Minor improvements on PKI docs

.infisicalignore

@@ -53,3 +53,5 @@ docs/integrations/app-connections/railway.mdx:generic-api-key:156
 k8-operator/config/samples/universalAuthIdentitySecret.yaml:generic-api-key:8
 docs/integrations/app-connections/redis.mdx:generic-api-key:80
 backend/src/ee/services/app-connections/chef/chef-connection-fns.ts:private-key:42
+docs/documentation/platform/pki/enrollment-methods/api.mdx:generic-api-key:93
+docs/documentation/platform/pki/enrollment-methods/api.mdx:private-key:139

docs/api-reference/endpoints/certificates/renew.mdx

@@ -0,0 +1,4 @@
+---
+title: "Renew Certificate"
+openapi: "POST /api/v3/certificates/{certificateId}/renew"
+---

docs/api-reference/endpoints/certificates/update-config.mdx

@@ -0,0 +1,4 @@
+---
+title: "Update Certificate Config"
+openapi: "PATCH /api/v3/certificates/{certificateId}/config"
+---

docs/api-reference/endpoints/pki/syncs/add-certificates.mdx

@@ -0,0 +1,4 @@
+---
+title: "Add Certificates to Sync"
+openapi: "POST /api/v1/pki/syncs/{pkiSyncId}/certificates"
+---

docs/api-reference/endpoints/pki/syncs/list-certificates.mdx

@@ -0,0 +1,4 @@
+---
+title: "List Sync Certificates"
+openapi: "GET /api/v1/pki/syncs/{pkiSyncId}/certificates"
+---

docs/api-reference/endpoints/pki/syncs/remove-certificates.mdx

@@ -0,0 +1,4 @@
+---
+title: "Remove Certificates from Sync"
+openapi: "DELETE /api/v1/pki/syncs/{pkiSyncId}/certificates"
+---

docs/docs.json

@@ -742,8 +742,10 @@
                     "group": "Enrollment Methods",
                     "pages": [
                       "documentation/platform/pki/enrollment-methods/overview",
+                      "documentation/platform/pki/enrollment-methods/acme",
                       "documentation/platform/pki/enrollment-methods/api",
-                      "documentation/platform/pki/enrollment-methods/est"
+                      "documentation/platform/pki/enrollment-methods/est",
+                      "documentation/platform/pki/enrollment-methods/scep"
                     ]
                   },
                   "documentation/platform/pki/alerting"
@@ -2595,13 +2597,15 @@
                 "pages": [
                   "api-reference/endpoints/certificates/list",
                   "api-reference/endpoints/certificates/read",
+                  "api-reference/endpoints/certificates/issue-certificate",
+                  "api-reference/endpoints/certificates/sign-certificate",
+                  "api-reference/endpoints/certificates/renew",
+                  "api-reference/endpoints/certificates/update-config",
                   "api-reference/endpoints/certificates/revoke",
                   "api-reference/endpoints/certificates/delete",
                   "api-reference/endpoints/certificates/cert-body",
                   "api-reference/endpoints/certificates/bundle",
-                  "api-reference/endpoints/certificates/private-key",
+                  "api-reference/endpoints/certificates/private-key"
-                  "api-reference/endpoints/certificates/issue-certificate",
-                  "api-reference/endpoints/certificates/sign-certificate"
                 ]
               },
               {
@@ -2638,10 +2642,13 @@
               {
                 "group": "Certificate Profiles",
                 "pages": [
+                  "api-reference/endpoints/certificate-profiles/list",
                   "api-reference/endpoints/certificate-profiles/create",
                   "api-reference/endpoints/certificate-profiles/update",
                   "api-reference/endpoints/certificate-profiles/get-by-id",
-                  "api-reference/endpoints/certificate-profiles/delete"
+                  "api-reference/endpoints/certificate-profiles/get-by-slug",
+                  "api-reference/endpoints/certificate-profiles/delete",
+                  "api-reference/endpoints/certificate-profiles/list-certificates"
                 ]
               },
               {
@@ -2650,6 +2657,9 @@
                   "api-reference/endpoints/pki/syncs/list",
                   "api-reference/endpoints/pki/syncs/get-by-id",
                   "api-reference/endpoints/pki/syncs/options",
+                  "api-reference/endpoints/pki/syncs/list-certificates",
+                  "api-reference/endpoints/pki/syncs/add-certificates",
+                  "api-reference/endpoints/pki/syncs/remove-certificates",
                   {
                     "group": "AWS Certificate Manager",
                     "pages": [

