From d341dd0fb75987dc0890b7ae68469fe9251aff80 Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Tue, 18 Nov 2025 16:59:06 -0800
Subject: [PATCH] Return existing even if `onlyReturnExisting` is not set to
 ture while creating the new one

---
 .../ee/services/pki-acme/pki-acme-service.ts  | 26 ++++++++++++++-----
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/backend/src/ee/services/pki-acme/pki-acme-service.ts b/backend/src/ee/services/pki-acme/pki-acme-service.ts
index 71a2383b6..1d724495f 100644
--- a/backend/src/ee/services/pki-acme/pki-acme-service.ts
+++ b/backend/src/ee/services/pki-acme/pki-acme-service.ts
@@ -291,6 +291,7 @@ export const pkiAcmeServiceFactory = ({
       url,
       rawJwsPayload,
       getJWK: async (protectedHeader) => {
+        // get jwk instead of kid
         if (!protectedHeader.kid) {
           throw new AcmeMalformedError({ message: "KID is required in the protected header" });
         }
@@ -394,16 +395,15 @@ export const pkiAcmeServiceFactory = ({
     const profile = await validateAcmeProfile(profileId);
     const publicKeyThumbprint = await calculateJwkThumbprint(jwk, "sha256");
 
+    const existingAccount: TPkiAcmeAccounts | null = await acmeAccountDAL.findByProfileIdAndPublicKeyThumbprintAndAlg(
+      profileId,
+      alg,
+      publicKeyThumbprint
+    );
     if (onlyReturnExisting) {
-      const existingAccount: TPkiAcmeAccounts | null = await acmeAccountDAL.findByProfileIdAndPublicKeyThumbprintAndAlg(
-        profileId,
-        alg,
-        publicKeyThumbprint
-      );
       if (!existingAccount) {
         throw new AcmeAccountDoesNotExistError({ message: "ACME account not found" });
       }
-      // With the same public key, we found an existing account, just return it
       return {
         status: 200,
         body: {
@@ -433,6 +433,20 @@ export const pkiAcmeServiceFactory = ({
     if (!externalAccountBinding) {
       throw new AcmeExternalAccountRequiredError({ message: "External account binding is required" });
     }
+    if (existingAccount) {
+      return {
+        status: 200,
+        body: {
+          status: "valid",
+          contact: existingAccount.emails,
+          orders: buildUrl(profile.id, `/accounts/${existingAccount.id}/orders`)
+        },
+        headers: {
+          Location: buildUrl(profile.id, `/accounts/${existingAccount.id}`),
+          Link: `<${buildUrl(profile.id, "/directory")}>;rel="index"`
+        }
+      };
+    }
 
     const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
       projectId: profile.projectId,