awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CA issuance blocker for profiles

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-20 15:55:32 -03:00
parent 5ce39fc823
commit 686cf92233
6 changed files with 20 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/server/routes/v1/certificate-profiles-router.ts
View File

@@ -142,7 +142,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
.object({
id: z.string(),
disableBootstrapCaValidation: z.boolean(),
passphrase: z.string(),
passphrase: z.string().optional(),
caChain: z.string().optional()
})
.optional(),

11
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
View File

@@ -1179,7 +1179,8 @@ export const internalCertificateAuthorityServiceFactory = ({
keyUsages,
extendedKeyUsages,
signatureAlgorithm,
keyAlgorithm
keyAlgorithm,
isFromProfile
}: TIssueCertFromCaDTO) => {
let ca: TCertificateAuthorityWithAssociatedCa | undefined;
let certificateTemplate: TCertificateTemplates | undefined;
@@ -1226,7 +1227,7 @@ export const internalCertificateAuthorityServiceFactory = ({
if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (!ca.internalCa.activeCaCertId)
throw new BadRequestError({ message: "CA does not have a certificate installed" });
if (!ca.enableDirectIssuance && !certificateTemplate) {
if (!isFromProfile && !ca.enableDirectIssuance && !certificateTemplate) {
throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
}
@@ -1355,7 +1356,7 @@ export const internalCertificateAuthorityServiceFactory = ({
// handle key usages
let selectedKeyUsages: CertKeyUsage[] = keyUsages ?? [];
if (keyUsages === undefined && !certificateTemplate) {
selectedKeyUsages = [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
selectedKeyUsages = isFromProfile ? [] : [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
}
if (keyUsages === undefined && certificateTemplate) {
@@ -1601,7 +1602,7 @@ export const internalCertificateAuthorityServiceFactory = ({
if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
if (!ca.internalCa.activeCaCertId)
throw new BadRequestError({ message: "CA does not have a certificate installed" });
if (!ca.enableDirectIssuance && !certificateTemplate) {
if (!dto.isFromProfile && !ca.enableDirectIssuance && !certificateTemplate) {
throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
}
@@ -1731,7 +1732,7 @@ export const internalCertificateAuthorityServiceFactory = ({
if (csrKeyUsageExtension) {
selectedKeyUsages = csrKeyUsages;
} else {
selectedKeyUsages = [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
selectedKeyUsages = dto.isFromProfile ? [] : [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
}
}

3
backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts
View File

@@ -138,6 +138,7 @@ export type TIssueCertFromCaDTO = {
extendedKeyUsages?: CertExtendedKeyUsage[];
signatureAlgorithm?: CertSignatureAlgorithm;
keyAlgorithm?: CertKeyAlgorithm;
isFromProfile?: boolean;
} & Omit<TProjectPermission, "projectId">;
export type TSignCertFromCaDTO =
@@ -157,6 +158,7 @@ export type TSignCertFromCaDTO =
extendedKeyUsages?: CertExtendedKeyUsage[];
signatureAlgorithm?: string;
keyAlgorithm?: string;
isFromProfile?: boolean;
}
| ({
isInternal: false;
@@ -174,6 +176,7 @@ export type TSignCertFromCaDTO =
extendedKeyUsages?: CertExtendedKeyUsage[];
signatureAlgorithm?: string;
keyAlgorithm?: string;
isFromProfile?: boolean;
} & Omit<TProjectPermission, "projectId">);
export type TGetCaCertificateTemplatesDTO = {

6
backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
View File

@@ -213,7 +213,8 @@ export const certificateEstV3ServiceFactory = ({
const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
isInternal: true,
caId: profile.caId,
csr
csr,
isFromProfile: true
});
return convertRawCertsToPkcs7([certificate.rawData]);
@@ -332,7 +333,8 @@ export const certificateEstV3ServiceFactory = ({
const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
isInternal: true,
caId: profile.caId,
csr
csr,
isFromProfile: true
});
return convertRawCertsToPkcs7([certificate.rawData]);

4
backend/src/services/certificate-profile/certificate-profile-dal.ts
View File

@@ -123,7 +123,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
? ({
id: result.estConfigId,
disableBootstrapCaValidation: !!result.estConfigDisableBootstrapCaValidation,
passphrase: "",
passphrase: result.estConfigHashedPassphrase,
caChain: result.estConfigEncryptedCaChain ? result.estConfigEncryptedCaChain.toString("utf8") : ""
} as TCertificateProfileWithConfigs["estConfig"])
: undefined;
@@ -324,7 +324,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
? {
id: result.estId as string,
disableBootstrapCaValidation: !!result.estDisableBootstrapCaValidation,
passphrase: "",
passphrase: result.estConfigHashedPassphrase,
caChain: result.estEncryptedCaChain ? (result.estEncryptedCaChain as Buffer).toString("utf8") : ""
}
: undefined;

6
backend/src/services/certificate-v3/certificate-v3-service.ts
View File

@@ -265,7 +265,8 @@ export const certificateV3ServiceFactory = ({
actor,
actorId,
actorAuthMethod,
actorOrgId
actorOrgId,
isFromProfile: true
});
const cert = await certificateDAL.findOne({ serialNumber, caId: ca.id });
@@ -361,7 +362,8 @@ export const certificateV3ServiceFactory = ({
notBefore: normalizeDateForApi(notBefore),
notAfter: normalizeDateForApi(notAfter),
signatureAlgorithm: effectiveSignatureAlgorithm,
keyAlgorithm: effectiveKeyAlgorithm
keyAlgorithm: effectiveKeyAlgorithm,
isFromProfile: true
});
const cert = await certificateDAL.findOne({ serialNumber, caId: ca.id });