Add cert foreign key

backend/src/db/migrations/20251029234547_add-pki-acme.ts

@@ -80,6 +80,10 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("accountId").notNullable();
       t.foreign("accountId").references("id").inTable(TableName.PkiAcmeAccount).onDelete("CASCADE");
 
+      // Foreign key to certificate
+      t.uuid("certificateId").nullable();
+      t.foreign("certificateId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
+
       t.timestamp("notBefore").nullable();
       t.timestamp("notAfter").nullable();
 

backend/src/ee/services/pki-acme/pki-acme-service.ts

@@ -319,7 +319,7 @@ export const pkiAcmeServiceFactory = ({
     const kmsDecryptor = await kmsService.decryptWithKmsKey({
       kmsId: certificateManagerKmsId
     });
-    const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret });
+    const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret! });
     try {
       const { payload: eabPayload, protectedHeader: eabProtectedHeader } = await flattenedVerify(
         externalAccountBinding,
@@ -393,7 +393,6 @@ export const pkiAcmeServiceFactory = ({
       emails: contact ?? []
     });
     // TODO: create audit log here
-    // TODO: check EAB authentication here
     return {
       status: 201,
       body: {