docs/documentation/platform/pki/ca/private-ca.mdx

@@ -277,9 +277,9 @@ the certificate back to the intermediate CA.
   <Tab title="Infisical UI">
     Head to the CA Page of the CA you wish you renew and press **Renew CA** on
     the left side. ![pki ca renewal
-    page](/images/platform/pki/ca/ca-renewal.png) Input a new **Valid Until**
+    page](/images/platform/pki/ca-renewal-page.png) Input a new **Valid Until**
     date to be used for the renewed CA certificate and press **Renew** to renew
-    the CA. ![pki ca renewal. modal](/images/platform/pki/ca/ca-renewal-modal.png)
+    the CA. ![pki ca renewal. modal](/images/platform/pki/ca-renewal-modal.png)
     <Note>
       The new **Valid Until** date must be within the validity period of the
       parent CA.

docs/documentation/platform/pki/certificate-syncs/aws-certificate-manager.mdx

@@ -40,7 +40,7 @@ These permissions allow Infisical to list, import, tag, and manage certificates
         - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
         - **Preserve ARN on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under the same ARN as the original synced certificate instead of creating a new certificate with a new ARN.
         - **Certificate Name Schema** (Optional): Customize how certificate tags are generated in AWS Certificate Manager. Must include `{{certificateId}}` as a placeholder for the certificate ID to ensure proper certificate identification and management. If not specified, defaults to `Infisical-{{certificateId}}`.
-        - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
+        - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
 
         5. Configure the **Details** of your AWS Certificate Manager Certificate Sync, then click **Next**.
         ![Configure Details](/images/platform/pki/certificate-syncs/aws-certificate-manager/acm-details.png)
@@ -62,20 +62,30 @@ These permissions allow Infisical to list, import, tag, and manage certificates
 
