Continue cert mgmt mvp

backend/src/@types/fastify.d.ts

@@ -29,6 +29,7 @@ import { TAuthPasswordFactory } from "@app/services/auth/auth-password-service";
 import { TAuthSignupFactory } from "@app/services/auth/auth-signup-service";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
+import { TCertificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service";
 import { TIdentityServiceFactory } from "@app/services/identity/identity-service";
@@ -133,6 +134,7 @@ declare module "fastify" {
       ldap: TLdapConfigServiceFactory;
       auditLog: TAuditLogServiceFactory;
       auditLogStream: TAuditLogStreamServiceFactory;
+      certificate: TCertificateServiceFactory;
       certificateAuthority: TCertificateAuthorityServiceFactory;
       secretScanning: TSecretScanningServiceFactory;
       license: TLicenseServiceFactory;

backend/src/@types/knex.d.ts

@@ -41,6 +41,15 @@ import {
   TCertificateAuthoritySk,
   TCertificateAuthoritySkInsert,
   TCertificateAuthoritySkUpdate,
+  TCertificateCerts,
+  TCertificateCertsInsert,
+  TCertificateCertsUpdate,
+  TCertificates,
+  TCertificateSecrets,
+  TCertificateSecretsInsert,
+  TCertificateSecretsUpdate,
+  TCertificatesInsert,
+  TCertificatesUpdate,
   TDynamicSecretLeases,
   TDynamicSecretLeasesInsert,
   TDynamicSecretLeasesUpdate,
@@ -264,6 +273,17 @@ declare module "knex/types/tables" {
       TCertificateAuthoritySkInsert,
       TCertificateAuthoritySkUpdate
     >;
+    [TableName.Certificate]: Knex.CompositeTableType<TCertificates, TCertificatesInsert, TCertificatesUpdate>;
+    [TableName.CertificateCert]: Knex.CompositeTableType<
+      TCertificateCerts,
+      TCertificateCertsInsert,
+      TCertificateCertsUpdate
+    >;
+    [TableName.CertificateSecret]: Knex.CompositeTableType<
+      TCertificateSecrets,
+      TCertificateSecretsInsert,
+      TCertificateSecretsUpdate
+    >;
     [TableName.UserGroupMembership]: Knex.CompositeTableType<
       TUserGroupMembership,
       TUserGroupMembershipInsert,

backend/src/db/migrations/20240522010055_certificate-authority.ts

@@ -14,11 +14,23 @@ export async function up(knex: Knex): Promise<void> {
       t.string("projectId").notNullable();
       t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
       t.string("type").notNullable(); // root / intermediate
+      t.string("status").notNullable(); // active / pending-certificate
+      t.string("organization").notNullable();
+      t.string("ou").notNullable();
+      t.string("country").notNullable();
+      t.string("province").notNullable();
+      t.string("locality").notNullable();
+      t.string("commonName").notNullable();
       t.string("dn").notNullable();
+      t.unique(["dn", "projectId"]);
+      t.integer("maxPathLength").nullable();
+      t.datetime("notBefore").nullable();
+      t.datetime("notAfter").nullable();
     });
   }
 
   if (!(await knex.schema.hasTable(TableName.CertificateAuthorityCert))) {
+    // table to keep track of certificates belonging to CA
     await knex.schema.createTable(TableName.CertificateAuthorityCert, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.timestamps(true, true, true);
@@ -41,12 +53,61 @@ export async function up(knex: Knex): Promise<void> {
     });
   }
 
+  if (!(await knex.schema.hasTable(TableName.Certificate))) {
+    // TODO: consider adding name
+    await knex.schema.createTable(TableName.Certificate, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+      t.uuid("caId").notNullable();
+      t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
+      t.string("commonName").notNullable();
+      t.datetime("notBefore").notNullable();
+      t.datetime("notAfter").notNullable();
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.CertificateCert))) {
+    await knex.schema.createTable(TableName.CertificateCert, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+      t.uuid("certId").notNullable().unique();
+      t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
+      t.text("certificate").notNullable(); // TODO: encrypt
+      t.text("certificateChain").notNullable(); // TODO: encrypt
+    });
+  }
+
+  if (!(await knex.schema.hasTable(TableName.CertificateSecret))) {
+    await knex.schema.createTable(TableName.CertificateSecret, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+      t.uuid("certId").notNullable().unique();
+      t.foreign("certId").references("id").inTable(TableName.Certificate).onDelete("CASCADE");
+      t.text("pk").notNullable(); // TODO: encrypt
+      t.text("sk").notNullable(); // TODO: encrypt
+    });
+  }
+
   await createOnUpdateTrigger(knex, TableName.CertificateAuthority);
   await createOnUpdateTrigger(knex, TableName.CertificateAuthorityCert);
   await createOnUpdateTrigger(knex, TableName.CertificateAuthoritySk);
+  await createOnUpdateTrigger(knex, TableName.Certificate);
+  await createOnUpdateTrigger(knex, TableName.CertificateCert);
+  await createOnUpdateTrigger(knex, TableName.CertificateSecret);
 }
 
 export async function down(knex: Knex): Promise<void> {
+  // certificates
+  await knex.schema.dropTableIfExists(TableName.CertificateSecret);
+  await dropOnUpdateTrigger(knex, TableName.CertificateSecret);
+
+  await knex.schema.dropTableIfExists(TableName.CertificateCert);
+  await dropOnUpdateTrigger(knex, TableName.CertificateCert);
+
+  await knex.schema.dropTableIfExists(TableName.Certificate);
+  await dropOnUpdateTrigger(knex, TableName.Certificate);
+
+  // certificate authorities
   await knex.schema.dropTableIfExists(TableName.CertificateAuthoritySk);
   await dropOnUpdateTrigger(knex, TableName.CertificateAuthoritySk);
 

backend/src/db/schemas/certificate-authorities.ts

@@ -14,7 +14,17 @@ export const CertificateAuthoritiesSchema = z.object({
   parentCaId: z.string().uuid().nullable().optional(),
   projectId: z.string(),
   type: z.string(),
-  dn: z.string()
+  status: z.string(),
+  organization: z.string(),
+  ou: z.string(),
+  country: z.string(),
+  province: z.string(),
+  locality: z.string(),
+  commonName: z.string(),
+  dn: z.string(),
+  maxPathLength: z.number().nullable().optional(),
+  notBefore: z.date().nullable().optional(),
+  notAfter: z.date().nullable().optional()
 });
 
 export type TCertificateAuthorities = z.infer<typeof CertificateAuthoritiesSchema>;

backend/src/db/schemas/certificate-certs.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const CertificateCertsSchema = z.object({
+  id: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  certId: z.string().uuid(),
+  certificate: z.string(),
+  certificateChain: z.string()
+});
+
+export type TCertificateCerts = z.infer<typeof CertificateCertsSchema>;
+export type TCertificateCertsInsert = Omit<z.input<typeof CertificateCertsSchema>, TImmutableDBKeys>;
+export type TCertificateCertsUpdate = Partial<Omit<z.input<typeof CertificateCertsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/certificate-secrets.ts

