PKI syncs: fixes and add includeRootCa to PKI cert issuance endpoints

2026-09-22 13:39:35 +00:00 · 2025-11-20 15:23:38 -03:00
parent b46313ed5a
commit e0c6f48808
20 changed files with 124 additions and 31 deletions
--- a/backend/src/server/routes/v3/certificates-router.ts
+++ b/backend/src/server/routes/v3/certificates-router.ts
@@ -23,6 +23,8 @@ import { mapEnumsForValidation } from "@app/services/certificate-common/certific
 import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";

+import { booleanSchema } from "../sanitizedSchemas";
+
 interface CertificateRequestForService {
  commonName?: string;
  keyUsages?: CertKeyUsageType[];
@@ -87,7 +89,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
            )
            .optional(),
          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm),
-          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
+          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm),
+          removeRootsFromChain: booleanSchema.default(false).optional()
        })
        .refine(validateTtlAndDateFields, {
          message:
@@ -131,7 +134,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
        actorAuthMethod: req.permission.authMethod,
        actorOrgId: req.permission.orgId,
        profileId: req.body.profileId,
-        certificateRequest: mappedCertificateRequest
+        certificateRequest: mappedCertificateRequest,
+        removeRootsFromChain: req.body.removeRootsFromChain
      });

      await server.services.auditLog.createAuditLog({
@@ -171,7 +175,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
            .min(1, "TTL cannot be empty")
            .refine((val) => ms(val) > 0, "TTL must be a positive number"),
          notBefore: validateCaDateField.optional(),
-          notAfter: validateCaDateField.optional()
+          notAfter: validateCaDateField.optional(),
+          removeRootsFromChain: booleanSchema.default(false).optional()
        })
        .refine(validateTtlAndDateFields, {
          message:
@@ -206,7 +211,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
        },
        notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
        notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-        enrollmentType: EnrollmentType.API
+        enrollmentType: EnrollmentType.API,
+        removeRootsFromChain: req.body.removeRootsFromChain
      });

      await server.services.auditLog.createAuditLog({
@@ -262,7 +268,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
          notAfter: validateCaDateField.optional(),
          commonName: validateTemplateRegexField.optional(),
          signatureAlgorithm: z.nativeEnum(CertSignatureAlgorithm),
-          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
+          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm),
+          removeRootsFromChain: booleanSchema.default(false).optional()
        })
        .refine(validateTtlAndDateFields, {
          message:
@@ -325,7 +332,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
          notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
          signatureAlgorithm: req.body.signatureAlgorithm,
          keyAlgorithm: req.body.keyAlgorithm
-        }
+        },
+        removeRootsFromChain: req.body.removeRootsFromChain
      });

      await server.services.auditLog.createAuditLog({
@@ -357,6 +365,11 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
      params: z.object({
        certificateId: z.string().uuid()
      }),
+      body: z
+        .object({
+          removeRootsFromChain: booleanSchema.default(false).optional()
+        })
+        .optional(),
      response: {
        200: z.object({
          certificate: z.string().trim(),
@@ -375,7 +388,8 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
        actorId: req.permission.id,
        actorAuthMethod: req.permission.authMethod,
        actorOrgId: req.permission.orgId,
-        certificateId: req.params.certificateId
+        certificateId: req.params.certificateId,
+        removeRootsFromChain: req.body?.removeRootsFromChain
      });

      await server.services.auditLog.createAuditLog({
--- a/backend/src/services/certificate-v3/certificate-v3-service.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-service.ts
@@ -47,7 +47,8 @@ import {
  convertKeyUsageArrayFromLegacy,
  convertKeyUsageArrayToLegacy,
  mapEnumsForValidation,
-  normalizeDateForApi
+  normalizeDateForApi,
+  removeRootCaFromChain
 } from "../certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
 import { TPkiSyncDALFactory } from "../pki-sync/pki-sync-dal";
@@ -366,7 +367,8 @@ export const certificateV3ServiceFactory = ({
    actor,
    actorId,
    actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    removeRootsFromChain
  }: TIssueCertificateFromProfileDTO): Promise<TCertificateFromProfileResponse> => {
    const profile = await validateProfileAndPermissions(
      profileId,
@@ -480,10 +482,15 @@ export const certificateV3ServiceFactory = ({
      renewBeforeDays: finalRenewBeforeDays
    });

