diff --git a/backend/src/server/routes/v1/certificate-profiles-router.ts b/backend/src/server/routes/v1/certificate-profiles-router.ts
index cc39b5d48..a63a98d58 100644
--- a/backend/src/server/routes/v1/certificate-profiles-router.ts
+++ b/backend/src/server/routes/v1/certificate-profiles-router.ts
@@ -7,6 +7,7 @@ import { ApiDocsTags } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { CertStatus } from "@app/services/certificate/certificate-types";
 import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
 
 export const registerCertificateProfilesRouter = async (server: FastifyZodProvider) => {
@@ -453,7 +454,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       querystring: z.object({
         offset: z.coerce.number().min(0).default(0),
         limit: z.coerce.number().min(1).max(100).default(20),
-        status: z.enum(["active", "expired", "revoked"]).optional(),
+        status: z.nativeEnum(CertStatus).optional(),
         search: z.string().optional()
       }),
       response: {
diff --git a/backend/src/server/routes/v3/certificates-router.ts b/backend/src/server/routes/v3/certificates-router.ts
index 1e5b093a5..4cbc0d2eb 100644
--- a/backend/src/server/routes/v3/certificates-router.ts
+++ b/backend/src/server/routes/v3/certificates-router.ts
@@ -54,8 +54,12 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
       body: z
         .object({
           profileId: z.string().uuid(),
-          commonName: validateTemplateRegexField,
-          ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+          commonName: validateTemplateRegexField.optional(),
+          ttl: z
+            .string()
+            .trim()
+            .min(1, "TTL cannot be empty")
+            .refine((val) => ms(val) > 0, "TTL must be a positive number"),
           keyUsages: z.nativeEnum(CertKeyUsageType).array().optional(),
           extendedKeyUsages: z.nativeEnum(CertExtendedKeyUsageType).array().optional(),
           notBefore: validateCaDateField.optional(),
@@ -162,8 +166,12 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
       body: z
         .object({
           profileId: z.string().uuid(),
-          csr: z.string().trim().min(1).max(4096),
-          ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+          csr: z.string().trim().min(1, "CSR cannot be empty").max(4096, "CSR cannot exceed 4096 characters"),
+          ttl: z
+            .string()
+            .trim()
+            .min(1, "TTL cannot be empty")
+            .refine((val) => ms(val) > 0, "TTL must be a positive number"),
           notBefore: validateCaDateField.optional(),
           notAfter: validateCaDateField.optional()
         })
@@ -234,11 +242,19 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
             .array(
               z.object({
                 type: z.nativeEnum(ACMESANType),
-                value: z.string()
+                value: z
+                  .string()
+                  .trim()
+                  .min(1, "SAN value cannot be empty")
+                  .max(255, "SAN value must be less than 255 characters")
               })
             )
-            .min(1),
-          ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number"),
+            .min(1, "At least one subject alternative name must be provided"),
+          ttl: z
+            .string()
+            .trim()
+            .min(1, "TTL cannot be empty")
+            .refine((val) => ms(val) > 0, "TTL must be a positive number"),
           keyUsages: z.nativeEnum(CertKeyUsageType).array().optional(),
           extendedKeyUsages: z.nativeEnum(CertExtendedKeyUsageType).array().optional(),
           notBefore: validateCaDateField.optional(),
diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
index 8bf6ff075..3ed14a7ee 100644
--- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
@@ -32,6 +32,7 @@ import {
   CertExtendedKeyUsageOIDToName,
   CertKeyAlgorithm,
   CertKeyUsage,
+  CertSignatureAlgorithm,
   CertStatus,
   TAltNameMapping
 } from "../../certificate/certificate-types";
@@ -1289,12 +1290,19 @@ export const internalCertificateAuthorityServiceFactory = ({
       const caKeyAlgorithm = ca.internalCa.keyAlgorithm;
       const requestedKeyType = signatureAlgorithm.split("-")[0];
 
-      const isRsaCa = caKeyAlgorithm.startsWith("RSA");
-      const isEcdsaCa = caKeyAlgorithm.startsWith("EC");
+      const isRsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.RSA_2048.split("_")[0]);
+      const isEcdsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.ECDSA_P256.split("_")[0]);
 
