Added Microsoft ADCS connector

2026-10-12 16:29:14 +00:00 · 2025-08-27 02:45:46 -03:00
parent 5c21ac3182
commit 4e2592960d
79 changed files with 3500 additions and 514 deletions
@@ -13,6 +13,7 @@ import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import {
  Auth0ConnectionMethod,
  AwsConnectionMethod,
+  AzureADCSConnectionMethod,
  AzureAppConfigurationConnectionMethod,
  AzureClientSecretsConnectionMethod,
  AzureDevOpsConnectionMethod,
@@ -76,6 +77,7 @@ export const APP_CONNECTION_MAP: Record<
    image: "Microsoft Azure.png"
  },
  [AppConnection.AzureDevOps]: { name: "Azure DevOps", image: "Microsoft Azure.png" },
+  [AppConnection.AzureADCS]: { name: "Azure ADCS", image: "Microsoft Azure.png" },
  [AppConnection.Databricks]: { name: "Databricks", image: "Databricks.png" },
  [AppConnection.Humanitec]: { name: "Humanitec", image: "Humanitec.png" },
  [AppConnection.TerraformCloud]: { name: "Terraform Cloud", image: "Terraform Cloud.png" },
@@ -151,6 +153,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
    case MsSqlConnectionMethod.UsernameAndPassword:
    case MySqlConnectionMethod.UsernameAndPassword:
    case OracleDBConnectionMethod.UsernameAndPassword:
+    case AzureADCSConnectionMethod.UsernamePassword:
      return { name: "Username & Password", icon: faLock };
    case HCVaultConnectionMethod.AccessToken:
    case TeamCityConnectionMethod.AccessToken:
@@ -7,6 +7,7 @@ export enum AppConnection {
  AzureAppConfiguration = "azure-app-configuration",
  AzureClientSecrets = "azure-client-secrets",
  AzureDevOps = "azure-devops",
+  AzureADCS = "azure-adcs",
  Databricks = "databricks",
  Humanitec = "humanitec",
  TerraformCloud = "terraform-cloud",
@@ -54,13 +54,13 @@ export const useAppConnectionOptions = (
 export const useGetAppConnectionOption = <T extends AppConnection>(app: T) => {
  const { data: options = [], isPending } = useAppConnectionOptions();

-  return useMemo(
-    () => ({
-      option: (options.find((opt) => opt.app === app) as TAppConnectionOptionMap[T]) ?? {},
+  return useMemo(() => {
+    const foundOption = options.find((opt) => opt.app === app);
+    return {
+      option: (foundOption as TAppConnectionOptionMap[T]) ?? {},
      isLoading: isPending
-    }),
-    [options, app, isPending]
-  );
+    };
+  }, [options, app, isPending]);
 };

 export const useListAppConnections = (
@@ -32,7 +32,7 @@ export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
 };

 export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
-  app: AppConnection.AzureKeyVault;
+  app: AppConnection.AzureAppConfiguration;
  oauthClientId?: string;
 };

@@ -164,9 +164,14 @@ export type TOktaConnectionOption = TAppConnectionOptionBase & {
  app: AppConnection.Okta;
 };

+export type TAzureAdCsConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.AzureADCS;
+};
+
 export type TAppConnectionOption =
  | TAwsConnectionOption
  | TGitHubConnectionOption
+  | TGitHubRadarConnectionOption
  | TGcpConnectionOption
  | TAzureAppConfigurationConnectionOption
  | TAzureKeyVaultConnectionOption
@@ -184,6 +189,7 @@ export type TAppConnectionOption =
  | TWindmillConnectionOption
  | TAuth0ConnectionOption
  | THCVaultConnectionOption
+  | TLdapConnectionOption
  | TTeamCityConnectionOption
  | TOCIConnectionOption
  | TOnePassConnectionOption
@@ -196,6 +202,7 @@ export type TAppConnectionOption =
  | TZabbixConnectionOption
  | TRailwayConnectionOption
  | TChecklyConnectionOption
+  | TSupabaseConnectionOption
  | TDigitalOceanConnectionOption
  | TNetlifyConnectionOption
  | TOktaConnectionOption;
@@ -238,4 +245,5 @@ export type TAppConnectionOptionMap = {
  [AppConnection.DigitalOcean]: TDigitalOceanConnectionOption;
  [AppConnection.Netlify]: TNetlifyConnectionOption;
  [AppConnection.Okta]: TOktaConnectionOption;
+  [AppConnection.AzureADCS]: TAzureAdCsConnectionOption;
 };
@@ -0,0 +1,25 @@
+import { z } from "zod";
+
+import { AppConnection } from "../enums";
+import { TRootAppConnection } from "./root-connection";
+
+export enum AzureADCSConnectionMethod {
+  UsernamePassword = "username-password"
+}
+
+export const CreateAzureADCSConnectionSchema = z.object({
+  adcsUrl: z.string().url().min(1, "ADCS URL is required"),
+  username: z.string().min(1, "Username is required"),
+  password: z.string().min(1, "Password is required")
+});
+
+export type TCreateAzureADCSConnection = z.infer<typeof CreateAzureADCSConnectionSchema>;
+
+export type TAzureADCSConnection = TRootAppConnection & { app: AppConnection.AzureADCS } & {
+  method: AzureADCSConnectionMethod.UsernamePassword;
+  credentials: {
+    username: string;
+    password: string;
+    adcsUrl: string;
+  };
+};
@@ -3,6 +3,7 @@ import { TOnePassConnection } from "./1password-connection";
 import { TAppConnectionOption } from "./app-options";
 import { TAuth0Connection } from "./auth0-connection";
 import { TAwsConnection } from "./aws-connection";
+import { TAzureADCSConnection } from "./azure-adcs-connection";
 import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
 import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
 import { TAzureDevOpsConnection } from "./azure-devops-connection";
@@ -41,6 +42,7 @@ import { TZabbixConnection } from "./zabbix-connection";
 export * from "./1password-connection";
 export * from "./auth0-connection";
 export * from "./aws-connection";
+export * from "./azure-adcs-connection";
 export * from "./azure-app-configuration-connection";
 export * from "./azure-client-secrets-connection";
 export * from "./azure-devops-connection";
@@ -83,6 +85,7 @@ export type TAppConnection =
  | TAzureAppConfigurationConnection
  | TAzureClientSecretsConnection
  | TAzureDevOpsConnection
+  | TAzureADCSConnection
  | TDatabricksConnection
  | THumanitecConnection
  | TTerraformCloudConnection
@@ -156,6 +159,7 @@ export type TAppConnectionMap = {
  [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
  [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
  [AppConnection.AzureDevOps]: TAzureDevOpsConnection;
+  [AppConnection.AzureADCS]: TAzureADCSConnection;
  [AppConnection.Databricks]: TDatabricksConnection;
  [AppConnection.Humanitec]: THumanitecConnection;
  [AppConnection.TerraformCloud]: TTerraformCloudConnection;
@@ -1,7 +1,15 @@
 import { AppConnection } from "../appConnections/enums";
 import { SshCaStatus } from "../sshCa";
 import { SshCertTemplateStatus } from "../sshCertificateTemplates";
-import { AcmeDnsProvider, CaStatus, InternalCaType } from "./enums";
+import {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaCapability,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";

 export const caTypeToNameMap: { [K in InternalCaType]: string } = {
  [InternalCaType.ROOT]: "Root",
@@ -24,6 +32,45 @@ export const ACME_DNS_PROVIDER_APP_CONNECTION_MAP: Record<AcmeDnsProvider, AppCo
  [AcmeDnsProvider.Cloudflare]: AppConnection.Cloudflare
 };

