PKI Syncs ui and removal improvements

2026-09-22 13:39:35 +00:00 · 2025-10-30 14:54:07 -03:00
parent 696680bd8b
commit caee0b34e8
17 changed files with 290 additions and 92 deletions
--- a/backend/src/server/routes/v1/pki-sync-routers/pki-sync-router.ts
+++ b/backend/src/server/routes/v1/pki-sync-routers/pki-sync-router.ts
@@ -93,6 +93,8 @@ const PkiSyncCertificateSchema = z.object({
  certificateStatus: z.string().optional(),
  certificateNotBefore: z.date().optional(),
  certificateNotAfter: z.date().optional(),
+  certificateRenewBeforeDays: z.number().optional(),
+  certificateRenewalError: z.string().optional(),
  pkiSyncName: z.string().optional(),
  pkiSyncDestination: z.string().optional()
 });
--- a/backend/src/services/certificate-sync/certificate-sync-dal.ts
+++ b/backend/src/services/certificate-sync/certificate-sync-dal.ts
@@ -184,6 +184,9 @@ export const certificateSyncDALFactory = (db: TDbClient) => {
      certificateStatus?: string;
      certificateNotBefore?: Date;
      certificateNotAfter?: Date;
+      certificateRenewBeforeDays?: number;
+      certificateRenewedByCertificateId?: string;
+      certificateRenewalError?: string;
      pkiSyncName?: string;
      pkiSyncDestination?: string;
    })[];
@@ -216,6 +219,9 @@ export const certificateSyncDALFactory = (db: TDbClient) => {
          db.ref("status").withSchema(TableName.Certificate).as("certificateStatus"),
          db.ref("notBefore").withSchema(TableName.Certificate).as("certificateNotBefore"),
          db.ref("notAfter").withSchema(TableName.Certificate).as("certificateNotAfter"),
+          db.ref("renewBeforeDays").withSchema(TableName.Certificate).as("certificateRenewBeforeDays"),
+          db.ref("renewedByCertificateId").withSchema(TableName.Certificate).as("certificateRenewedByCertificateId"),
+          db.ref("renewalError").withSchema(TableName.Certificate).as("certificateRenewalError"),
          db.ref("name").withSchema(TableName.PkiSync).as("pkiSyncName"),
          db.ref("destination").withSchema(TableName.PkiSync).as("pkiSyncDestination")
        )
@@ -235,6 +241,9 @@ export const certificateSyncDALFactory = (db: TDbClient) => {
        certificateStatus?: string;
        certificateNotBefore?: Date;
        certificateNotAfter?: Date;
+        certificateRenewBeforeDays?: number;
+        certificateRenewedByCertificateId?: string;
+        certificateRenewalError?: string;
        pkiSyncName?: string;
        pkiSyncDestination?: string;
      })[];
--- a/backend/src/services/certificate-sync/certificate-sync-enums.ts
+++ b/backend/src/services/certificate-sync/certificate-sync-enums.ts
@@ -2,5 +2,6 @@ export enum CertificateSyncStatus {
  Pending = "pending",
  Syncing = "syncing",
  Succeeded = "succeeded",
-  Failed = "failed"
+  Failed = "failed",
+  Running = "running"
 }
--- a/backend/src/services/certificate-v3/certificate-v3-service.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-service.ts
@@ -51,7 +51,7 @@ import {
 import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
 import { TPkiSyncDALFactory } from "../pki-sync/pki-sync-dal";
 import { TPkiSyncQueueFactory } from "../pki-sync/pki-sync-queue";
-import { replaceCertificateInSyncs, triggerAutoSyncForCertificate } from "../pki-sync/pki-sync-utils";
+import { addRenewedCertificateToSyncs, triggerAutoSyncForCertificate } from "../pki-sync/pki-sync-utils";
 import {
  TCertificateFromProfileResponse,
  TCertificateOrderResponse,
@@ -885,7 +885,7 @@ export const certificateV3ServiceFactory = ({
        tx
      );

