns-made-easy-connection-schema";
+
+export type TDNSMadeEasyConnection = z.infer<typeof DNSMadeEasyConnectionSchema>;
+
+export type TDNSMadeEasyConnectionInput = z.infer<typeof CreateDNSMadeEasyConnectionSchema> & {
+  app: AppConnection.DNSMadeEasy;
+};
+
+export type TValidateDNSMadeEasyConnectionCredentialsSchema = typeof ValidateDNSMadeEasyConnectionCredentialsSchema;
+
+export type TDNSMadeEasyConnectionConfig = DiscriminativePick<
+  TDNSMadeEasyConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TDNSMadeEasyZone = {
+  id: string;
+  name: string;
+};

backend/src/services/certificate-authority/acme/acme-certificate-authority-enums.ts

@@ -1,4 +1,5 @@
 export enum AcmeDnsProvider {
   Route53 = "route53",
-  Cloudflare = "cloudflare"
+  Cloudflare = "cloudflare",
+  DNSMadeEasy = "dns-made-easy"
 }

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -14,6 +14,7 @@ import { decryptAppConnection } from "@app/services/app-connection/app-connectio
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { TAwsConnection } from "@app/services/app-connection/aws/aws-connection-types";
 import { TCloudflareConnection } from "@app/services/app-connection/cloudflare/cloudflare-connection-types";
+import { TDNSMadeEasyConnection } from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-types";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
@@ -43,6 +44,7 @@ import {
   TUpdateAcmeCertificateAuthorityDTO
 } from "./acme-certificate-authority-types";
 import { cloudflareDeleteTxtRecord, cloudflareInsertTxtRecord } from "./dns-providers/cloudflare";
+import { dnsMadeEasyDeleteTxtRecord, dnsMadeEasyInsertTxtRecord } from "./dns-providers/dns-made-easy";
 import { route53DeleteTxtRecord, route53InsertTxtRecord } from "./dns-providers/route54";
 
 type TAcmeCertificateAuthorityFnsDeps = {
@@ -120,6 +122,22 @@ export const castDbEntryToAcmeCertificateAuthority = (
   };
 };
 
+const getAcmeChallengeRecord = (
+  provider: AcmeDnsProvider,
+  identifierValue: string,
+  keyAuthorization: string
+): { recordName: string; recordValue: string } => {
+  let recordName: string;
+  if (provider === AcmeDnsProvider.DNSMadeEasy) {
+    // For DNS Made Easy, we don't need to provide the domain name in the record name.
+    recordName = "_acme-challenge";
+  } else {
+    recordName = `_acme-challenge.${identifierValue}`; // e.g., "_acme-challenge.example.com"
+  }
+  const recordValue = `"${keyAuthorization}"`; // must be double quoted
+  return { recordName, recordValue };
+};
+
 export const orderCertificate = async (
   {
     caId,
@@ -241,8 +259,11 @@ export const orderCertificate = async (
         throw new Error("Unsupported challenge type");
       }
 
-      const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-      const recordValue = `"${keyAuthorization}"`; // must be double quoted
+      const { recordName, recordValue } = getAcmeChallengeRecord(
+        acmeCa.configuration.dnsProviderConfig.provider,
+        authz.identifier.value,
+        keyAuthorization
+      );
 
       switch (acmeCa.configuration.dnsProviderConfig.provider) {
         case AcmeDnsProvider.Route53: {
@@ -263,14 +284,26 @@ export const orderCertificate = async (
           );
           break;
         }
+        case AcmeDnsProvider.DNSMadeEasy: {
+          await dnsMadeEasyInsertTxtRecord(
+            connection as TDNSMadeEasyConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
         default: {
           throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
         }
       }
     },
     challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-      const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-      const recordValue = `"${keyAuthorization}"`; // must be double quoted
+      const { recordName, recordValue } = getAcmeChallengeRecord(
+        acmeCa.configuration.dnsProviderConfig.provider,
+        authz.identifier.value,
+        keyAuthorization
+      );
 
       switch (acmeCa.configuration.dnsProviderConfig.provider) {
         case AcmeDnsProvider.Route53: {
@@ -291,6 +324,15 @@ export const orderCertificate = async (
           );
           break;
         }
+        case AcmeDnsProvider.DNSMadeEasy: {
+          await dnsMadeEasyDeleteTxtRecord(
+            connection as TDNSMadeEasyConnection,
+            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
+            recordName,
+            recordValue
+          );
+          break;
+        }
         default: {
           throw new Error(`Unsupported DNS provider: ${acmeCa.configuration.dnsProviderConfig.provider as string}`);
         }
@@ -413,6 +455,12 @@ export const AcmeCertificateAuthorityFns = ({
       });
     }
 
+    if (dnsProviderConfig.provider === AcmeDnsProvider.DNSMadeEasy && appConnection.app !== AppConnection.DNSMadeEasy) {
+      throw new BadRequestError({
+        message: `App connection with ID '${dnsAppConnectionId}' is not a DNS Made Easy connection`
+      });
+    }
+
     // validates permission to connect
     await appConnectionService.validateAppConnectionUsageById(
       appConnection.app as AppConnection,
@@ -508,6 +556,15 @@ export const AcmeCertificateAuthorityFns = ({
           });
         }
 
+        if (
+          dnsProviderConfig.provider === AcmeDnsProvider.DNSMadeEasy &&
+          appConnection.app !== AppConnection.DNSMadeEasy
+        ) {
+          throw new BadRequestError({
+            message: `App connection with ID '${dnsAppConnectionId}' is not a DNS Made Easy connection`
+          });
+        }
+
         const ca = await certificateAuthorityDAL.findById(id);
 
         if (!ca) {

backend/src/services/certificate-authority/acme/dns-providers/dns-made-easy.ts

@@ -0,0 +1,106 @@
+import axios from "axios";
+
+import { request } from "@app/lib/config/request";
+import { logger } from "@app/lib/logger";
+import {
+  getDNSMadeEasyUrl,
+  listDNSMadeEasyRecords,
+  makeDNSMadeEasyAuthHeaders
+} from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-fns";
+import { TDNSMadeEasyConnection } from "@app/services/app-connection/dns-made-easy/dns-made-easy-connection-types";
+
+export const dnsMadeEasyInsertTxtRecord = async (
+  connection: TDNSMadeEasyConnection,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const {
+    credentials: { apiKey, secretKey }
+  } = connection;
+
+  logger.info({ hostedZoneId, domain, value }, "Inserting TXT record for DNS Made Easy");
+  try {
+    await request.post(
+      getDNSMadeEasyUrl(`/V2.0/dns/managed/${encodeURIComponent(hostedZoneId)}/records`),
+      {
+        type: "TXT",
+        name: domain,
+        value,
+        ttl: 60
+      },
+      {
+        headers: {
+          ...makeDNSMadeEasyAuthHeaders(apiKey, secretKey),
+          "Content-Type": "application/json",
+          Accept: "application/json"
+        }
+      }
+    );
+  } catch (error) {
+    if (axios.isAxiosError(error)) {
+      const errorMessage =
+        (error.response?.data as { error?: string[] | string })?.error?.[0] ||
+        (error.response?.data as { error?: string[] | string })?.error ||
+        error.message ||
+        "Unknown error";
+
+      if (error.status === 400 && error.message.includes("already exists")) {
+        logger.info({ domain, value }, `Record already exists for domain: ${domain} and value: ${value}`);
+        return;
+      }
+
+      throw new Error(typeof errorMessage === "string" ? errorMessage : String(errorMessage));
+    }
+    throw error;
+  }
+};
+
+export const dnsMadeEasyDeleteTxtRecord = async (
+  connection: TDNSMadeEasyConnection,
+  hostedZoneId: string,
+  domain: string,
+  value: string
+) => {
+  const {
+    credentials: { apiKey, secretKey }
+  } = connection;
+
+  logger.info({ hostedZoneId, domain, value }, "Deleting TXT record for DNS Made Easy");
+  try {
+    const dnsRecords = await listDNSMadeEasyRecords(connection, { zoneId: hostedZoneId, type: "TXT", name: domain });
+
+    let foundRecord = false;
+    if (dnsRecords.length > 0) {
+      const recordToDelete = dnsRecords.find(
+        (record) => record.type === "TXT" && record.name === domain && record.value === value
+      );
+
+      if (recordToDelete) {
+        await request.delete(
+          getDNSMadeEasyUrl(`/V2.0/dns/managed/${encodeURIComponent(hostedZoneId)}/records/${recordToDelete.id}`),
+          {
+            headers: {
+              ...makeDNSMadeEasyAuthHeaders(apiKey, secretKey),
+              Accept: "application/json"
+            }
+          }
+        );
+        foundRecord = true;
+      }
+    }
+    if (!foundRecord) {
+      logger.warn({ hostedZoneId, domain, value }, "Record to delete not found");
+    }
+  } catch (error) {
+    if (axios.isAxiosError(error)) {
+      const errorMessage =
+        (error.response?.data as { error?: string[] | string })?.error?.[0] ||
+        (error.response?.data as { error?: string[] | string })?.error ||
+        error.message ||
+        "Unknown error";
+      throw new Error(typeof errorMessage === "string" ? errorMessage : String(errorMessage));
+    }
+    throw error;
+  }
+};

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

@@ -67,6 +67,12 @@ export const certificateEstV3ServiceFactory = ({
       throw new BadRequestError({ message: "EST enrollment not configured for this profile" });
     }
 