-      if ((requestedKeyType === "RSA" && !isRsaCa) || (requestedKeyType === "ECDSA" && !isEcdsaCa)) {
+      if (
+        (requestedKeyType === CertSignatureAlgorithm.RSA_SHA256.split("-")[0] && !isRsaCa) ||
+        (requestedKeyType === CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0] && !isEcdsaCa)
+      ) {
         // eslint-disable-next-line no-nested-ternary
-        const supportedType = isRsaCa ? "RSA" : isEcdsaCa ? "ECDSA" : "unknown";
+        const supportedType = isRsaCa
+          ? CertSignatureAlgorithm.RSA_SHA256.split("-")[0]
+          : isEcdsaCa
+            ? CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0]
+            : "unknown";
         throw new BadRequestError({
           message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.`
         });
@@ -1655,12 +1663,19 @@ export const internalCertificateAuthorityServiceFactory = ({
       const caKeyAlgorithm = ca.internalCa.keyAlgorithm;
       const requestedKeyType = signatureAlgorithm.split("-")[0]; // Get the first part (RSA, ECDSA)
 
-      const isRsaCa = caKeyAlgorithm.startsWith("RSA");
-      const isEcdsaCa = caKeyAlgorithm.startsWith("EC");
+      const isRsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.RSA_2048.split("_")[0]);
+      const isEcdsaCa = caKeyAlgorithm.startsWith(CertKeyAlgorithm.ECDSA_P256.split("_")[0]);
 
-      if ((requestedKeyType === "RSA" && !isRsaCa) || (requestedKeyType === "ECDSA" && !isEcdsaCa)) {
+      if (
+        (requestedKeyType === CertSignatureAlgorithm.RSA_SHA256.split("-")[0] && !isRsaCa) ||
+        (requestedKeyType === CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0] && !isEcdsaCa)
+      ) {
         // eslint-disable-next-line no-nested-ternary
-        const supportedType = isRsaCa ? "RSA" : isEcdsaCa ? "ECDSA" : "unknown";
+        const supportedType = isRsaCa
+          ? CertSignatureAlgorithm.RSA_SHA256.split("-")[0]
+          : isEcdsaCa
+            ? CertSignatureAlgorithm.ECDSA_SHA256.split("-")[0]
+            : "unknown";
         throw new BadRequestError({
           message: `Requested signature algorithm ${signatureAlgorithm} is not compatible with CA key algorithm ${caKeyAlgorithm}. CA can only sign with ${supportedType}-based signature algorithms.`
         });
diff --git a/backend/src/services/certificate-profile/certificate-profile-service.test.ts b/backend/src/services/certificate-profile/certificate-profile-service.test.ts
index 7f390e580..b03d85128 100644
--- a/backend/src/services/certificate-profile/certificate-profile-service.test.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.test.ts
@@ -559,7 +559,6 @@ describe("CertificateProfileService", () => {
 
       expect(result).toEqual(sampleProfile);
       expect(mockCertificateProfileDAL.findById).toHaveBeenCalledWith("profile-123");
-      expect(mockCertificateProfileDAL.isProfileInUse).toHaveBeenCalledWith("profile-123");
       expect(mockCertificateProfileDAL.deleteById).toHaveBeenCalledWith("profile-123");
     });
 
@@ -573,18 +572,6 @@ describe("CertificateProfileService", () => {
         })
       ).rejects.toThrow(NotFoundError);
     });
-
-    it("should throw ForbiddenRequestError when profile is in use", async () => {
-      (mockCertificateProfileDAL.isProfileInUse as any).mockResolvedValue(true);
-
-      await expect(
-        service.deleteProfile({
-          ...mockActor,
-          profileId: "profile-123"
-        })
-      ).rejects.toThrow(ForbiddenRequestError);
-      expect(mockCertificateProfileDAL.deleteById).not.toHaveBeenCalled();
-    });
   });
 
   describe("getProfileCertificates", () => {
@@ -841,23 +828,8 @@ describe("CertificateProfileService", () => {
         expect(result.enrollmentType).toBe(EnrollmentType.EST);
       });
 
-      it("should prevent deletion of profiles with active certificates", async () => {
+      it("should allow deletion of profiles", async () => {
         (mockCertificateProfileDAL.findById as any).mockResolvedValue(sampleProfile);
-        (mockCertificateProfileDAL.isProfileInUse as any).mockResolvedValue(true);
-
-        await expect(
-          service.deleteProfile({
-            ...mockActor,
-            profileId: "profile-123"
-          })
-        ).rejects.toThrow(ForbiddenRequestError);
-
-        expect(mockCertificateProfileDAL.deleteById).not.toHaveBeenCalled();
-      });
-
-      it("should allow deletion of unused profiles", async () => {
-        (mockCertificateProfileDAL.findById as any).mockResolvedValue(sampleProfile);
-        (mockCertificateProfileDAL.isProfileInUse as any).mockResolvedValue(false);
         (mockCertificateProfileDAL.deleteById as any).mockResolvedValue(sampleProfile);
 