+    let finalCertificateChain = bufferToString(certificateChain);
+    if (removeRootsFromChain) {
+      finalCertificateChain = removeRootCaFromChain(finalCertificateChain);
+    }
+
    return {
      certificate: bufferToString(certificate),
      issuingCaCertificate: bufferToString(issuingCaCertificate),
-      certificateChain: bufferToString(certificateChain),
+      certificateChain: finalCertificateChain,
      privateKey: bufferToString(privateKey),
      serialNumber,
      certificateId: cert.id,
@@ -503,7 +510,8 @@ export const certificateV3ServiceFactory = ({
    actorId,
    actorAuthMethod,
    actorOrgId,
-    enrollmentType
+    enrollmentType,
+    removeRootsFromChain
  }: TSignCertificateFromProfileDTO): Promise<Omit<TCertificateFromProfileResponse, "privateKey">> => {
    const profile = await validateProfileAndPermissions(
      profileId,
@@ -590,7 +598,10 @@ export const certificateV3ServiceFactory = ({
    });

    const certificateString = extractCertificateFromBuffer(certificate as unknown as Buffer);
-    const certificateChainString = extractCertificateFromBuffer(certificateChain as unknown as Buffer);
+    let certificateChainString = extractCertificateFromBuffer(certificateChain as unknown as Buffer);
+    if (removeRootsFromChain) {
+      certificateChainString = removeRootCaFromChain(certificateChainString);
+    }

    return {
      certificate: certificateString,
@@ -610,7 +621,8 @@ export const certificateV3ServiceFactory = ({
    actor,
    actorId,
    actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    removeRootsFromChain
  }: TOrderCertificateFromProfileDTO): Promise<TCertificateOrderResponse> => {
    const profile = await validateProfileAndPermissions(
      profileId,
@@ -665,7 +677,8 @@ export const certificateV3ServiceFactory = ({
        actor,
        actorId,
        actorAuthMethod,
-        actorOrgId
+        actorOrgId,
+        removeRootsFromChain
      });

      const orderId = randomUUID();
@@ -703,7 +716,8 @@ export const certificateV3ServiceFactory = ({
    actorId,
    actorAuthMethod,
    actorOrgId,
-    internal = false
+    internal = false,
+    removeRootsFromChain
  }: TRenewCertificateDTO & { internal?: boolean }): Promise<TCertificateFromProfileResponse> => {
    const renewalResult = await certificateDAL.transaction(async (tx) => {
      const originalCert = await certificateDAL.findById(certificateId, tx);
@@ -929,10 +943,14 @@ export const certificateV3ServiceFactory = ({
      pkiSyncQueue
    });

+    let finalCertificateChain = renewalResult.certificateChain;
+    if (removeRootsFromChain) {
+      finalCertificateChain = removeRootCaFromChain(finalCertificateChain);
+    }
    return {
      certificate: renewalResult.certificate,
      issuingCaCertificate: renewalResult.issuingCaCertificate,
-      certificateChain: renewalResult.certificateChain,
+      certificateChain: finalCertificateChain,
      serialNumber: renewalResult.serialNumber,
      certificateId: renewalResult.newCert.id,
      projectId: renewalResult.profile.projectId,
--- a/backend/src/services/certificate-v3/certificate-v3-types.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-types.ts
@@ -26,6 +26,7 @@ export type TIssueCertificateFromProfileDTO = {
    signatureAlgorithm?: string;
    keyAlgorithm?: string;
  };
+  removeRootsFromChain?: boolean;
 } & Omit<TProjectPermission, "projectId">;

 export type TSignCertificateFromProfileDTO = {
@@ -37,6 +38,7 @@ export type TSignCertificateFromProfileDTO = {
  notBefore?: Date;
  notAfter?: Date;
  enrollmentType: EnrollmentType;
+  removeRootsFromChain?: boolean;
 } & Omit<TProjectPermission, "projectId">;