@@ -0,0 +1,21 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const CertificateSecretsSchema = z.object({
+  id: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  certId: z.string().uuid(),
+  pk: z.string(),
+  sk: z.string()
+});
+
+export type TCertificateSecrets = z.infer<typeof CertificateSecretsSchema>;
+export type TCertificateSecretsInsert = Omit<z.input<typeof CertificateSecretsSchema>, TImmutableDBKeys>;
+export type TCertificateSecretsUpdate = Partial<Omit<z.input<typeof CertificateSecretsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/certificates.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const CertificatesSchema = z.object({
+  id: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  caId: z.string().uuid(),
+  commonName: z.string(),
+  notBefore: z.date(),
+  notAfter: z.date()
+});
+
+export type TCertificates = z.infer<typeof CertificatesSchema>;
+export type TCertificatesInsert = Omit<z.input<typeof CertificatesSchema>, TImmutableDBKeys>;
+export type TCertificatesUpdate = Partial<Omit<z.input<typeof CertificatesSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -11,6 +11,9 @@ export * from "./backup-private-key";
 export * from "./certificate-authorities";
 export * from "./certificate-authority-certs";
 export * from "./certificate-authority-sk";
+export * from "./certificate-certs";
+export * from "./certificate-secrets";
+export * from "./certificates";
 export * from "./dynamic-secret-leases";
 export * from "./dynamic-secrets";
 export * from "./git-app-install-sessions";

backend/src/db/schemas/models.ts

@@ -5,6 +5,9 @@ export enum TableName {
   CertificateAuthority = "certificate_authorities",
   CertificateAuthorityCert = "certificate_authority_certs",
   CertificateAuthoritySk = "certificate_authority_sk",
+  Certificate = "certificates",
+  CertificateCert = "certificate_certs",
+  CertificateSecret = "certificate_secrets",
   Groups = "groups",
   GroupProjectMembership = "group_project_memberships",
   GroupProjectMembershipRole = "group_project_membership_roles",

backend/src/ee/services/permission/project-permission.ts

@@ -26,7 +26,9 @@ export enum ProjectPermissionSub {
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
-  Identity = "identity"
+  Identity = "identity",
+  CertificateAuthorities = "certificate-authorities",
+  Certificates = "certificates"
 }
 
 type SubjectFields = {
@@ -53,6 +55,8 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation]
   | [ProjectPermissionActions, ProjectPermissionSub.Identity]
+  | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
+  | [ProjectPermissionActions, ProjectPermissionSub.Certificates]
   | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
@@ -139,6 +143,17 @@ const buildAdminPermissionRules = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.IpAllowList);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.IpAllowList);
 
+  // double check if all CRUD are needed for CA and Certificates
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.CertificateAuthorities);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.CertificateAuthorities);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.CertificateAuthorities);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
+
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Project);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
 
@@ -205,6 +220,14 @@ const buildMemberPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
 
+  // double check if all CRUD are needed for CA and Certificates
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
+
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
+  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
+
   return rules;
 };
 
@@ -229,6 +252,8 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.AuditLogs);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
 
   return rules;
 };

backend/src/server/routes/index.ts

@@ -71,8 +71,11 @@ import { authPaswordServiceFactory } from "@app/services/auth/auth-password-serv
 import { authSignupServiceFactory } from "@app/services/auth/auth-signup-service";
 import { tokenDALFactory } from "@app/services/auth-token/auth-token-dal";
 import { tokenServiceFactory } from "@app/services/auth-token/auth-token-service";
+import { certificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal";
+import { certificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { certificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import { certificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
-// ca / certs
 import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { certificateAuthoritySkDALFactory } from "@app/services/certificate-authority/certificate-authority-sk-dal";
@@ -226,16 +229,6 @@ export const registerRoutes = async (
   const trustedIpDAL = trustedIpDALFactory(db);
   const telemetryDAL = telemetryDALFactory(db);
 
-  const certificateAuthorityDAL = certificateAuthorityDALFactory(db);
-  const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
-  const certificateAuthoritySkDAL = certificateAuthoritySkDALFactory(db);
-  const certificateAuthorityService = certificateAuthorityServiceFactory({
-    certificateAuthorityDAL,
-    certificateAuthorityCertDAL,
-    certificateAuthoritySkDAL,
-    projectDAL
-  });
-
   // ee db layer ops
   const permissionDAL = permissionDALFactory(db);
   const samlConfigDAL = samlConfigDALFactory(db);
@@ -503,6 +496,34 @@ export const registerRoutes = async (
     projectUserMembershipRoleDAL
   });
 
+  const certificateAuthorityDAL = certificateAuthorityDALFactory(db);
+  const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
+  const certificateAuthoritySkDAL = certificateAuthoritySkDALFactory(db);
+
+  const certificateDAL = certificateDALFactory(db);
+  const certificateCertDAL = certificateCertDALFactory(db);
+  const certificateSecretDAL = certificateSecretDALFactory(db);
+
+  const certificateService = certificateServiceFactory({
+    certificateDAL,
+    certificateCertDAL,
+    certificateSecretDAL,
+    certificateAuthorityDAL,
+    certificateAuthorityCertDAL,
+    permissionService
+  });
+
+  const certificateAuthorityService = certificateAuthorityServiceFactory({
+    certificateAuthorityDAL,
+    certificateAuthorityCertDAL,
+    certificateAuthoritySkDAL,
+    certificateDAL,
+    certificateCertDAL,
+    certificateSecretDAL,
+    projectDAL,
+    permissionService
+  });
+
   const projectService = projectServiceFactory({
     permissionService,
     projectDAL,
@@ -520,6 +541,7 @@ export const registerRoutes = async (
     folderDAL,
     licenseService,
     certificateAuthorityDAL,
+    certificateDAL,
     projectUserMembershipRoleDAL,
     identityProjectMembershipRoleDAL,
     keyStore
@@ -842,6 +864,7 @@ export const registerRoutes = async (
     ldap: ldapService,
     auditLog: auditLogService,
     auditLogStream: auditLogStreamService,
+    certificate: certificateService,
     certificateAuthority: certificateAuthorityService,
     secretScanning: secretScanningService,
     license: licenseService,

backend/src/server/routes/v1/certificate-authority-router.ts

@@ -4,7 +4,8 @@ import { CertificateAuthoritiesSchema } from "@app/db/schemas";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { CAType } from "@app/services/certificate-authority/certificate-authority-types";
+import { CaStatus, CaType } from "@app/services/certificate-authority/certificate-authority-types";
+import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators";
 