         const result = await service.deleteProfile({
@@ -866,7 +838,6 @@ describe("CertificateProfileService", () => {
         });
 
         expect(result).toEqual(sampleProfile);
-        expect(mockCertificateProfileDAL.isProfileInUse).toHaveBeenCalledWith("profile-123");
         expect(mockCertificateProfileDAL.deleteById).toHaveBeenCalledWith("profile-123");
       });
     });
diff --git a/backend/src/services/certificate-profile/certificate-profile-service.ts b/backend/src/services/certificate-profile/certificate-profile-service.ts
index 35c390af6..ccad3fccb 100644
--- a/backend/src/services/certificate-profile/certificate-profile-service.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.ts
@@ -116,7 +116,7 @@ export const certificateProfileServiceFactory = ({
     const existingSlugProfile = await certificateProfileDAL.findBySlugAndProjectId(data.slug, projectId);
     if (existingSlugProfile) {
       throw new ForbiddenRequestError({
-        message: "Certificate profile with this slug already exists in project"
+        message: "Certificate profile with this name already exists in project"
       });
     }
 
@@ -245,7 +245,7 @@ export const certificateProfileServiceFactory = ({
       );
       if (conflictingProfile && conflictingProfile.id !== profileId) {
         throw new ForbiddenRequestError({
-          message: "Certificate profile with this slug already exists in project"
+          message: "Certificate profile with this name already exists in project"
         });
       }
     }
@@ -521,14 +521,6 @@ export const certificateProfileServiceFactory = ({
       ProjectPermissionSub.CertificateProfiles
     );
 
-    // Check if profile is in use by any certificates
-    const isInUse = await certificateProfileDAL.isProfileInUse(profileId);
-    if (isInUse) {
-      throw new ForbiddenRequestError({
-        message: "Cannot delete certificate profile that has issued certificates"
-      });
-    }
-
     const deletedProfile = await certificateProfileDAL.deleteById(profileId);
     if (!deletedProfile) {
       throw new NotFoundError({ message: "Failed to delete certificate profile" });
diff --git a/backend/src/services/certificate-template-v2/certificate-template-v2-schemas.ts b/backend/src/services/certificate-template-v2/certificate-template-v2-schemas.ts
index 5e653f626..9fcc51a57 100644
--- a/backend/src/services/certificate-template-v2/certificate-template-v2-schemas.ts
+++ b/backend/src/services/certificate-template-v2/certificate-template-v2-schemas.ts
@@ -1,3 +1,4 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 import {
@@ -13,9 +14,9 @@ const sanTypeSchema = z.nativeEnum(CertSubjectAlternativeNameType);
 const templateV2SubjectSchema = z
   .object({
     type: attributeTypeSchema,
-    allowed: z.array(z.string()).optional(),
-    required: z.array(z.string()).optional(),
-    denied: z.array(z.string()).optional()
+    allowed: z.array(z.string().trim().min(1, "Value cannot be empty")).optional(),
+    required: z.array(z.string().trim().min(1, "Value cannot be empty")).optional(),
+    denied: z.array(z.string().trim().min(1, "Value cannot be empty")).optional()
   })
   .refine(
     (data) => {
@@ -68,9 +69,9 @@ const templateV2ExtendedKeyUsagesSchema = z
 const templateV2SanSchema = z
   .object({
     type: sanTypeSchema,
-    allowed: z.array(z.string()).optional(),
-    required: z.array(z.string()).optional(),
-    denied: z.array(z.string()).optional()
+    allowed: z.array(z.string().trim().min(1, "Value cannot be empty")).optional(),
+    required: z.array(z.string().trim().min(1, "Value cannot be empty")).optional(),
+    denied: z.array(z.string().trim().min(1, "Value cannot be empty")).optional()
   })
   .refine(
     (data) => {
@@ -87,22 +88,33 @@ const templateV2SanSchema = z
 const templateV2ValiditySchema = z.object({
   max: z
     .string()
-    .regex(/^\d+[dhmy]$/, {
+    .regex(new RE2("^\\d+[dhmy]$"), {
       message: "Max validity must be in format like '365d', '12m', '1y', or '24h'"
     })
     .optional()
 });
 