 export type TOrderCertificateFromProfileDTO = {
@@ -57,6 +59,7 @@ export type TOrderCertificateFromProfileDTO = {
    signatureAlgorithm?: string;
    keyAlgorithm?: string;
  };
+  removeRootsFromChain?: boolean;
 } & Omit<TProjectPermission, "projectId">;

 export type TCertificateFromProfileResponse = {
@@ -101,6 +104,7 @@ export type TCertificateOrderResponse = {

 export type TRenewCertificateDTO = {
  certificateId: string;
+  removeRootsFromChain?: boolean;
 } & Omit<TProjectPermission, "projectId">;

 export type TUpdateRenewalConfigDTO = {
--- a/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-schemas.ts
@@ -14,6 +14,7 @@ export const AwsCertificateManagerPkiSyncConfigSchema = z.object({
 const AwsCertificateManagerPkiSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  preserveArn: z.boolean().default(true),
  certificateNameSchema: z
    .string()
--- a/backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-fns.ts
@@ -17,7 +17,6 @@ import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
 import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -263,10 +262,7 @@ export const awsSecretsManagerPkiSyncFactory = ({
      };

      if (certificateChain && certificateChain.trim().length > 0) {
-        const processedCertificateChain = removeRootCaFromChain(certificateChain);
-        if (processedCertificateChain.trim().length > 0) {
-          certificateData[fieldMappings.certificateChain] = processedCertificateChain;
-        }
+        certificateData[fieldMappings.certificateChain] = certificateChain;
      }

      if (caCertificate && typeof caCertificate === "string" && caCertificate.trim().length > 0) {
@@ -307,6 +303,7 @@ export const awsSecretsManagerPkiSyncFactory = ({
          } else if (certificate?.renewedFromCertificateId && !preserveSecretOnRenewal) {
            activeExternalIdentifiers.add(existingRecord.externalIdentifier);
          } else if (!certificate?.renewedFromCertificateId) {
+            activeExternalIdentifiers.add(existingRecord.externalIdentifier);
            shouldProcess = false;
          }
        }
--- a/backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-schemas.ts
@@ -22,6 +22,7 @@ export const AwsSecretsManagerFieldMappingsSchema = z.object({
 const AwsSecretsManagerPkiSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  preserveSecretOnRenewal: z.boolean().default(true),
  updateExistingCertificates: z.boolean().default(true),
  certificateNameSchema: z
--- a/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts
@@ -14,6 +14,7 @@ export const AzureKeyVaultPkiSyncConfigSchema = z.object({
 const AzureKeyVaultPkiSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  enableVersioning: z.boolean().default(true),
  certificateNameSchema: z
    .string()
--- a/backend/src/services/pki-sync/chef/chef-pki-sync-fns.ts
+++ b/backend/src/services/pki-sync/chef/chef-pki-sync-fns.ts
@@ -10,7 +10,6 @@ import {
 import { TChefDataBagItemContent } from "@app/ee/services/secret-sync/chef";
 import { logger } from "@app/lib/logger";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -265,13 +264,11 @@ export const chefPkiSyncFactory = ({ certificateDAL, certificateSyncDAL }: TChef
      } = certificateData;

      try {
-        const processedCertificateChain = certificateChain ? removeRootCaFromChain(certificateChain) : undefined;
-
        const chefDataBagItem: ChefCertificateDataBagItem = {
          id: targetItemName,
          [fieldMappings.certificate]: cert,
          [fieldMappings.privateKey]: certPrivateKey,
-          ...(processedCertificateChain && { [fieldMappings.certificateChain]: processedCertificateChain }),
+          ...(certificateChain && { [fieldMappings.certificateChain]: certificateChain }),
          ...(caCertificate && { [fieldMappings.caCertificate]: caCertificate })
        };