 export const registerCaRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -16,18 +17,38 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
       description: "Create CA",
-      body: z.object({
-        projectSlug: z.string().trim(),
-        type: z.enum([CAType.ROOT, CAType.INTERMEDIATE]),
-        commonName: z.string().trim(),
-        organization: z.string().trim(),
-        ou: z.string().trim(),
-        country: z.string().trim(),
-        province: z.string().trim(),
-        locality: z.string().trim()
-      }),
+      body: z
+        .object({
+          projectSlug: z.string().trim(),
+          type: z.enum([CaType.ROOT, CaType.INTERMEDIATE]),
+          commonName: z.string().trim(),
+          organization: z.string().trim(),
+          ou: z.string().trim(),
+          country: z.string().trim(),
+          province: z.string().trim(),
+          locality: z.string().trim(),
+          // format: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format
+          notBefore: validateCaDateField.optional(),
+          notAfter: validateCaDateField.optional(),
+          maxPathLength: z.number().min(-1).optional()
+        })
+        .refine(
+          (data) => {
+            // Check that at least one of the specified fields is non-empty
+            return [data.commonName, data.organization, data.ou, data.country, data.province, data.locality].some(
+              (field) => field !== ""
+            );
+          },
+          {
+            message:
+              "At least one of the fields commonName, organization, ou, country, province, or locality must be non-empty",
+            path: []
+          }
+        ),
       response: {
-        200: CertificateAuthoritiesSchema
+        200: z.object({
+          ca: CertificateAuthoritiesSchema
+        })
       }
     },
     handler: async (req) => {
@@ -38,7 +59,109 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         actorOrgId: req.permission.orgId,
         ...req.body
       });
-      return ca;
+      return {
+        ca
+      };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:caId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Get CA",
+      params: z.object({
+        caId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          ca: CertificateAuthoritiesSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const ca = await server.services.certificateAuthority.getCaById({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+      return {
+        ca
+      };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:caId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Update CA",
+      params: z.object({
+        caId: z.string().trim()
+      }),
+      body: z.object({
+        status: z.enum([CaStatus.ACTIVE, CaStatus.DISABLED]).optional()
+      }),
+      response: {
+        200: z.object({
+          ca: CertificateAuthoritiesSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const ca = await server.services.certificateAuthority.updateCaById({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+      return {
+        ca
+      };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:caId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Delete CA",
+      params: z.object({
+        caId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          ca: CertificateAuthoritiesSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const ca = await server.services.certificateAuthority.deleteCaById({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+      return {
+        ca
+      };
     }
   });
 
@@ -76,7 +199,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
 
   server.route({
     method: "GET",
-    url: ":caId/certificate",
+    url: "/:caId/certificate",
     config: {
       rateLimit: readLimit
     },
@@ -89,12 +212,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           certificate: z.string(),
-          certificateChain: z.string()
+          certificateChain: z.string(),
+          serialNumber: z.string()
         })
       }
     },
     handler: async (req) => {
-      const { certificate, certificateChain } = await server.services.certificateAuthority.getCaCert({
+      const { certificate, certificateChain, serialNumber } = await server.services.certificateAuthority.getCaCert({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -103,49 +227,155 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       });
       return {
         certificate,
-        certificateChain
+        certificateChain,
+        serialNumber
       };
     }
   });
 
   server.route({
     method: "POST",
-    url: ":caId/issue-certificate",
+    url: "/:caId/sign-intermediate",
     config: {
-      rateLimit: readLimit
+      rateLimit: writeLimit
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Issue (leaf) certificate from CA",
+      description: "Create intermediate CA certificate from parent CA",
       params: z.object({
         caId: z.string().trim()
       }),
       body: z.object({
         csr: z.string().trim(),
-        notBefore: z.string().trim(),
-        notAfter: z.string().trim()
+        notBefore: validateCaDateField.optional(),
+        notAfter: validateCaDateField,
+        maxPathLength: z.number().min(-1).default(-1)
       }),
       response: {
         200: z.object({
-          certificateId: z.string().trim()
+          certificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          serialNumber: z.string().trim()
         })
       }
     },
-    handler: async () => {
-      // await server.services.certificateAuthority.issueCertFromCa({
-      //   caId: req.params.caId,
-      //   actor: req.permission.type,
-      //   actorId: req.permission.id,
-      //   actorAuthMethod: req.permission.authMethod,
-      //   actorOrgId: req.permission.orgId,
-      //   ...req.body
-      // });
+    handler: async (req) => {
+      const { certificate, certificateChain, issuingCaCertificate, serialNumber } =
+        await server.services.certificateAuthority.signIntermediate({
+          caId: req.params.caId,
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId,
+          ...req.body
+        });
       return {
-        certificateId: "111"
+        certificate,
+        certificateChain,
+        issuingCaCertificate,
+        serialNumber
       };
     }
   });
 
-  // TODO 2: logic for creating intermediary ca
-  // TODO 1: get certificate + certificate chain for the root and intermediary CA GET /ca/:caId/certificate
+  server.route({
+    method: "POST",
+    url: "/:caId/import-certificate",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Import certificate and chain to CA",
+      params: z.object({
+        caId: z.string().trim()
+      }),
+      body: z.object({
+        certificate: z.string().trim(),
+        certificateChain: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          message: z.string().trim(),
+          caId: z.string().trim()
+        })
+      }
+    },
+    handler: async (req) => {
+      await server.services.certificateAuthority.importCertToCa({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return {
+        message: "Successfully imported certificate to CA",
+        caId: req.params.caId
+      };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/:caId/issue-certificate",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Issue certificate from CA",
+      params: z.object({
+        caId: z.string().trim()
+      }),
+      body: z
+        .object({
+          commonName: z.string().trim().min(1),
+          ttl: z.number().int().min(0).optional(),
+          notBefore: validateCaDateField.optional(),
+          notAfter: validateCaDateField.optional()
+        })
+        .refine(
+          (data) => {
+            const { ttl, notAfter } = data;
+            return (ttl !== undefined && notAfter === undefined) || (ttl === undefined && notAfter !== undefined);
+          },
+          {
+            message: "Either ttl or notAfter must be present, but not both",
+            path: ["ttl", "notAfter"]
+          }
+        ),
+      response: {
+        200: z.object({
+          certificate: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          privateKey: z.string().trim(),
+          serialNumber: z.string().trim()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } =
+        await server.services.certificateAuthority.issueCertFromCa({
+          caId: req.params.caId,
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId,
+          ...req.body
+        });
+
+      return {
+        certificate,
+        certificateChain,
+        issuingCaCertificate,
+        privateKey,
+        serialNumber
+      };
+    }
+  });
 };