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for EST enrollment"
+      });
+    }
+
     const estConfig = await estEnrollmentConfigDAL.findById(profile.estConfigId);
     if (!estConfig) {
       throw new NotFoundError({ message: "EST configuration not found" });
@@ -169,6 +175,12 @@ export const certificateEstV3ServiceFactory = ({
       throw new BadRequestError({ message: "EST enrollment not configured for this profile" });
     }
 
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for EST enrollment"
+      });
+    }
+
     const estConfig = await estEnrollmentConfigDAL.findById(profile.estConfigId);
     if (!estConfig) {
       throw new NotFoundError({ message: "EST configuration not found" });
@@ -281,6 +293,12 @@ export const certificateEstV3ServiceFactory = ({
       throw new BadRequestError({ message: "EST enrollment not configured for this profile" });
     }
 
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for EST enrollment"
+      });
+    }
+
     const estConfig = await estEnrollmentConfigDAL.findById(profile.estConfigId);
     if (!estConfig) {
       throw new NotFoundError({ message: "EST configuration not found" });

backend/src/services/certificate-profile/certificate-profile-dal.ts

@@ -7,6 +7,7 @@ import { ormify, selectAllTableCols } from "@app/lib/knex";
 
 import {
   EnrollmentType,
+  IssuerType,
   TCertificateProfile,
   TCertificateProfileCertificate,
   TCertificateProfileInsert,
@@ -198,6 +199,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         slug: result.slug,
         description: result.description,
         enrollmentType: result.enrollmentType as EnrollmentType,
+        issuerType: result.issuerType as IssuerType,
         estConfigId: result.estConfigId,
         apiConfigId: result.apiConfigId,
         acmeConfigId: result.acmeConfigId,
@@ -239,12 +241,13 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
       limit?: number;
       search?: string;
       enrollmentType?: EnrollmentType;
+      issuerType?: IssuerType;
       caId?: string;
     } = {},
     tx?: Knex
   ): Promise<TCertificateProfile[] | TCertificateProfileWithConfigs[]> => {
     try {
-      const { offset = 0, limit = 20, search, enrollmentType, caId } = options;
+      const { offset = 0, limit = 20, search, enrollmentType, issuerType, caId } = options;
 
       let baseQuery = (tx || db)(TableName.PkiCertificateProfile).where(
         `${TableName.PkiCertificateProfile}.projectId`,
@@ -269,6 +272,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         baseQuery = baseQuery.where(`${TableName.PkiCertificateProfile}.caId`, caId);
       }
 
+      if (issuerType) {
+        baseQuery = baseQuery.where(`${TableName.PkiCertificateProfile}.issuerType`, issuerType);
+      }
+
       const query = baseQuery
         .leftJoin(
           TableName.PkiEstEnrollmentConfig,
@@ -338,8 +345,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           slug: result.slug,
           description: result.description,
           enrollmentType: result.enrollmentType as EnrollmentType,
+          issuerType: result.issuerType as IssuerType,
           estConfigId: result.estConfigId,
           apiConfigId: result.apiConfigId,
+          acmeConfigId: result.acmeConfigId,
           createdAt: result.createdAt,
           updatedAt: result.updatedAt,
           estConfig,
@@ -359,12 +368,13 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
     options: {
       search?: string;
       enrollmentType?: EnrollmentType;
+      issuerType?: IssuerType;
       caId?: string;
     } = {},
     tx?: Knex
   ): Promise<number> => {
     try {
-      const { search, enrollmentType, caId } = options;
+      const { search, enrollmentType, issuerType, caId } = options;
 
       let query = (tx || db)(TableName.PkiCertificateProfile).where({ projectId });
 
@@ -384,6 +394,10 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
         query = query.where({ caId });
       }
 
+      if (issuerType) {
+        query = query.where({ issuerType });
+      }
+
       const result = await query.count("*").first();
       return parseInt((result as unknown as { count: string }).count || "0", 10);
     } catch (error) {

backend/src/services/certificate-profile/certificate-profile-schemas.ts

@@ -1,12 +1,13 @@
 import RE2 from "re2";
 import { z } from "zod";
 
-import { EnrollmentType } from "./certificate-profile-types";
+import { CertStatus } from "../certificate/certificate-types";
+import { EnrollmentType, IssuerType } from "./certificate-profile-types";
 
 export const createCertificateProfileSchema = z
   .object({
     projectId: z.string().uuid("Project ID must be valid"),
-    caId: z.string().uuid(),
+    caId: z.string().uuid().nullable().optional(),
     certificateTemplateId: z.string().uuid(),
     slug: z
       .string()
@@ -15,6 +16,7 @@ export const createCertificateProfileSchema = z
       .regex(new RE2("^[a-z0-9-]+$"), "Slug must contain only lowercase letters, numbers, and hyphens"),
     description: z.string().max(1000).optional(),
     enrollmentType: z.nativeEnum(EnrollmentType),
+    issuerType: z.nativeEnum(IssuerType).default(IssuerType.CA),
     estConfig: z
       .object({
         disableBootstrapCaValidation: z.boolean().default(false),
@@ -33,43 +35,100 @@ export const createCertificateProfileSchema = z
   .refine(
     (data) => {
       if (data.enrollmentType === EnrollmentType.EST) {
-        if (!data.estConfig) {
-          return false;
-        }
-        if (data.apiConfig) {
-          return false;
-        }
-        if (data.acmeConfig) {
-          return false;
-        }
-      }
-      if (data.enrollmentType === EnrollmentType.API) {
-        if (!data.apiConfig) {
-          return false;
-        }
-        if (data.estConfig) {
-          return false;
-        }
-        if (data.acmeConfig) {
-          return false;
-        }
-      }
-      if (data.enrollmentType === EnrollmentType.ACME) {
-        if (!data.acmeConfig) {
-          return false;
-        }
-        if (data.estConfig) {
-          return false;
-        }
-        if (data.apiConfig) {
-          return false;
-        }
+        return !!data.estConfig;
       }
       return true;
     },
     {
-      message:
-        "EST enrollment type requires EST configuration and cannot have API configuration. API enrollment type requires API configuration and cannot have EST configuration."
+      message: "EST enrollment type requires EST configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.API) {
+        return !!data.apiConfig;
+      }
+      return true;
+    },
+    {
+      message: "API enrollment type requires API configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.ACME) {
+        return !!data.acmeConfig;
+      }
+      return true;
+    },
+    {
+      message: "ACME enrollment type requires ACME configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.EST) {
+        return !data.apiConfig && !data.acmeConfig;
+      }
+      return true;
+    },
+    {
+      message: "EST enrollment type cannot have API or ACME configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.API) {
+        return !data.estConfig && !data.acmeConfig;
+      }
+      return true;
+    },
+    {
+      message: "API enrollment type cannot have EST or ACME configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.ACME) {
+        return !data.estConfig && !data.apiConfig;
+      }
+      return true;
+    },
+    {
+      message: "ACME enrollment type cannot have EST or API configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.issuerType === IssuerType.CA) {
+        return !!data.caId;
+      }
+      return true;
+    },
+    {
+      message: "CA issuer type requires a CA ID"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.issuerType === IssuerType.SELF_SIGNED) {
+        return !data.caId;
+      }
+      return true;
+    },
+    {
+      message: "Self-signed issuer type cannot have a CA ID"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.issuerType === IssuerType.SELF_SIGNED) {
+        return data.enrollmentType === EnrollmentType.API;
+      }
+      return true;
+    },
+    {
+      message: "Self-signed issuer type only supports API enrollment"
     }
   );
 
@@ -83,6 +142,7 @@ export const updateCertificateProfileSchema = z
       .optional(),
     description: z.string().max(1000).optional(),
     enrollmentType: z.nativeEnum(EnrollmentType).optional(),
+    issuerType: z.nativeEnum(IssuerType).optional(),
     estConfig: z
       .object({
         disableBootstrapCaValidation: z.boolean().default(false),
@@ -100,19 +160,34 @@ export const updateCertificateProfileSchema = z
   .refine(
     (data) => {
       if (data.enrollmentType === EnrollmentType.EST) {
-        if (data.apiConfig) {
-          return false;
-        }
-      }
-      if (data.enrollmentType === EnrollmentType.API) {
-        if (data.estConfig) {
-          return false;
-        }
+        return !data.apiConfig;
       }
       return true;
     },
     {
-      message: "Cannot have EST config with API enrollment type or API config with EST enrollment type."
+      message: "EST enrollment type cannot have API configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.enrollmentType === EnrollmentType.API) {
+        return !data.estConfig;
+      }
+      return true;
+    },
+    {
+      message: "API enrollment type cannot have EST configuration"
+    }
+  )
+  .refine(
+    (data) => {
+      if (data.issuerType === IssuerType.SELF_SIGNED) {
+        return !data.enrollmentType || data.enrollmentType === EnrollmentType.API;
+      }
+      return true;
+    },
+    {
+      message: "Self-signed issuer type only supports API enrollment"
     }
   );
 
@@ -131,6 +206,7 @@ export const listCertificateProfilesSchema = z.object({
   limit: z.coerce.number().min(1).max(100).default(20),
   search: z.string().optional(),
   enrollmentType: z.nativeEnum(EnrollmentType).optional(),
+  issuerType: z.nativeEnum(IssuerType).optional(),
   caId: z.string().uuid().optional()
 });
 