--- a/backend/src/services/pki-sync/chef/chef-pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/chef/chef-pki-sync-schemas.ts
@@ -29,6 +29,7 @@ const ChefFieldMappingsSchema = z.object({
 const ChefPkiSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  preserveItemOnRenewal: z.boolean().default(true),
  updateExistingCertificates: z.boolean().default(true),
  certificateNameSchema: z
--- a/backend/src/services/pki-sync/pki-sync-queue.ts
+++ b/backend/src/services/pki-sync/pki-sync-queue.ts
@@ -26,7 +26,7 @@ import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-
 import { TCertificateAuthorityCertDALFactory } from "../certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
 import { getCaCertChain } from "../certificate-authority/certificate-authority-fns";
-import { extractRootCaFromChain } from "../certificate-common/certificate-utils";
+import { extractRootCaFromChain, removeRootCaFromChain } from "../certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "../certificate-sync/certificate-sync-enums";
 import { TPkiSyncDALFactory } from "./pki-sync-dal";
@@ -269,7 +269,12 @@ export const pkiSyncQueueFactory = ({
            }

            let certificateName: string;
-            const syncOptions = pkiSync.syncOptions as { certificateNameSchema?: string } | undefined;
+            const syncOptions = pkiSync.syncOptions as
+              | {
+                  certificateNameSchema?: string;
+                  includeRootCa?: boolean;
+                }
+              | undefined;
            const certificateNameSchema = syncOptions?.certificateNameSchema;

            if (certificateNameSchema) {
@@ -301,10 +306,15 @@ export const pkiSyncQueueFactory = ({
              alternativeNames.push(originalLegacyName);
            }

+            let processedCertificateChain = certificateChain;
+            if (certificateChain && syncOptions?.includeRootCa === false) {
+              processedCertificateChain = removeRootCaFromChain(certificateChain);
+            }
+
            certificateMap[certificateName] = {
              cert: certificatePem,
              privateKey: certPrivateKey || "",
-              certificateChain,
+              certificateChain: processedCertificateChain,
              caCertificate,
              alternativeNames,
              certificateId: certificate.id
--- a/backend/src/services/pki-sync/pki-sync-schemas.ts
+++ b/backend/src/services/pki-sync/pki-sync-schemas.ts
@@ -7,6 +7,7 @@ import { PkiSync } from "./pki-sync-enums";
 export const PkiSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean(),
  canRemoveCertificates: z.boolean().optional(),
+  includeRootCa: z.boolean().optional().default(false),
  certificateNameSchema: z
    .string()
    .optional()
--- a/frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx
+++ b/frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx
@@ -95,6 +95,48 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
        )}
      />