backend/src/server/routes/v1/certificate-router.ts

@@ -0,0 +1,113 @@
+import { z } from "zod";
+
+import { CertificatesSchema } from "@app/db/schemas";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerCertRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/:certId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Get certificate",
+      params: z.object({
+        certId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          certificate: CertificatesSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const certificate = await server.services.certificate.getCertById({
+        certId: req.params.certId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+      return {
+        certificate
+      };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:certId",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Delete certificate",
+      params: z.object({
+        certId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          certificate: CertificatesSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const certificate = await server.services.certificate.deleteCertById({
+        certId: req.params.certId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+      return {
+        certificate
+      };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:certId/certificate",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Get certificate of certificate",
+      params: z.object({
+        certId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          certificate: z.string().trim(),
+          certificateChain: z.string().trim(),
+          issuingCaCertificate: z.string().trim(),
+          privateKey: z.string().trim(),
+          serialNumber: z.string().trim()
+        })
+      }
+    },
+    handler: async (req) => {
+      const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber } =
+        await server.services.certificate.getCertCert({
+          certId: req.params.certId,
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId
+        });
+      return {
+        certificate,
+        certificateChain,
+        issuingCaCertificate,
+        privateKey,
+        serialNumber
+      };
+    }
+  });
+};

backend/src/server/routes/v1/index.ts

@@ -2,6 +2,7 @@ import { registerAdminRouter } from "./admin-router";
 import { registerAuthRoutes } from "./auth-router";
 import { registerProjectBotRouter } from "./bot-router";
 import { registerCaRouter } from "./certificate-authority-router";
+import { registerCertRouter } from "./certificate-router";
 import { registerIdentityAccessTokenRouter } from "./identity-access-token-router";
 import { registerIdentityAwsAuthRouter } from "./identity-aws-iam-auth-router";
 import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router";
@@ -59,12 +60,8 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
     { prefix: "/workspace" }
   );
 
-  await server.register(
-    async (certRouter) => {
-      await certRouter.register(registerCaRouter);
-    },
-    { prefix: "/ca" }
-  );
+  await server.register(registerCaRouter, { prefix: "/ca" });
+  await server.register(registerCertRouter, { prefix: "/certificates" });
 
   await server.register(registerProjectBotRouter, { prefix: "/bot" });
   await server.register(registerIntegrationRouter, { prefix: "/integration" });

backend/src/server/routes/v2/project-router.ts

@@ -1,13 +1,14 @@
 import slugify from "@sindresorhus/slugify";
 import { z } from "zod";
 
-import { CertificateAuthoritiesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas";
+import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { PROJECTS } from "@app/lib/api-docs";
 import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { ProjectFilterType } from "@app/services/project/project-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
@@ -312,22 +313,58 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
     method: "GET",
     url: "/:slug/cas",
     config: {
-      rateLimit: writeLimit
+      rateLimit: readLimit
     },
     schema: {
       params: z.object({
         slug: slugSchema.describe("The slug of the project to list CAs.")
       }),
+      querystring: z.object({
+        status: z.enum([CaStatus.ACTIVE, CaStatus.PENDING_CERTIFICATE]).optional()
+      }),
       response: {
         200: z.object({
           cas: z.array(CertificateAuthoritiesSchema)
         })
       }
     },
-
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const cas = await server.services.project.listProjectCas({
+        filter: {
+          slug: req.params.slug,
+          orgId: req.permission.orgId,
+          type: ProjectFilterType.SLUG
+        },
+        status: req.query.status,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        actor: req.permission.type
+      });
+      return { cas };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:slug/certificates",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        slug: slugSchema.describe("The slug of the project to list certificates.")
+      }),
+      response: {
+        200: z.object({
+          certificates: z.array(CertificatesSchema)
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const certificates = await server.services.project.listProjectCertificates({
         filter: {
           slug: req.params.slug,
           orgId: req.permission.orgId,
@@ -338,7 +375,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         actorAuthMethod: req.permission.authMethod,
         actor: req.permission.type
       });
-      return { cas };
+      return { certificates };
     }
   });
 };

backend/src/services/certificate-authority/certificate-authority-dal.ts

@@ -1,10 +1,47 @@
 import { TDbClient } from "@app/db";
 import { TableName } from "@app/db/schemas";
+import { DatabaseError } from "@app/lib/errors";
 import { ormify } from "@app/lib/knex";
 
 export type TCertificateAuthorityDALFactory = ReturnType<typeof certificateAuthorityDALFactory>;
 
 export const certificateAuthorityDALFactory = (db: TDbClient) => {
   const caOrm = ormify(db, TableName.CertificateAuthority);
-  return caOrm;
+
+  const buildCertificateChain = async (caId: string) => {
+    try {
+      const result: {
+        caId: string;
+        parentCaId?: string;
+        certificate: string;
+      }[] = await db
+        .withRecursive("cte", (cte) => {
+          void cte
+            .select("ca.id as caId", "ca.parentCaId", "cert.certificate")
+            .from({ ca: TableName.CertificateAuthority })
+            .leftJoin({ cert: TableName.CertificateAuthorityCert }, "ca.id", "cert.caId")
+            .where("ca.id", caId)
+            .unionAll((builder) => {
+              void builder
+                .select("ca.id as caId", "ca.parentCaId", "cert.certificate")
+                .from({ ca: TableName.CertificateAuthority })
+                .leftJoin({ cert: TableName.CertificateAuthorityCert }, "ca.id", "cert.caId")
+                .innerJoin("cte", "cte.parentCaId", "ca.id");
+            });
+        })
+        .select("*")
+        .from("cte");
+
+      // Extract certificates and reverse the order to have the root CA at the end
+      const certChain: string[] = result.map((row) => row.certificate);
+      return certChain;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "BuildCertificateChain" });
+    }
+  };
+
+  return {
+    ...caOrm,
+    buildCertificateChain
+  };
 };

backend/src/services/certificate-authority/certificate-authority-fns.ts

@@ -0,0 +1,12 @@
+import { TDNParts } from "./certificate-authority-types";
+
+export const createDistinguishedName = (parts: TDNParts) => {
+  const dnParts = [];
+  if (parts.country) dnParts.push(`C=${parts.country}`);
+  if (parts.organization) dnParts.push(`O=${parts.organization}`);
+  if (parts.ou) dnParts.push(`OU=${parts.ou}`);
+  if (parts.province) dnParts.push(`ST=${parts.province}`);
+  if (parts.commonName) dnParts.push(`CN=${parts.commonName}`);
+  if (parts.locality) dnParts.push(`L=${parts.locality}`);
+  return dnParts.join(", ");
+};

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -1,18 +1,31 @@
+import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 import crypto, { KeyObject } from "crypto";
 