-      await replaceCertificateInSyncs(originalCert.id, newCert.id, { certificateSyncDAL }, tx);
+      await addRenewedCertificateToSyncs(originalCert.id, newCert.id, { certificateSyncDAL }, tx);

      return {
        certificate,
--- a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
@@ -15,6 +15,9 @@ import {
  AwsConnectionAssumeRoleCredentialsSchema
 } from "@app/services/app-connection/aws/aws-connection-schemas";
 import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
+import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TCertificateMap } from "@app/services/pki-sync/pki-sync-types";
@@ -182,6 +185,8 @@ const generateCertificateName = (certificateName: string, pkiSync: TPkiSyncWithC
 type TAwsCertificateManagerPkiSyncFactoryDeps = {
  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  certificateSyncDAL: Pick<TCertificateSyncDALFactory, "removeCertificates">;
+  certificateDAL: Pick<TCertificateDALFactory, "findById">;
 };

 const getAwsAcmClient = async (
@@ -240,7 +245,9 @@ const getAwsAcmClient = async (

 export const awsCertificateManagerPkiSyncFactory = ({
  kmsService,
-  appConnectionDAL
+  appConnectionDAL,
+  certificateSyncDAL,
+  certificateDAL
 }: TAwsCertificateManagerPkiSyncFactoryDeps) => {
  const deleteCertificateFromAcm = async (
    acm: AWS.ACM,
@@ -415,11 +422,12 @@ export const awsCertificateManagerPkiSyncFactory = ({
    const validationErrors: Array<{ name: string; error: string }> = [];

    const activeCertificateNames = Object.keys(certificateMap);
-    const syncOptions = pkiSync.syncOptions as { preserveArn?: boolean } | undefined;
+    const syncOptions = pkiSync.syncOptions as { preserveArn?: boolean; canRemoveCertificates?: boolean } | undefined;
    const preserveArn = syncOptions?.preserveArn ?? true;
+    const canRemoveCertificates = syncOptions?.canRemoveCertificates ?? true;

-    Object.entries(certificateMap).forEach(([certName, certData]) => {
-      const { cert, privateKey, certificateChain, alternativeNames } = certData;
+    for (const [certName, certData] of Object.entries(certificateMap)) {
+      const { cert, privateKey, certificateChain, alternativeNames, certificateId } = certData;

      try {
        validateCertificateContent(cert, privateKey);
@@ -429,7 +437,16 @@ export const awsCertificateManagerPkiSyncFactory = ({
          name: certName,
          error: `Certificate validation failed: ${errorMessage}`
        });
-        return;
+        // eslint-disable-next-line no-continue
+        continue;
+      }
+
+      if (preserveArn && certificateId) {
+        const certificate = await certificateDAL.findById(certificateId);
+        if (certificate?.renewedByCertificateId) {
+          // eslint-disable-next-line no-continue
+          continue;
+        }
      }

      const certificateName = generateCertificateName(certName, pkiSync);
@@ -451,44 +468,47 @@ export const awsCertificateManagerPkiSyncFactory = ({
        cert,
        privateKey,
        certificateChain,
-        existingArn
+        existingArn,
+        certificateId
      });
-    });
+    }

-    const certificatesToRemove = Object.values(acmCertificates)
-      .filter((acmCert) => {
-        if (!acmCert.arn || !acmCert.Tags) {
-          return false;
-        }
+    const certificatesToRemove = canRemoveCertificates
+      ? Object.values(acmCertificates)
+          .filter((acmCert) => {
+            if (!acmCert.arn || !acmCert.Tags) {
+              return false;
+            }

-        const certNameTag = findInfisicalCertificateTag(acmCert.Tags);
-        if (!certNameTag || !certNameTag.Value) {
-          return false;
-        }
+            const certNameTag = findInfisicalCertificateTag(acmCert.Tags);
+            if (!certNameTag || !certNameTag.Value) {
+              return false;
+            }

-        const isActive = activeCertificateNames.some((activeCertName) => {
-          const certData = certificateMap[activeCertName];
-          if (!certData) return false;
+            const isActive = activeCertificateNames.some((activeCertName) => {
+              const certData = certificateMap[activeCertName];
+              if (!certData) return false;

-          return validateCertificateIdentification(activeCertName, acmCert, certData.alternativeNames);
-        });
+              return validateCertificateIdentification(activeCertName, acmCert, certData.alternativeNames);
+            });

-        if (!isActive) {
-          return true;
-        }
+            if (!isActive) {
+              return true;
+            }

-        if (!preserveArn && isActive) {
-          return true;
-        }
+            if (!preserveArn && isActive) {
+              return true;
+            }

