No need for allowEmptyCommonName flag, just allow empty CN for all

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -1577,8 +1577,7 @@ export const internalCertificateAuthorityServiceFactory = ({
       keyUsages,
       extendedKeyUsages,
       signatureAlgorithm,
-      keyAlgorithm,
+      keyAlgorithm
-      allowEmptyCommonName
     } = dto;
 
     let collectionId = pkiCollectionId;
@@ -1717,20 +1716,7 @@ export const internalCertificateAuthorityServiceFactory = ({
     const csrObj = new x509.Pkcs10CertificateRequest(csr);
 
     const dn = parseDistinguishedName(csrObj.subject);
-    let cn = commonName || dn.commonName;
+    const cn = (commonName || dn.commonName) ?? "";
-
-    if (!cn) {
-      if (allowEmptyCommonName ?? false) {
-        // Notice: for modern TLS certificates, the CN is deprecated, many ACME clients will generate CSRs with without a CN
-        //         we allow empty CN here to support ACME clients mostly. Since it's unclear what's the side effect of
-        //         allowing empty CN for legacy PKI code, let's only do it if a true allowEmptyCommonName value is provided.
-        cn = "";
-      } else {
-        throw new BadRequestError({
-          message: "A common name (CN) is required in the CSR or as a parameter to this endpoint"
-        });
-      }
-    }
 
     const { caPrivateKey, caSecret } = await getCaCredentials({
       caId: ca.id,
@@ -1948,7 +1934,7 @@ export const internalCertificateAuthorityServiceFactory = ({
           certificateTemplateId: certificateTemplate?.id,
           status: CertStatus.ACTIVE,
           friendlyName: friendlyName || csrObj.subject,
-          commonName: cn!,
+          commonName: cn,
           altNames: altNamesFromCsr || altNames,
           serialNumber,
           notBefore: notBeforeDate,

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -164,7 +164,6 @@ export type TSignCertFromCaDTO =
       keyAlgorithm?: string;
       isFromProfile?: boolean;
       profileId?: string;
-      allowEmptyCommonName?: boolean;
     }
   | ({
       isInternal: false;
@@ -184,7 +183,6 @@ export type TSignCertFromCaDTO =
       keyAlgorithm?: string;
       isFromProfile?: boolean;
       profileId?: string;
-      allowEmptyCommonName?: boolean;
     } & Omit<TProjectPermission, "projectId">);
 
 export type TGetCaCertificateTemplatesDTO = {

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -511,8 +511,7 @@ export const certificateV3ServiceFactory = ({
     actorAuthMethod,
     actorOrgId,
     enrollmentType,
-    removeRootsFromChain,
+    removeRootsFromChain
-    allowEmptyCommonName
   }: TSignCertificateFromProfileDTO): Promise<Omit<TCertificateFromProfileResponse, "privateKey">> => {
     const profile = await validateProfileAndPermissions(
       profileId,
@@ -583,8 +582,7 @@ export const certificateV3ServiceFactory = ({
         notAfter: normalizeDateForApi(notAfter),
         signatureAlgorithm: effectiveSignatureAlgorithm,
         keyAlgorithm: effectiveKeyAlgorithm,
-        isFromProfile: true,
+        isFromProfile: true
-        allowEmptyCommonName
       });
 
     const cert = await certificateDAL.findOne({ serialNumber, caId: ca.id });

backend/src/services/certificate-v3/certificate-v3-types.ts

@@ -39,7 +39,6 @@ export type TSignCertificateFromProfileDTO = {
   notAfter?: Date;
   enrollmentType: EnrollmentType;
   removeRootsFromChain?: boolean;
-  allowEmptyCommonName?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TOrderCertificateFromProfileDTO = {