@@ -142,6 +218,6 @@ export const listCertificatesByProfileSchema = z.object({
   profileId: z.string().uuid(),
   offset: z.coerce.number().min(0).default(0),
   limit: z.coerce.number().min(1).max(100).default(20),
-  status: z.enum(["active", "expired", "revoked"]).optional(),
+  status: z.nativeEnum(CertStatus).optional(),
   search: z.string().optional()
 });

backend/src/services/certificate-profile/certificate-profile-service.test.ts

@@ -22,7 +22,12 @@ import type { TKmsServiceFactory } from "../kms/kms-service";
 import type { TProjectDALFactory } from "../project/project-dal";
 import type { TCertificateProfileDALFactory } from "./certificate-profile-dal";
 import { certificateProfileServiceFactory, TCertificateProfileServiceFactory } from "./certificate-profile-service";
-import { EnrollmentType, TCertificateProfile, TCertificateProfileWithConfigs } from "./certificate-profile-types";
+import {
+  EnrollmentType,
+  IssuerType,
+  TCertificateProfile,
+  TCertificateProfileWithConfigs
+} from "./certificate-profile-types";
 
 vi.mock("@app/lib/crypto/cryptography", () => ({
   crypto: {
@@ -90,6 +95,7 @@ describe("CertificateProfileService", () => {
     description: "Test certificate profile",
     slug: "test-profile",
     enrollmentType: EnrollmentType.API,
+    issuerType: IssuerType.CA,
     caId: "ca-123",
     certificateTemplateId: "template-123",
     apiConfigId: "api-config-123",
@@ -272,6 +278,7 @@ describe("CertificateProfileService", () => {
       slug: "new-profile",
       description: "New test profile",
       enrollmentType: EnrollmentType.API,
+      issuerType: IssuerType.CA,
       caId: "ca-123",
       certificateTemplateId: "template-123",
       apiConfig: {
@@ -312,6 +319,7 @@ describe("CertificateProfileService", () => {
           slug: "new-profile",
           description: "New test profile",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           apiConfigId: "api-config-123",
@@ -383,6 +391,7 @@ describe("CertificateProfileService", () => {
         slug: "invalid-profile",
         description: "Invalid test profile",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123"
       };
@@ -401,6 +410,7 @@ describe("CertificateProfileService", () => {
         slug: "api-profile",
         description: "Profile with API enrollment",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         apiConfig: {
@@ -726,6 +736,7 @@ describe("CertificateProfileService", () => {
           slug: "est-profile",
           description: "Profile with EST enrollment",
           enrollmentType: EnrollmentType.EST,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           estConfig: {
@@ -776,6 +787,7 @@ describe("CertificateProfileService", () => {
           slug: "different-profile-name",
           description: "Profile with duplicate slug",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           apiConfig: {
@@ -801,6 +813,7 @@ describe("CertificateProfileService", () => {
           slug: "auto-renew-profile",
           description: "Profile with auto-renewal",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           apiConfig: {
@@ -965,6 +978,7 @@ describe("CertificateProfileService", () => {
           slug: "invalid-template-profile",
           description: "Profile with invalid template",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "nonexistent-template",
           apiConfig: {
@@ -990,6 +1004,7 @@ describe("CertificateProfileService", () => {
           slug: "concurrent-profile",
           description: "Profile created concurrently",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           apiConfig: {
@@ -1018,6 +1033,7 @@ describe("CertificateProfileService", () => {
           slug: "cross-project-profile",
           description: "Profile using template from different project",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-456",
           apiConfig: {
@@ -1047,6 +1063,7 @@ describe("CertificateProfileService", () => {
           slug: "invalid-slug-profile",
           description: "Profile with invalid slug format",
           enrollmentType: EnrollmentType.API,
+          issuerType: IssuerType.CA,
           caId: "ca-123",
           certificateTemplateId: "template-123",
           apiConfig: {

backend/src/services/certificate-profile/certificate-profile-service.ts

@@ -32,6 +32,7 @@ import { getProjectKmsCertificateKeyId } from "../project/project-fns";
 import { TCertificateProfileDALFactory } from "./certificate-profile-dal";
 import {
   EnrollmentType,
+  IssuerType,
   TCertificateProfile,
   TCertificateProfileCertificate,
   TCertificateProfileInsert,
@@ -39,6 +40,34 @@ import {
   TCertificateProfileWithConfigs
 } from "./certificate-profile-types";
 
+const validateIssuerTypeConstraints = (
+  issuerType: IssuerType,
+  enrollmentType: EnrollmentType,
+  caId: string | null,
+  existingCaId?: string | null
+) => {
+  if (issuerType === IssuerType.CA) {
+    if (!caId && !existingCaId) {
+      throw new ForbiddenRequestError({
+        message: "CA issuer type requires a Certificate Authority to be selected"
+      });
+    }
+  }
+
+  if (issuerType === IssuerType.SELF_SIGNED) {
+    if (caId) {
+      throw new ForbiddenRequestError({
+        message: "Self-signed issuer type cannot have a Certificate Authority"
+      });
+    }
+    if (enrollmentType !== EnrollmentType.API) {
+      throw new ForbiddenRequestError({
+        message: "Self-signed issuer type only supports API enrollment"
+      });
+    }
+  }
+};
+
 const generateAndEncryptAcmeEabSecret = async (
   projectId: string,
   kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey">,
@@ -163,7 +192,8 @@ export type TCertificateProfileServiceFactory = ReturnType<typeof certificatePro
 const convertDalToService = (dalResult: Record<string, unknown>): TCertificateProfile => {
   return {
     ...dalResult,
-    enrollmentType: dalResult.enrollmentType as EnrollmentType
+    enrollmentType: dalResult.enrollmentType as EnrollmentType,
+    issuerType: dalResult.issuerType as IssuerType
   } as TCertificateProfile;
 };
 
@@ -240,6 +270,8 @@ export const certificateProfileServiceFactory = ({
       });
     }
 
+    validateIssuerTypeConstraints(data.issuerType, data.enrollmentType, data.caId ?? null);
+
     // Validate enrollment configuration requirements
     if (data.enrollmentType === EnrollmentType.EST && !data.estConfig) {
       throw new ForbiddenRequestError({
@@ -376,7 +408,16 @@ export const certificateProfileServiceFactory = ({
       }
     }
 
-    const { estConfig, apiConfig, ...profileUpdateData } = data;
+    const finalIssuerType = data.issuerType || existingProfile.issuerType;
+    const finalEnrollmentType = data.enrollmentType || existingProfile.enrollmentType;
+    const finalCaId = data.caId !== undefined ? data.caId : existingProfile.caId;
+
+    validateIssuerTypeConstraints(finalIssuerType, finalEnrollmentType, finalCaId ?? null, existingProfile.caId);
+
+    const updatedData =
+      finalIssuerType === IssuerType.SELF_SIGNED && existingProfile.caId ? { ...data, caId: null } : data;
+
+    const { estConfig, apiConfig, ...profileUpdateData } = updatedData;
 
     const updatedProfile = await certificateProfileDAL.transaction(async (tx) => {
       if (estConfig && existingProfile.estConfigId) {
@@ -569,6 +610,7 @@ export const certificateProfileServiceFactory = ({
     limit = 20,
     search,
     enrollmentType,
+    issuerType,
     caId
   }: {
     actor: ActorType;
@@ -580,6 +622,7 @@ export const certificateProfileServiceFactory = ({
     limit?: number;
     search?: string;
     enrollmentType?: EnrollmentType;
+    issuerType?: IssuerType;
     caId?: string;
   }): Promise<{
     profiles: TCertificateProfileWithConfigs[];
@@ -603,12 +646,14 @@ export const certificateProfileServiceFactory = ({
       limit,
       search,
       enrollmentType,
+      issuerType,
       caId
     });
 
     const totalCount = await certificateProfileDAL.countByProjectId(projectId, {
       search,
       enrollmentType,
+      issuerType,
       caId
     });
 

backend/src/services/certificate-profile/certificate-profile-types.ts

@@ -10,16 +10,24 @@ export enum EnrollmentType {
   ACME = "acme"
 }
 
-export type TCertificateProfile = Omit<TPkiCertificateProfiles, "enrollmentType"> & {
+export enum IssuerType {
+  CA = "ca",
+  SELF_SIGNED = "self-signed"
+}
+
+export type TCertificateProfile = Omit<TPkiCertificateProfiles, "enrollmentType" | "issuerType"> & {
   enrollmentType: EnrollmentType;
+  issuerType: IssuerType;
 };
 
-export type TCertificateProfileInsert = Omit<TPkiCertificateProfilesInsert, "enrollmentType"> & {
+export type TCertificateProfileInsert = Omit<TPkiCertificateProfilesInsert, "enrollmentType" | "issuerType"> & {
   enrollmentType: EnrollmentType;
+  issuerType: IssuerType;
 };
 
-export type TCertificateProfileUpdate = Omit<TPkiCertificateProfilesUpdate, "enrollmentType"> & {
+export type TCertificateProfileUpdate = Omit<TPkiCertificateProfilesUpdate, "enrollmentType" | "issuerType"> & {
   enrollmentType?: EnrollmentType;
+  issuerType?: IssuerType;
   estConfig?: {
     disableBootstrapCaValidation?: boolean;
     passphrase?: string;

backend/src/services/certificate-v3/certificate-v3-service.test.ts

@@ -22,7 +22,7 @@ import {
   CertSubjectAttributeType
 } from "@app/services/certificate-common/certificate-constants";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
-import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
+import { EnrollmentType, IssuerType } from "@app/services/certificate-profile/certificate-profile-types";
 import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
 
 import { ActorType, AuthMethod } from "../auth/auth-type";
@@ -40,18 +40,29 @@ vi.mock("../certificate-common/certificate-csr-utils", () => ({
 describe("CertificateV3Service", () => {
   let service: TCertificateV3ServiceFactory;
 