 const templateV2AlgorithmsSchema = z.object({
-  signature: z.array(z.string()).min(1, "At least one signature algorithm must be provided").optional(),
-  keyAlgorithm: z.array(z.string()).min(1, "At least one key algorithm must be provided").optional()
+  signature: z
+    .array(z.string().trim().min(1, "Algorithm cannot be empty"))
+    .min(1, "At least one signature algorithm must be provided")
+    .optional(),
+  keyAlgorithm: z
+    .array(z.string().trim().min(1, "Algorithm cannot be empty"))
+    .min(1, "At least one key algorithm must be provided")
+    .optional()
 });
 
 export const certificateTemplateV2ResponseSchema = z.object({
   id: z.string().uuid(),
   projectId: z.string().uuid("Project ID must be valid"),
-  name: z.string(),
-  description: z.string().nullable().optional(),
+  name: z
+    .string()
+    .trim()
+    .min(1, "Template name is required")
+    .max(255, "Template name must be less than 255 characters")
+    .regex(new RE2("^[a-zA-Z0-9-_]+$"), "Template name must contain only letters, numbers, hyphens, and underscores"),
+  description: z.string().trim().max(1000, "Description must be less than 1000 characters").nullable().optional(),
   subject: z.array(templateV2SubjectSchema).optional(),
   sans: z.array(templateV2SanSchema).optional(),
   keyUsages: templateV2KeyUsagesSchema.optional(),
@@ -114,26 +126,53 @@ export const certificateTemplateV2ResponseSchema = z.object({
 });
 
 export const certificateRequestSchema = z.object({
-  commonName: z.string().optional(),
-  organization: z.string().optional(),
-  country: z.string().optional(),
-  keyUsages: z.array(z.nativeEnum(CertKeyUsageType)).optional(),
-  extendedKeyUsages: z.array(z.nativeEnum(CertExtendedKeyUsageType)).optional(),
+  commonName: z
+    .string()
+    .trim()
+    .min(1, "Common name cannot be empty")
+    .max(64, "Common name must be less than 64 characters")
+    .optional(),
+  organization: z
+    .string()
+    .trim()
+    .min(1, "Organization cannot be empty")
+    .max(64, "Organization must be less than 64 characters")
+    .optional(),
+  country: z
+    .string()
+    .trim()
+    .min(2, "Country code must be 2 characters")
+    .max(2, "Country code must be 2 characters")
+    .optional(),
+  keyUsages: z.array(z.nativeEnum(CertKeyUsageType)).min(1, "At least one key usage must be provided").optional(),
+  extendedKeyUsages: z
+    .array(z.nativeEnum(CertExtendedKeyUsageType))
+    .min(1, "At least one extended key usage must be provided")
+    .optional(),
   subjectAlternativeNames: z
     .array(
       z.object({
         type: sanTypeSchema,
-        value: z.string()
+        value: z
+          .string()
+          .trim()
+          .min(1, "SAN value cannot be empty")
+          .max(255, "SAN value must be less than 255 characters")
       })
     )
+    .min(1, "At least one SAN must be provided")
     .optional(),
   validity: z
     .object({
-      ttl: z.string()
+      ttl: z
+        .string()
+        .trim()
+        .min(1, "TTL cannot be empty")
+        .regex(new RE2("^\\d+[dhmy]$"), "TTL must be in format like '365d', '12m', '1y', or '24h'")
     })
     .optional(),
-  signatureAlgorithm: z.string().optional(),
-  keyAlgorithm: z.string().optional()
+  signatureAlgorithm: z.string().trim().min(1, "Signature algorithm cannot be empty").optional(),
+  keyAlgorithm: z.string().trim().min(1, "Key algorithm cannot be empty").optional()
 });
 
 export const validateCertificateRequestSchema = z.object({
diff --git a/backend/src/services/certificate/certificate-types.ts b/backend/src/services/certificate/certificate-types.ts
index b747314b3..9a09945c6 100644
--- a/backend/src/services/certificate/certificate-types.ts
+++ b/backend/src/services/certificate/certificate-types.ts
@@ -8,6 +8,7 @@ import { TCertificateSecretDALFactory } from "./certificate-secret-dal";
 
 export enum CertStatus {
   ACTIVE = "active",
+  EXPIRED = "expired",
   REVOKED = "revoked"
 }
 
