diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts
index c5d3ccabe..b101c168f 100644
--- a/backend/src/lib/api-docs/constants.ts
+++ b/backend/src/lib/api-docs/constants.ts
@@ -2320,7 +2320,7 @@ export const AppConnections = {
       password: "The password used to access Azure ADCS.",
       sslRejectUnauthorized:
         "Whether or not to reject unauthorized SSL certificates (true/false). Set to false only in test environments with self-signed certificates.",
-      sslCertificate: "The SSL certificate (PEM format) to use for secure connection with a self-signed certificate."
+      sslCertificate: "The SSL certificate (PEM format) to use for secure connection."
     }
   }
 };
diff --git a/backend/src/server/routes/v1/pki-subscriber-router.ts b/backend/src/server/routes/v1/pki-subscriber-router.ts
index d9f6ff6f0..30202af18 100644
--- a/backend/src/server/routes/v1/pki-subscriber-router.ts
+++ b/backend/src/server/routes/v1/pki-subscriber-router.ts
@@ -142,7 +142,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
@@ -164,7 +164,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "State cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
@@ -179,7 +179,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "Locality cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
@@ -310,7 +310,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
@@ -332,7 +332,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "State cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
@@ -347,7 +347,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
                 'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
               )
               .regex(
-                /^[^\s-_.]+.*[^\s-_.]+$|^[^\s-_.]{1}$/,
+                new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
                 "Locality cannot start or end with spaces, hyphens, underscores, or periods"
               )
               .optional()
diff --git a/backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts b/backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
index 92f99cede..0e2619a27 100644
--- a/backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
+++ b/backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
@@ -923,7 +923,7 @@ export const AzureAdCsCertificateAuthorityFns = ({
 
       if (retryCount === maxRetries) {
         throw new BadRequestError({
-          message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}. For manual approval scenarios, consider implementing a background polling mechanism.`
+          message: `Certificate request submitted with ID ${submissionResponse.certificateId} but failed to retrieve after ${maxRetries} attempts. The certificate may still be pending approval or processing. Last error: ${lastError?.message || "Unknown error"}.`
         });
       }
     }
diff --git a/docs/documentation/platform/pki/azure-adcs.mdx b/docs/documentation/platform/pki/azure-adcs.mdx
index 8ce48345f..b0cea565e 100644
--- a/docs/documentation/platform/pki/azure-adcs.mdx
+++ b/docs/documentation/platform/pki/azure-adcs.mdx
@@ -137,7 +137,7 @@ If a certificate request requires manual approval:
 4. **No background polling**: Currently, Infisical does not check for certificates that might be approved hours or days later
 
 <Info>
-**Future Enhancement**: Background polling for delayed certificate approvals is planned for future releases. For now, configure your ADCS templates for immediate issuance to ensure smooth certificate provisioning.
+**Future Enhancement**: Background polling for delayed certificate approvals is planned for future releases.
 </Info>
 
 ### Certificate Revocation
@@ -200,8 +200,7 @@ This allows Infisical to control certificate expiration dates directly.
 - Ensure network connectivity to ADCS server
 
 **SSL/TLS Certificate Errors**
-- For ADCS servers with self-signed certificates: disable "Reject Unauthorized" in the SSL tab of your Azure ADCS app connection, or provide the certificate in PEM format
-- For production environments, consider installing proper SSL certificates on your ADCS server instead of disabling SSL verification
+- For ADCS servers with self-signed or private certificates: disable "Reject Unauthorized" in the SSL tab of your Azure ADCS app connection, or provide the certificate in PEM format
 - Common SSL errors: `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`
 - The SSL configuration applies to all HTTPS communications between Infisical and your ADCS server
 - Only HTTPS URLs are supported - HTTP connections are not allowed for security reasons