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { BadRequestError } from "@app/lib/errors";
+import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 
 import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
+import { createDistinguishedName } from "./certificate-authority-fns";
 import { TCertificateAuthoritySkDALFactory } from "./certificate-authority-sk-dal";
 import {
-  // TIssueCertFromCaDTO,
-  CAType,
+  CaStatus,
+  CaType,
   TCreateCaDTO,
+  TDeleteCaDTO,
   TGetCaCertDTO,
-  TGetCaCsrDTO
+  TGetCaCsrDTO,
+  TGetCaDTO,
+  TImportCertToCaDTO,
+  TIssueCertFromCaDTO,
+  TSignIntermediateDTO,
+  TUpdateCaDTO
 } from "./certificate-authority-types";
 
 type TCertificateAuthorityServiceFactoryDep = {
@@ -20,41 +33,27 @@ type TCertificateAuthorityServiceFactoryDep = {
   certificateAuthorityDAL: TCertificateAuthorityDALFactory;
   certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory;
   certificateAuthoritySkDAL: TCertificateAuthoritySkDALFactory;
+  certificateDAL: TCertificateDALFactory;
+  certificateCertDAL: TCertificateCertDALFactory;
+  certificateSecretDAL: TCertificateSecretDALFactory;
   projectDAL: TProjectDALFactory;
+  permissionService: TPermissionServiceFactory;
 };
 
 export type TCertificateAuthorityServiceFactory = ReturnType<typeof certificateAuthorityServiceFactory>;
 
-type DNParts = {
-  commonName?: string;
-  organization?: string;
-  ou?: string;
-  country?: string;
-  province?: string;
-  locality?: string;
-};
-
-function createDistinguishedName(parts: DNParts) {
-  const dnParts = [];
-  if (parts.country) dnParts.push(`C=${parts.country}`);
-  if (parts.organization) dnParts.push(`O=${parts.organization}`);
-  if (parts.ou) dnParts.push(`OU=${parts.ou}`);
-  if (parts.province) dnParts.push(`ST=${parts.province}`);
-  if (parts.commonName) dnParts.push(`CN=${parts.commonName}`);
-  if (parts.locality) dnParts.push(`L=${parts.locality}`);
-  return dnParts.join(", ");
-}
-
 export const certificateAuthorityServiceFactory = ({
   certificateAuthorityDAL,
   certificateAuthorityCertDAL,
   certificateAuthoritySkDAL,
-  projectDAL
+  certificateDAL,
+  certificateCertDAL,
+  certificateSecretDAL,
+  projectDAL,
+  permissionService
 }: TCertificateAuthorityServiceFactoryDep) => {
   /**
    * Generates a new root or intermediate CA
-   * @param param0
-   * @returns
    */
   const createCa = async ({
     projectSlug,
@@ -65,14 +64,30 @@ export const certificateAuthorityServiceFactory = ({
     country,
     province,
     locality,
-    // actorId,
-    // actorAuthMethod,
-    // actor,
+    notBefore,
+    notAfter,
+    maxPathLength,
+    actorId,
+    actorAuthMethod,
+    actor,
     actorOrgId
   }: TCreateCaDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
 
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      project.id,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
     const dn = createDistinguishedName({
       commonName,
       organization,
@@ -97,25 +112,41 @@ export const certificateAuthorityServiceFactory = ({
     const pk = pkObj.export({ format: "pem", type: "spki" }) as string;
 
     const newCa = await certificateAuthorityDAL.transaction(async (tx) => {
+      const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
+
+      // if undefined, set [notAfterDate] to 10 years from now
+      const notAfterDate = notAfter
+        ? new Date(notAfter)
+        : new Date(new Date().setFullYear(new Date().getFullYear() + 10));
+
       const ca = await certificateAuthorityDAL.create(
         {
           projectId: project.id,
           type,
-          dn
+          organization,
+          ou,
+          country,
+          province,
+          locality,
+          commonName,
+          status: type === CaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE,
+          dn,
+          ...(type === CaType.ROOT && { maxPathLength, notBefore: notBeforeDate, notAfter: notAfterDate })
         },
         tx
       );
 
-      if (type === CAType.ROOT) {
+      if (type === CaType.ROOT) {
         // note: self-signed cert only applicable for root CA
+
         const cert = await x509.X509CertificateGenerator.createSelfSigned({
           name: dn,
-          notBefore: new Date("2020/01/01"),
-          notAfter: new Date("2020/01/02"),
+          notBefore: notBeforeDate,
+          notAfter: notAfterDate,
           signingAlgorithm: alg,
           keys,
           extensions: [
-            new x509.BasicConstraintsExtension(true, 2, true),
+            new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true),
             new x509.ExtendedKeyUsageExtension(["1.2.3.4.5.6.7", "2.3.4.5.6.7.8"], true),
             // eslint-disable-next-line no-bitwise
             new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true),
@@ -148,15 +179,94 @@ export const certificateAuthorityServiceFactory = ({
     return newCa;
   };
 
+  const getCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    return ca;
+  };
+
+  const updateCaById = async ({ caId, status, actorId, actorAuthMethod, actor, actorOrgId }: TUpdateCaDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    const updatedCa = await certificateAuthorityDAL.updateById(caId, { status });
+
+    return updatedCa;
+  };
+
+  const deleteCaById = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCaDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    const deletedCa = await certificateAuthorityDAL.deleteById(caId);
+
+    return deletedCa;
+  };
+
   /**
    * Generates a CSR for a CA
    */
-  const getCaCsr = async ({ caId }: TGetCaCsrDTO) => {
+  const getCaCsr = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCsrDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
     if (!ca) throw new BadRequestError({ message: "CA not found" });
-    // TODO: permissioning
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    if (ca.type === CaType.ROOT) throw new BadRequestError({ message: "Root CA cannot generate CSR" });
 
     const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    if (caCert) throw new BadRequestError({ message: "CA already has a certificate installed" });
+
     const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id });
 
     const alg = {
@@ -176,10 +286,8 @@ export const certificateAuthorityServiceFactory = ({
       "verify"
     ]);
 
-    const cert = new x509.X509Certificate(caCert.certificate);
-
-    const csr = await x509.Pkcs10CertificateRequestGenerator.create({
-      name: cert.subject || ca.dn,
+    const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
+      name: ca.dn,
       keys: { privateKey: sk, publicKey: pk },
       signingAlgorithm: alg,
       extensions: [
@@ -189,80 +297,389 @@ export const certificateAuthorityServiceFactory = ({
       attributes: [new x509.ChallengePasswordAttribute("password")]
     });
 
-    return csr.toString("base64");
+    return csrObj.toString("pem");
   };
 
   /**
    * Return certificate and certificate chain for CA
    */
-  const getCaCert = async ({ caId }: TGetCaCertDTO) => {
+  const getCaCert = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCertDTO) => {
     const ca = await certificateAuthorityDAL.findById(caId);
     if (!ca) throw new BadRequestError({ message: "CA not found" });
-    // TODO: permissioning
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.CertificateAuthorities
+    );
 
     const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    const certObj = new x509.X509Certificate(caCert.certificate);
 
     return {
       certificate: caCert.certificate,
-      certificateChain: caCert.certificateChain
+      certificateChain: caCert.certificateChain,
+      serialNumber: certObj.serialNumber
     };
   };
 