-  const mockCertificateDAL: Pick<TCertificateDALFactory, "findOne" | "findById" | "updateById" | "transaction"> = {
+  const mockCertificateDAL: Pick<
+    TCertificateDALFactory,
+    "findOne" | "findById" | "updateById" | "transaction" | "create"
+  > = {
     findOne: vi.fn(),
     findById: vi.fn(),
     updateById: vi.fn(),
+    create: vi.fn().mockResolvedValue({
+      id: "new-cert-id",
+      serialNumber: "123456789",
+      friendlyName: "Test Certificate",
+      commonName: "test.example.com",
+      status: "ACTIVE"
+    }),
     transaction: vi.fn().mockImplementation(async (callback: (tx: any) => Promise<unknown>) => {
       const mockTx = {};
       return callback(mockTx);
     })
   };
 
-  const mockCertificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne"> = {
-    findOne: vi.fn()
+  const mockCertificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne" | "create"> = {
+    findOne: vi.fn(),
+    create: vi.fn()
   };
 
   const mockCertificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa"> = {
@@ -150,7 +161,24 @@ describe("CertificateV3Service", () => {
       },
       pkiSyncQueue: {
         queuePkiSyncSyncCertificatesById: vi.fn().mockResolvedValue(undefined)
-      }
+      },
+      certificateBodyDAL: {
+        create: vi.fn().mockResolvedValue({ id: "body-123" })
+      },
+      kmsService: {
+        generateKmsKey: vi.fn().mockResolvedValue("kms-key-123"),
+        encryptWithKmsKey: vi.fn().mockResolvedValue(vi.fn().mockResolvedValue(Buffer.from("encrypted"))),
+        decryptWithKmsKey: vi.fn().mockResolvedValue(vi.fn().mockResolvedValue(Buffer.from("decrypted")))
+      },
+      projectDAL: {
+        findOne: vi.fn().mockResolvedValue({ id: "project-123" }),
+        findById: vi.fn().mockResolvedValue({ id: "project-123" }),
+        updateById: vi.fn().mockResolvedValue({ id: "project-123" }),
+        transaction: vi.fn().mockImplementation(async (callback: (tx: any) => Promise<unknown>) => {
+          const mockTx = {};
+          return callback(mockTx);
+        })
+      } as any
     });
   });
 
@@ -175,6 +203,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -319,6 +348,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -508,6 +538,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.EST, // Wrong enrollment type
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -561,6 +592,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -721,6 +753,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.EST, // Wrong enrollment type
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -772,6 +805,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -933,6 +967,7 @@ describe("CertificateV3Service", () => {
         id: profileId,
         projectId: "project-123",
         enrollmentType: EnrollmentType.EST, // Wrong enrollment type
+        issuerType: IssuerType.CA,
         caId: "ca-123",
         certificateTemplateId: "template-123",
         createdAt: new Date(),
@@ -971,6 +1006,7 @@ describe("CertificateV3Service", () => {
       caId: "ca-1",
       certificateTemplateId: "template-1",
       enrollmentType: EnrollmentType.API,
+      issuerType: IssuerType.CA,
       createdAt: new Date(),
       updatedAt: new Date(),
       description: "Test profile for algorithm compatibility",
@@ -1552,6 +1588,7 @@ describe("CertificateV3Service", () => {
       id: "profile-123",
       projectId: "project-123",
       enrollmentType: EnrollmentType.API,
+      issuerType: IssuerType.CA,
       caId: "ca-123",
       certificateTemplateId: "template-123",
       apiConfig: {
@@ -1733,9 +1770,9 @@ describe("CertificateV3Service", () => {
       });
     });
 
-    it("should reject renewal if certificate is not from a profile", async () => {
-      const certWithoutProfile = { ...mockOriginalCert, profileId: null };
-      vi.mocked(mockCertificateDAL.findById).mockResolvedValue(certWithoutProfile);
+    it("should reject renewal if certificate has no profile and no CA", async () => {
+      const certWithoutProfileAndCA = { ...mockOriginalCert, profileId: null, caId: null };
+      vi.mocked(mockCertificateDAL.findById).mockResolvedValue(certWithoutProfileAndCA);
 
       // Set up transaction mock to properly handle errors
       vi.mocked(mockCertificateDAL.transaction).mockImplementation(async (callback: (tx: any) => Promise<unknown>) => {
@@ -2008,6 +2045,7 @@ describe("CertificateV3Service", () => {
       const mockProfile = {
         id: "profile-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         projectId: "project-123"
       };
 
@@ -2084,6 +2122,7 @@ describe("CertificateV3Service", () => {
       const mockProfile = {
         id: "profile-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         projectId: "project-123"
       };
 
@@ -2129,6 +2168,7 @@ describe("CertificateV3Service", () => {
       const mockProfile = {
         id: "profile-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         projectId: "project-123"
       };
 
@@ -2172,6 +2212,7 @@ describe("CertificateV3Service", () => {
       const mockProfile = {
         id: "profile-123",
         enrollmentType: EnrollmentType.API,
+        issuerType: IssuerType.CA,
         projectId: "project-123"
       };
 

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -1,8 +1,9 @@
 import { ForbiddenError } from "@casl/ability";
+import * as x509 from "@peculiar/x509";
 import { randomUUID } from "crypto";
 import RE2 from "re2";
 
-import { ActionProjectType } from "@app/db/schemas";
+import { ActionProjectType, TCertificates } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import {
   ProjectPermissionCertificateActions,
@@ -10,8 +11,11 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { TPkiAcmeAccountDALFactory } from "@app/ee/services/pki-acme/pki-acme-account-dal";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { ms } from "@app/lib/ms";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
+import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
 import {
@@ -28,12 +32,25 @@ import {
   TCertificateAuthorityWithAssociatedCa
 } from "@app/services/certificate-authority/certificate-authority-dal";
 import { CaStatus, CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import {
+  createDistinguishedName,
+  createSerialNumber,
+  keyAlgorithmToAlgCfg,
+  signatureAlgorithmToAlgCfg
+} from "@app/services/certificate-authority/certificate-authority-fns";
 import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
-import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
+import { EnrollmentType, IssuerType } from "@app/services/certificate-profile/certificate-profile-types";
 import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
-import { CertSubjectAlternativeNameType } from "../certificate-common/certificate-constants";
+import {
+  CertExtendedKeyUsageType,
+  CertKeyUsageType,
+  CertSubjectAlternativeNameType
+} from "../certificate-common/certificate-constants";
 import {
   extractAlgorithmsFromCSR,
   extractCertificateRequestFromCSR
@@ -68,8 +85,9 @@ import {
 } from "./certificate-v3-types";
 
 type TCertificateV3ServiceFactoryDep = {
-  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "findById" | "updateById" | "transaction">;
-  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne">;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "findById" | "updateById" | "transaction" | "create">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne" | "create">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
   certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">;
   acmeAccountDAL: Pick<TPkiAcmeAccountDALFactory, "findById">;
@@ -85,6 +103,8 @@ type TCertificateV3ServiceFactoryDep = {
   >;
   pkiSyncDAL: Pick<TPkiSyncDALFactory, "find">;
   pkiSyncQueue: Pick<TPkiSyncQueueFactory, "queuePkiSyncSyncCertificatesById">;
+  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey">;
+  projectDAL: TProjectDALFactory;
 };
 
 export type TCertificateV3ServiceFactory = ReturnType<typeof certificateV3ServiceFactory>;
@@ -329,6 +349,158 @@ const parseTtlToDays = (ttl: string): number => {
   }
 };
 