+export const AZURE_AD_CS_TEMPLATE_NAME_MAP: Record<AzureAdCsTemplateType, string> = {
+  [AzureAdCsTemplateType.WEB_SERVER]: "Web Server",
+  [AzureAdCsTemplateType.COMPUTER]: "Computer",
+  [AzureAdCsTemplateType.USER]: "User",
+  [AzureAdCsTemplateType.DOMAIN_CONTROLLER]: "Domain Controller",
+  [AzureAdCsTemplateType.SUBORDINATE_CA]: "Subordinate CA"
+};
+
+export const AZURE_AD_CS_AUTH_METHOD_NAME_MAP: Record<AzureAdCsAuthMethod, string> = {
+  [AzureAdCsAuthMethod.CLIENT_CERTIFICATE]: "Client Certificate",
+  [AzureAdCsAuthMethod.KERBEROS]: "Kerberos"
+};
+
+export const CA_TYPE_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
+  [CaType.INTERNAL]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.ACME]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.AZURE_AD_CS]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+    // Note: REVOKE_CERTIFICATES intentionally omitted - not supported by ADCS connector
+  ]
+};
+
+/**
+ * Check if a certificate authority type supports a specific capability
+ */
+export const caSupportsCapability = (caType: CaType, capability: CaCapability): boolean => {
+  const capabilities = CA_TYPE_CAPABILITIES_MAP[caType] || [];
+  return capabilities.includes(capability);
+};
+
 export const getCaStatusBadgeVariant = (status: CaStatus | SshCaStatus | SshCertTemplateStatus) => {
  switch (status) {
    case CaStatus.ACTIVE:
@@ -1,6 +1,7 @@
 export enum CaType {
  INTERNAL = "internal",
-  ACME = "acme"
+  ACME = "acme",
+  AZURE_AD_CS = "azure-ad-cs"
 }

 export enum InternalCaType {
@@ -22,3 +23,22 @@ export enum AcmeDnsProvider {
  ROUTE53 = "route53",
  Cloudflare = "cloudflare"
 }
+
+export enum AzureAdCsTemplateType {
+  WEB_SERVER = "WebServer",
+  COMPUTER = "Computer",
+  USER = "User",
+  DOMAIN_CONTROLLER = "DomainController",
+  SUBORDINATE_CA = "SubordinateCA"
+}
+
+export enum AzureAdCsAuthMethod {
+  CLIENT_CERTIFICATE = "client-certificate",
+  KERBEROS = "kerberos"
+}
+
+export enum CaCapability {
+  ISSUE_CERTIFICATES = "issue-certificates",
+  REVOKE_CERTIFICATES = "revoke-certificates",
+  RENEW_CERTIFICATES = "renew-certificates"
+}
@@ -1,4 +1,12 @@
-export { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
+export {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaRenewalType,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";
 export {
  useCreateCa,
  useCreateCertificate,
@@ -9,6 +17,7 @@ export {
  useUpdateCa
 } from "./mutations";
 export {
+  useGetAzureAdcsTemplates,
  useGetCa,
  useGetCaById,
  useGetCaCert,
@@ -17,5 +26,6 @@ export {
  useGetCaCrls,
  useGetCaCsr,
  useListCasByProjectId,
-  useListCasByTypeAndProjectId
+  useListCasByTypeAndProjectId,
+  useListExternalCasByProjectId
 } from "./queries";
@@ -39,6 +39,10 @@ export const useUpdateCa = () => {
      queryClient.invalidateQueries({
        queryKey: caKeys.getCaByNameAndProjectId(caName, projectId)
      });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
    }
  });
 };
@@ -57,6 +61,10 @@ export const useCreateCa = () => {
      queryClient.invalidateQueries({
        queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
      });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
    }
  });
 };
@@ -79,6 +87,10 @@ export const useDeleteCa = () => {
      queryClient.invalidateQueries({
        queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
      });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: [`external-cas-${projectId}`]
+      });
    }
  });
 };
@@ -17,7 +17,11 @@ export const caKeys = {
  getCaCsr: (caId: string) => [{ caId }, "ca-csr"],
  getCaCrl: (caId: string) => [{ caId }, "ca-crl"],
  getCaCertTemplates: (caId: string) => [{ caId }, "ca-cert-templates"],
-  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"]
+  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"],
+  getAzureAdcsTemplates: (caId: string, projectId: string) => [
+    { caId, projectId },
+    "azure-adcs-templates"
+  ]
 };

 export const useGetCa = ({
@@ -67,6 +71,34 @@ export const useListCasByProjectId = (projectId: string) => {
  });
 };

+export const useListExternalCasByProjectId = (projectId: string) => {
+  return useQuery({
+    queryKey: [`external-cas-${projectId}`],
+    queryFn: async () => {
+      const [acmeResponse, azureAdCsResponse] = await Promise.allSettled([
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.ACME}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.AZURE_AD_CS}?projectId=${projectId}`
+        )
+      ]);
+
+      const allCas: TUnifiedCertificateAuthority[] = [];
+
+      if (acmeResponse.status === "fulfilled") {
+        allCas.push(...acmeResponse.value.data);
+      }
+
+      if (azureAdCsResponse.status === "fulfilled") {
+        allCas.push(...azureAdCsResponse.value.data);
+      }
+
+      return allCas;
+    }
+  });
+};
+
 export const useGetCaById = (caId: string) => {
  return useQuery({
    queryKey: caKeys.getCaById(caId),
@@ -156,3 +188,22 @@ export const useGetCaCertTemplates = (caId: string) => {
    enabled: Boolean(caId)
  });
 };
+
+export const useGetAzureAdcsTemplates = ({
+  caId,
+  projectId
+}: {
+  caId: string;
+  projectId: string;
+}) => {
+  return useQuery({
+    queryKey: caKeys.getAzureAdcsTemplates(caId, projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        templates: { id: string; name: string; description?: string }[];
+      }>(`/api/v1/pki/ca/azure-ad-cs/${caId}/templates?projectId=${projectId}`);
+      return data;
+    },
+    enabled: Boolean(caId && projectId)
+  });
+};
@@ -1,5 +1,13 @@
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "../certificates/enums";
-import { AcmeDnsProvider, CaRenewalType, CaStatus, CaType, InternalCaType } from "./enums";
+import {
+  AcmeDnsProvider,
+  AzureAdCsAuthMethod,
+  AzureAdCsTemplateType,
+  CaRenewalType,
+  CaStatus,
+  CaType,
+  InternalCaType
+} from "./enums";

 export type TAcmeCertificateAuthority = {
  id: string;
@@ -19,6 +27,20 @@ export type TAcmeCertificateAuthority = {
  };
 };