         ### Sample request
 
+        <Note>
+          You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
+          If not provided, you can add certificates later using the certificate management endpoints.
+        </Note>
+
         ```bash Request
         curl --request POST \
         --url https://app.infisical.com/api/v1/pki/syncs/aws-certificate-manager \
+        --header 'Authorization: Bearer <access-token>' \
         --header 'Content-Type: application/json' \
         --data '{
             "name": "my-acm-cert-sync",
             "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
             "description": "an example certificate sync",
             "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-            "subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
             "destination": "aws-certificate-manager",
             "isAutoSyncEnabled": true,
+            "certificateIds": [
+                "550e8400-e29b-41d4-a716-446655440000",
+                "660f1234-e29b-41d4-a716-446655440001"
+            ],
             "syncOptions": {
                 "canRemoveCertificates": true,
+                "preserveArnOnRenewal": true,
                 "certificateNameSchema": "myapp-{{certificateId}}"
             },
             "destinationConfig": {
@@ -99,10 +109,10 @@ These permissions allow Infisical to list, import, tag, and manage certificates
                 },
                 "syncOptions": {
                     "canRemoveCertificates": true,
+                    "preserveArnOnRenewal": true,
                     "certificateNameSchema": "myapp-{{certificateId}}"
                 },
                 "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-                "subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
                 "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
                 "createdAt": "2023-01-01T00:00:00.000Z",
                 "updatedAt": "2023-01-01T00:00:00.000Z"
@@ -130,7 +140,7 @@ Your AWS Certificate Manager Certificate Sync will:
 
 ## Manual Certificate Sync
 
-You can manually trigger certificate synchronization from your PKI subscriber to AWS Certificate Manager using the sync certificates functionality. This is useful for:
+You can manually trigger certificate synchronization to AWS Certificate Manager using the sync certificates functionality. This is useful for:
 
 - Initial setup when you have existing certificates to deploy
 - One-time sync of specific certificates

docs/documentation/platform/pki/certificate-syncs/azure-key-vault.mdx

@@ -41,7 +41,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
             - **Enable Removal of Expired/Revoked Certificates**: If enabled, Infisical will remove certificates from the destination if they are no longer active in Infisical.
             - **Enable Versioning on Renewal**: If enabled, Infisical will sync renewed certificates to the destination under a new version of the original synced certificate instead of creating a new certificate.
             - **Certificate Name Schema** (Optional): Customize how certificate names are generated in Azure Key Vault. Use `{{certificateId}}` as a placeholder for the certificate ID. If not specified, defaults to `Infisical-{{certificateId}}`.
-            - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced from the source PKI subscriber when changes occur. Disable to enforce manual syncing only.
+            - **Auto-Sync Enabled**: If enabled, certificates will automatically be synced when changes occur. Disable to enforce manual syncing only.
 
         <Tip>
             **Azure Key Vault Soft Delete**: When certificates are removed from Azure Key Vault, they are placed in a soft-deleted state rather than being permanently deleted. This means:
@@ -55,7 +55,7 @@ Any role with these permissions would work such as the **Key Vault Certificates
             - **Name**: The name of your sync. Must be slug-friendly.
             - **Description**: An optional description for your sync.
 
-        6. Select which certificates should be synced to AWS Certificate Manager.
+        6. Select which certificates should be synced to Azure Key Vault.
         ![Select Certificates](/images/platform/pki/certificate-syncs/azure-key-vault/akv-certificates.png)
 
         7. Review your Azure Key Vault Certificate Sync configuration, then click **Create Sync**.
@@ -69,20 +69,30 @@ Any role with these permissions would work such as the **Key Vault Certificates
 
         ### Sample request
 
+        <Note>
+          You can optionally specify `certificateIds` during sync creation to immediately add certificates to the sync.
+          If not provided, you can add certificates later using the certificate management endpoints.
+        </Note>
+
         ```bash Request
         curl --request POST \
         --url https://app.infisical.com/api/v1/pki/syncs/azure-key-vault \
+        --header 'Authorization: Bearer <access-token>' \
         --header 'Content-Type: application/json' \
         --data '{
             "name": "my-key-vault-cert-sync",
             "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
             "description": "an example certificate sync",
             "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-            "subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
             "destination": "azure-key-vault",
             "isAutoSyncEnabled": true,
+            "certificateIds": [
+                "550e8400-e29b-41d4-a716-446655440000",
+                "660f1234-e29b-41d4-a716-446655440001"
+            ],
             "syncOptions": {
                 "canRemoveCertificates": true,
+                "enableVersioningOnRenewal": true,
                 "certificateNameSchema": "myapp-{{certificateId}}"
             },
             "destinationConfig": {
@@ -106,10 +116,10 @@ Any role with these permissions would work such as the **Key Vault Certificates
                 },
                 "syncOptions": {
                     "canRemoveCertificates": true,
+                    "enableVersioningOnRenewal": true,
                     "certificateNameSchema": "myapp-{{certificateId}}"
                 },
                 "projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
-                "subscriberId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
                 "connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
                 "createdAt": "2023-01-01T00:00:00.000Z",
                 "updatedAt": "2023-01-01T00:00:00.000Z"
@@ -137,7 +147,7 @@ Your Azure Key Vault Certificate Sync will:
 
 ## Manual Certificate Sync
 
-You can manually trigger certificate synchronization from your PKI subscriber to Azure Key Vault using the sync certificates functionality. This is useful for:
+You can manually trigger certificate synchronization to Azure Key Vault using the sync certificates functionality. This is useful for:
 
 - Initial setup when you have existing certificates to deploy
 - One-time sync of specific certificates

docs/documentation/platform/pki/certificates/certificates.mdx

@@ -24,10 +24,10 @@ To issue a certificate, you must first create a [certificate profile](/documenta
 The [enrollment method](/documentation/platform/pki/enrollment-methods/overview) configured on the certificate profile determines how a certificate is issued for it.
 Refer to the documentation for each enrollment method below to learn more about how to issue certificates using it.
 
-- [API](/documentation/platform/pki/certificates/api): Issue a certificate over UI or by making an API request to Infisical.
+- [API](/documentation/platform/pki/enrollment-methods/api): Issue a certificate over UI or by making an API request to Infisical.
-- [EST](/documentation/platform/pki/certificates/est): Issue a certificate over the EST protocol.
+- [EST](/documentation/platform/pki/enrollment-methods/est): Issue a certificate over the EST protocol.
-- [ACME](/documentation/platform/pki/certificates/acme): Issue a certificate over the ACME protocol.
+- [ACME](/documentation/platform/pki/enrollment-methods/acme): Issue a certificate over the ACME protocol.
-- [SCEP](/documentation/platform/pki/certificates/scep): Issue a certificate over the SCEP protocol.
+- [SCEP](/documentation/platform/pki/enrollment-methods/scep): Issue a certificate over the SCEP protocol.
 