+const generateSelfSignedCertificate = async ({
+  certificateRequest,
+  template,
+  effectiveSignatureAlgorithm,
+  effectiveKeyAlgorithm
+}: {
+  certificateRequest: {
+    commonName?: string;
+    keyUsages?: CertKeyUsageType[];
+    extendedKeyUsages?: CertExtendedKeyUsageType[];
+    altNames?: Array<{
+      type: CertSubjectAlternativeNameType;
+      value: string;
+    }>;
+    validity: { ttl: string };
+    notBefore?: Date;
+    notAfter?: Date;
+  };
+  template?: {
+    subject?: Array<{
+      type: string;
+      allowed?: string[];
+      required?: string[];
+      denied?: string[];
+    }>;
+    sans?: Array<{
+      type: string;
+      allowed?: string[];
+      required?: string[];
+      denied?: string[];
+    }>;
+  } | null;
+  effectiveSignatureAlgorithm: CertSignatureAlgorithm;
+  effectiveKeyAlgorithm: CertKeyAlgorithm;
+}): Promise<{
+  certificate: Buffer;
+  privateKey: Buffer;
+  serialNumber: string;
+  notBefore: Date;
+  notAfter: Date;
+  certificateSubject: Record<string, unknown>;
+  subjectAlternativeNames: Array<{
+    type: CertSubjectAlternativeNameType;
+    value: string;
+  }>;
+}> => {
+  const certificateSubject = buildCertificateSubjectFromTemplate(certificateRequest, template?.subject);
+  const subjectAlternativeNames = buildSubjectAlternativeNamesFromTemplate(
+    { subjectAlternativeNames: certificateRequest.altNames },
+    template?.sans
+  );
+
+  const keyGenAlg = keyAlgorithmToAlgCfg(effectiveKeyAlgorithm);
+  const keyPair = await crypto.nativeCrypto.subtle.generateKey(keyGenAlg, true, ["sign", "verify"]);
+
+  const signatureAlgorithmConfig = signatureAlgorithmToAlgCfg(effectiveSignatureAlgorithm, effectiveKeyAlgorithm);
+
+  const notBeforeDate = certificateRequest.notBefore ? new Date(certificateRequest.notBefore) : new Date();
+
+  let notAfterDate: Date;
+  if (certificateRequest.notAfter) {
+    notAfterDate = new Date(certificateRequest.notAfter);
+  } else if (certificateRequest.validity.ttl) {
+    notAfterDate = new Date(new Date().getTime() + ms(certificateRequest.validity.ttl));
+  } else {
+    throw new BadRequestError({
+      message: "Either notAfter date or TTL must be provided for certificate validity"
+    });
+  }
+
+  const serialNumber = createSerialNumber();
+  const dn = createDistinguishedName({
+    commonName: certificateSubject.common_name,
+    organization: certificateSubject.organization,
+    ou: certificateSubject.organizational_unit,
+    country: certificateSubject.country,
+    province: certificateSubject.state_or_province_name,
+    locality: certificateSubject.locality_name
+  });
+
+  const cert = await x509.X509CertificateGenerator.createSelfSigned({
+    name: dn,
+    serialNumber,
+    notBefore: notBeforeDate,
+    notAfter: notAfterDate,
+    signingAlgorithm: signatureAlgorithmConfig,
+    keys: keyPair,
+    extensions: [
+      new x509.BasicConstraintsExtension(false, undefined, false),
+      ...(certificateRequest.keyUsages?.length
+        ? [
+            new x509.KeyUsagesExtension(
+              (convertKeyUsageArrayToLegacy(certificateRequest.keyUsages) || []).reduce(
+                // eslint-disable-next-line no-bitwise
+                (acc: number, usage) => acc | x509.KeyUsageFlags[usage],
+                0
+              ),
+              false
+            )
+          ]
+        : []),
+      ...(certificateRequest.extendedKeyUsages?.length
+        ? [
+            new x509.ExtendedKeyUsageExtension(
+              (convertExtendedKeyUsageArrayToLegacy(certificateRequest.extendedKeyUsages) || []).map(
+                (eku) => x509.ExtendedKeyUsage[eku]
+              ),
+              false
+            )
+          ]
+        : []),
+      ...(subjectAlternativeNames
+        ? [
+            new x509.SubjectAlternativeNameExtension(
+              certificateRequest.altNames?.map((san) => {
+                switch (san.type) {
+                  case CertSubjectAlternativeNameType.DNS_NAME:
+                    return { type: "dns" as const, value: san.value };
+                  case CertSubjectAlternativeNameType.IP_ADDRESS:
+                    return { type: "ip" as const, value: san.value };
+                  case CertSubjectAlternativeNameType.EMAIL:
+                    return { type: "email" as const, value: san.value };
+                  case CertSubjectAlternativeNameType.URI:
+                    return { type: "url" as const, value: san.value };
+                  default:
+                    throw new BadRequestError({
+                      message: `Unsupported Subject Alternative Name type: ${san.type as string}`
+                    });
+                }
+              }) || [],
+              false
+            )
+          ]
+        : [])
+    ]
+  });
+
+  const certificatePem = cert.toString("pem");
+  const privateKeyObj = crypto.nativeCrypto.KeyObject.from(keyPair.privateKey);
+  const privateKeyPem = privateKeyObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+  return {
+    certificate: Buffer.from(certificatePem),
+    privateKey: Buffer.from(privateKeyPem),
+    serialNumber,
+    notBefore: notBeforeDate,
+    notAfter: notAfterDate,
+    certificateSubject,
+    subjectAlternativeNames: certificateRequest.altNames || []
+  };
+};
+
 const calculateFinalRenewBeforeDays = (
   profile: { apiConfig?: { autoRenew?: boolean; renewBeforeDays?: number } },
   ttl: string,
@@ -348,8 +520,248 @@ const calculateFinalRenewBeforeDays = (
   return isValidRenewalTiming(renewBeforeDays, certificateExpiryDate) ? renewBeforeDays : undefined;
 };
 
+const getEffectiveAlgorithms = (
+  requestSignatureAlgorithm?: CertSignatureAlgorithm,
+  requestKeyAlgorithm?: CertKeyAlgorithm,
+  originalSignatureAlgorithm?: CertSignatureAlgorithm,
+  originalKeyAlgorithm?: CertKeyAlgorithm
+) => {
+  return {
+    signatureAlgorithm: requestSignatureAlgorithm || originalSignatureAlgorithm || CertSignatureAlgorithm.RSA_SHA256,
+    keyAlgorithm: requestKeyAlgorithm || originalKeyAlgorithm || CertKeyAlgorithm.RSA_2048
+  };
+};
+
+const createSelfSignedCertificateRecord = async ({
+  selfSignedResult,
+  certificateRequest,
+  profile,
+  originalCert,
+  certificateDAL,
+  tx,
+  isRenewal = false
+}: {
+  selfSignedResult: Awaited<ReturnType<typeof generateSelfSignedCertificate>>;
+  certificateRequest: {
+    commonName?: string;
+    keyUsages?: CertKeyUsageType[];
+    extendedKeyUsages?: CertExtendedKeyUsageType[];
+  };
+  profile?: { id: string; projectId: string } | null;
+  originalCert?: {
+    id: string;
+    friendlyName?: string | null;
+    commonName?: string | null;
+    projectId: string;
+  };
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "updateById">;
+  tx: Parameters<TCertificateDALFactory["create"]>[1];
+  isRenewal?: boolean;
+}) => {
+  const subjectCommonName =
+    (selfSignedResult.certificateSubject.common_name as string) ||
+    certificateRequest.commonName ||
+    originalCert?.commonName ||
+    "";
+
+  const altNamesList = selfSignedResult.subjectAlternativeNames.map((san) => san.value).join(",");
+
+  const projectId = originalCert?.projectId || profile?.projectId;
+  if (!projectId) {
+    throw new BadRequestError({ message: "Project ID is required for certificate creation" });
+  }
+
+  const baseRecord = {
+    serialNumber: selfSignedResult.serialNumber,
+    friendlyName: originalCert?.friendlyName || subjectCommonName,
+    commonName: subjectCommonName,
+    altNames: altNamesList,
+    status: CertStatus.ACTIVE,
+    notBefore: selfSignedResult.notBefore,
+    notAfter: selfSignedResult.notAfter,
+    projectId,
+    keyUsages: convertKeyUsageArrayToLegacy(certificateRequest.keyUsages) || [],
+    extendedKeyUsages: convertExtendedKeyUsageArrayToLegacy(certificateRequest.extendedKeyUsages) || [],
+    profileId: profile?.id || null
+  };
+
+  const renewalRecord =
+    isRenewal && originalCert
+      ? {
+          renewedFromCertificateId: originalCert.id
+        }
+      : {};
+
+  return certificateDAL.create(
+    {
+      ...baseRecord,
+      ...renewalRecord
+    },
+    tx
+  );
+};
+
+const createEncryptedCertificateData = async ({
+  certificateId,
+  certificate,
+  privateKey,
+  projectId,
+  certificateBodyDAL,
+  certificateSecretDAL,
+  kmsService,
+  projectDAL,
+  tx
+}: {
+  certificateId: string;
+  certificate: Buffer;
+  privateKey: Buffer;
+  projectId: string;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<TKmsServiceFactory, "encryptWithKmsKey" | "generateKmsKey">;
+  projectDAL: TProjectDALFactory;
+  tx: Parameters<TCertificateBodyDALFactory["create"]>[1];
+}) => {
+  const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
+    projectId,
+    projectDAL,
+    kmsService
+  });
+
+  const kmsEncryptor = await kmsService.encryptWithKmsKey({ kmsId: certificateManagerKeyId });
+
+  const encryptedCertificate = await kmsEncryptor({
+    plainText: certificate
+  });
+
+  await certificateBodyDAL.create(
+    {
+      certId: certificateId,
+      encryptedCertificate: encryptedCertificate.cipherTextBlob
+    },
+    tx
+  );
+
+  const encryptedPrivateKey = await kmsEncryptor({
+    plainText: privateKey
+  });
+
+  await certificateSecretDAL.create(
+    {
+      certId: certificateId,
+      encryptedPrivateKey: encryptedPrivateKey.cipherTextBlob
+    },
+    tx
+  );
+};
+
+const processSelfSignedCertificate = async ({
+  certificateRequest,
+  template,
+  profile,
+  originalCert,
+  effectiveAlgorithms,
+  certificateDAL,
+  certificateBodyDAL,
+  certificateSecretDAL,
+  kmsService,
+  projectDAL,
+  tx,
+  isRenewal = false
+}: {
+  certificateRequest: {
+    commonName?: string;
+    keyUsages?: CertKeyUsageType[];
+    extendedKeyUsages?: CertExtendedKeyUsageType[];
+    validity: { ttl: string };
+    notBefore?: Date;
+    notAfter?: Date;
+  };
+  template?: {
+    subject?: Array<{
+      type: string;
+      allowed?: string[];
+      required?: string[];
+      denied?: string[];
+    }>;
+    sans?: Array<{
+      type: string;
+      allowed?: string[];
+      required?: string[];
+      denied?: string[];
+    }>;
+  } | null;
+  profile?: { id: string; projectId: string } | null;
+  originalCert?: {
+    id: string;
+    friendlyName?: string | null;
+    commonName?: string | null;
+    projectId: string;
+  };
+  effectiveAlgorithms: {
+    signatureAlgorithm: CertSignatureAlgorithm;
+    keyAlgorithm: CertKeyAlgorithm;
+  };
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "updateById">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<TKmsServiceFactory, "encryptWithKmsKey" | "generateKmsKey">;
+  projectDAL: TProjectDALFactory;
+  tx: Parameters<TCertificateDALFactory["create"]>[1];
+  isRenewal?: boolean;
+}) => {
+  const projectId = originalCert?.projectId || profile?.projectId;
+  if (!projectId) {
+    throw new BadRequestError({ message: "Project ID is required for certificate creation" });
+  }
+
+  const selfSignedResult = await generateSelfSignedCertificate({
+    certificateRequest,
+    template,
+    effectiveSignatureAlgorithm: effectiveAlgorithms.signatureAlgorithm,
+    effectiveKeyAlgorithm: effectiveAlgorithms.keyAlgorithm
+  });
+
+  const certificateData = await createSelfSignedCertificateRecord({
+    selfSignedResult,
+    certificateRequest,
+    profile,
+    originalCert,
+    certificateDAL,
+    tx,
+    isRenewal
+  });
+
+  await certificateDAL.updateById(
+    certificateData.id,
+    {
+      signatureAlgorithm: effectiveAlgorithms.signatureAlgorithm,
+      keyAlgorithm: effectiveAlgorithms.keyAlgorithm
+    },
+    tx
+  );
+
+  await createEncryptedCertificateData({
+    certificateId: certificateData.id,
+    certificate: selfSignedResult.certificate,
+    privateKey: selfSignedResult.privateKey,
+    projectId,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    kmsService,
+    projectDAL,
+    tx
+  });
+
+  return {
+    selfSignedResult,
+    certificateData
+  };
+};
+
 export const certificateV3ServiceFactory = ({
   certificateDAL,
+  certificateBodyDAL,
   certificateSecretDAL,
   certificateAuthorityDAL,
   certificateProfileDAL,
@@ -359,7 +771,9 @@ export const certificateV3ServiceFactory = ({
   permissionService,
   certificateSyncDAL,
   pkiSyncDAL,
-  pkiSyncQueue
+  pkiSyncQueue,
+  kmsService,
+  projectDAL
 }: TCertificateV3ServiceFactoryDep) => {
   const issueCertificateFromProfile = async ({
     profileId,
@@ -416,15 +830,6 @@ export const certificateV3ServiceFactory = ({
       });
     }
 