+export type TAzureAdCsCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.AZURE_AD_CS;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    azureAdcsConnectionId: string;
+    templateName: AzureAdCsTemplateType;
+    authMethod: AzureAdCsAuthMethod;
+  };
+};
+
 export type TInternalCertificateAuthority = {
  id: string;
  projectId: string;
@@ -48,6 +70,7 @@ export type TInternalCertificateAuthority = {

 export type TUnifiedCertificateAuthority =
  | TAcmeCertificateAuthority
+  | TAzureAdCsCertificateAuthority
  | TInternalCertificateAuthority;

 export type TCreateCertificateAuthorityDTO = Omit<TUnifiedCertificateAuthority, "id">;
@@ -10,6 +10,16 @@ export enum SubscriberOperationStatus {
  FAILED = "failed"
 }

+export type TPkiSubscriberProperties = {
+  azureTemplateType?: string;
+  organization?: string;
+  organizationalUnit?: string;
+  country?: string;
+  state?: string;
+  locality?: string;
+  emailAddress?: string;
+};
+
 export type TPkiSubscriber = {
  id: string;
  projectId: string;
@@ -27,6 +37,7 @@ export type TPkiSubscriber = {
  lastOperationStatus?: SubscriberOperationStatus;
  lastOperationMessage?: string;
  lastOperationAt?: string;
+  properties?: TPkiSubscriberProperties;
 };

 export type TCreatePkiSubscriberDTO = {
@@ -40,6 +51,7 @@ export type TCreatePkiSubscriberDTO = {
  extendedKeyUsages: CertExtendedKeyUsage[];
  enableAutoRenewal?: boolean;
  autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };

 export type TUpdatePkiSubscriberDTO = {
@@ -55,6 +67,7 @@ export type TUpdatePkiSubscriberDTO = {
  extendedKeyUsages?: CertExtendedKeyUsage[];
  enableAutoRenewal?: boolean;
  autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };

 export type TDeletePkiSubscriberDTO = {
@@ -42,29 +42,45 @@ import {
 import { UsePopUpState } from "@app/hooks/usePopUp";
 import { slugSchema } from "@app/lib/schemas";

-const schema = z
-  .object({
-    type: z.nativeEnum(CaType),
-    name: slugSchema({
-      field: "Name"
-    }),
-    enableDirectIssuance: z.boolean(),
-    status: z.nativeEnum(CaStatus),
-    configuration: z.object({
-      dnsAppConnection: z.object({
-        id: z.string(),
-        name: z.string()
-      }),
-      // currently specific to Route53 & Cloudflare but can be extended to others by differentiating via the provider property
-      dnsProviderConfig: z.object({
-        provider: z.nativeEnum(AcmeDnsProvider),
-        hostedZoneId: z.string()
-      }),
-      directoryUrl: z.string(),
-      accountEmail: z.string()
-    })
+const baseSchema = z.object({
+  type: z.nativeEnum(CaType),
+  name: slugSchema({
+    field: "Name"
+  }),
+  enableDirectIssuance: z.boolean(),
+  status: z.nativeEnum(CaStatus)
+});
+
+const acmeConfigurationSchema = z.object({
+  dnsAppConnection: z.object({
+    id: z.string(),
+    name: z.string()
+  }),
+  dnsProviderConfig: z.object({
+    provider: z.nativeEnum(AcmeDnsProvider),
+    hostedZoneId: z.string()
+  }),
+  directoryUrl: z.string(),
+  accountEmail: z.string()
+});
+
+const azureAdCsConfigurationSchema = z.object({
+  azureAdcsConnection: z.object({
+    id: z.string(),
+    name: z.string()
  })
-  .required();
+});
+
+const schema = z.discriminatedUnion("type", [
+  baseSchema.extend({
+    type: z.literal(CaType.ACME),
+    configuration: acmeConfigurationSchema
+  }),
+  baseSchema.extend({
+    type: z.literal(CaType.AZURE_AD_CS),
+    configuration: azureAdCsConfigurationSchema
+  })
+]);

 export type FormData = z.infer<typeof schema>;

@@ -73,12 +89,15 @@ type Props = {
  handlePopUpToggle: (popUpName: keyof UsePopUpState<["ca"]>, state?: boolean) => void;
 };

-const caTypes = [{ label: "ACME", value: CaType.ACME }];
+const caTypes = [
+  { label: "ACME", value: CaType.ACME },
+  { label: "Azure AD Certificate Service", value: CaType.AZURE_AD_CS }
+];

 export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
  const { currentWorkspace } = useWorkspace();

-  const { data: ca } = useGetCa({
+  const { data: ca, isLoading: isCaLoading } = useGetCa({
    caName: (popUp?.ca?.data as { name: string })?.name || "",
    projectId: currentWorkspace?.id || "",
    type: (popUp?.ca?.data as { type: CaType })?.type || ""
@@ -94,29 +113,54 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
    formState: { isSubmitting },
    watch
  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      type: CaType.ACME,
-      name: "",
-      status: CaStatus.ACTIVE,
-      enableDirectIssuance: true,
-      configuration: {
-        dnsAppConnection: {
-          id: "",
-          name: ""
-        },
-        dnsProviderConfig: {
-          provider: AcmeDnsProvider.ROUTE53,
-          hostedZoneId: ""
-        },
-        directoryUrl: "",
-        accountEmail: ""
-      }
-    }
+    resolver: zodResolver(schema)
  });

  const caType = watch("type");
-  const dnsProvider = watch("configuration.dnsProviderConfig.provider");
+  const configuration = watch("configuration");
+  const dnsProvider =
+    caType === CaType.ACME && configuration && "dnsProviderConfig" in configuration
+      ? configuration.dnsProviderConfig.provider
+      : undefined;
+
+  useEffect(() => {
+    const initialType = (popUp?.ca?.data as { type: CaType })?.type;
+    if (!ca && popUp?.ca?.isOpen) {
+      if (initialType === CaType.AZURE_AD_CS) {
+        reset({
+          type: CaType.AZURE_AD_CS,
+          name: "",
+          status: CaStatus.ACTIVE,
+          enableDirectIssuance: false,
+          configuration: {
+            azureAdcsConnection: {
+              id: "",
+              name: ""
+            }
+          }
+        });
+      } else {
+        reset({
+          type: CaType.ACME,
+          name: "",
+          status: CaStatus.ACTIVE,
+          enableDirectIssuance: true,
+          configuration: {
+            dnsAppConnection: {
+              id: "",
+              name: ""
+            },
+            dnsProviderConfig: {
+              provider: AcmeDnsProvider.ROUTE53,
+              hostedZoneId: ""
+            },
+            directoryUrl: "",
+            accountEmail: ""
+          }
+        });
+      }
+    }
+  }, [popUp?.ca?.isOpen, popUp?.ca?.data, reset, ca]);

  const { data: availableRoute53Connections, isPending: isRoute53Pending } =
    useListAvailableAppConnections(AppConnection.AWS, {
@@ -128,25 +172,44 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
      enabled: caType === CaType.ACME
    });

