From de2c1c556018d608a3b430bace73dc06f861d6d5 Mon Sep 17 00:00:00 2001
From: Julius Mieliauskas <julius.mieliauskas@gmail.com>
Date: Thu, 31 Jul 2025 23:51:07 +0300
Subject: [PATCH] removed TLD requirement from SAN extension dns field

---
 .../certificate-authority-validators.ts          |  4 ++--
 .../internal-certificate-authority-fns.ts        | 16 ++++++++--------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/backend/src/services/certificate-authority/certificate-authority-validators.ts b/backend/src/services/certificate-authority/certificate-authority-validators.ts
index 3a1be7cdf..3fa7e8d5e 100644
--- a/backend/src/services/certificate-authority/certificate-authority-validators.ts
+++ b/backend/src/services/certificate-authority/certificate-authority-validators.ts
@@ -16,7 +16,7 @@ export const validateAltNameField = z
   .refine(
     (name) => {
       return (
-        isFQDN(name, { allow_wildcard: true }) ||
+        isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
         z.string().url().safeParse(name).success ||
         z.string().email().safeParse(name).success ||
         isValidIp(name)
@@ -45,7 +45,7 @@ export const validateAltNamesField = z
       // Split and validate each alt name
       return data.split(", ").every((name) => {
         return (
-          isFQDN(name, { allow_wildcard: true }) ||
+          isFQDN(name, { allow_wildcard: true, require_tld: false }) ||
           z.string().url().safeParse(name).success ||
           z.string().email().safeParse(name).success ||
           isValidIp(name)
diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
index 086737d85..eace4e47a 100644
--- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
+++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
@@ -160,6 +160,10 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "email", value: altName };
         }
 
+        if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
+          return { type: "dns", value: altName };
+        }
+
         if (z.string().url().safeParse(altName).success) {
           return { type: "url", value: altName };
         }
@@ -168,10 +172,6 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "ip", value: altName };
         }
 
-        if (isFQDN(altName, { allow_wildcard: true })) {
-          return { type: "dns", value: altName };
-        }
-
         throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
       });
 
@@ -434,6 +434,10 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "email", value: altName };
         }
 
+        if (isFQDN(altName, { allow_wildcard: true, require_tld: false })) {
+          return { type: "dns", value: altName };
+        }
+
         if (z.string().url().safeParse(altName).success) {
           return { type: "url", value: altName };
         }
@@ -442,10 +446,6 @@ export const InternalCertificateAuthorityFns = ({
           return { type: "ip", value: altName };
         }
 
-        if (isFQDN(altName, { allow_wildcard: true })) {
-          return { type: "dns", value: altName };
-        }
-
         throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
       });