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
-    if (!ca) {
-      throw new NotFoundError({ message: "Certificate Authority not found" });
-    }
-
-    validateCaSupport(ca, "direct certificate issuance");
-
-    validateAlgorithmCompatibility(ca, template);
-
     const effectiveSignatureAlgorithm = certificateRequest.signatureAlgorithm as CertSignatureAlgorithm | undefined;
     const effectiveKeyAlgorithm = certificateRequest.keyAlgorithm as CertKeyAlgorithm | undefined;
 
@@ -440,12 +845,76 @@ export const certificateV3ServiceFactory = ({
       });
     }
 
-    const certificateSubject = buildCertificateSubjectFromTemplate(certificateRequest, template.subject);
+    const certificateSubject = buildCertificateSubjectFromTemplate(certificateRequest, template?.subject);
     const subjectAlternativeNames = buildSubjectAlternativeNamesFromTemplate(
       { subjectAlternativeNames: certificateRequest.altNames },
-      template.sans
+      template?.sans
     );
 
+    const issuerType = profile?.issuerType || (profile?.caId ? IssuerType.CA : IssuerType.SELF_SIGNED);
+
+    if (issuerType === IssuerType.SELF_SIGNED) {
+      const result = await certificateDAL.transaction(async (tx) => {
+        const effectiveAlgorithms = getEffectiveAlgorithms(effectiveSignatureAlgorithm, effectiveKeyAlgorithm);
+
+        return processSelfSignedCertificate({
+          certificateRequest,
+          template,
+          profile,
+          effectiveAlgorithms,
+          certificateDAL,
+          certificateBodyDAL,
+          certificateSecretDAL,
+          kmsService,
+          projectDAL,
+          tx
+        });
+      });
+
+      const { selfSignedResult, certificateData } = result;
+
+      const subjectCommonName =
+        (selfSignedResult.certificateSubject.common_name as string) ||
+        certificateRequest.commonName ||
+        "Self-signed Certificate";
+
+      const finalRenewBeforeDays = calculateFinalRenewBeforeDays(
+        profile,
+        certificateRequest.validity.ttl,
+        selfSignedResult.notAfter
+      );
+
+      if (finalRenewBeforeDays !== undefined) {
+        await certificateDAL.updateById(certificateData.id, {
+          renewBeforeDays: finalRenewBeforeDays
+        });
+      }
+
+      return {
+        certificate: selfSignedResult.certificate.toString("utf8"),
+        issuingCaCertificate: "",
+        certificateChain: selfSignedResult.certificate.toString("utf8"),
+        privateKey: selfSignedResult.privateKey.toString("utf8"),
+        serialNumber: selfSignedResult.serialNumber,
+        certificateId: certificateData.id,
+        projectId: profile.projectId,
+        profileName: profile.slug,
+        commonName: subjectCommonName
+      };
+    }
+
+    if (!profile.caId) {
+      throw new NotFoundError({ message: "Certificate Authority ID not found" });
+    }
+
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
+    if (!ca) {
+      throw new NotFoundError({ message: "Certificate Authority not found" });
+    }
+
+    validateCaSupport(ca, "direct certificate issuance");
+    validateAlgorithmCompatibility(ca, template);
+
     const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } =
       await internalCaService.issueCertFromCa({
         caId: ca.id,
@@ -477,10 +946,11 @@ export const certificateV3ServiceFactory = ({
       new Date(cert.notAfter)
     );
 
-    await certificateDAL.updateById(cert.id, {
-      profileId,
-      renewBeforeDays: finalRenewBeforeDays
-    });
+    const updateData: { profileId: string; renewBeforeDays?: number } = { profileId };
+    if (finalRenewBeforeDays !== undefined) {
+      updateData.renewBeforeDays = finalRenewBeforeDays;
+    }
+    await certificateDAL.updateById(cert.id, updateData);
 
     let finalCertificateChain = bufferToString(certificateChain);
     if (removeRootsFromChain) {
@@ -525,6 +995,12 @@ export const certificateV3ServiceFactory = ({
       enrollmentType
     );
 
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for CSR signing"
+      });
+    }
+
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
     if (!ca) {
       throw new NotFoundError({ message: "Certificate Authority not found" });
@@ -592,10 +1068,11 @@ export const certificateV3ServiceFactory = ({
 
     const finalRenewBeforeDays = calculateFinalRenewBeforeDays(profile, validity.ttl, new Date(cert.notAfter));
 
-    await certificateDAL.updateById(cert.id, {
-      profileId,
-      renewBeforeDays: finalRenewBeforeDays
-    });
+    const updateData2: { profileId: string; renewBeforeDays?: number } = { profileId };
+    if (finalRenewBeforeDays !== undefined) {
+      updateData2.renewBeforeDays = finalRenewBeforeDays;
+    }
+    await certificateDAL.updateById(cert.id, updateData2);
 
     const certificateString = extractCertificateFromBuffer(certificate as unknown as Buffer);
     let certificateChainString = extractCertificateFromBuffer(certificateChain as unknown as Buffer);
@@ -640,10 +1117,25 @@ export const certificateV3ServiceFactory = ({
       commonName: certificateOrder.commonName,
       keyUsages: certificateOrder.keyUsages,
       extendedKeyUsages: certificateOrder.extendedKeyUsages,
-      subjectAlternativeNames: certificateOrder.altNames.map((san) => ({
-        type: san.type === "dns" ? CertSubjectAlternativeNameType.DNS_NAME : CertSubjectAlternativeNameType.IP_ADDRESS,
-        value: san.value
-      })),
+      subjectAlternativeNames: certificateOrder.altNames.map((san) => {
+        let certType: CertSubjectAlternativeNameType;
+        switch (san.type) {
+          case "dns":
+            certType = CertSubjectAlternativeNameType.DNS_NAME;
+            break;
+          case "ip":
+            certType = CertSubjectAlternativeNameType.IP_ADDRESS;
+            break;
+          default:
+            throw new BadRequestError({
+              message: `Unsupported Subject Alternative Name type: ${san.type as string}`
+            });
+        }
+        return {
+          type: certType,
+          value: san.value
+        };
+      }),
       validity: certificateOrder.validity,
       notBefore: certificateOrder.notBefore,
       notAfter: certificateOrder.notAfter,
@@ -663,6 +1155,12 @@ export const certificateV3ServiceFactory = ({
       });
     }
 
+    if (!profile.caId) {
+      throw new BadRequestError({
+        message: "Self-signed certificates are not supported for certificate ordering"
+      });
+    }
+
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
     if (!ca) {
       throw new NotFoundError({ message: "Certificate Authority not found" });
@@ -741,15 +1239,19 @@ export const certificateV3ServiceFactory = ({
         });
       }
 