-        return false;
-      })
-      .map((acmCert) => acmCert.arn!)
-      .filter((arn) => arn);
+            return false;
+          })
+          .map((acmCert) => acmCert.arn!)
+          .filter((arn) => arn)
+      : [];

    const uploadResults = await executeWithConcurrencyLimit(
      setCertificates,
-      async ({ key, name, cert, privateKey, certificateChain, existingArn }) => {
+      async ({ key, name, cert, privateKey, certificateChain, existingArn, certificateId }) => {
        try {
          const importParams: AWS.ACM.ImportCertificateRequest = {
            Certificate: cert,
@@ -549,6 +569,13 @@ export const awsCertificateManagerPkiSyncFactory = ({
            }
          }

+          if (existingArn && preserveArn && certificateId) {
+            const currentCertificate = await certificateDAL.findById(certificateId);
+            if (currentCertificate?.renewedFromCertificateId) {
+              await certificateSyncDAL.removeCertificates(pkiSync.id, [currentCertificate.renewedFromCertificateId]);
+            }
+          }
+
          return { key, name, success: true, response };
        } catch (error) {
          const errorMessage = error instanceof Error ? error.message : "Unknown error";
@@ -644,7 +671,8 @@ export const awsCertificateManagerPkiSyncFactory = ({

  const removeCertificates = async (
    pkiSync: TPkiSyncWithCredentials,
-    certificateNames: string[]
+    certificateNames: string[],
+    deps?: { certificateSyncDAL?: TCertificateSyncDALFactory; certificateMap?: TCertificateMap }
  ): Promise<RemoveCertificatesResult> => {
    const destinationConfig = pkiSync.destinationConfig as TAwsCertificateManagerPkiSyncConfig;
    const acm = await getAwsAcmClient(
@@ -686,6 +714,43 @@ export const awsCertificateManagerPkiSyncFactory = ({

    const failedRemovals = results.filter((result) => result.status === "rejected");

+    if (failedRemovals.length > 0 && deps?.certificateSyncDAL && deps?.certificateMap) {
+      const certificateNameToArnMap = new Map<string, string>();
+      for (const certName of certificateNames) {
+        const matchingCerts = Object.values(acmCertificates).filter((acmCert) =>
+          validateCertificateIdentification(certName, acmCert)
+        );
+        for (const acmCert of matchingCerts) {
+          if (acmCert.arn) {
+            certificateNameToArnMap.set(acmCert.arn, certName);
+          }
+        }
+      }
+
+      for (const failure of failedRemovals) {
+        if (failure.status === "rejected") {
+          const failedArn = certificateArnsToRemove[results.indexOf(failure)];
+          const certificateName = certificateNameToArnMap.get(failedArn);
+          if (certificateName && deps.certificateMap[certificateName]?.certificateId) {
+            const { certificateId } = deps.certificateMap[certificateName];
+            if (certificateId) {
+              const errorMessage = failure.reason instanceof Error ? failure.reason.message : "Unknown error";
+              try {
+                await deps.certificateSyncDAL.updateSyncStatus(
+                  pkiSync.id,
+                  certificateId,
+                  CertificateSyncStatus.Failed,
+                  `Failed to remove from AWS: ${errorMessage}`
+                );
+              } catch (updateError) {
+                logger.warn(`Failed to update sync status for certificate ${certificateId}:`, String(updateError));
+              }
+            }
+          }
+        }
+      }
+    }
+
    if (failedRemovals.length > 0) {
      const failedReasons = failedRemovals.map((failure) => {
        if (failure.status === "rejected") {
--- a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts
+++ b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-types.ts
@@ -56,4 +56,5 @@ export interface CertificateImportRequest {
  privateKey: string;
  certificateChain?: string;
  existingArn?: string;
+  certificateId?: string;
 }
--- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
@@ -6,6 +6,8 @@ import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
+import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
+import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { matchesCertificateNameSchema } from "@app/services/pki-sync/pki-sync-fns";
@@ -32,7 +34,9 @@ const extractCertificateNameFromId = (certificateId: string): string => {
 };

 const isInfisicalManagedCertificate = (certificateName: string, pkiSync: TPkiSyncWithCredentials): boolean => {
-  const syncOptions = pkiSync.syncOptions as { certificateNameSchema?: string } | undefined;
+  const syncOptions = pkiSync.syncOptions as
+    | { certificateNameSchema?: string; canRemoveCertificates?: boolean }
+    | undefined;
  const certificateNameSchema = syncOptions?.certificateNameSchema;

  if (certificateNameSchema) {
@@ -330,13 +334,19 @@ export const azureKeyVaultPkiSyncFactory = ({ kmsService, appConnectionDAL }: TA
      cert: string;
      privateKey: string;
      certificateChain?: string;
+      certificateId?: string;
    }[] = [];

