Fix missing signatureAlgorithm on getCaCredentials

backend/src/services/certificate-authority/certificate-authority-fns.test.ts

@@ -28,6 +28,17 @@ describe("signatureAlgorithmToAlgCfg", () => {
       });
     });
 
+    it("should handle RSA-SHA256 with RSA_3072 correctly", () => {
+      const result = signatureAlgorithmToAlgCfg("RSA-SHA256", CertKeyAlgorithm.RSA_3072);
+
+      expect(result).toEqual({
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256",
+        publicExponent: new Uint8Array([1, 0, 1]),
+        modulusLength: 3072
+      });
+    });
+
     it("should handle RSA-SHA512 correctly", () => {
       const result = signatureAlgorithmToAlgCfg("RSA-SHA512", CertKeyAlgorithm.RSA_2048);
 

backend/src/services/certificate-authority/certificate-authority-fns.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-nested-ternary */
 import * as x509 from "@peculiar/x509";
 
 import { crypto } from "@app/lib/crypto/cryptography";
@@ -68,6 +69,13 @@ export const parseDistinguishedName = (dn: string): TDNParts => {
 
 export const keyAlgorithmToAlgCfg = (keyAlgorithm: CertKeyAlgorithm) => {
   switch (keyAlgorithm) {
+    case CertKeyAlgorithm.RSA_3072:
+      return {
+        name: "RSASSA-PKCS1-v1_5",
+        hash: "SHA-256",
+        publicExponent: new Uint8Array([1, 0, 1]),
+        modulusLength: 3072
+      };
     case CertKeyAlgorithm.RSA_4096:
       return {
         name: "RSASSA-PKCS1-v1_5",
@@ -137,7 +145,8 @@ export const signatureAlgorithmToAlgCfg = (signatureAlgorithm: string, keyAlgori
         name: "RSASSA-PKCS1-v1_5",
         hash: normalizedHash || "SHA-256",
         publicExponent: new Uint8Array([1, 0, 1]),
-        modulusLength: keyAlgorithm === CertKeyAlgorithm.RSA_4096 ? 4096 : 2048
+        modulusLength:
+          keyAlgorithm === CertKeyAlgorithm.RSA_4096 ? 4096 : keyAlgorithm === CertKeyAlgorithm.RSA_3072 ? 3072 : 2048
       };
     case "ECDSA":
       // eslint-disable-next-line no-case-declarations
@@ -177,7 +186,8 @@ export const getCaCredentials = async ({
   certificateAuthorityDAL,
   certificateAuthoritySecretDAL,
   projectDAL,
-  kmsService
+  kmsService,
+  signatureAlgorithm
 }: TGetCaCredentialsDTO) => {
   const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
   if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
@@ -198,7 +208,7 @@ export const getCaCredentials = async ({
     cipherTextBlob: caSecret.encryptedPrivateKey
   });
 
-  const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+  const alg = signatureAlgorithm || keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
   const skObj = crypto.nativeCrypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" });
   const caPrivateKey = await crypto.nativeCrypto.subtle.importKey(
     "pkcs8",

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -1322,7 +1322,8 @@ export const internalCertificateAuthorityServiceFactory = ({
       certificateAuthorityDAL,
       certificateAuthoritySecretDAL,
       projectDAL,
-      kmsService
+      kmsService,
+      signatureAlgorithm: signingAlg
     });
 
     const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -195,6 +195,7 @@ export type TGetCaCredentialsDTO = {
   certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+  signatureAlgorithm?: RsaHashedImportParams | EcKeyImportParams;
 };
 
 export type TGetCaCertChainsDTO = {

backend/src/services/certificate-template-v2/certificate-template-v2-service.ts

@@ -174,9 +174,11 @@ export const certificateTemplateV2ServiceFactory = ({
   const mapTemplateKeyAlgorithmToApi = (templateFormat: string): string => {
     const mapping: Record<string, string> = {
       "RSA-2048": "RSA_2048",
+      "RSA-3072": "RSA_3072",
       "RSA-4096": "RSA_4096",
       "ECDSA-P256": "EC_prime256v1",
-      "ECDSA-P384": "EC_secp384r1"
+      "ECDSA-P384": "EC_secp384r1",
+      "ECDSA-P521": "EC_secp521r1"
     };
     return mapping[templateFormat] || templateFormat;
   };

backend/src/services/certificate/certificate-types.ts

@@ -13,9 +13,11 @@ export enum CertStatus {
 
 export enum CertKeyAlgorithm {
   RSA_2048 = "RSA_2048",
+  RSA_3072 = "RSA_3072",
   RSA_4096 = "RSA_4096",
   ECDSA_P256 = "EC_prime256v1",
-  ECDSA_P384 = "EC_secp384r1"
+  ECDSA_P384 = "EC_secp384r1",
+  ECDSA_P521 = "EC_secp521r1"
 }
 
 export enum CertSignatureAlgorithm {