Fix CA issuance blocker for profiles

backend/src/server/routes/v1/certificate-profiles-router.ts

@@ -142,7 +142,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
               .object({
                 id: z.string(),
                 disableBootstrapCaValidation: z.boolean(),
-                passphrase: z.string(),
+                passphrase: z.string().optional(),
                 caChain: z.string().optional()
               })
               .optional(),

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -1179,7 +1179,8 @@ export const internalCertificateAuthorityServiceFactory = ({
     keyUsages,
     extendedKeyUsages,
     signatureAlgorithm,
-    keyAlgorithm
+    keyAlgorithm,
+    isFromProfile
   }: TIssueCertFromCaDTO) => {
     let ca: TCertificateAuthorityWithAssociatedCa | undefined;
     let certificateTemplate: TCertificateTemplates | undefined;
@@ -1226,7 +1227,7 @@ export const internalCertificateAuthorityServiceFactory = ({
     if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.internalCa.activeCaCertId)
       throw new BadRequestError({ message: "CA does not have a certificate installed" });
-    if (!ca.enableDirectIssuance && !certificateTemplate) {
+    if (!isFromProfile && !ca.enableDirectIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
     }
 
@@ -1355,7 +1356,7 @@ export const internalCertificateAuthorityServiceFactory = ({
     // handle key usages
     let selectedKeyUsages: CertKeyUsage[] = keyUsages ?? [];
     if (keyUsages === undefined && !certificateTemplate) {
-      selectedKeyUsages = [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
+      selectedKeyUsages = isFromProfile ? [] : [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
     }
 
     if (keyUsages === undefined && certificateTemplate) {
@@ -1601,7 +1602,7 @@ export const internalCertificateAuthorityServiceFactory = ({
     if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.internalCa.activeCaCertId)
       throw new BadRequestError({ message: "CA does not have a certificate installed" });
-    if (!ca.enableDirectIssuance && !certificateTemplate) {
+    if (!dto.isFromProfile && !ca.enableDirectIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
     }
 
@@ -1731,7 +1732,7 @@ export const internalCertificateAuthorityServiceFactory = ({
       if (csrKeyUsageExtension) {
         selectedKeyUsages = csrKeyUsages;
       } else {
-        selectedKeyUsages = [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
+        selectedKeyUsages = dto.isFromProfile ? [] : [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT];
       }
     }
 

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -138,6 +138,7 @@ export type TIssueCertFromCaDTO = {
   extendedKeyUsages?: CertExtendedKeyUsage[];
   signatureAlgorithm?: CertSignatureAlgorithm;
   keyAlgorithm?: CertKeyAlgorithm;
+  isFromProfile?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TSignCertFromCaDTO =
@@ -157,6 +158,7 @@ export type TSignCertFromCaDTO =
       extendedKeyUsages?: CertExtendedKeyUsage[];
       signatureAlgorithm?: string;
       keyAlgorithm?: string;
+      isFromProfile?: boolean;
     }
   | ({
       isInternal: false;
@@ -174,6 +176,7 @@ export type TSignCertFromCaDTO =
       extendedKeyUsages?: CertExtendedKeyUsage[];
       signatureAlgorithm?: string;
       keyAlgorithm?: string;
+      isFromProfile?: boolean;
     } & Omit<TProjectPermission, "projectId">);
 
 export type TGetCaCertificateTemplatesDTO = {

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

@@ -213,7 +213,8 @@ export const certificateEstV3ServiceFactory = ({
     const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
       isInternal: true,
       caId: profile.caId,
-      csr
+      csr,
+      isFromProfile: true
     });
 
     return convertRawCertsToPkcs7([certificate.rawData]);
@@ -332,7 +333,8 @@ export const certificateEstV3ServiceFactory = ({
     const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
       isInternal: true,
       caId: profile.caId,
-      csr
+      csr,
+      isFromProfile: true
     });
 
     return convertRawCertsToPkcs7([certificate.rawData]);

backend/src/services/certificate-profile/certificate-profile-dal.ts

@@ -123,7 +123,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
           ? ({
               id: result.estConfigId,
               disableBootstrapCaValidation: !!result.estConfigDisableBootstrapCaValidation,
-              passphrase: "",
+              passphrase: result.estConfigHashedPassphrase,
               caChain: result.estConfigEncryptedCaChain ? result.estConfigEncryptedCaChain.toString("utf8") : ""
             } as TCertificateProfileWithConfigs["estConfig"])
           : undefined;
@@ -324,7 +324,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
             ? {
                 id: result.estId as string,
                 disableBootstrapCaValidation: !!result.estDisableBootstrapCaValidation,
-                passphrase: "",
+                passphrase: result.estConfigHashedPassphrase,
                 caChain: result.estEncryptedCaChain ? (result.estEncryptedCaChain as Buffer).toString("utf8") : ""
               }
             : undefined;

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -265,7 +265,8 @@ export const certificateV3ServiceFactory = ({
         actor,
         actorId,
         actorAuthMethod,
-        actorOrgId
+        actorOrgId,
+        isFromProfile: true
       });
 
     const cert = await certificateDAL.findOne({ serialNumber, caId: ca.id });
@@ -361,7 +362,8 @@ export const certificateV3ServiceFactory = ({
         notBefore: normalizeDateForApi(notBefore),
         notAfter: normalizeDateForApi(notAfter),
         signatureAlgorithm: effectiveSignatureAlgorithm,
-        keyAlgorithm: effectiveKeyAlgorithm
+        keyAlgorithm: effectiveKeyAlgorithm,
+        isFromProfile: true
       });
 
     const cert = await certificateDAL.findOne({ serialNumber, caId: ca.id });