+    const syncOptions = pkiSync.syncOptions as
+      | { certificateNameSchema?: string; canRemoveCertificates?: boolean }
+      | undefined;
+    const canRemoveCertificates = syncOptions?.canRemoveCertificates ?? true;
+
    // Track which certificates should exist in Azure Key Vault
    const activeCertificateNames = Object.keys(certificateMap);

    // Iterate through certificates to sync to Azure Key Vault
-    Object.entries(certificateMap).forEach(([certName, { cert, privateKey, certificateChain }]) => {
+    Object.entries(certificateMap).forEach(([certName, { cert, privateKey, certificateChain, certificateId }]) => {
      if (disabledAzureKeyVaultCertificateKeys.includes(certName)) {
        return;
      }
@@ -349,19 +359,22 @@ export const azureKeyVaultPkiSyncFactory = ({ kmsService, appConnectionDAL }: TA
          key: certName,
          cert,
          privateKey,
-          certificateChain
+          certificateChain,
+          certificateId
        });
      }
    });

    // Identify expired/removed certificates that need to be cleaned up from Azure Key Vault
    // Only remove certificates that were managed by Infisical (match naming schema)
-    const certificatesToRemove = Object.keys(vaultCertificates).filter(
-      (vaultCertName) =>
-        isInfisicalManagedCertificate(vaultCertName, pkiSync) &&
-        !activeCertificateNames.includes(vaultCertName) &&
-        !disabledAzureKeyVaultCertificateKeys.includes(vaultCertName)
-    );
+    const certificatesToRemove = canRemoveCertificates
+      ? Object.keys(vaultCertificates).filter(
+          (vaultCertName) =>
+            isInfisicalManagedCertificate(vaultCertName, pkiSync) &&
+            !activeCertificateNames.includes(vaultCertName) &&
+            !disabledAzureKeyVaultCertificateKeys.includes(vaultCertName)
+        )
+      : [];

    // Upload certificates to Azure Key Vault with rate limiting
    const uploadResults = await executeWithConcurrencyLimit(
@@ -599,7 +612,11 @@ export const azureKeyVaultPkiSyncFactory = ({ kmsService, appConnectionDAL }: TA
    };
  };

-  const removeCertificates = async (pkiSync: TPkiSyncWithCredentials, certificateNames: string[]) => {
+  const removeCertificates = async (
+    pkiSync: TPkiSyncWithCredentials,
+    certificateNames: string[],
+    deps?: { certificateSyncDAL?: TCertificateSyncDALFactory; certificateMap?: TCertificateMap }
+  ) => {
    const { accessToken } = await getAzureConnectionAccessToken(pkiSync.connection.id, appConnectionDAL, kmsService);

    // Cast destination config to Azure Key Vault config
@@ -648,6 +665,27 @@ export const azureKeyVaultPkiSyncFactory = ({ kmsService, appConnectionDAL }: TA
    );
    const failedRemovals = results.filter((result) => result.status === "rejected");

+    if (failedRemovals.length > 0 && deps?.certificateSyncDAL && deps?.certificateMap) {
+      for (const failure of failedRemovals) {
+        if (failure.status === "rejected") {
+          const failedIndex = results.indexOf(failure);
+          const failedCertName = infisicalManagedCertNames[failedIndex];
+          if (failedCertName && deps.certificateMap[failedCertName]?.certificateId) {
+            const { certificateId } = deps.certificateMap[failedCertName];
+            if (certificateId) {
+              const errorMessage = (failure.reason as Error)?.message || "Unknown error";
+              await deps.certificateSyncDAL.updateSyncStatus(
+                pkiSync.id,
+                certificateId,
+                CertificateSyncStatus.Failed,
+                `Failed to remove from Azure: ${errorMessage}`
+              );
+            }
+          }
+        }
+      }
+    }
+
    if (failedRemovals.length > 0) {
      const failedReasons = failedRemovals.map((failure) => {
        if (failure.status === "rejected") {
--- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts
@@ -50,7 +50,7 @@ export const CreateAzureKeyVaultPkiSyncSchema = z.object({
  isAutoSyncEnabled: z.boolean().default(true),
  destinationConfig: AzureKeyVaultPkiSyncConfigSchema,
  syncOptions: AzureKeyVaultPkiSyncOptionsSchema.optional().default({}),
-  subscriberId: z.string().optional(),
+  subscriberId: z.string().nullish(),
  connectionId: z.string(),
  projectId: z.string().trim().min(1),
  certificateIds: z.array(z.string().uuid()).optional()
@@ -62,7 +62,7 @@ export const UpdateAzureKeyVaultPkiSyncSchema = z.object({
  isAutoSyncEnabled: z.boolean().optional(),
  destinationConfig: AzureKeyVaultPkiSyncConfigSchema.optional(),
  syncOptions: AzureKeyVaultPkiSyncOptionsSchema.optional(),
-  subscriberId: z.string().optional(),
+  subscriberId: z.string().nullish(),
  connectionId: z.string().optional()
 });