diff --git a/docs/api-reference/endpoints/certificate-templates/create.mdx b/docs/api-reference/endpoints/certificate-templates/create.mdx
deleted file mode 100644
index f159aff34..000000000
--- a/docs/api-reference/endpoints/certificate-templates/create.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/pki/certificate-templates"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Templates V2 API](/api-reference/endpoints/certificate-templates-v2) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/certificate-templates/delete.mdx b/docs/api-reference/endpoints/certificate-templates/delete.mdx
deleted file mode 100644
index 48c3fd755..000000000
--- a/docs/api-reference/endpoints/certificate-templates/delete.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/pki/certificate-templates/{certificateTemplateId}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Templates V2 API](/api-reference/endpoints/certificate-templates-v2) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/certificate-templates/get-by-id.mdx b/docs/api-reference/endpoints/certificate-templates/get-by-id.mdx
deleted file mode 100644
index 09fcbd028..000000000
--- a/docs/api-reference/endpoints/certificate-templates/get-by-id.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Get by ID"
-openapi: "GET /api/v1/pki/certificate-templates/{certificateTemplateId}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Templates V2 API](/api-reference/endpoints/certificate-templates-v2) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/certificate-templates/update.mdx b/docs/api-reference/endpoints/certificate-templates/update.mdx
deleted file mode 100644
index 9db27e5e6..000000000
--- a/docs/api-reference/endpoints/certificate-templates/update.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/pki/certificate-templates/{certificateTemplateId}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Templates V2 API](/api-reference/endpoints/certificate-templates-v2) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/create.mdx b/docs/api-reference/endpoints/pki/subscribers/create.mdx
deleted file mode 100644
index 8285e2bdc..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/create.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Create"
-openapi: "POST /api/v1/pki/subscribers"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/delete.mdx b/docs/api-reference/endpoints/pki/subscribers/delete.mdx
deleted file mode 100644
index a553c2f9e..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/delete.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Delete"
-openapi: "DELETE /api/v1/pki/subscribers/{subscriberName}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle.mdx b/docs/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle.mdx
deleted file mode 100644
index 1b6cfe19a..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/get-latest-cert-bundle.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Retrieve latest certificate bundle"
-openapi: "GET /api/v1/pki/subscribers/{subscriberName}/latest-certificate-bundle"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/issue-cert.mdx b/docs/api-reference/endpoints/pki/subscribers/issue-cert.mdx
deleted file mode 100644
index 2ecd4bf50..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/issue-cert.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Issue Certificate"
-openapi: "POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/list-certs.mdx b/docs/api-reference/endpoints/pki/subscribers/list-certs.mdx
deleted file mode 100644
index 1afb5e32a..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/list-certs.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "List Certificates"
-openapi: "GET /api/v1/pki/subscribers/{subscriberName}/certificates"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/order-cert.mdx b/docs/api-reference/endpoints/pki/subscribers/order-cert.mdx
deleted file mode 100644
index ae512b071..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/order-cert.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Order Certificate"
-openapi: "POST /api/v1/pki/subscribers/{subscriberName}/order-certificate"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/read.mdx b/docs/api-reference/endpoints/pki/subscribers/read.mdx
deleted file mode 100644
index f18690c5e..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/read.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/pki/subscribers/{subscriberName}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/sign-cert.mdx b/docs/api-reference/endpoints/pki/subscribers/sign-cert.mdx
deleted file mode 100644
index 9672bfb82..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/sign-cert.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Sign Certificate"
-openapi: "POST /api/v1/pki/subscribers/{subscriberName}/sign-certificate"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/api-reference/endpoints/pki/subscribers/update.mdx b/docs/api-reference/endpoints/pki/subscribers/update.mdx
deleted file mode 100644
index e85c6e28c..000000000
--- a/docs/api-reference/endpoints/pki/subscribers/update.mdx
+++ /dev/null
@@ -1,10 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/pki/subscribers/{subscriberName}"
----
-
-<Warning>
-**Deprecated API Endpoint**
-
-This endpoint is deprecated and will be removed in a future version. Please use the new [Certificate Profiles API](/api-reference/endpoints/certificate-profiles) instead.
-</Warning>
diff --git a/docs/docs.json b/docs/docs.json
index 9d2516e70..b2d514aed 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -2451,20 +2451,6 @@
           {
             "group": "Infisical PKI",
             "pages": [
-              {
-                "group": "Subscribers",
-                "pages": [
-                  "api-reference/endpoints/pki/subscribers/list-certs",
-                  "api-reference/endpoints/pki/subscribers/create",
-                  "api-reference/endpoints/pki/subscribers/read",
-                  "api-reference/endpoints/pki/subscribers/update",
-                  "api-reference/endpoints/pki/subscribers/delete",
-                  "api-reference/endpoints/pki/subscribers/issue-cert",
-                  "api-reference/endpoints/pki/subscribers/sign-cert",
-                  "api-reference/endpoints/pki/subscribers/order-cert",
-                  "api-reference/endpoints/pki/subscribers/get-latest-cert-bundle"
-                ]
-              },
               {
                 "group": "Certificate Authorities",
                 "pages": [
@@ -2525,17 +2511,7 @@
                   "api-reference/endpoints/certificate-templates-v2/create",
                   "api-reference/endpoints/certificate-templates-v2/update",
                   "api-reference/endpoints/certificate-templates-v2/get-by-id",
-                  "api-reference/endpoints/certificate-templates-v2/delete",
-                  {
-                    "group": "Legacy",
-                    "pages": [
-                      "api-reference/endpoints/certificate-templates/list",
-                      "api-reference/endpoints/certificate-templates/create",
-                      "api-reference/endpoints/certificate-templates/update",
-                      "api-reference/endpoints/certificate-templates/get-by-id",
-                      "api-reference/endpoints/certificate-templates/delete"
-                    ]
-                  }
+                  "api-reference/endpoints/certificate-templates-v2/delete"
                 ]
               },
               {
diff --git a/frontend/src/context/ProjectPermissionContext/types.ts b/frontend/src/context/ProjectPermissionContext/types.ts
index 36685d542..0236113eb 100644
--- a/frontend/src/context/ProjectPermissionContext/types.ts
+++ b/frontend/src/context/ProjectPermissionContext/types.ts
@@ -129,8 +129,7 @@ export enum ProjectPermissionCertificateProfileActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  IssueCert = "issue-cert",
-  ListCerts = "list-certs"
+  IssueCert = "issue-cert"
 }
 