-      const profile = await certificateProfileDAL.findByIdWithConfigs(originalCert.profileId);
-      if (!profile) {
-        throw new NotFoundError({ message: "Certificate profile not found" });
-      }
+      let profile = null;
+      if (originalCert.profileId) {
+        profile = await certificateProfileDAL.findByIdWithConfigs(originalCert.profileId);
+        if (!profile) {
+          throw new NotFoundError({ message: "Certificate profile not found" });
+        }
 
-      if (profile.enrollmentType !== EnrollmentType.API) {
-        throw new ForbiddenRequestError({
-          message: "Certificate is not eligible for renewal: EST certificates cannot be renewed through this endpoint"
-        });
+        if (profile.enrollmentType !== EnrollmentType.API) {
+          throw new ForbiddenRequestError({
+            message:
+              "Certificate is not eligible for renewal: Only certificates issued from an API enrollment profile can be renewed through this endpoint"
+          });
+        }
       }
 
       const certificateSecret = await certificateSecretDAL.findOne({ certId: originalCert.id }, tx);
@@ -761,10 +1263,11 @@ export const certificateV3ServiceFactory = ({
       }
 
       if (!internal) {
+        const projectId = profile?.projectId || originalCert.projectId;
         const { permission } = await permissionService.getProjectPermission({
           actor,
           actorId,
-          projectId: profile.projectId,
+          projectId,
           actorAuthMethod,
           actorOrgId,
           actionProjectType: ActionProjectType.CertificateManager
@@ -776,33 +1279,46 @@ export const certificateV3ServiceFactory = ({
         );
       }
 
-      const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
-      if (!ca) {
-        throw new NotFoundError({ message: "Certificate Authority not found" });
+      const issuerType = profile?.issuerType || (originalCert.caId ? IssuerType.CA : IssuerType.SELF_SIGNED);
+
+      let ca;
+      if (issuerType === IssuerType.CA) {
+        const caId = profile?.caId || originalCert.caId;
+        if (!caId) {
+          throw new NotFoundError({ message: "Certificate Authority ID not found" });
+        }
+
+        ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
+        if (!ca) {
+          throw new NotFoundError({ message: "Certificate Authority not found" });
+        }
+
+        const eligibilityCheck = validateRenewalEligibility(originalCert, ca);
+        if (!eligibilityCheck.isEligible) {
+          await certificateDAL.updateById(originalCert.id, {
+            renewalError: `Certificate is not eligible for renewal: ${eligibilityCheck.errors.join(", ")}`
+          });
+          throw new BadRequestError({
+            message: `Certificate is not eligible for renewal: ${eligibilityCheck.errors.join(", ")}`
+          });
+        }
+
+        validateCaSupport(ca, "direct certificate issuance");
       }
 
-      const eligibilityCheck = validateRenewalEligibility(originalCert, ca);
-      if (!eligibilityCheck.isEligible) {
-        await certificateDAL.updateById(originalCert.id, {
-          renewalError: `Certificate is not eligible for renewal: ${eligibilityCheck.errors.join(", ")}`
-        });
-        throw new BadRequestError({
-          message: `Certificate is not eligible for renewal: ${eligibilityCheck.errors.join(", ")}`
-        });
-      }
+      const templateId = profile?.certificateTemplateId || originalCert.certificateTemplateId;
+      const template = templateId
+        ? await certificateTemplateV2Service.getTemplateV2ById({
+            actor,
+            actorId,
+            actorAuthMethod,
+            actorOrgId,
+            templateId,
+            internal
+          })
+        : null;
 
-      validateCaSupport(ca, "direct certificate issuance");
-
-      const template = await certificateTemplateV2Service.getTemplateV2ById({
-        actor,
-        actorId,
-        actorAuthMethod,
-        actorOrgId,
-        templateId: profile.certificateTemplateId,
-        internal
-      });
-
-      if (!template) {
+      if (!template && profile) {
         throw new NotFoundError({ message: "Certificate template not found for this profile" });
       }
 
@@ -857,10 +1373,13 @@ export const certificateV3ServiceFactory = ({
         keyAlgorithm: originalCert.keyAlgorithm || undefined
       };
 
-      const validationResult = await certificateTemplateV2Service.validateCertificateRequest(
-        profile.certificateTemplateId,
-        certificateRequest
-      );
+      let validationResult: { isValid: boolean; errors: string[] } = { isValid: true, errors: [] };
+      if (profile?.certificateTemplateId) {
+        validationResult = await certificateTemplateV2Service.validateCertificateRequest(
+          profile.certificateTemplateId,
+          certificateRequest
+        );
+      }
 
       if (!validationResult.isValid) {
         await certificateDAL.updateById(originalCert.id, {
@@ -872,14 +1391,28 @@ export const certificateV3ServiceFactory = ({
         });
       }
 
-      validateAlgorithmCompatibility(ca, template);
       const notBefore = new Date();
       const notAfter = new Date(Date.now() + parseTtlToDays(ttl) * 24 * 60 * 60 * 1000);
 
-      const finalRenewBeforeDays = calculateFinalRenewBeforeDays(profile, ttl, notAfter);
+      const finalRenewBeforeDays = profile ? calculateFinalRenewBeforeDays(profile, ttl, notAfter) : undefined;
 
-      const { certificate, certificateChain, issuingCaCertificate, serialNumber } =
-        await internalCaService.issueCertFromCa({
+      let certificate: string;
+      let certificateChain: string;
+      let issuingCaCertificate: string;
+      let serialNumber: string;
+      let newCert: TCertificates;
+
+      if (issuerType === IssuerType.CA) {
+        // CA-signed certificate renewal
+        if (!ca) {
+          throw new NotFoundError({ message: "Certificate Authority not found for CA-signed certificate renewal" });
+        }
+
+        validateAlgorithmCompatibility(ca, {
+          algorithms: template?.algorithms
+        } as { algorithms?: { signature?: string[] } });
+
+        const caResult = await internalCaService.issueCertFromCa({
           caId: ca.id,
           friendlyName: originalCert.friendlyName || originalCert.commonName || "Renewed Certificate",
           commonName: originalCert.commonName || "",
@@ -900,20 +1433,72 @@ export const certificateV3ServiceFactory = ({
           tx
         });
 
-      const newCert = await certificateDAL.findOne({ serialNumber, caId: ca.id }, tx);
+        certificate = caResult.certificate;
+        certificateChain = caResult.certificateChain;
+        issuingCaCertificate = caResult.issuingCaCertificate;
+        serialNumber = caResult.serialNumber;
+
+        const foundCert = await certificateDAL.findOne({ serialNumber, caId: ca.id }, tx);
+        if (!foundCert) {
+          throw new NotFoundError({ message: "Certificate was signed but could not be found in database" });
+        }
+        newCert = foundCert;
+      } else {
+        // Self-signed certificate renewal
+        const effectiveAlgorithms = getEffectiveAlgorithms(
+          undefined,
+          undefined,
+          originalSignatureAlgorithm,
+          originalKeyAlgorithm
+        );
+
+        const selfSignedRenewalResult = await processSelfSignedCertificate({
+          certificateRequest,
+          template,
+          profile,
+          originalCert,
+          effectiveAlgorithms,
+          certificateDAL,
+          certificateBodyDAL,
+          certificateSecretDAL,
+          kmsService,
+          projectDAL,
+          tx,
+          isRenewal: true
+        });
+
+        certificate = selfSignedRenewalResult.selfSignedResult.certificate.toString("utf8");
+        certificateChain = selfSignedRenewalResult.selfSignedResult.certificate.toString("utf8"); // Self-signed has no chain
+        issuingCaCertificate = ""; // No issuing CA for self-signed
+        serialNumber = selfSignedRenewalResult.selfSignedResult.serialNumber;
+        newCert = selfSignedRenewalResult.certificateData;
+      }
+
       if (!newCert) {
         throw new NotFoundError({ message: "Certificate was signed but could not be found in database" });
       }
 
-      await certificateDAL.updateById(
-        newCert.id,
-        {
-          profileId: originalCert.profileId,
-          renewBeforeDays: finalRenewBeforeDays,
+      // For self-signed certificates, we already set the renewal data during creation
+      // For CA-signed certificates, we need to set it now
+      if (issuerType === IssuerType.CA) {
+        const renewalUpdateData: {
+          profileId: string | null;
+          renewedFromCertificateId: string;
+          renewBeforeDays?: number;
+        } = {
+          profileId: originalCert.profileId || null,
           renewedFromCertificateId: originalCert.id
-        },
-        tx
-      );
+        };
+
+        if (finalRenewBeforeDays !== undefined) {
+          renewalUpdateData.renewBeforeDays = finalRenewBeforeDays;
+        }
+
+        await certificateDAL.updateById(newCert.id, renewalUpdateData, tx);
+      } else if (finalRenewBeforeDays !== undefined) {
+        // For self-signed certificates, just update the renewBeforeDays if needed
+        await certificateDAL.updateById(newCert.id, { renewBeforeDays: finalRenewBeforeDays }, tx);
+      }
 
       await certificateDAL.updateById(
         originalCert.id,
@@ -953,8 +1538,8 @@ export const certificateV3ServiceFactory = ({
       certificateChain: finalCertificateChain,
       serialNumber: renewalResult.serialNumber,
       certificateId: renewalResult.newCert.id,
-      projectId: renewalResult.profile.projectId,
-      profileName: renewalResult.profile.slug,
+      projectId: renewalResult.originalCert.projectId,
+      profileName: renewalResult.profile?.slug || "Self-signed Certificate",
       commonName: renewalResult.originalCert.commonName || ""
     };
   };

backend/src/services/certificate/certificate-service.ts

@@ -309,6 +309,14 @@ export const certificateServiceFactory = ({
 
     const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
 
+    if (!certBody) {
+      throw new NotFoundError({ message: "Certificate body not found" });
+    }
+
+    if (!certBody.encryptedCertificate) {
+      throw new BadRequestError({ message: "Certificate data not available" });
+    }
+
     const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
       projectId: cert.projectId,
       projectDAL,
@@ -599,6 +607,14 @@ export const certificateServiceFactory = ({
 
     const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
 
+    if (!certBody) {
+      throw new NotFoundError({ message: "Certificate body not found" });
+    }
+
+    if (!certBody.encryptedCertificate) {
+      throw new BadRequestError({ message: "Certificate data not available" });
+    }
+
     const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
       projectId: cert.projectId,
       projectDAL,