 ## Guide to Renewing Certificates
 

docs/documentation/platform/pki/enrollment-methods/acme.mdx

@@ -2,3 +2,7 @@
 title: "Certificate Enrollment via ACME"
 sidebarTitle: "ACME"
 ---
+
+<Info>
+  ACME-based certificate enrollment is currently under development and will be included in a future release.
+</Info>

docs/documentation/platform/pki/enrollment-methods/api.mdx

@@ -60,17 +60,21 @@ Here, select the certificate profile from step 1 that will be used to issue the
 
     ### Sample request
 
-    TODO: update this sample request.
-
     ```bash Request
-    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-templates' \
+    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificate-profiles' \
+      --header 'Authorization: Bearer <access-token>' \
       --header 'Content-Type: application/json' \
       --data-raw '{
+          "projectId": "<project-id>",
           "caId": "<ca-id>",
-          "name": "My Certificate Template",
+          "certificateTemplateId": "<certificate-template-id>",
-          "commonName": ".*.acme.com",
+          "slug": "my-api-profile",
-          "subjectAlternativeName": ".*.acme.com",
+          "description": "Certificate profile for API enrollment",
-          "ttl": "1y",
+          "enrollmentType": "API",
+          "apiConfig": {
+              "autoRenew": true,
+              "renewBeforeDays": 7
+          }
       }'
     ```
 
@@ -78,32 +82,50 @@ Here, select the certificate profile from step 1 that will be used to issue the
 
     ```bash Response
     {
-      id: "...",
+      "certificateProfile": {
-      caId: "...",
+        "id": "550e8400-e29b-41d4-a716-446655440000",
-      name: "...",
+        "projectId": "65f0a4b0-c123-4567-8901-23456789abcd",
-      commonName: "...",
+        "caId": "550e8400-e29b-41d4-a716-446655440000",
-      subjectAlternativeName: "...",
+        "certificateTemplateId": "660f1234-e29b-41d4-a716-446655440001",
-      ttl: "...",
+        "slug": "my-api-profile",
+        "description": "Certificate profile for API enrollment",
+        "enrollmentType": "API",
+        "apiConfigId": "770g2345-e29b-41d4-a716-446655440002",
+        "createdAt": "2023-01-19T09:44:36.267Z",
+        "updatedAt": "2023-01-19T09:44:36.267Z"
+      }
     }
     ```
 
   </Step>
   <Step title="Issue a certificate">
-  
-    TODO: update this sample request.
 
-    To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-cert) API endpoint,
+    To issue a certificate against the certificate profile, make an API request to the [Issue Certificate](/api-reference/endpoints/certificates/issue-certificate) API endpoint.
-    specifying the issuing CA.
 
     ### Sample request
 
     ```bash Request
-    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/issue-certificate' \
+    curl --location --request POST 'https://app.infisical.com/api/v3/certificates/issue-certificate' \
+      --header 'Authorization: Bearer <access-token>' \
       --header 'Content-Type: application/json' \
       --data-raw '{
-          "certificateTemplateId": "<certificate-template-id>",
+          "profileId": "<certificate-profile-id>",
           "commonName": "service.acme.com",
           "ttl": "1y",
+          "signatureAlgorithm": "RSA-SHA256",
+          "keyAlgorithm": "RSA_2048",
+          "keyUsages": ["digital_signature", "key_encipherment"],
+          "extendedKeyUsages": ["server_auth"],
+          "altNames": [
+              {
+                  "type": "DNS",
+                  "value": "service.acme.com"
+              },
+              {
+                  "type": "DNS",
+                  "value": "www.service.acme.com"
+              }
+          ]
       }'
     ```
 
@@ -111,11 +133,12 @@ Here, select the certificate profile from step 1 that will be used to issue the
 
     ```bash Response
     {
-      certificate: "...",
+      "certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      certificateChain: "...",
+      "certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      issuingCaCertificate: "...",
+      "issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      privateKey: "...",
+      "privateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----",
-      serialNumber: "..."
+      "serialNumber": "123456789012345678",
+      "certificateId": "880h3456-e29b-41d4-a716-446655440003"
     }
     ```
 
@@ -123,19 +146,18 @@ Here, select the certificate profile from step 1 that will be used to issue the
       Make sure to store the `privateKey` as it is only returned once here at the time of certificate issuance. The `certificate` and `certificateChain` will remain accessible and can be retrieved at any time.
     </Note>
 
