From 7de071736e37b40550f84770fedf11dd39a9fce0 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Mon, 10 Nov 2025 15:41:33 -0800
Subject: [PATCH] Fix TTL for issuing cert

---
 backend/bdd/features/steps/pki_acme.py               | 5 ++---
 backend/src/ee/services/pki-acme/pki-acme-service.ts | 5 +++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/backend/bdd/features/steps/pki_acme.py b/backend/bdd/features/steps/pki_acme.py
index a408c81d1..d9004e0ba 100644
--- a/backend/bdd/features/steps/pki_acme.py
+++ b/backend/bdd/features/steps/pki_acme.py
@@ -1,6 +1,5 @@
 import json
 import logging
-import os
 import re
 import threading
 import urllib.parse
@@ -138,8 +137,8 @@ def step_impl(context: Context, faker_type: str, var_name: str):
 
 @given('I have an ACME cert profile as "{profile_var}"')
 def step_impl(context: Context, profile_var: str):
-    profile_id = os.getenv("PROFILE_ID")
-    secret = os.getenv("EAB_SECRET")
+    profile_id = context.vars.get("PROFILE_ID")
+    secret = context.vars.get("EAB_SECRET")
     if profile_id is not None and secret is not None:
         kid = profile_id
     else:
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 9e5491ecb..923ac94b4 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -641,11 +641,12 @@ export const pkiAcmeServiceFactory = ({
             notAfter: finalizingOrder.notAfter ? new Date(finalizingOrder.notAfter) : undefined,
             validity: !finalizingOrder.notAfter
               ? {
+                  // 47 days, the default TTL comes with Let's Encrypt
                   // TODO: read config from the profile to get the expiration time instead
-                  ttl: (24 * 60 * 60 * 1000).toString()
+                  ttl: `${47 * 24 * 60}m`
                 }
               : // ttl is not used if notAfter is provided
-                ({ ttl: "0" } as const),
+                ({ ttl: "0m" } as const),
             enrollmentType: EnrollmentType.ACME
           });
           // TODO: associate the certificate with the order