From d2c8904e8fbcd8dd741c402c59a494d49ee9d2e3 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Fri, 7 Nov 2025 09:16:27 -0800
Subject: [PATCH] Address review feedbacks

---
 backend/src/ee/services/pki-acme/pki-acme-errors.ts  |  6 +++---
 backend/src/ee/services/pki-acme/pki-acme-service.ts | 11 +++++++----
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/backend/src/ee/services/pki-acme/pki-acme-errors.ts b/backend/src/ee/services/pki-acme/pki-acme-errors.ts
index 5872addae..febce5e81 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-errors.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-errors.ts
@@ -14,13 +14,13 @@ export enum AcmeErrorType {
   BadPublicKey = "badPublicKey",
   BadRevocationReason = "badRevocationReason",
   BadSignatureAlgorithm = "badSignatureAlgorithm",
-  CAA = "CAA",
+  CAA = "caa",
   Compound = "compound",
   Connection = "connection",
-  DNS = "DNS",
+  DNS = "dns",
   ExternalAccountRequired = "externalAccountRequired",
   IncorrectResponse = "incorrectResponse",
-  IncorrectContact = "incorrectContact",
+  InvalidContact = "invalidContact",
   Malformed = "malformed",
   OrderNotReady = "orderNotReady",
   RateLimited = "rateLimited",
diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 4f4eb93ad..e3a82000d 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -614,10 +614,13 @@ export const pkiAcmeServiceFactory = ({
             csr,
             notBefore: finalizingOrder.notBefore ? new Date(finalizingOrder.notBefore) : undefined,
             notAfter: finalizingOrder.notAfter ? new Date(finalizingOrder.notAfter) : undefined,
-            validity: {
-              // TODO: read config from the profile to get the expiration time instead
-              ttl: (24 * 60 * 60 * 1000).toString()
-            },
+            validity: !finalizingOrder.notAfter
+              ? {
+                  // TODO: read config from the profile to get the expiration time instead
+                  ttl: (24 * 60 * 60 * 1000).toString()
+                }
+              : // ttl is not used if notAfter is provided
+                ({ ttl: "0" } as const),
             enrollmentType: EnrollmentType.ACME
           });
           // TODO: associate the certificate with the order