-    TODO: update this sample request.
+    If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint.
-
-    If you have an external private key, you can also issue a certificate by making an API request containing a pem-encoded CSR (Certificate Signing Request) to the [Sign Certificate](/api-reference/endpoints/certificates/sign-certificate) API endpoint, specifying the issuing CA.
 
      ### Sample request
 
     ```bash Request
-    curl --location --request POST 'https://app.infisical.com/api/v1/pki/certificates/sign-certificate' \
+    curl --location --request POST 'https://app.infisical.com/api/v3/certificates/sign-certificate' \
+      --header 'Authorization: Bearer <access-token>' \
       --header 'Content-Type: application/json' \
       --data-raw '{
-          "certificateTemplateId": "<certificate-template-id>",
+          "profileId": "<certificate-profile-id>",
-          "csr": "...",
+          "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBE9oaW8...\n-----END CERTIFICATE REQUEST-----",
-          "ttl": "1y",
+          "ttl": "1y"
       }'
     ```
 
@@ -143,11 +165,11 @@ Here, select the certificate profile from step 1 that will be used to issue the
 
     ```bash Response
     {
-      certificate: "...",
+      "certificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      certificateChain: "...",
+      "certificateChain": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      issuingCaCertificate: "...",
+      "issuingCaCertificate": "-----BEGIN CERTIFICATE-----\nMIIEpDCCAowCCQD...\n-----END CERTIFICATE-----",
-      privateKey: "...",
+      "serialNumber": "123456789012345679",
-      serialNumber: "..."
+      "certificateId": "990i4567-e29b-41d4-a716-446655440004"
     }
     ```
 

docs/documentation/platform/pki/enrollment-methods/scep.mdx

@@ -2,3 +2,7 @@
 title: "Certificate Enrollment via SCEP"
 sidebarTitle: "SCEP"
 ---
+
+<Info>
+  SCEP-based certificate enrollment is currently under development and will be included in a future release.
+</Info>

frontend/src/layouts/PkiManagerLayout/PkiManagerLayout.tsx

@@ -34,7 +34,7 @@ export const PkiManagerLayout = () => {
   return (
     <>
       <div className="dark hidden h-full w-full flex-col overflow-x-hidden md:flex">
-        <div className="border-mineshaft-600 bg-mineshaft-900 border-b">
+        <div className="border-b border-mineshaft-600 bg-mineshaft-900">
           <motion.div
             key="menu-project-items"
             initial={{ x: -150 }}
@@ -92,9 +92,9 @@ export const PkiManagerLayout = () => {
                       <Tab value={isActive ? "selected" : ""}>App Connections</Tab>
                     )}
                   </Link>
-                  {
+                  {showLegacySection && (
                     <>
-                      {/* {
+                      {(subscription.pkiLegacyTemplates || hasExistingSubscribers) && (
                         <Link
                           to="/projects/cert-management/$projectId/subscribers"
                           params={{
@@ -105,7 +105,7 @@ export const PkiManagerLayout = () => {
                             <Tab value={isActive ? "selected" : ""}>Subscribers (Legacy)</Tab>
                           )}
                         </Link>
-                      } */}
+                      )}
                       {(subscription.pkiLegacyTemplates || hasExistingTemplates) && (
                         <Link
                           to="/projects/cert-management/$projectId/certificate-templates"
@@ -121,7 +121,7 @@ export const PkiManagerLayout = () => {
                         </Link>
                       )}
                     </>
-                  }
+                  )}
                   <Link
                     to="/projects/cert-management/$projectId/access-management"
                     params={{
@@ -163,11 +163,11 @@ export const PkiManagerLayout = () => {
           </motion.div>
         </div>
         {assumedPrivilegeDetails && <AssumePrivilegeModeBanner />}
-        <div className="bg-bunker-800 flex-1 overflow-y-auto overflow-x-hidden px-12 pb-4 pt-10">
+        <div className="flex-1 overflow-x-hidden overflow-y-auto bg-bunker-800 px-12 pt-10 pb-4">
           <Outlet />
         </div>
       </div>
-      <div className="z-200 bg-bunker-800 flex h-screen w-screen flex-col items-center justify-center md:hidden">
+      <div className="z-200 flex h-screen w-screen flex-col items-center justify-center bg-bunker-800 md:hidden">
         <FontAwesomeIcon icon={faMobile} className="mb-8 text-7xl text-gray-300" />
         <p className="max-w-sm px-6 text-center text-lg text-gray-200">
           {` ${t("common.no-mobile")} `}