   /**
-   * Issue new certificate
+   * Issue certificate to be imported back in for intermediate CA
+   * TODO: cannot chain to self
    */
-  const issueCertFromCa = async () => {
-    // WIP: parse publicKey from CSR
-    // const csrArrayBuffer = Uint8Array.from(atob(csr), (c) => c.charCodeAt(0));
-    // const csrR = new x509.Pkcs10CertificateRequest(csrArrayBuffer);
+  const signIntermediate = async ({
+    caId,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId,
+    csr,
+    notBefore,
+    notAfter,
+    maxPathLength
+  }: TSignIntermediateDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
 
-    // const ca = await certificateAuthorityDAL.findById(caId);
-    // if (!ca) throw new BadRequestError({ message: "CA not found" });
-    // // TODO: permissioning
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
 
-    // const alg = {
-    //   name: "RSASSA-PKCS1-v1_5",
-    //   hash: "SHA-256",
-    //   publicExponent: new Uint8Array([1, 0, 1]),
-    //   modulusLength: 2048
-    // };
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      ProjectPermissionSub.CertificateAuthorities
+    );
 
-    // const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
-    // const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id });
+    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
 
-    // const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" });
-    // const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [
-    //   "sign"
-    // ]);
+    const alg = {
+      name: "RSASSA-PKCS1-v1_5",
+      hash: "SHA-256",
+      publicExponent: new Uint8Array([1, 0, 1]),
+      modulusLength: 2048
+    };
 
-    // const cert = new x509.X509Certificate(caCert.certificate);
+    const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id });
 
-    // const leafCert = await x509.X509CertificateGenerator.create({
-    //   // serialNumber: "03",
-    //   subject: "CN=Leaf", // TODO: make dynamic
-    //   issuer: cert.subject,
-    //   notBefore: new Date(notBefore),
-    //   notAfter: new Date(notAfter),
-    //   signingKey: sk,
-    //   publicKey: leafKeys.publicKey,
-    //   signingAlgorithm: alg,
-    //   extensions: [
-    //     new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true),
-    //     new x509.BasicConstraintsExtension(false),
-    //     await x509.AuthorityKeyIdentifierExtension.create(cert, false),
-    //     await x509.SubjectKeyIdentifierExtension.create(leafKeys.publicKey)
-    //   ]
-    // });
+    const skObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" });
+    const sk = await crypto.subtle.importKey("pkcs8", skObj.export({ format: "der", type: "pkcs8" }), alg, true, [
+      "sign"
+    ]);
 
-    // console.log("leafCert: ", leafCert);
+    const certObj = new x509.X509Certificate(caCert.certificate);
+    const csrObj = new x509.Pkcs10CertificateRequest(csr);
 
-    return "";
+    // check path length constraint
+    const caPathLength = certObj.getExtension(x509.BasicConstraintsExtension)?.pathLength;
+    if (caPathLength !== undefined) {
+      if (caPathLength === 0)
+        throw new BadRequestError({
+          message: "Failed to issue intermediate certificate due to CA path length constraint"
+        });
+      if (maxPathLength >= caPathLength || (maxPathLength === -1 && caPathLength !== -1))
+        throw new BadRequestError({
+          message: "The requested path length constraint exceeds the CA's allowed path length"
+        });
+    }
+
+    const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
+    const notAfterDate = new Date(notAfter);
+
+    const caCertNotBeforeDate = new Date(certObj.notBefore);
+    const caCertNotAfterDate = new Date(certObj.notAfter);
+
+    // check not before constraint
+    if (notBeforeDate < caCertNotBeforeDate) {
+      throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" });
+    }
+
+    if (notBeforeDate > notAfterDate) throw new BadRequestError({ message: "notBefore date is after notAfter date" });
+
+    // check not after constraint
+    if (notAfterDate > caCertNotAfterDate) {
+      throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
+    }
+
+    const intermediateCert = await x509.X509CertificateGenerator.create({
+      // serialNumber: "03",
+      subject: csrObj.subject,
+      issuer: certObj.subject,
+      notBefore: notBeforeDate,
+      notAfter: notAfterDate,
+      signingKey: sk,
+      publicKey: csrObj.publicKey,
+      signingAlgorithm: alg,
+      extensions: [
+        new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true),
+        new x509.BasicConstraintsExtension(true, maxPathLength === -1 ? undefined : maxPathLength, true),
+        await x509.AuthorityKeyIdentifierExtension.create(certObj, false),
+        await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
+      ]
+    });
+
+    const chain = await certificateAuthorityDAL.buildCertificateChain(caId);
+
+    return {
+      certificate: intermediateCert.toString("pem"),
+      issuingCaCertificate: caCert.certificate,
+      certificateChain: chain.join("\n"),
+      serialNumber: intermediateCert.serialNumber
+    };
+  };
+
+  const importCertToCa = async ({
+    caId,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId,
+    certificate,
+    certificateChain
+  }: TImportCertToCaDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    if (caCert) throw new BadRequestError({ message: "CA has already imported a certificate" });
+
+    const certObj = new x509.X509Certificate(certificate);
+    const maxPathLength = certObj.getExtension(x509.BasicConstraintsExtension)?.pathLength;
+
+    // validate imported certificate and certificate chain
+    const certificates = certificateChain
+      .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g)
+      ?.map((cert) => new x509.X509Certificate(cert));
+
+    if (!certificates) throw new BadRequestError({ message: "Failed to parse certificate chain" });
+
+    const chain = new x509.X509ChainBuilder({
+      certificates
+    });
+
+    const chainItems = await chain.build(certObj);
+
+    // chain.build() implicitly verifies the chain
+    if (chainItems.length !== certificates.length + 1)
+      throw new BadRequestError({ message: "Invalid certificate chain" });
+
+    const parentCertObj = chainItems[1];
+    const parentCertSubject = parentCertObj.subject;
+
+    const parentCa = await certificateAuthorityDAL.findOne({
+      projectId: ca.projectId,
+      dn: parentCertSubject
+    });
+
+    await certificateAuthorityCertDAL.transaction(async (tx) => {
+      await certificateAuthorityCertDAL.create(
+        {
+          caId: ca.id,
+          certificate, // TODO: encrypt
+          certificateChain // TODO: encrypt
+        },
+        tx
+      );
+
+      await certificateAuthorityDAL.updateById(
+        ca.id,
+        {
+          status: CaStatus.ACTIVE,
+          maxPathLength: maxPathLength === undefined ? -1 : maxPathLength,
+          notBefore: new Date(certObj.notBefore),
+          notAfter: new Date(certObj.notAfter),
+          parentCaId: parentCa?.id
+        },
+        tx
+      );
+    });
+  };
+
+  const issueCertFromCa = async ({
+    caId,
+    commonName,
+    ttl,
+    notBefore,
+    notAfter,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId
+  }: TIssueCertFromCaDTO) => {
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new BadRequestError({ message: "CA not found" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates);
+
+    const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    if (!caCert) throw new BadRequestError({ message: "CA does not have a certificate installed" });
+
+    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+
+    const caCertObj = new x509.X509Certificate(caCert.certificate);
+
+    const alg = {
+      name: "RSASSA-PKCS1-v1_5",
+      hash: "SHA-256",
+      publicExponent: new Uint8Array([1, 0, 1]),
+      modulusLength: 2048
+    };
+
+    const caKeys = await certificateAuthoritySkDAL.findOne({ caId: ca.id });
+
+    const caSkObj = crypto.createPrivateKey({ key: caKeys.sk, format: "pem", type: "pkcs8" });
+    const caSk = await crypto.subtle.importKey("pkcs8", caSkObj.export({ format: "der", type: "pkcs8" }), alg, true, [
+      "sign"
+    ]);
+
+    const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
+
+    const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
+      name: `CN=${commonName}`,
+      keys: leafKeys,
+      signingAlgorithm: alg,
+      extensions: [
+        // eslint-disable-next-line no-bitwise
+        new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment)
+      ],
+      attributes: [new x509.ChallengePasswordAttribute("password")]
+    });
+
+    const notBeforeDate = notBefore ? new Date(notBefore) : new Date();
+
+    let notAfterDate = new Date(new Date().setFullYear(new Date().getFullYear() + 1));
+    if (notAfter) {
+      notAfterDate = new Date(notAfter);
+    } else if (ttl) {
+      // ttl in seconds
+      notAfterDate = new Date(new Date().getTime() + ttl * 1000);
+    }
+
+    const caCertNotBeforeDate = new Date(caCertObj.notBefore);
+    const caCertNotAfterDate = new Date(caCertObj.notAfter);
+
+    // check not before constraint
+    if (notBeforeDate < caCertNotBeforeDate) {
+      throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" });
+    }
+
+    if (notBeforeDate > notAfterDate) throw new BadRequestError({ message: "notBefore date is after notAfter date" });
+
+    // check not after constraint
+    if (notAfterDate > caCertNotAfterDate) {
+      throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
+    }
+
+    const leafCert = await x509.X509CertificateGenerator.create({
+      // serialNumber: "03",
+      subject: csrObj.subject,
+      issuer: caCertObj.subject,
+      notBefore: notBeforeDate,
+      notAfter: notAfterDate,
+      signingKey: caSk,
+      publicKey: csrObj.publicKey,
+      signingAlgorithm: alg,
+      extensions: [
+        new x509.KeyUsagesExtension(x509.KeyUsageFlags.dataEncipherment, true),
+        new x509.BasicConstraintsExtension(false),
+        await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false),
+        await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey)
+      ]
+    });
+
+    const skLeafObj = KeyObject.from(leafKeys.privateKey);
+    const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
+
+    const chain = await certificateAuthorityDAL.buildCertificateChain(caId);
+
+    // https://nodejs.org/api/crypto.html#static-method-keyobjectfromkey
+    const skObj = KeyObject.from(leafKeys.privateKey);
+    const sk = skObj.export({ format: "pem", type: "pkcs8" }) as string;
+    const pkObj = KeyObject.from(leafKeys.publicKey);
+    const pk = pkObj.export({ format: "pem", type: "spki" }) as string;
+
+    await certificateDAL.transaction(async (tx) => {
+      const cert = await certificateDAL.create(
+        {
+          caId: ca.id,
+          commonName,
+          notBefore: notBeforeDate,
+          notAfter: notAfterDate
+        },
+        tx
+      );
+
+      await certificateCertDAL.create(
+        {
+          certId: cert.id,
+          certificate: leafCert.toString("pem"), // TODO: encrypt
+          certificateChain: chain.join("\n") // TODO: encrypt
+        },
+        tx
+      );
+
+      await certificateSecretDAL.create(
+        {
+          certId: cert.id,
+          pk, // TODO: encrypt
+          sk // TODO: encrypt
+        },
+        tx
+      );
+
+      return cert;
+    });
+
+    return {
+      certificate: leafCert.toString("pem"),
+      certificateChain: chain.join("\n"),
+      issuingCaCertificate: caCert.certificate,
+      privateKey: skLeaf,
+      serialNumber: leafCert.serialNumber
+    };
   };
 
