awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-20 08:20:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix PKI syncs to return intermidiate chain and root CA on the json object

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-20 10:32:31 -03:00
parent 002969a32d
commit 4ed9ca106e
4 changed files with 70 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-fns.ts
+5 -1
View File
@@ -17,6 +17,7 @@ import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -262,7 +263,10 @@ export const awsSecretsManagerPkiSyncFactory = ({
};
if (certificateChain && certificateChain.trim().length > 0) {
certificateData[fieldMappings.certificateChain] = certificateChain;
const processedCertificateChain = removeRootCaFromChain(certificateChain);
if (processedCertificateChain.trim().length > 0) {
certificateData[fieldMappings.certificateChain] = processedCertificateChain;
}
}
if (caCertificate && typeof caCertificate === "string" && caCertificate.trim().length > 0) {
backend/src/services/pki-sync/chef/chef-pki-sync-fns.ts
+4 -1
View File
@@ -10,6 +10,7 @@ import {
import { TChefDataBagItemContent } from "@app/ee/services/secret-sync/chef";
import { logger } from "@app/lib/logger";
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -264,11 +265,13 @@ export const chefPkiSyncFactory = ({ certificateDAL, certificateSyncDAL }: TChef
} = certificateData;
try {
const processedCertificateChain = certificateChain ? removeRootCaFromChain(certificateChain) : undefined;
const chefDataBagItem: ChefCertificateDataBagItem = {
id: targetItemName,
[fieldMappings.certificate]: cert,
[fieldMappings.privateKey]: certPrivateKey,
...(certificateChain && { [fieldMappings.certificateChain]: certificateChain }),
...(processedCertificateChain && { [fieldMappings.certificateChain]: processedCertificateChain }),
...(caCertificate && { [fieldMappings.caCertificate]: caCertificate })
};
backend/src/services/pki-sync/pki-sync-queue.ts
+2 -1
View File
@@ -26,6 +26,7 @@ import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-
import { TCertificateAuthorityCertDALFactory } from "../certificate-authority/certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
import { getCaCertChain } from "../certificate-authority/certificate-authority-fns";
import { extractRootCaFromChain } from "../certificate-common/certificate-utils";
import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
import { CertificateSyncStatus } from "../certificate-sync/certificate-sync-enums";
import { TPkiSyncDALFactory } from "./pki-sync-dal";
@@ -255,7 +256,7 @@ export const pkiSyncQueueFactory = ({
if (!certBody.encryptedCertificateChain) {
certificateChain = `${caCert}\n${caCertChain}`.trim();
}
caCertificate = caCert;
caCertificate = certificateChain ? extractRootCaFromChain(certificateChain) : caCert;
}
} catch (chainError) {
logger.warn(