From 833061f080e37dd1232f524adb0502ee2619b8af Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Wed, 12 Nov 2025 22:02:13 -0800
Subject: [PATCH] Ext ca bdd

---
 backend/bdd/features/environment.py           |  1 +
 .../bdd/features/pki/acme/external-ca.feature | 44 +++++++++----------
 2 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/backend/bdd/features/environment.py b/backend/bdd/features/environment.py
index 99595338b..69637b850 100644
--- a/backend/bdd/features/environment.py
+++ b/backend/bdd/features/environment.py
@@ -16,6 +16,7 @@ load_dotenv()
 logger = logging.getLogger(__name__)
 
 BASE_URL = os.environ.get("INFISICAL_API_URL", "http://localhost:8080")
+PEBBLE_URL = os.environ.get("PEBBLE_URL", "https://pebble:14000/dir")
 PROJECT_ID = os.environ.get("PROJECT_ID")
 CERT_CA_ID = os.environ.get("CERT_CA_ID")
 CERT_TEMPLATE_ID = os.environ.get("CERT_TEMPLATE_ID")
diff --git a/backend/bdd/features/pki/acme/external-ca.feature b/backend/bdd/features/pki/acme/external-ca.feature
index 2ddf8f539..64b0bee6b 100644
--- a/backend/bdd/features/pki/acme/external-ca.feature
+++ b/backend/bdd/features/pki/acme/external-ca.feature
@@ -10,7 +10,7 @@ Feature: External CA
             "provider": "cloudflare",
             "hostedZoneId": "MOCK_ZONE_ID"
         },
-        "directoryUrl": "https://acme-v02.api.letsencrypt.org/directory",
+        "directoryUrl": "{PEBBLE_URL}",
         "accountEmail": "fangpen@infisical.com",
         "dnsAppConnectionId": "{app_conn_id}",
         "eabKid": "",
@@ -86,25 +86,23 @@ Feature: External CA
       }
       """
     Then I memorize cert_template with jq ".certificateTemplate.id" as cert_template_id
-    Given I create an ACME profile with ca ext_ca_id and template cert_template_id as "acme_profile"
-
-#    Given I have an ACME cert profile as "acme_profile"
-#    When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
-#    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
-#    When I create certificate signing request as csr
-#    Then I add names to certificate signing request csr
-#      """
-#      {
-#        "COMMON_NAME": "localhost"
-#      }
-#      """
-#    And I create a RSA private key pair as cert_key
-#    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
-#    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
-#    And I select challenge with type http-01 for domain localhost from order in order as challenge
-#    And I serve challenge response for challenge at localhost
-#    And I tell ACME server that challenge is ready to be verified
-#    And I poll and finalize the ACME order order as finalized_order
-#    And the value finalized_order.body with jq ".status" should be equal to "valid"
-#    And I parse the full-chain certificate from order finalized_order as cert
-#    And the value cert with jq ".subject.common_name" should be equal to "localhost"
+    Given I create an ACME profile with ca {ext_ca_id} and template {cert_template_id} as "acme_profile"
+    When I have an ACME client connecting to "{BASE_URL}/api/v1/pki/acme/profiles/{acme_profile.id}/directory"
+    Then I register a new ACME account with email fangpen@infisical.com and EAB key id "{acme_profile.eab_kid}" with secret "{acme_profile.eab_secret}" as acme_account
+    When I create certificate signing request as csr
+    Then I add names to certificate signing request csr
+      """
+      {
+        "COMMON_NAME": "localhost"
+      }
+      """
+    And I create a RSA private key pair as cert_key
+    And I sign the certificate signing request csr with private key cert_key and output it as csr_pem in PEM format
+    And I submit the certificate signing request PEM csr_pem certificate order to the ACME server as order
+    And I select challenge with type http-01 for domain localhost from order in order as challenge
+    And I serve challenge response for challenge at localhost
+    And I tell ACME server that challenge is ready to be verified
+    And I poll and finalize the ACME order order as finalized_order
+    And the value finalized_order.body with jq ".status" should be equal to "valid"
+    And I parse the full-chain certificate from order finalized_order as cert
+    And the value cert with jq ".subject.common_name" should be equal to "localhost"