-  const availableConnections: TAvailableAppConnection[] = useMemo(
-    () => [...(availableRoute53Connections || []), ...(availableCloudflareConnections || [])],
-    [availableRoute53Connections, availableCloudflareConnections]
-  );
+  const { data: availableAzureConnections, isPending: isAzurePending } =
+    useListAvailableAppConnections(AppConnection.AzureADCS, {
+      enabled: caType === CaType.AZURE_AD_CS
+    });

-  const isPending = isRoute53Pending || isCloudflarePending;
+  const availableConnections: TAvailableAppConnection[] = useMemo(() => {
+    if (caType === CaType.ACME) {
+      return [...(availableRoute53Connections || []), ...(availableCloudflareConnections || [])];
+    }
+    if (caType === CaType.AZURE_AD_CS) {
+      return availableAzureConnections || [];
+    }
+    return [];
+  }, [
+    caType,
+    availableRoute53Connections,
+    availableCloudflareConnections,
+    availableAzureConnections
+  ]);

-  const dnsAppConnection = watch("configuration.dnsAppConnection");
+  const isPending = isRoute53Pending || isCloudflarePending || isAzurePending;
+
+  const dnsAppConnection =
+    caType === CaType.ACME && configuration && "dnsAppConnection" in configuration
+      ? configuration.dnsAppConnection
+      : { id: "", name: "" };

  const { data: cloudflareZones = [], isPending: isZonesPending } =
    useCloudflareConnectionListZones(dnsAppConnection.id, {
      enabled: dnsProvider === AcmeDnsProvider.Cloudflare && !!dnsAppConnection.id
    });

+  // Populate form with CA data when editing
  useEffect(() => {
-    if (ca) {
-      if (ca.type !== CaType.INTERNAL && availableConnections?.length) {
+    if (ca && !isCaLoading) {
+      if (ca.type === CaType.ACME && availableConnections?.length) {
        const selectedConnection = availableConnections?.find(
-          (connection) => connection.id === ca?.configuration.dnsAppConnectionId
+          (connection) => connection.id === ca.configuration.dnsAppConnectionId
        );

        reset({
@@ -167,32 +230,61 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
            accountEmail: ca.configuration.accountEmail
          }
        });
+      } else if (ca.type === CaType.AZURE_AD_CS && availableConnections?.length) {
+        const selectedConnection = availableConnections?.find(
+          (connection) => connection.id === ca.configuration.azureAdcsConnectionId
+        );
+
+        reset({
+          type: ca.type,
+          name: ca.name,
+          status: ca.status,
+          enableDirectIssuance: false,
+          configuration: {
+            azureAdcsConnection: {
+              id: ca.configuration.azureAdcsConnectionId,
+              name: selectedConnection?.name || ""
+            }
+          }
+        });
      }
    }
-  }, [ca, availableConnections]);
+  }, [ca, availableConnections, reset, isCaLoading]);

  const onFormSubmit = async ({
    type,
    name,
    enableDirectIssuance,
    status,
-    configuration
+    configuration: formConfiguration
  }: FormData) => {
    try {
      if (!currentWorkspace?.slug) return;

-      if (ca && type !== CaType.INTERNAL) {
+      let configPayload: any;
+
+      if (type === CaType.ACME && "dnsAppConnection" in formConfiguration) {
+        configPayload = {
+          dnsProviderConfig: formConfiguration.dnsProviderConfig,
+          directoryUrl: formConfiguration.directoryUrl,
+          accountEmail: formConfiguration.accountEmail,
+          dnsAppConnectionId: formConfiguration.dnsAppConnection.id
+        };
+      } else if (type === CaType.AZURE_AD_CS && "azureAdcsConnection" in formConfiguration) {
+        configPayload = {
+          azureAdcsConnectionId: formConfiguration.azureAdcsConnection.id
+        };
+      }
+
+      if (ca) {
        await updateMutateAsync({
          caName: ca.name,
          projectId: currentWorkspace.id,
          name,
          type,
          status,
-          enableDirectIssuance,
-          configuration: {
-            ...configuration,
-            dnsAppConnectionId: configuration.dnsAppConnection.id
-          }
+          enableDirectIssuance: type === CaType.AZURE_AD_CS ? false : enableDirectIssuance,
+          configuration: configPayload
        });
      } else {
        await createMutateAsync({
@@ -200,11 +292,8 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
          name,
          type,
          status,
-          enableDirectIssuance,
-          configuration: {
-            ...configuration,
-            dnsAppConnectionId: configuration.dnsAppConnection.id
-          }
+          enableDirectIssuance: type === CaType.AZURE_AD_CS ? false : enableDirectIssuance,
+          configuration: configPayload
        });
      }