--- a/backend/src/services/pki-sync/pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/pki-sync-fns.ts
@@ -4,6 +4,8 @@ import { z, ZodSchema } from "zod";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { BadRequestError } from "@app/lib/errors";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";

 import { AWS_CERTIFICATE_MANAGER_PKI_SYNC_LIST_OPTION } from "./aws-certificate-manager/aws-certificate-manager-pki-sync-constants";
@@ -184,6 +186,8 @@ export const PkiSyncFns = {
    dependencies: {
      appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
      kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+      certificateDAL: TCertificateDALFactory;
+      certificateSyncDAL: TCertificateSyncDALFactory;
    }
  ): Promise<{
    uploaded: number;
@@ -205,7 +209,12 @@ export const PkiSyncFns = {
      }
      case PkiSync.AwsCertificateManager: {
        checkPkiSyncDestination(pkiSync, PkiSync.AwsCertificateManager);
-        const awsCertificateManagerPkiSync = awsCertificateManagerPkiSyncFactory(dependencies);
+        const awsCertificateManagerPkiSync = awsCertificateManagerPkiSyncFactory({
+          appConnectionDAL: dependencies.appConnectionDAL,
+          kmsService: dependencies.kmsService,
+          certificateDAL: dependencies.certificateDAL,
+          certificateSyncDAL: dependencies.certificateSyncDAL
+        });
        return awsCertificateManagerPkiSync.syncCertificates(pkiSync, certificateMap);
      }
      default:
@@ -219,19 +228,33 @@ export const PkiSyncFns = {
    dependencies: {
      appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
      kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+      certificateSyncDAL: TCertificateSyncDALFactory;
+      certificateDAL: TCertificateDALFactory;
+      certificateMap: TCertificateMap;
    }
  ): Promise<void> => {
    switch (pkiSync.destination) {
      case PkiSync.AzureKeyVault: {
        checkPkiSyncDestination(pkiSync, PkiSync.AzureKeyVault);
        const azureKeyVaultPkiSync = azureKeyVaultPkiSyncFactory(dependencies);
-        await azureKeyVaultPkiSync.removeCertificates(pkiSync, certificateNames);
+        await azureKeyVaultPkiSync.removeCertificates(pkiSync, certificateNames, {
+          certificateSyncDAL: dependencies.certificateSyncDAL,
+          certificateMap: dependencies.certificateMap
+        });
        break;
      }
      case PkiSync.AwsCertificateManager: {
        checkPkiSyncDestination(pkiSync, PkiSync.AwsCertificateManager);
-        const awsCertificateManagerPkiSync = awsCertificateManagerPkiSyncFactory(dependencies);
-        await awsCertificateManagerPkiSync.removeCertificates(pkiSync, certificateNames);
+        const awsCertificateManagerPkiSync = awsCertificateManagerPkiSyncFactory({
+          appConnectionDAL: dependencies.appConnectionDAL,
+          kmsService: dependencies.kmsService,
+          certificateDAL: dependencies.certificateDAL,
+          certificateSyncDAL: dependencies.certificateSyncDAL
+        });
+        await awsCertificateManagerPkiSync.removeCertificates(pkiSync, certificateNames, {
+          certificateSyncDAL: dependencies.certificateSyncDAL,
+          certificateMap: dependencies.certificateMap
+        });
        break;
      }
      default:
--- a/backend/src/services/pki-sync/pki-sync-queue.ts
+++ b/backend/src/services/pki-sync/pki-sync-queue.ts
@@ -27,6 +27,7 @@ import { TCertificateAuthorityCertDALFactory } from "../certificate-authority/ce
 import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
 import { getCaCertChain } from "../certificate-authority/certificate-authority-fns";
 import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
+import { CertificateSyncStatus } from "../certificate-sync/certificate-sync-enums";
 import { TPkiSyncDALFactory } from "./pki-sync-dal";
 import { PkiSyncStatus } from "./pki-sync-enums";
 import { PkiSyncError } from "./pki-sync-errors";
@@ -57,23 +58,12 @@ type TPkiSyncQueueFactoryDep = {
  auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
  projectDAL: TProjectDALFactory;
  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-  certificateDAL: Pick<
-    TCertificateDALFactory,
-    | "findLatestActiveCertForSubscriber"
-    | "findAllActiveCertsForSubscriber"
-    | "findActiveCertificatesByIds"
-    | "create"
-    | "findById"
-    | "find"
-  >;
+  certificateDAL: TCertificateDALFactory;
  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne" | "create">;
  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne" | "create">;
  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
-  certificateSyncDAL: Pick<
-    TCertificateSyncDALFactory,
-    "findCertificateIdsByPkiSyncId" | "updateSyncStatus" | "bulkUpdateSyncStatus"
-  >;
+  certificateSyncDAL: TCertificateSyncDALFactory;
 };