 export enum ProjectPermissionSecretRotationActions {
@@ -226,7 +225,6 @@ export type ConditionalProjectPermissionSubject =
   | ProjectPermissionSub.SshHosts
   | ProjectPermissionSub.PkiSubscribers
   | ProjectPermissionSub.CertificateTemplates
-  | ProjectPermissionSub.CertificateProfiles
   | ProjectPermissionSub.SecretFolders
   | ProjectPermissionSub.SecretImports
   | ProjectPermissionSub.SecretRotation
diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx
index c0bd8abf1..fa422054c 100644
--- a/frontend/src/hooks/api/ca/mutations.tsx
+++ b/frontend/src/hooks/api/ca/mutations.tsx
@@ -166,6 +166,10 @@ export const useCreateCertificateV3 = () => {
       queryClient.invalidateQueries({
         queryKey: projectKeys.forProjectCertificates(projectSlug)
       });
+
+      queryClient.invalidateQueries({
+        queryKey: ["certificate-profiles"]
+      });
     }
   });
 };
diff --git a/frontend/src/hooks/api/ca/types.ts b/frontend/src/hooks/api/ca/types.ts
index d4a62a710..696e72494 100644
--- a/frontend/src/hooks/api/ca/types.ts
+++ b/frontend/src/hooks/api/ca/types.ts
@@ -176,7 +176,7 @@ export type TCreateCertificateV3DTO = {
   profileId: string;
   pkiCollectionId?: string;
   friendlyName?: string;
-  commonName: string;
+  commonName?: string;
   organization?: string;
   organizationUnit?: string;
   locality?: string;
@@ -195,7 +195,11 @@ export type TCreateCertificateV3DTO = {
   keyAlgorithm?: string;
 };
 
-export type TCreateCertificateV3Response = TCreateCertificateResponse;
+export type TCreateCertificateV3Response = TCreateCertificateResponse & {
+  projectId: string;
+  profileName: string;
+  certificateId: string;
+};
 