@@ -232,7 +321,7 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
        handlePopUpToggle("ca", isOpen);
      }}
    >
-      <ModalContent title={`${ca ? "View" : "Create"} External CA`}>
+      <ModalContent title={`${ca ? "Edit" : "Create"} External CA`}>
        <form onSubmit={handleSubmit(onFormSubmit)}>
          {ca && (
            <FormControl label="CA ID">
@@ -307,7 +396,11 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
              <Controller
                render={({ field: { value, onChange }, fieldState: { error } }) => (
                  <FormControl
-                    tooltipText={`${ACME_DNS_PROVIDER_NAME_MAP[dnsProvider]} uses the ${APP_CONNECTION_MAP[ACME_DNS_PROVIDER_APP_CONNECTION_MAP[dnsProvider]].name} App Connection. You can create one in the Organization Settings page.`}
+                    tooltipText={
+                      dnsProvider
+                        ? `${ACME_DNS_PROVIDER_NAME_MAP[dnsProvider]} uses the ${APP_CONNECTION_MAP[ACME_DNS_PROVIDER_APP_CONNECTION_MAP[dnsProvider]].name} App Connection. You can create one in the Organization Settings page.`
+                        : "Select a DNS provider first"
+                    }
                    isError={Boolean(error)}
                    errorText={error?.message}
                    label="DNS App Connection"
@@ -406,23 +499,52 @@ export const ExternalCaModal = ({ popUp, handlePopUpToggle }: Props) => {
              />
            </>
          )}
-          <Controller
-            control={control}
-            name="enableDirectIssuance"
-            render={({ field, fieldState: { error } }) => {
-              return (
-                <FormControl isError={Boolean(error)} errorText={error?.message} className="my-8">
-                  <Switch
-                    id="is-active"
-                    onCheckedChange={(value) => field.onChange(value)}
-                    isChecked={field.value}
-                  >
-                    <p className="w-full">Enable Direct Issuance</p>
-                  </Switch>
+          {caType === CaType.AZURE_AD_CS && (
+            <Controller
+              render={({ field: { value, onChange }, fieldState: { error } }) => (
+                <FormControl
+                  tooltipText="Azure ADCS App Connection contains the Windows domain credentials and ADCS server URL for certificate requests."
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                  label="Azure ADCS Connection"
+                >
+                  <FilterableSelect
+                    menuPlacement="top"
+                    value={value}
+                    onChange={(newValue) => {
+                      onChange(newValue);
+                    }}
+                    isLoading={isPending}
+                    options={availableConnections}
+                    placeholder="Select connection..."
+                    getOptionLabel={(option) => option.name}
+                    getOptionValue={(option) => option.id}
+                  />
                </FormControl>
-              );
-            }}
-          />
+              )}
+              control={control}
+              name="configuration.azureAdcsConnection"
+            />
+          )}
+          {caType === CaType.ACME && (
+            <Controller
+              control={control}
+              name="enableDirectIssuance"
+              render={({ field, fieldState: { error } }) => {
+                return (
+                  <FormControl isError={Boolean(error)} errorText={error?.message} className="my-8">
+                    <Switch
+                      id="is-active"
+                      onCheckedChange={(value) => field.onChange(value)}
+                      isChecked={field.value}
+                    >
+                      <p className="w-full">Enable Direct Issuance</p>
+                    </Switch>
+                  </FormControl>
+                );
+              }}
+            />
+          )}
          <div className="flex items-center">
            <Button
              className="mr-4"
@@ -27,7 +27,7 @@ import {
  Tr
 } from "@app/components/v2";
 import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context";
-import { CaStatus, CaType, useListCasByTypeAndProjectId } from "@app/hooks/api";
+import { CaStatus, CaType, useListExternalCasByProjectId } from "@app/hooks/api";
 import { caStatusToNameMap, getCaStatusBadgeVariant } from "@app/hooks/api/ca/constants";
 import { UsePopUpState } from "@app/hooks/usePopUp";

@@ -45,7 +45,7 @@ type Props = {

 export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
  const { currentWorkspace } = useWorkspace();
-  const { data, isPending } = useListCasByTypeAndProjectId(CaType.ACME, currentWorkspace.id);
+  const { data, isPending } = useListExternalCasByProjectId(currentWorkspace.id);

  return (
    <div>
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useMemo, useState } from "react";
 import {
  faBan,
  faCertificate,
@@ -36,6 +36,9 @@ import {
  useWorkspace
 } from "@app/context";
 import { useListWorkspaceCertificates } from "@app/hooks/api";
+import { caSupportsCapability } from "@app/hooks/api/ca/constants";
+import { CaCapability, CaType } from "@app/hooks/api/ca/enums";
+import { useListCasByProjectId } from "@app/hooks/api/ca/queries";
 import { CertStatus } from "@app/hooks/api/certificates/enums";
 import { UsePopUpState } from "@app/hooks/usePopUp";

@@ -66,6 +69,20 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
    limit: perPage
  });

+  // Fetch CA data to determine capabilities
+  const { data: caData } = useListCasByProjectId(currentWorkspace?.id ?? "");
+
+  // Create mapping from caId to CA type for capability checking
+  const caCapabilityMap = useMemo(() => {
+    if (!caData) return {};
+
+    const map: Record<string, CaType> = {};
+    caData.forEach((ca) => {
+      map[ca.id] = ca.type;
+    });
+    return map;
+  }, [caData]);
+
  return (
    <TableContainer>
      <Table>
@@ -155,27 +172,42 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
                            </DropdownMenuItem>
                          )}
                        </ProjectPermissionCan>
-                        <ProjectPermissionCan
-                          I={ProjectPermissionCertificateActions.Delete}
-                          a={ProjectPermissionSub.Certificates}
-                        >
-                          {(isAllowed) => (
-                            <DropdownMenuItem
-                              className={twMerge(
-                                !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                              )}
-                              onClick={async () =>
-                                handlePopUpOpen("revokeCertificate", {
-                                  serialNumber: certificate.serialNumber
-                                })
-                              }
-                              disabled={!isAllowed}
-                              icon={<FontAwesomeIcon icon={faBan} />}
+                        {/* Only show revoke button if CA supports revocation */}
+                        {(() => {
+                          const caType = caCapabilityMap[certificate.caId];
+                          const supportsRevocation =
+                            caType &&
+                            caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES);
+
+                          if (!supportsRevocation) {
+                            return null;
+                          }
+
+                          return (
+                            <ProjectPermissionCan
+                              I={ProjectPermissionCertificateActions.Delete}
+                              a={ProjectPermissionSub.Certificates}
                            >
-                              Revoke Certificate
-                            </DropdownMenuItem>
-                          )}
-                        </ProjectPermissionCan>
+                              {(isAllowed) => (
+                                <DropdownMenuItem
+                                  className={twMerge(
+                                    !isAllowed &&
+                                      "pointer-events-none cursor-not-allowed opacity-50"
+                                  )}
+                                  onClick={async () =>
+                                    handlePopUpOpen("revokeCertificate", {
+                                      serialNumber: certificate.serialNumber
+                                    })
+                                  }
+                                  disabled={!isAllowed}
+                                  icon={<FontAwesomeIcon icon={faBan} />}
+                                >
+                                  Revoke Certificate
+                                </DropdownMenuItem>
+                              )}
+                            </ProjectPermissionCan>
+                          );
+                        })()}
                        <ProjectPermissionCan
                          I={ProjectPermissionCertificateActions.Delete}
                          a={ProjectPermissionSub.Certificates}
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useMemo, useState } from "react";
 import { subject } from "@casl/ability";
 import { faCertificate, faEllipsis, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
@@ -31,6 +31,9 @@ import {
  useWorkspace
 } from "@app/context";
 import { useGetPkiSubscriberCertificates } from "@app/hooks/api";
+import { caSupportsCapability } from "@app/hooks/api/ca/constants";
+import { CaCapability, CaType } from "@app/hooks/api/ca/enums";
+import { useListCasByProjectId } from "@app/hooks/api/ca/queries";
 import { CertStatus } from "@app/hooks/api/certificates/enums";
 import { UsePopUpState } from "@app/hooks/usePopUp";

@@ -60,6 +63,20 @@ export const PkiSubscriberCertificatesTable = ({ subscriberName, handlePopUpOpen
    }
  );