 type PkiSyncActionJob = Job<
@@ -303,7 +293,8 @@ export const pkiSyncQueueFactory = ({
              cert: certificatePem,
              privateKey: certPrivateKey || "",
              certificateChain,
-              alternativeNames
+              alternativeNames,
+              certificateId: certificate.id
            };

            certificateMetadata.set(certificateName, {
@@ -427,7 +418,7 @@ export const pkiSyncQueueFactory = ({
      const statusUpdates = Array.from(certificateMetadata.entries()).map(([, metadata]) => ({
        pkiSyncId: pkiSync.id,
        certificateId: metadata.id,
-        status: "running",
+        status: CertificateSyncStatus.Running,
        message: "Syncing certificate to destination"
      }));

@@ -437,7 +428,9 @@ export const pkiSyncQueueFactory = ({

      const syncResult = await PkiSyncFns.syncCertificates(pkiSyncWithCredentials, certificateMap, {
        appConnectionDAL,
-        kmsService
+        kmsService,
+        certificateDAL,
+        certificateSyncDAL
      });

      logger.info(
@@ -462,7 +455,7 @@ export const pkiSyncQueueFactory = ({
        postSyncUpdates.push({
          pkiSyncId: pkiSync.id,
          certificateId: metadata.id,
-          status: "succeeded",
+          status: CertificateSyncStatus.Succeeded,
          message: "Certificate successfully synced to destination"
        });
      }
@@ -476,7 +469,7 @@ export const pkiSyncQueueFactory = ({
              postSyncUpdates[updateIndex] = {
                pkiSyncId: pkiSync.id,
                certificateId: metadata.id,
-                status: "failed",
+                status: CertificateSyncStatus.Failed,
                message: `${validationError.error}`
              };
            }
@@ -493,7 +486,7 @@ export const pkiSyncQueueFactory = ({
              postSyncUpdates[updateIndex] = {
                pkiSyncId: pkiSync.id,
                certificateId: metadata.id,
-                status: "failed",
+                status: CertificateSyncStatus.Failed,
                message: `Failed to sync certificate: ${failure.error}`
              };
            }
@@ -699,7 +692,10 @@ export const pkiSyncQueueFactory = ({
        Object.keys(certificateMap),
        {
          appConnectionDAL,
-          kmsService
+          kmsService,
+          certificateSyncDAL,
+          certificateDAL,
+          certificateMap
        }
      );

--- a/backend/src/services/pki-sync/pki-sync-service.ts
+++ b/backend/src/services/pki-sync/pki-sync-service.ts
@@ -610,6 +610,10 @@ export const pkiSyncServiceFactory = ({
      certificateStatus: detail.certificateStatus || undefined,
      certificateNotBefore: detail.certificateNotBefore || undefined,
      certificateNotAfter: detail.certificateNotAfter || undefined,
+      certificateRenewBeforeDays: !detail.certificateRenewedByCertificateId
+        ? detail.certificateRenewBeforeDays
+        : undefined,
+      certificateRenewalError: detail.certificateRenewalError || undefined,
      pkiSyncName: detail.pkiSyncName || undefined,
      pkiSyncDestination: detail.pkiSyncDestination || undefined
    }));
--- a/backend/src/services/pki-sync/pki-sync-types.ts
+++ b/backend/src/services/pki-sync/pki-sync-types.ts
@@ -73,7 +73,7 @@ export type TPkiSyncListItem = TPkiSync & {

