PKI syncs: fixes and add includeRootCa to PKI cert issuance endpoints

backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-schemas.ts

@@ -14,6 +14,7 @@ export const AwsCertificateManagerPkiSyncConfigSchema = z.object({
 const AwsCertificateManagerPkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
   preserveArn: z.boolean().default(true),
   certificateNameSchema: z
     .string()

backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-fns.ts

@@ -17,7 +17,6 @@ import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
 import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
 import { TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -263,10 +262,7 @@ export const awsSecretsManagerPkiSyncFactory = ({
       };
 
       if (certificateChain && certificateChain.trim().length > 0) {
-        const processedCertificateChain = removeRootCaFromChain(certificateChain);
-        if (processedCertificateChain.trim().length > 0) {
-          certificateData[fieldMappings.certificateChain] = processedCertificateChain;
-        }
+        certificateData[fieldMappings.certificateChain] = certificateChain;
       }
 
       if (caCertificate && typeof caCertificate === "string" && caCertificate.trim().length > 0) {
@@ -307,6 +303,7 @@ export const awsSecretsManagerPkiSyncFactory = ({
           } else if (certificate?.renewedFromCertificateId && !preserveSecretOnRenewal) {
             activeExternalIdentifiers.add(existingRecord.externalIdentifier);
           } else if (!certificate?.renewedFromCertificateId) {
+            activeExternalIdentifiers.add(existingRecord.externalIdentifier);
             shouldProcess = false;
           }
         }

backend/src/services/pki-sync/aws-secrets-manager/aws-secrets-manager-pki-sync-schemas.ts

@@ -22,6 +22,7 @@ export const AwsSecretsManagerFieldMappingsSchema = z.object({
 const AwsSecretsManagerPkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
   preserveSecretOnRenewal: z.boolean().default(true),
   updateExistingCertificates: z.boolean().default(true),
   certificateNameSchema: z

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts

@@ -14,6 +14,7 @@ export const AzureKeyVaultPkiSyncConfigSchema = z.object({
 const AzureKeyVaultPkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
   enableVersioning: z.boolean().default(true),
   certificateNameSchema: z
     .string()

backend/src/services/pki-sync/chef/chef-pki-sync-fns.ts

@@ -10,7 +10,6 @@ import {
 import { TChefDataBagItemContent } from "@app/ee/services/secret-sync/chef";
 import { logger } from "@app/lib/logger";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { removeRootCaFromChain } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "@app/services/certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "@app/services/certificate-sync/certificate-sync-enums";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
@@ -265,13 +264,11 @@ export const chefPkiSyncFactory = ({ certificateDAL, certificateSyncDAL }: TChef
       } = certificateData;
 
       try {
-        const processedCertificateChain = certificateChain ? removeRootCaFromChain(certificateChain) : undefined;
-
         const chefDataBagItem: ChefCertificateDataBagItem = {
           id: targetItemName,
           [fieldMappings.certificate]: cert,
           [fieldMappings.privateKey]: certPrivateKey,
-          ...(processedCertificateChain && { [fieldMappings.certificateChain]: processedCertificateChain }),
+          ...(certificateChain && { [fieldMappings.certificateChain]: certificateChain }),
           ...(caCertificate && { [fieldMappings.caCertificate]: caCertificate })
         };
 

backend/src/services/pki-sync/chef/chef-pki-sync-schemas.ts

@@ -29,6 +29,7 @@ const ChefFieldMappingsSchema = z.object({
 const ChefPkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
+  includeRootCa: z.boolean().default(false),
   preserveItemOnRenewal: z.boolean().default(true),
   updateExistingCertificates: z.boolean().default(true),
   certificateNameSchema: z

backend/src/services/pki-sync/pki-sync-queue.ts

@@ -26,7 +26,7 @@ import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-
 import { TCertificateAuthorityCertDALFactory } from "../certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
 import { getCaCertChain } from "../certificate-authority/certificate-authority-fns";
-import { extractRootCaFromChain } from "../certificate-common/certificate-utils";
+import { extractRootCaFromChain, removeRootCaFromChain } from "../certificate-common/certificate-utils";
 import { TCertificateSyncDALFactory } from "../certificate-sync/certificate-sync-dal";
 import { CertificateSyncStatus } from "../certificate-sync/certificate-sync-enums";
 import { TPkiSyncDALFactory } from "./pki-sync-dal";
@@ -269,7 +269,12 @@ export const pkiSyncQueueFactory = ({
             }
 
             let certificateName: string;
-            const syncOptions = pkiSync.syncOptions as { certificateNameSchema?: string } | undefined;
+            const syncOptions = pkiSync.syncOptions as
+              | {
+                  certificateNameSchema?: string;
+                  includeRootCa?: boolean;
+                }
+              | undefined;
             const certificateNameSchema = syncOptions?.certificateNameSchema;
 
             if (certificateNameSchema) {
@@ -301,10 +306,15 @@ export const pkiSyncQueueFactory = ({
               alternativeNames.push(originalLegacyName);
             }
 
+            let processedCertificateChain = certificateChain;
+            if (certificateChain && syncOptions?.includeRootCa === false) {
+              processedCertificateChain = removeRootCaFromChain(certificateChain);
+            }
+
             certificateMap[certificateName] = {
               cert: certificatePem,
               privateKey: certPrivateKey || "",
-              certificateChain,
+              certificateChain: processedCertificateChain,
               caCertificate,
               alternativeNames,
               certificateId: certificate.id

backend/src/services/pki-sync/pki-sync-schemas.ts

@@ -7,6 +7,7 @@ import { PkiSync } from "./pki-sync-enums";
 export const PkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean(),
   canRemoveCertificates: z.boolean().optional(),
+  includeRootCa: z.boolean().optional().default(false),
   certificateNameSchema: z
     .string()
     .optional()