+  // Fetch CA data to determine capabilities
+  const { data: caData } = useListCasByProjectId(currentWorkspace?.id ?? "");
+
+  // Create mapping from caId to CA type for capability checking
+  const caCapabilityMap = useMemo(() => {
+    if (!caData) return {};
+
+    const map: Record<string, CaType> = {};
+    caData.forEach((ca) => {
+      map[ca.id] = ca.type;
+    });
+    return map;
+  }, [caData]);
+
  const getCertStatusBadge = (status: string, notAfter: string) => {
    if (status === CertStatus.REVOKED) {
      return <Badge variant="danger">Revoked</Badge>;
@@ -121,39 +138,53 @@ export const PkiSubscriberCertificatesTable = ({ subscriberName, handlePopUpOpen
                        : "-"}
                    </Td>
                    <Td className="flex justify-end">
-                      <DropdownMenu>
-                        <DropdownMenuTrigger asChild className="rounded-lg">
-                          <div className="hover:text-primary-400 data-[state=open]:text-primary-400">
-                            <Tooltip content="More options">
-                              <FontAwesomeIcon size="lg" icon={faEllipsis} />
-                            </Tooltip>
-                          </div>
-                        </DropdownMenuTrigger>
-                        <DropdownMenuContent align="start" className="p-1">
-                          <ProjectPermissionCan
-                            I={ProjectPermissionPkiSubscriberActions.Delete}
-                            a={ProjectPermissionSub.PkiSubscribers}
-                          >
-                            {(isAllowed) => (
-                              <DropdownMenuItem
-                                className={twMerge(
-                                  !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                                )}
-                                onClick={() =>
-                                  handlePopUpOpen &&
-                                  handlePopUpOpen("revokeCertificate", {
-                                    serialNumber: certificate.serialNumber
-                                  })
-                                }
-                                disabled={!isAllowed}
-                                icon={<FontAwesomeIcon icon={faTrash} />}
+                      {(() => {
+                        const caType = caCapabilityMap[certificate.caId];
+                        const supportsRevocation =
+                          caType && caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES);
+
+                        // Don't show dropdown for CAs that don't support revocation
+                        if (!supportsRevocation) {
+                          return null;
+                        }
+
+                        return (
+                          <DropdownMenu>
+                            <DropdownMenuTrigger asChild className="rounded-lg">
+                              <div className="hover:text-primary-400 data-[state=open]:text-primary-400">
+                                <Tooltip content="More options">
+                                  <FontAwesomeIcon size="lg" icon={faEllipsis} />
+                                </Tooltip>
+                              </div>
+                            </DropdownMenuTrigger>
+                            <DropdownMenuContent align="start" className="p-1">
+                              <ProjectPermissionCan
+                                I={ProjectPermissionPkiSubscriberActions.Delete}
+                                a={ProjectPermissionSub.PkiSubscribers}
                              >
-                                Revoke Certificate
-                              </DropdownMenuItem>
-                            )}
-                          </ProjectPermissionCan>
-                        </DropdownMenuContent>
-                      </DropdownMenu>
+                                {(isAllowed) => (
+                                  <DropdownMenuItem
+                                    className={twMerge(
+                                      !isAllowed &&
+                                        "pointer-events-none cursor-not-allowed opacity-50"
+                                    )}
+                                    onClick={() =>
+                                      handlePopUpOpen &&
+                                      handlePopUpOpen("revokeCertificate", {
+                                        serialNumber: certificate.serialNumber
+                                      })
+                                    }
+                                    disabled={!isAllowed}
+                                    icon={<FontAwesomeIcon icon={faTrash} />}
+                                  >
+                                    Revoke Certificate
+                                  </DropdownMenuItem>
+                                )}
+                              </ProjectPermissionCan>
+                            </DropdownMenuContent>
+                          </DropdownMenu>
+                        );
+                      })()}
                    </Td>
                  </Tr>
                );
@@ -26,6 +26,7 @@ import { useWorkspace } from "@app/context";
 import {
  CaType,
  useCreatePkiSubscriber,
+  useGetAzureAdcsTemplates,
  useGetPkiSubscriber,
  useListCasByProjectId,
  useListWorkspacePkiSubscribers,
@@ -77,7 +78,15 @@ const schema = z
    }),
    enableAutoRenewal: z.boolean().optional().default(false),
    renewalBefore: z.number().min(1).optional(),
-    renewalUnit: z.nativeEnum(TimeUnit).optional()
+    renewalUnit: z.nativeEnum(TimeUnit).optional(),
+    // Properties for Azure ADCS and additional subject fields
+    azureTemplateType: z.string().optional(),
+    organization: z.string().optional(),
+    organizationalUnit: z.string().optional(),
+    country: z.string().length(2).optional().or(z.literal("")),
+    state: z.string().optional(),
+    locality: z.string().optional(),
+    emailAddress: z.string().email().optional().or(z.literal(""))
  })
  .required();

@@ -121,7 +130,14 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
      extendedKeyUsages: {},
      enableAutoRenewal: false,
      renewalBefore: 7,
-      renewalUnit: TimeUnit.DAY
+      renewalUnit: TimeUnit.DAY,
+      azureTemplateType: "",
+      organization: "",
+      organizationalUnit: "",
+      country: "",
+      state: "",
+      locality: "",
+      emailAddress: ""
    }
  });

@@ -129,46 +145,54 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
  const selectedCa = cas?.find((ca) => ca.id === selectedCaId);
  const selectedAutoRenewalState = watch("enableAutoRenewal");

+  // Fetch Azure ADCS templates when Azure CA is selected
+  const { data: azureTemplates } = useGetAzureAdcsTemplates({
+    caId: selectedCa?.type === CaType.AZURE_AD_CS ? selectedCaId : "",
+    projectId
+  });
+
+  console.log(pkiSubscriber);
+
+  // Initialize form with ALL subscriber data including template
  useEffect(() => {
    if (pkiSubscriber) {
-      reset({
-        name: pkiSubscriber.name,
-        caId: pkiSubscriber.caId || "",
-        commonName: pkiSubscriber.commonName,
-        subjectAlternativeNames: pkiSubscriber.subjectAlternativeNames.join(", ") || "",
-        ttl: pkiSubscriber.ttl || "",
-        keyUsages: Object.fromEntries((pkiSubscriber.keyUsages || []).map((name) => [name, true])),
-        extendedKeyUsages: Object.fromEntries(
-          (pkiSubscriber.extendedKeyUsages || []).map((name) => [name, true])
-        ),
-        enableAutoRenewal: pkiSubscriber.enableAutoRenewal || false,
-        renewalBefore: pkiSubscriber.autoRenewalPeriodInDays || 7,
-        renewalUnit: TimeUnit.DAY
-      });
-    } else {
-      reset({
-        name: "",
-        caId: "",
-        commonName: "",
-        subjectAlternativeNames: "",
-        ttl: "",
-        keyUsages: {
-          [CertKeyUsage.DIGITAL_SIGNATURE]: true,
-          [CertKeyUsage.KEY_ENCIPHERMENT]: true
-        },
-        extendedKeyUsages: {},
-        enableAutoRenewal: false,
-        renewalBefore: 7,
-        renewalUnit: TimeUnit.DAY
-      });
+      // Set all values directly and immediately
+      setValue("name", pkiSubscriber.name);
+      setValue("caId", pkiSubscriber.caId || "");
+      setValue("commonName", pkiSubscriber.commonName);
+      setValue("subjectAlternativeNames", pkiSubscriber.subjectAlternativeNames.join(", "));
+      setValue("ttl", pkiSubscriber.ttl || "");
+      setValue(
+        "keyUsages",
+        Object.fromEntries((pkiSubscriber.keyUsages || []).map((name) => [name, true]))
+      );
+      setValue(
+        "extendedKeyUsages",
+        Object.fromEntries((pkiSubscriber.extendedKeyUsages || []).map((name) => [name, true]))
+      );
+      setValue("enableAutoRenewal", pkiSubscriber.enableAutoRenewal || false);
+      setValue("renewalBefore", pkiSubscriber.autoRenewalPeriodInDays || 7);
+      setValue("renewalUnit", TimeUnit.DAY);
+
+      // Set Azure template immediately
+      setValue("azureTemplateType", pkiSubscriber.properties?.azureTemplateType || "");
+
+      // Set all Additional Subject Fields immediately
+      setValue("organization", pkiSubscriber.properties?.organization || "");
+      setValue("organizationalUnit", pkiSubscriber.properties?.organizationalUnit || "");
+      setValue("country", pkiSubscriber.properties?.country || "");
+      setValue("state", pkiSubscriber.properties?.state || "");
+      setValue("locality", pkiSubscriber.properties?.locality || "");
+      setValue("emailAddress", pkiSubscriber.properties?.emailAddress || "");
    }
-  }, [pkiSubscriber, reset]);
+  }, [pkiSubscriber, setValue]);