 export type TCertificateMap = Record<
  string,
-  { cert: string; privateKey: string; certificateChain?: string; alternativeNames?: string[] }
+  { cert: string; privateKey: string; certificateChain?: string; alternativeNames?: string[]; certificateId?: string }
 >;

 export type TCreatePkiSyncDTO = {
@@ -176,6 +176,8 @@ export type TPkiSyncCertificate = {
  certificateStatus?: string;
  certificateNotBefore?: Date;
  certificateNotAfter?: Date;
+  certificateRenewBeforeDays?: number;
+  certificateRenewalError?: string;
  pkiSyncName?: string;
  pkiSyncDestination?: string;
 };
--- a/backend/src/services/pki-sync/pki-sync-utils.ts
+++ b/backend/src/services/pki-sync/pki-sync-utils.ts
@@ -59,7 +59,7 @@ export const triggerAutoSyncForCertificate = async (
  }
 };

-export const replaceCertificateInSyncs = async (
+export const addRenewedCertificateToSyncs = async (
  oldCertificateId: string,
  newCertificateId: string,
  dependencies: {
@@ -77,18 +77,15 @@ export const replaceCertificateInSyncs = async (
      return;
    }

-    const replacementPromises = pkiSyncIds.map(async (pkiSyncId) => {
-      await dependencies.certificateSyncDAL.removeCertificates(pkiSyncId, [oldCertificateId], tx);
+    const addPromises = pkiSyncIds.map(async (pkiSyncId) => {
      await dependencies.certificateSyncDAL.addCertificates(pkiSyncId, [newCertificateId], tx);
    });

-    await Promise.all(replacementPromises);
+    await Promise.all(addPromises);

-    logger.info(
-      `Successfully replaced certificate ${oldCertificateId} with ${newCertificateId} in ${pkiSyncIds.length} PKI sync(s)`
-    );
+    logger.info(`Successfully added renewed certificate ${newCertificateId} to ${pkiSyncIds.length} PKI sync(s)`);
  } catch (error) {
-    logger.error(error, `Failed to replace certificate ${oldCertificateId} with ${newCertificateId} in syncs:`);
+    logger.error(error, `Failed to add renewed certificate ${newCertificateId} to syncs:`);
    throw error;
  }
 };
--- a/frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx
+++ b/frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx
@@ -71,14 +71,14 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
              isChecked={value}
            >
              <p>
-                Enable Certificate Removal{" "}
+                Enable Inactive Certificate Removal{" "}
                <Tooltip
                  className="max-w-md"
                  content={
                    <>
                      <p>
                        When enabled, Infisical will remove certificates from the destination during
-                        a sync if they are no longer managed by Infisical.
+                        a sync if they are no longer active in Infisical.
                      </p>
                      <p className="mt-4">
                        Disable this option if you intend to manage some certificates manually
--- a/frontend/src/hooks/api/pkiSyncs/types/common.ts
+++ b/frontend/src/hooks/api/pkiSyncs/types/common.ts
@@ -61,6 +61,8 @@ export type TPkiSyncCertificate = {
  certificateStatus?: string;
  certificateNotBefore?: Date;
  certificateNotAfter?: Date;
+  certificateRenewBeforeDays?: number;
+  certificateRenewalError?: string;
  pkiSyncName?: string;
  pkiSyncDestination?: string;
 };
--- a/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncCertificatesSection.tsx
+++ b/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncCertificatesSection.tsx
@@ -1,6 +1,11 @@
 import { useState } from "react";
 import { subject } from "@casl/ability";
-import { faCertificate, faEdit, faTrash } from "@fortawesome/free-solid-svg-icons";
+import {
+  faCertificate,
+  faClockRotateLeft,
+  faEdit,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";

 import { createNotification } from "@app/components/notifications";
@@ -49,6 +54,18 @@ const getSyncStatusText = (status?: CertificateSyncStatus | null) => {
  return "Unknown";
 };