+      <Controller
+        control={control}
+        name="syncOptions.includeRootCa"
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl isError={Boolean(error)} errorText={error?.message}>
+            <Switch
+              className="bg-mineshaft-400/80 shadow-inner data-[state=checked]:bg-green/80"
+              id="include-root-ca"
+              thumbClassName="bg-mineshaft-800"
+              onCheckedChange={onChange}
+              isChecked={value}
+            >
+              <p>
+                Include Root CA in Certificate Chain{" "}
+                <Tooltip
+                  className="max-w-md"
+                  content={
+                    <>
+                      <p>
+                        When enabled, the full certificate chain including the root CA will be
+                        synced to the destination.
+                      </p>
+                      <p className="mt-4">
+                        When disabled, the root CA will be excluded from the certificate chain
+                        during sync operations, reducing the size of the synced certificate chain.
+                      </p>
+                      <p className="mt-4">
+                        Most applications and services work correctly with intermediate certificates
+                        only, as they can validate the trust chain up to a root CA they already
+                        trust.
+                      </p>
+                    </>
+                  }
+                >
+                  <FontAwesomeIcon icon={faQuestionCircle} size="sm" className="ml-1" />
+                </Tooltip>
+              </p>
+            </Switch>
+          </FormControl>
+        )}
+      />
+
      {currentDestination === PkiSync.AwsCertificateManager && (
        <Controller
          control={control}
--- a/frontend/src/components/pki-syncs/forms/schemas/aws-certificate-manager-pki-sync-destination-schema.ts
+++ b/frontend/src/components/pki-syncs/forms/schemas/aws-certificate-manager-pki-sync-destination-schema.ts
@@ -7,6 +7,7 @@ import { BasePkiSyncSchema } from "./base-pki-sync-schema";
 const AwsCertificateManagerSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(false),
+  includeRootCa: z.boolean().default(false),
  preserveArn: z.boolean().default(true),
  certificateNameSchema: z
    .string()
--- a/frontend/src/components/pki-syncs/forms/schemas/aws-secrets-manager-pki-sync-destination-schema.ts
+++ b/frontend/src/components/pki-syncs/forms/schemas/aws-secrets-manager-pki-sync-destination-schema.ts
@@ -20,6 +20,7 @@ const AwsSecretsManagerFieldMappingsSchema = z.object({
 const AwsSecretsManagerSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  preserveSecretOnRenewal: z.boolean().default(true),
  updateExistingCertificates: z.boolean().default(true),
  certificateNameSchema: z
--- a/frontend/src/components/pki-syncs/forms/schemas/azure-key-vault-pki-sync-destination-schema.ts
+++ b/frontend/src/components/pki-syncs/forms/schemas/azure-key-vault-pki-sync-destination-schema.ts
@@ -7,6 +7,7 @@ import { BasePkiSyncSchema } from "./base-pki-sync-schema";
 const AzureKeyVaultSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  enableVersioning: z.boolean().default(true),
  certificateNameSchema: z
    .string()
--- a/frontend/src/components/pki-syncs/forms/schemas/base-pki-sync-schema.ts
+++ b/frontend/src/components/pki-syncs/forms/schemas/base-pki-sync-schema.ts
@@ -6,6 +6,7 @@ export const BasePkiSyncSchema = <T extends AnyZodObject | undefined = undefined
  const baseSyncOptionsSchema = z.object({
    canImportCertificates: z.boolean().default(false),
    canRemoveCertificates: z.boolean().default(false),
+    includeRootCa: z.boolean().default(false),
    certificateNameSchema: z
      .string()
      .optional()
--- a/frontend/src/components/pki-syncs/forms/schemas/chef-pki-sync-destination-schema.ts
+++ b/frontend/src/components/pki-syncs/forms/schemas/chef-pki-sync-destination-schema.ts
@@ -20,6 +20,7 @@ const ChefFieldMappingsSchema = z.object({
 const ChefSyncOptionsSchema = z.object({
  canImportCertificates: z.boolean().default(false),
  canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
  preserveItemOnRenewal: z.boolean().default(true),
  updateExistingCertificates: z.boolean().default(true),
  certificateNameSchema: z
--- a/frontend/src/hooks/api/pkiSyncs/enums.ts
+++ b/frontend/src/hooks/api/pkiSyncs/enums.ts
@@ -14,7 +14,7 @@ export enum PkiSyncStatus {

 export enum CertificateSyncStatus {
  Pending = "pending",
-  Syncing = "syncing",
+  Running = "running",
  Succeeded = "succeeded",
  Failed = "failed"
 }
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
@@ -354,6 +354,7 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
            <div>
              <h4 className="text-sm font-medium text-mineshaft-300">Certificate Details</h4>
              <p className="text-sm text-mineshaft-400">Serial Number: {cert.serialNumber}</p>
+              <p className="text-sm text-mineshaft-400">Certificate Id: {cert.id}</p>
              <p className="text-sm text-mineshaft-400">Common Name: {cert.commonName}</p>
              <p className="text-sm text-mineshaft-400">Status: {cert.status}</p>
            </div>
--- a/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncCertificatesSection.tsx
+++ b/frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncCertificatesSection.tsx
@@ -42,14 +42,14 @@ type Props = {
 const getSyncStatusVariant = (status?: CertificateSyncStatus | null) => {
  if (status === CertificateSyncStatus.Succeeded) return "success";
  if (status === CertificateSyncStatus.Failed) return "danger";
-  if (status === CertificateSyncStatus.Syncing) return "neutral";
+  if (status === CertificateSyncStatus.Running) return "neutral";
  return "project";
 };

 const getSyncStatusText = (status?: CertificateSyncStatus | null) => {
  if (status === CertificateSyncStatus.Succeeded) return "Synced";
  if (status === CertificateSyncStatus.Failed) return "Failed";
-  if (status === CertificateSyncStatus.Syncing) return "Syncing";
+  if (status === CertificateSyncStatus.Running) return "Syncing";
  if (status === CertificateSyncStatus.Pending) return "Pending";
  return "Unknown";
 };