   return {
     createCa,
+    getCaById,
+    updateCaById,
+    deleteCaById,
     getCaCsr,
     getCaCert,
+    signIntermediate,
+    importCertToCa,
     issueCertFromCa
   };
 };

backend/src/services/certificate-authority/certificate-authority-types.ts

@@ -1,21 +1,43 @@
 import { TProjectPermission } from "@app/lib/types";
 
-export enum CAType {
+export enum CaType {
   ROOT = "root",
   INTERMEDIATE = "intermediate"
 }
 
+export enum CaStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+  PENDING_CERTIFICATE = "pending-certificate"
+}
+
 // TODO: attach permissions after draft impl
 
 export type TCreateCaDTO = {
   projectSlug: string;
-  type: CAType;
+  type: CaType;
   commonName: string;
   organization: string;
   ou: string;
   country: string;
   province: string;
   locality: string;
+  notBefore?: string;
+  notAfter?: string;
+  maxPathLength?: number;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TUpdateCaDTO = {
+  caId: string;
+  status?: CaStatus;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDeleteCaDTO = {
+  caId: string;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TGetCaCsrDTO = {
@@ -26,9 +48,33 @@ export type TGetCaCertDTO = {
   caId: string;
 } & Omit<TProjectPermission, "projectId">;
 
-export type TIssueCertFromCaDTO = {
+export type TSignIntermediateDTO = {
   caId: string;
   csr: string;
-  notBefore: string;
+  notBefore?: string;
   notAfter: string;
+  maxPathLength: number;
 } & Omit<TProjectPermission, "projectId">;
+
+export type TImportCertToCaDTO = {
+  caId: string;
+  certificate: string;
+  certificateChain: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TIssueCertFromCaDTO = {
+  caId: string;
+  commonName: string;
+  ttl?: number;
+  notBefore?: string;
+  notAfter?: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDNParts = {
+  commonName?: string;
+  organization?: string;
+  ou?: string;
+  country?: string;
+  province?: string;
+  locality?: string;
+};

backend/src/services/certificate-authority/certificate-authority-validators.ts

@@ -0,0 +1,8 @@
+import { z } from "zod";
+
+const isValidDate = (dateString: string) => {
+  const date = new Date(dateString);
+  return !Number.isNaN(date.getTime());
+};
+
+export const validateCaDateField = z.string().trim().refine(isValidDate, { message: "Invalid date format" });

backend/src/services/certificate/certificate-cert-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TCertificateCertDALFactory = ReturnType<typeof certificateCertDALFactory>;
+
+export const certificateCertDALFactory = (db: TDbClient) => {
+  const certificateCertOrm = ormify(db, TableName.CertificateCert);
+  return certificateCertOrm;
+};