+const getCertificateStatusVariant = (isExpired: boolean, isRevoked: boolean) => {
+  if (isRevoked) return "danger";
+  if (isExpired) return "danger";
+  return "success";
+};
+
+const getCertificateStatusText = (isExpired: boolean, isRevoked: boolean) => {
+  if (isRevoked) return "Revoked";
+  if (isExpired) return "Expired";
+  return "Active";
+};
+
 export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
  const [isManageModalOpen, setIsManageModalOpen] = useState(false);
  const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
@@ -128,11 +145,12 @@ export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
              <Table>
                <THead>
                  <Tr>
-                    <Th className="w-1/3">SAN / CN</Th>
-                    <Th className="w-1/3">Serial Number</Th>
-                    <Th className="w-1/9">Status</Th>
-                    <Th className="w-1/9">Expires</Th>
-                    <Th className="w-1/9">Actions</Th>
+                    <Th className="w-3/8">SAN / CN</Th>
+                    <Th className="w-1/8">Status</Th>
+                    <Th className="w-1/8">Serial Number</Th>
+                    <Th className="w-1/8">Sync Status</Th>
+                    <Th className="w-1/8">Expires At</Th>
+                    <Th className="w-1/8" />
                  </Tr>
                </THead>
                <TBody>
@@ -140,6 +158,29 @@ export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
                    const isExpired = syncCert.certificateNotAfter
                      ? new Date(syncCert.certificateNotAfter) < new Date()
                      : false;
+                    const isRevoked = syncCert.certificateStatus === "revoked";
+
+                    // Calculate auto-renewal timeline
+                    const hasAutoRenewal = Boolean(
+                      syncCert.certificateRenewBeforeDays &&
+                        syncCert.certificateRenewBeforeDays > 0 &&
+                        !syncCert.certificateRenewalError &&
+                        syncCert.certificateNotAfter
+                    );
+
+                    const daysUntilRenewal =
+                      hasAutoRenewal && syncCert.certificateNotAfter
+                        ? (() => {
+                            const expiryDate = new Date(syncCert.certificateNotAfter);
+                            const renewalDate = new Date(
+                              expiryDate.getTime() -
+                                syncCert.certificateRenewBeforeDays! * 24 * 60 * 60 * 1000
+                            );
+                            const now = new Date();
+                            const diffInMs = renewalDate.getTime() - now.getTime();
+                            return Math.max(0, Math.ceil(diffInMs / (24 * 60 * 60 * 1000)));
+                          })()
+                        : null;

                    const { originalDisplayName } = getCertificateDisplayName(
                      {
@@ -162,12 +203,22 @@ export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
                            fallback="Unknown"
                          />
                        </Td>
+                        <Td>
+                          <Badge variant={getCertificateStatusVariant(isExpired, isRevoked)}>
+                            {getCertificateStatusText(isExpired, isRevoked)}
+                          </Badge>
+                        </Td>
                        <Td className="max-w-0">
                          <div
                            className="truncate text-xs"
                            title={syncCert.certificateSerialNumber || "Unknown"}
                          >
-                            {syncCert.certificateSerialNumber || "Unknown"}
+                            {(() => {
+                              const serial = syncCert.certificateSerialNumber;
+                              if (!serial || serial === "Unknown") return "Unknown";
+                              if (serial.length <= 8) return serial;
+                              return `${serial.substring(0, 4)}...${serial.substring(serial.length - 4)}`;
+                            })()}
                          </div>
                        </Td>
                        <Td>
@@ -191,7 +242,14 @@ export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
                              : "Unknown"}
                          </span>
                        </Td>
-                        <Td className="flex items-center">
+                        <Td className="flex items-center justify-end gap-2 pr-4">
+                          {hasAutoRenewal && daysUntilRenewal !== null && (
+                            <Tooltip content={`Auto-renews in ${daysUntilRenewal}d`}>
+                              <div className="text-primary-500">
+                                <FontAwesomeIcon icon={faClockRotateLeft} size="sm" />
+                              </div>
+                            </Tooltip>
+                          )}
                          <ProjectPermissionCan
                            I={ProjectPermissionPkiSyncActions.Edit}
                            a={permissionSubject}
--- a/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncOptionsSection/PkiSyncOptionsSection.tsx
+++ b/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncOptionsSection/PkiSyncOptionsSection.tsx
@@ -65,7 +65,7 @@ export const PkiSyncOptionsSection = ({ pkiSync, onEditOptions }: Props) => {
              </Badge>
            </GenericFieldLabel>
            */}
-          <GenericFieldLabel label="Certificate Removal" labelClassName="mb-1">
+          <GenericFieldLabel label="Inactive Certificate Removal" labelClassName="mb-1">
            <Badge variant={canRemoveCertificates ? "success" : "danger"}>
              {canRemoveCertificates ? "Enabled" : "Disabled"}
            </Badge>