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -270,7 +270,13 @@ export const identityKubernetesAuthServiceFactory = ({
             }
           )
           .catch((err) => {
+            const tokenReviewerJwtSnippet = `${tokenReviewerJwt?.substring?.(0, 10) || ""}...${tokenReviewerJwt?.substring?.(tokenReviewerJwt.length - 10) || ""}`;
+            const serviceAccountJwtSnippet = `${serviceAccountJwt?.substring?.(0, 10) || ""}...${serviceAccountJwt?.substring?.(serviceAccountJwt.length - 10) || ""}`;
             if (err instanceof AxiosError) {
+              logger.error(
+                { response: err.response, host, port, tokenReviewerJwtSnippet, serviceAccountJwtSnippet },
+                "tokenReviewCallbackRaw: Kubernetes token review request error (request error)"
+              );
               if (err.response) {
                 const { message } = err?.response?.data as unknown as { message?: string };
 
@@ -281,6 +287,11 @@ export const identityKubernetesAuthServiceFactory = ({
                   });
                 }
               }
+            } else {
+              logger.error(
+                { error: err as Error, host, port, tokenReviewerJwtSnippet, serviceAccountJwtSnippet },
+                "tokenReviewCallbackRaw: Kubernetes token review request error (non-request error)"
+              );
             }
             throw err;
           });

backend/src/services/integration-auth/integration-list.ts

@@ -105,7 +105,9 @@ export enum IntegrationUrls {
   GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform",
 
   GITHUB_USER_INSTALLATIONS = "https://api.github.com/user/installations",
-  CHEF_API_URL = "https://api.chef.io"
+  CHEF_API_URL = "https://api.chef.io",
+  DNS_MADE_EASY_API_URL = "https://api.dnsmadeeasy.com",
+  DNS_MADE_EASY_SANDBOX_API_URL = "https://api.sandbox.dnsmadeeasy.com"
 }
 
 export const getIntegrationOptions = async () => {

backend/src/services/membership-identity/membership-identity-dal.ts

@@ -94,6 +94,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
           db.ref("hasDeleteProtection").withSchema(TableName.Identity).as("identityHasDeleteProtection"),
 
           db.ref("slug").withSchema(TableName.Role).as("roleSlug"),
+          db.ref("name").withSchema(TableName.Role).as("roleName"),
           db.ref("id").withSchema(TableName.MembershipRole).as("membershipRoleId"),
           db.ref("role").withSchema(TableName.MembershipRole).as("membershipRole"),
           db.ref("temporaryMode").withSchema(TableName.MembershipRole).as("membershipRoleTemporaryMode"),
@@ -180,6 +181,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
             label: "roles" as const,
             mapper: ({
               roleSlug,
+              roleName,
               membershipRoleId,
               membershipRole,
               membershipRoleIsTemporary,
@@ -193,6 +195,7 @@ export const membershipIdentityDALFactory = (db: TDbClient) => {
               id: membershipRoleId,
               role: membershipRole,
               customRoleSlug: roleSlug,
+              customRoleName: roleName,
               temporaryRange: membershipRoleTemporaryRange,
               temporaryMode: membershipRoleTemporaryMode,
               temporaryAccessStartTime: membershipRoleTemporaryAccessStartTime,

backend/src/services/smtp/emails/DynamicSecretLeaseRevocationFailedTemplate.tsx

@@ -0,0 +1,68 @@
+import { Heading, Section, Text } from "@react-email/components";
+
+import { BaseButton } from "./BaseButton";
+import { BaseEmailWrapper, BaseEmailWrapperProps } from "./BaseEmailWrapper";
+
+interface DynamicSecretLeaseRevocationFailedTemplateProps
+  extends Omit<BaseEmailWrapperProps, "title" | "preview" | "children"> {
+  siteUrl: string;
+  dynamicSecretLeaseUrl: string;
+  dynamicSecretName: string;
+  projectName: string;
+  environmentSlug: string;
+  errorMessage: string;
+}
+
+export const DynamicSecretLeaseRevocationFailedTemplate = ({
+  siteUrl,
+  dynamicSecretLeaseUrl,
+  dynamicSecretName,
+  projectName,
+  environmentSlug,
+  errorMessage
+}: DynamicSecretLeaseRevocationFailedTemplateProps) => {
+  return (
+    <BaseEmailWrapper
+      title="Dynamic Secret Lease Revocation Failed"
+      preview={`Dynamic secret lease revocation failed for dynamic secret ${dynamicSecretName}`}
+      siteUrl={siteUrl}
+    >
+      <Heading className="text-black text-[18px] leading-[28px] text-center font-normal p-0 mx-0">
+        Dynamic Secret Lease Revocation Failed
+      </Heading>
+      <Section className="px-[24px] mt-[36px] pt-[12px] pb-[8px] border border-solid border-gray-200 rounded-md bg-gray-50">
+        <Text className="text-black text-[14px] leading-[24px]">
+          One or more leases for the dynamic secret <strong>{dynamicSecretName}</strong> in project{" "}
+          <strong>{projectName}</strong> and environment <strong>{environmentSlug}</strong> have failed to revoke after
+          multiple attempts.
+        </Text>
+        <Text className="text-black text-[14px] leading-[24px]">
+          Please review the dynamic secret leases and attempt to revoke them again.
+        </Text>
+      </Section>
+
+      <Section className="mt-[24px] bg-gray-50 pt-[2px] mb-[25px] pb-[16px] border border-solid border-gray-200 px-[24px] rounded-md text-gray-800">
+        <Text className="mb-[0px]">
+          <strong>Latest error message</strong>
+        </Text>
+        <Text className="leading-[24px] text-[14px] text-red-600 mt-[4px]">{errorMessage}</Text>
+      </Section>
+
+      <Section className="text-center">
+        <BaseButton href={dynamicSecretLeaseUrl}>View Dynamic Secret Leases</BaseButton>
+      </Section>
+    </BaseEmailWrapper>
+  );
+};
+
+export default DynamicSecretLeaseRevocationFailedTemplate;
+
+DynamicSecretLeaseRevocationFailedTemplate.PreviewProps = {
+  errorMessage: 'REVOKE ALL PRIVILEGES ON ALL TABLES IN SCHEMA public FROM "[REDACTED]" - tuple concurrently updated.',
+  dynamicSecretLeaseUrl: "https://infisical.com/test",
+  leaseId: "717d5013-7194-49d9-b6ac-6192328c2914",
+  dynamicSecretName: "postgres-prod-db",
+  projectName: "Development Team",
+  environmentSlug: "dev",
+  siteUrl: "https://infisical.com"
+} as DynamicSecretLeaseRevocationFailedTemplateProps;

backend/src/services/smtp/smtp-service.ts

@@ -43,6 +43,7 @@ import {
   SubOrganizationInvitationTemplate,
   UnlockAccountTemplate
 } from "./emails";
+import DynamicSecretLeaseRevocationFailedTemplate from "./emails/DynamicSecretLeaseRevocationFailedTemplate";
 
 export type TSmtpConfig = SMTPTransport.Options;
 export type TSmtpSendMail = {
@@ -89,7 +90,8 @@ export enum SmtpTemplates {
   SecretScanningV2ScanFailed = "secretScanningV2ScanFailed",
   SecretScanningV2SecretsDetected = "secretScanningV2SecretsDetected",
   AccountDeletionConfirmation = "accountDeletionConfirmation",
-  HealthAlert = "healthAlert"
+  HealthAlert = "healthAlert",
+  DynamicSecretLeaseRevocationFailed = "dynamicSecretLeaseRevocationFailed"
 }
 
 export enum SmtpHost {
@@ -137,7 +139,8 @@ const EmailTemplateMap: Record<SmtpTemplates, React.FC<any>> = {
   [SmtpTemplates.SecretScanningV2ScanFailed]: SecretScanningScanFailedTemplate,
   [SmtpTemplates.SecretScanningV2SecretsDetected]: SecretScanningSecretsDetectedTemplate,
   [SmtpTemplates.AccountDeletionConfirmation]: AccountDeletionConfirmationTemplate,
-  [SmtpTemplates.HealthAlert]: HealthAlertTemplate
+  [SmtpTemplates.HealthAlert]: HealthAlertTemplate,
+  [SmtpTemplates.DynamicSecretLeaseRevocationFailed]: DynamicSecretLeaseRevocationFailedTemplate
 };
 
 export const smtpServiceFactory = (cfg: TSmtpConfig) => {