backend/src/services/certificate/certificate-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TCertificateDALFactory = ReturnType<typeof certificateDALFactory>;
+
+export const certificateDALFactory = (db: TDbClient) => {
+  const certificateOrm = ormify(db, TableName.Certificate);
+  return certificateOrm;
+};

backend/src/services/certificate/certificate-secret-dal.ts

@@ -0,0 +1,10 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TCertificateSecretDALFactory = ReturnType<typeof certificateSecretDALFactory>;
+
+export const certificateSecretDALFactory = (db: TDbClient) => {
+  const certificateSecretOrm = ormify(db, TableName.CertificateSecret);
+  return certificateSecretOrm;
+};

backend/src/services/certificate/certificate-service.ts

@@ -0,0 +1,102 @@
+import { ForbiddenError } from "@casl/ability";
+import * as x509 from "@peculiar/x509";
+
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { TCertificateCertDALFactory } from "@app/services/certificate/certificate-cert-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
+import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
+
+import { TDeleteCertDTO, TGetCertCertDTO, TGetCertDTO } from "./certificate-types";
+
+type TCertificateServiceFactoryDep = {
+  // TODO: Pick
+  certificateDAL: TCertificateDALFactory;
+  certificateCertDAL: TCertificateCertDALFactory;
+  certificateSecretDAL: TCertificateSecretDALFactory;
+  certificateAuthorityDAL: TCertificateAuthorityDALFactory;
+  certificateAuthorityCertDAL: TCertificateAuthorityCertDALFactory;
+  permissionService: TPermissionServiceFactory;
+};
+
+export type TCertificateServiceFactory = ReturnType<typeof certificateServiceFactory>;
+
+export const certificateServiceFactory = ({
+  certificateDAL,
+  certificateCertDAL,
+  certificateSecretDAL,
+  certificateAuthorityDAL,
+  certificateAuthorityCertDAL,
+  permissionService
+}: TCertificateServiceFactoryDep) => {
+  const getCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => {
+    const cert = await certificateDAL.findById(certId);
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
+
+    return cert;
+  };
+
+  const deleteCertById = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => {
+    const cert = await certificateDAL.findById(certId);
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
+
+    const deletedCert = await certificateDAL.deleteById(cert.id);
+    return deletedCert;
+  };
+
+  const getCertCert = async ({ certId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertCertDTO) => {
+    const cert = await certificateDAL.findById(certId);
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      ca.projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+    // TODO: re-evaluate this permission
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Certificates);
+
+    const caCert = await certificateAuthorityCertDAL.findOne({ caId: ca.id });
+    const certCert = await certificateCertDAL.findOne({ certId });
+    const certSecret = await certificateSecretDAL.findOne({ certId });
+    const certObj = new x509.X509Certificate(certCert.certificate);
+
+    return {
+      certificate: certCert.certificate,
+      certificateChain: certCert.certificateChain,
+      issuingCaCertificate: caCert.certificate,
+      privateKey: certSecret.sk,
+      serialNumber: certObj.serialNumber
+    };
+  };
+
+  return {
+    getCertById,
+    deleteCertById,
+    getCertCert
+  };
+};

backend/src/services/certificate/certificate-types.ts

@@ -0,0 +1,13 @@
+import { TProjectPermission } from "@app/lib/types";
+
+export type TGetCertDTO = {
+  certId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDeleteCertDTO = {
+  certId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCertCertDTO = {
+  certId: string;
+} & Omit<TProjectPermission, "projectId">;

backend/src/services/project/project-service.ts

@@ -16,6 +16,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TProjectPermission } from "@app/lib/types";
 
 import { ActorType } from "../auth/auth-type";
+import { TCertificateDALFactory } from "../certificate/certificate-dal";
 import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityProjectDALFactory } from "../identity-project/identity-project-dal";
@@ -51,6 +52,7 @@ export const DEFAULT_PROJECT_ENVS = [
 ];
 
 type TProjectServiceFactoryDep = {
+  // TODO: Pick
   projectDAL: TProjectDALFactory;
   projectQueue: TProjectQueueFactory;
   userDAL: TUserDALFactory;
@@ -65,6 +67,7 @@ type TProjectServiceFactoryDep = {
   projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "create">;
   secretBlindIndexDAL: Pick<TSecretBlindIndexDALFactory, "create">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "find">;
+  certificateDAL: TCertificateDALFactory;
   permissionService: TPermissionServiceFactory;
   orgService: Pick<TOrgServiceFactory, "addGhostUser">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -93,6 +96,7 @@ export const projectServiceFactory = ({
   projectUserMembershipRoleDAL,
   identityProjectMembershipRoleDAL,
   certificateAuthorityDAL,
+  certificateDAL,
   keyStore
 }: TProjectServiceFactoryDep) => {
   /*
@@ -500,24 +504,66 @@ export const projectServiceFactory = ({
    * Return list of CAs for project
    */
   const listProjectCas = async ({
-    // actorId,
-    // actorOrgId,
-    // actorAuthMethod,
-    filter // actor
+    status,
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    filter,
+    actor
   }: TListProjectCasDTO) => {
     const project = await projectDAL.findProjectByFilter(filter);
 
-    // const { permission } = await permissionService.getProjectPermission(
-    //   actor,
-    //   actorId,
-    //   project.id,
-    //   actorAuthMethod,
-    //   actorOrgId
-    // );
-    // TODO: add permissioning
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      project.id,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.CertificateAuthorities
+    );
+
+    const cas = await certificateAuthorityDAL.find({
+      projectId: project.id,
+      ...(status && { status })
+    });
+
+    return cas;
+  };
+
+  /**
+   * Return list of certificates for project
+   */
+  const listProjectCertificates = async ({
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    filter,
+    actor
+  }: TListProjectCasDTO) => {
+    const project = await projectDAL.findProjectByFilter(filter);
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      project.id,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Certificates);
 
     const cas = await certificateAuthorityDAL.find({ projectId: project.id });
-    return cas;
+
+    const certificates = await certificateDAL.find({
+      $in: {
+        caId: cas.map((ca) => ca.id)
+      }
+    });
+    return certificates;
   };
 
   return {
@@ -530,6 +576,7 @@ export const projectServiceFactory = ({
     toggleAutoCapitalization,
     updateName,
     upgradeProject,
-    listProjectCas
+    listProjectCas,
+    listProjectCertificates
   };
 };

backend/src/services/project/project-types.ts

@@ -2,6 +2,7 @@ import { ProjectMembershipRole, TProjectKeys } from "@app/db/schemas";
 import { TProjectPermission } from "@app/lib/types";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
+import { CaStatus } from "../certificate-authority/certificate-authority-types";
 
 export enum ProjectFilterType {
   ID = "id",
@@ -77,5 +78,6 @@ export type AddUserToWsDTO = {
 };
 
 export type TListProjectCasDTO = {
+  status?: CaStatus;
   filter: Filter;
 } & Omit<TProjectPermission, "projectId">;