 export type TOrderCertificateDTO = {
   projectSlug: string;
diff --git a/frontend/src/hooks/api/certificates/mutations.tsx b/frontend/src/hooks/api/certificates/mutations.tsx
index 77a3dab72..388295b0a 100644
--- a/frontend/src/hooks/api/certificates/mutations.tsx
+++ b/frontend/src/hooks/api/certificates/mutations.tsx
@@ -52,6 +52,10 @@ export const useRevokeCert = () => {
       queryClient.invalidateQueries({
         queryKey: pkiSubscriberKeys.allPkiSubscriberCertificates()
       });
+
+      queryClient.invalidateQueries({
+        queryKey: ["certificate-profiles", "list"]
+      });
     }
   });
 };
diff --git a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx
index 5bc606c45..a19a3a9c7 100644
--- a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx
+++ b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx
@@ -12,8 +12,7 @@ import {
   Modal,
   ModalContent,
   Select,
-  SelectItem,
-  Switch
+  SelectItem
   // DatePicker
 } from "@app/components/v2";
 import { useProject } from "@app/context";
@@ -152,7 +151,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => {
         type: CaType.INTERNAL,
         name: "",
         status: CaStatus.ACTIVE,
-        enableDirectIssuance: true,
+        enableDirectIssuance: false,
         configuration: {
           type: InternalCaType.ROOT,
           organization: "",
@@ -456,23 +455,6 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => {
               </FormControl>
             )}
           />
-          <Controller
-            control={control}
-            name="enableDirectIssuance"
-            render={({ field, fieldState: { error } }) => {
-              return (
-                <FormControl isError={Boolean(error)} errorText={error?.message} className="my-8">
-                  <Switch
-                    id="enable-direct-issuance"
-                    onCheckedChange={(value) => field.onChange(value)}
-                    isChecked={field.value}
-                  >
-                    <p className="w-full">Enable Direct Issuance</p>
-                  </Switch>
-                </FormControl>
-              );
-            }}
-          />
           <div className="flex items-center">
             <Button
               className="mr-4"
diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
index 6e3cf4ae8..561e9ad79 100644
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
@@ -27,10 +27,8 @@ import { useProject } from "@app/context";
 import { useCreateCertificateV3, useGetCert } from "@app/hooks/api";
 import { useListCertificateProfiles } from "@app/hooks/api/certificateProfiles";
 import {
-  certKeyAlgorithms,
   EXTENDED_KEY_USAGES_OPTIONS,
-  KEY_USAGES_OPTIONS,
-  SIGNATURE_ALGORITHMS_OPTIONS
+  KEY_USAGES_OPTIONS
 } from "@app/hooks/api/certificates/constants";
 import { CertExtendedKeyUsage, CertKeyUsage } from "@app/hooks/api/certificates/enums";
 import { useGetCertificateTemplateV2ById } from "@app/hooks/api/certificateTemplates/queries";
@@ -42,49 +40,60 @@ import {
 
 import { CertificateContent } from "./CertificateContent";
 
-const schema = z.object({
-  profileId: z.string().min(1, "Profile is required"),
-  subjectAttributes: z
-    .array(
-      z.object({
-        type: z.enum(["common_name"]),
-        value: z.string().min(1, "Value is required")
-      })
-    )
-    .min(1, "At least one subject attribute is required"),
-  subjectAltNames: z
-    .array(
-      z.object({
-        type: z.enum(["dns", "ip", "email", "uri"]),
-        value: z.string().min(1, "Value is required")
-      })
-    )
-    .default([]),
-  ttl: z.string().trim().min(1, "TTL is required"),
-  signatureAlgorithm: z.string().optional(),
-  keyAlgorithm: z.string().optional(),
-  keyUsages: z.object({
-    [CertKeyUsage.DIGITAL_SIGNATURE]: z.boolean().optional(),
-    [CertKeyUsage.KEY_ENCIPHERMENT]: z.boolean().optional(),
-    [CertKeyUsage.NON_REPUDIATION]: z.boolean().optional(),
-    [CertKeyUsage.DATA_ENCIPHERMENT]: z.boolean().optional(),
-    [CertKeyUsage.KEY_AGREEMENT]: z.boolean().optional(),
-    [CertKeyUsage.KEY_CERT_SIGN]: z.boolean().optional(),
-    [CertKeyUsage.CRL_SIGN]: z.boolean().optional(),
-    [CertKeyUsage.ENCIPHER_ONLY]: z.boolean().optional(),
-    [CertKeyUsage.DECIPHER_ONLY]: z.boolean().optional()
-  }),
-  extendedKeyUsages: z.object({
-    [CertExtendedKeyUsage.CLIENT_AUTH]: z.boolean().optional(),
-    [CertExtendedKeyUsage.CODE_SIGNING]: z.boolean().optional(),
-    [CertExtendedKeyUsage.EMAIL_PROTECTION]: z.boolean().optional(),
-    [CertExtendedKeyUsage.OCSP_SIGNING]: z.boolean().optional(),
-    [CertExtendedKeyUsage.SERVER_AUTH]: z.boolean().optional(),
-    [CertExtendedKeyUsage.TIMESTAMPING]: z.boolean().optional()
-  })
-});
+const createSchema = (shouldShowSubjectSection: boolean) => {
+  return z.object({
+    profileId: z.string().min(1, "Profile is required"),
+    subjectAttributes: shouldShowSubjectSection
+      ? z
+          .array(
+            z.object({
+              type: z.enum(["common_name"]),
+              value: z.string().min(1, "Value is required")
+            })
+          )
+          .min(1, "At least one subject attribute is required")
+      : z
+          .array(
+            z.object({
+              type: z.enum(["common_name"]),
+              value: z.string().min(1, "Value is required")
+            })
+          )
+          .optional(),
+    subjectAltNames: z
+      .array(
+        z.object({
+          type: z.enum(["dns", "ip", "email", "uri"]),
+          value: z.string().min(1, "Value is required")
+        })
+      )
+      .default([]),
+    ttl: z.string().trim().min(1, "TTL is required"),
+    signatureAlgorithm: z.string().min(1, "Signature algorithm is required"),
+    keyAlgorithm: z.string().min(1, "Key algorithm is required"),
+    keyUsages: z.object({
+      [CertKeyUsage.DIGITAL_SIGNATURE]: z.boolean().optional(),
+      [CertKeyUsage.KEY_ENCIPHERMENT]: z.boolean().optional(),
+      [CertKeyUsage.NON_REPUDIATION]: z.boolean().optional(),
+      [CertKeyUsage.DATA_ENCIPHERMENT]: z.boolean().optional(),
+      [CertKeyUsage.KEY_AGREEMENT]: z.boolean().optional(),
+      [CertKeyUsage.KEY_CERT_SIGN]: z.boolean().optional(),
+      [CertKeyUsage.CRL_SIGN]: z.boolean().optional(),
+      [CertKeyUsage.ENCIPHER_ONLY]: z.boolean().optional(),
+      [CertKeyUsage.DECIPHER_ONLY]: z.boolean().optional()
+    }),
+    extendedKeyUsages: z.object({
+      [CertExtendedKeyUsage.CLIENT_AUTH]: z.boolean().optional(),
+      [CertExtendedKeyUsage.CODE_SIGNING]: z.boolean().optional(),
+      [CertExtendedKeyUsage.EMAIL_PROTECTION]: z.boolean().optional(),
+      [CertExtendedKeyUsage.OCSP_SIGNING]: z.boolean().optional(),
+      [CertExtendedKeyUsage.SERVER_AUTH]: z.boolean().optional(),
+      [CertExtendedKeyUsage.TIMESTAMPING]: z.boolean().optional()
+    })
+  });
+};
 