  useEffect(() => {
-    if (cas?.length) {
+    if (cas?.length && !pkiSubscriber) {
+      // Only auto-select first CA when creating new subscriber, not when updating
      setValue("caId", cas[0].id);
    }
-  }, [cas, setValue]);
+  }, [cas, setValue, pkiSubscriber]);

  const onFormSubmit = async ({
    name,
@@ -180,7 +204,14 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
    extendedKeyUsages,
    enableAutoRenewal,
    renewalBefore,
-    renewalUnit
+    renewalUnit,
+    azureTemplateType,
+    organization,
+    organizationalUnit,
+    country,
+    state,
+    locality,
+    emailAddress
  }: FormData) => {
    try {
      if (!projectId) return;
@@ -205,13 +236,28 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
        return;
      }

-      const keyUsagesList = Object.entries(keyUsages)
-        .filter(([, value]) => value)
-        .map(([key]) => key as CertKeyUsage);
+      // Validate Azure template for Azure ADCS CA
+      if (selectedCa?.type === CaType.AZURE_AD_CS && !azureTemplateType) {
+        createNotification({
+          text: "Please select an Azure certificate template",
+          type: "error"
+        });
+        return;
+      }

-      const extendedKeyUsagesList = Object.entries(extendedKeyUsages)
-        .filter(([, value]) => value)
-        .map(([key]) => key as CertExtendedKeyUsage);
+      const keyUsagesList =
+        selectedCa?.type === CaType.AZURE_AD_CS
+          ? []
+          : Object.entries(keyUsages)
+              .filter(([, value]) => value)
+              .map(([key]) => key as CertKeyUsage);
+
+      const extendedKeyUsagesList =
+        selectedCa?.type === CaType.AZURE_AD_CS
+          ? []
+          : Object.entries(extendedKeyUsages)
+              .filter(([, value]) => value)
+              .map(([key]) => key as CertExtendedKeyUsage);

      const subjectAlternativeNamesList = subjectAlternativeNames
        .split(",")
@@ -222,6 +268,17 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
        ? convertTimeUnitValueToDays(renewalUnit, renewalBefore)
        : undefined;

+      // Build properties object
+      const properties = {
+        ...(selectedCa?.type === CaType.AZURE_AD_CS && azureTemplateType && { azureTemplateType }),
+        ...(organization && { organization }),
+        ...(organizationalUnit && { organizationalUnit }),
+        ...(country && { country }),
+        ...(state && { state }),
+        ...(locality && { locality }),
+        ...(emailAddress && { emailAddress })
+      };
+
      if (pkiSubscriber) {
        await updateMutateAsync({
          subscriberName: pkiSubscriber.name,
@@ -234,7 +291,8 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
          keyUsages: keyUsagesList,
          extendedKeyUsages: extendedKeyUsagesList,
          enableAutoRenewal,
-          autoRenewalPeriodInDays
+          autoRenewalPeriodInDays,
+          properties: Object.keys(properties).length > 0 ? properties : undefined
        });
      } else {
        await createMutateAsync({
@@ -247,7 +305,8 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
          keyUsages: keyUsagesList,
          extendedKeyUsages: extendedKeyUsagesList,
          enableAutoRenewal,
-          autoRenewalPeriodInDays
+          autoRenewalPeriodInDays,
+          properties: Object.keys(properties).length > 0 ? properties : undefined
        });
      }

@@ -276,17 +335,7 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
      }}
    >
      <ModalContent title={`${pkiSubscriber ? "Update" : "Add"} PKI Subscriber`}>
-        <form
-          onSubmit={handleSubmit(onFormSubmit, (fields) => {
-            setTabValue(
-              ["name", "caId", "commonName", "subjectAlternativeNames", "ttl"].includes(
-                Object.keys(fields)[0]
-              )
-                ? FormTab.Configuration
-                : FormTab.Advanced
-            );
-          })}
-        >
+        <form key={pkiSubscriber?.id || "new"} onSubmit={handleSubmit(onFormSubmit)}>
          <Tabs value={tabValue} onValueChange={(value) => setTabValue(value as FormTab)}>
            <TabList>
              <Tab value={FormTab.Configuration}>Configuration</Tab>
@@ -323,8 +372,7 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
                    isRequired
                  >
                    <Select
-                      defaultValue={field.value}
-                      {...field}
+                      value={field.value}
                      onValueChange={(e) => onChange(e)}
                      className="w-full"
                    >
@@ -342,6 +390,34 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
                  </FormControl>
                )}
              />
+              {selectedCa?.type === CaType.AZURE_AD_CS && (
+                <Controller
+                  control={control}
+                  name="azureTemplateType"
+                  render={({ field: { onChange, ...field }, fieldState: { error } }) => (
+                    <FormControl
+                      label="Certificate Template"
+                      errorText={error?.message}
+                      isError={Boolean(error)}
+                      isRequired
+                    >
+                      <Select
+                        value={field.value}
+                        onValueChange={(e) => onChange(e)}
+                        className="w-full"
+                      >
+                        {(azureTemplates?.templates || []).map(
+                          (template: { id: string; name: string }) => (
+                            <SelectItem value={template.id} key={template.id}>
+                              {template.name}
+                            </SelectItem>
+                          )
+                        )}
+                      </Select>
+                    </FormControl>
+                  )}
+                />
+              )}
              <Controller
                control={control}
                name="commonName"
@@ -369,6 +445,102 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
                  </FormControl>
                )}
              />
+
+              {/* Additional Subject Fields - Available for all CA types */}
+              <Accordion type="single" collapsible className="mb-4 w-full">
+                <AccordionItem value="subject-fields" className="data-[state=open]:border-none">
+                  <AccordionTrigger className="h-fit flex-none pl-1 text-sm">
+                    <div className="order-1 ml-3">Additional Subject Fields</div>
+                  </AccordionTrigger>
+                  <AccordionContent>
+                    <div className="grid grid-cols-1 gap-4">
+                      <Controller
+                        control={control}
+                        name="organization"
+                        render={({ field, fieldState: { error } }) => (
+                          <FormControl
+                            label="Organization (O)"
+                            isError={Boolean(error)}
+                            errorText={error?.message}
+                          >
+                            <Input {...field} placeholder="Example Corp" />
+                          </FormControl>
+                        )}
+                      />
+                      <Controller
+                        control={control}
+                        name="organizationalUnit"
+                        render={({ field, fieldState: { error } }) => (
+                          <FormControl
+                            label="Organizational Unit (OU)"
+                            isError={Boolean(error)}
+                            errorText={error?.message}
+                          >
+                            <Input {...field} placeholder="IT Department" />
+                          </FormControl>
+                        )}
+                      />
+                      <div className="grid grid-cols-2 gap-4">
+                        <Controller
+                          control={control}
+                          name="country"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="Country (C)"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                            >
+                              <Input {...field} placeholder="US" maxLength={2} />
+                            </FormControl>
+                          )}
+                        />
+                        <Controller
+                          control={control}
+                          name="state"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="State/Province (ST)"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                            >
+                              <Input {...field} placeholder="California" />
+                            </FormControl>
+                          )}
+                        />
+                      </div>
+                      <div className="grid grid-cols-2 gap-4">
+                        <Controller
+                          control={control}
+                          name="locality"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="Locality (L)"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                            >
+                              <Input {...field} placeholder="San Francisco" />
+                            </FormControl>
+                          )}
+                        />
+                        <Controller
+                          control={control}
+                          name="emailAddress"
+                          render={({ field, fieldState: { error } }) => (
+                            <FormControl
+                              label="Email Address"
+                              isError={Boolean(error)}
+                              errorText={error?.message}
+                            >
+                              <Input {...field} type="email" placeholder="[email protected]" />
+                            </FormControl>
+                          )}
+                        />
+                      </div>
+                    </div>
+                  </AccordionContent>
+                </AccordionItem>
+              </Accordion>
+
              {selectedCa?.type !== CaType.ACME && (
                <Controller
                  control={control}
@@ -385,7 +557,7 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
                  )}
                />
              )}
-              {selectedCa?.type !== CaType.ACME && (
+              {selectedCa?.type !== CaType.ACME && selectedCa?.type !== CaType.AZURE_AD_CS && (
                <Accordion type="single" collapsible className="w-full">
                  <AccordionItem value="key-usages" className="data-[state=open]:border-none">
                    <AccordionTrigger className="h-fit flex-none pl-1 text-sm">
@@ -517,8 +689,7 @@ export const PkiSubscriberModal = ({ popUp, handlePopUpToggle }: Props) => {
                        isError={Boolean(error)}
                      >
                        <Select
-                          defaultValue={field.value}
-                          {...field}
+                          value={field.value}
                          onValueChange={(e) => onChange(e)}
                          className="w-48"
                        >
@@ -12,6 +12,7 @@ import { AppConnectionHeader } from "../AppConnectionHeader";
 import { OnePassConnectionForm } from "./1PasswordConnectionForm";
 import { Auth0ConnectionForm } from "./Auth0ConnectionForm";
 import { AwsConnectionForm } from "./AwsConnectionForm";
+import { AzureADCSConnectionForm } from "./AzureADCSConnectionForm";
 import { AzureAppConfigurationConnectionForm } from "./AzureAppConfigurationConnectionForm";
 import { AzureClientSecretsConnectionForm } from "./AzureClientSecretsConnectionForm";
 import { AzureDevOpsConnectionForm } from "./AzureDevOpsConnectionForm";
@@ -96,6 +97,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
      return <AzureKeyVaultConnectionForm onSubmit={onSubmit} />;
    case AppConnection.AzureAppConfiguration:
      return <AzureAppConfigurationConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.AzureADCS:
+      return <AzureADCSConnectionForm onSubmit={onSubmit} />;
    case AppConnection.Databricks:
      return <DatabricksConnectionForm onSubmit={onSubmit} />;
    case AppConnection.Humanitec:
@@ -208,6 +211,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
      return (
        <AzureAppConfigurationConnectionForm appConnection={appConnection} onSubmit={onSubmit} />
      );
+    case AppConnection.AzureADCS:
+      return <AzureADCSConnectionForm appConnection={appConnection} onSubmit={onSubmit} />;
    case AppConnection.Databricks:
      return <DatabricksConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    case AppConnection.Humanitec:
@@ -0,0 +1,169 @@
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { AzureADCSConnectionMethod, TAzureADCSConnection } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TAzureADCSConnection;
+  onSubmit: (formData: FormData) => Promise<void>;
+};
+
+const rootSchema = genericAppConnectionFieldsSchema.extend({
+  app: z.literal(AppConnection.AzureADCS)
+});
+
+const formSchema = z.discriminatedUnion("method", [
+  rootSchema.extend({
+    method: z.literal(AzureADCSConnectionMethod.UsernamePassword),
+    credentials: z.object({
+      adcsUrl: z.string().url().trim().min(1, "ADCS URL required"),
+      username: z.string().trim().min(1, "Username required"),
+      password: z.string().trim().min(1, "Password required")
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const AzureADCSConnectionForm = ({ appConnection, onSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues: appConnection ?? {
+      app: AppConnection.AzureADCS,
+      method: AzureADCSConnectionMethod.UsernamePassword,
+      name: "",
+      description: "",
+      credentials: {
+        adcsUrl: "",
+        username: "",
+        password: ""
+      }
+    }
+  });
+
+  const {
+    handleSubmit,
+    control,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.AzureADCS].name
+              }. This field cannot be changed after creation.`}
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => onChange(val)}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(AzureADCSConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+        <Controller
+          name="credentials.adcsUrl"
+          control={control}
+          render={({ field, fieldState: { error } }) => (
+            <FormControl
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              label="ADCS URL"
+            >
+              <Input {...field} placeholder="https://your-adcs-server.com" />
+            </FormControl>
+          )}
+        />
+        <div className="grid grid-cols-2 gap-2">
+          <Controller
+            name="credentials.username"
+            control={control}
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Username"
+              >
+                <Input {...field} placeholder="domain\\username" />
+              </FormControl>
+            )}
+          />
+          <Controller
+            name="credentials.password"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                label="Password"
+              >
+                <SecretInput
+                  containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                  value={value}
+                  onChange={(e) => onChange(e.target.value)}
+                />
+              </FormControl>
+            )}
+          />
+        </div>
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting || !isDirty}
+          >
+            {isUpdate ? "Update Credentials" : "Connect to Azure ADCS"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};