-export type FormData = z.infer<typeof schema>;
+export type FormData = z.infer<ReturnType<typeof createSchema>>;
 
 type Props = {
   popUp: UsePopUpState<["certificateIssuance"]>;
@@ -110,6 +119,9 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
   const [requiredExtendedKeyUsages, setRequiredExtendedKeyUsages] = useState<string[]>([]);
   const [allowedSignatureAlgorithms, setAllowedSignatureAlgorithms] = useState<string[]>([]);
   const [allowedKeyAlgorithms, setAllowedKeyAlgorithms] = useState<string[]>([]);
+  const [allowedSanTypes, setAllowedSanTypes] = useState<string[]>(["dns", "ip", "email", "uri"]);
+  const [shouldShowSanSection, setShouldShowSanSection] = useState<boolean>(true);
+  const [shouldShowSubjectSection, setShouldShowSubjectSection] = useState<boolean>(true);
   const { currentProject } = useProject();
 
   const inputSerialNumber =
@@ -133,10 +145,12 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
     setValue,
     formState: { isSubmitting }
   } = useForm<FormData>({
-    resolver: zodResolver(schema),
+    resolver: zodResolver(createSchema(shouldShowSubjectSection)),
     defaultValues: {
       profileId: profileId || "",
-      subjectAttributes: [{ type: "common_name", value: "" }],
+      subjectAttributes: shouldShowSubjectSection
+        ? [{ type: "common_name", value: "" }]
+        : undefined,
       subjectAltNames: [],
       ttl: "30d",
       signatureAlgorithm: "",
@@ -154,6 +168,9 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
     setRequiredExtendedKeyUsages([]);
     setAllowedSignatureAlgorithms([]);
     setAllowedKeyAlgorithms([]);
+    setAllowedSanTypes(["dns", "ip", "email", "uri"]);
+    setShouldShowSanSection(true);
+    setShouldShowSubjectSection(true);
     reset();
   }, [reset]);
 
@@ -168,21 +185,31 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
   });
 
   const filteredKeyUsages = useMemo(() => {
-    if (allowedKeyUsages.length === 0) return KEY_USAGES_OPTIONS;
     return KEY_USAGES_OPTIONS.filter(({ value }) => allowedKeyUsages.includes(value));
   }, [allowedKeyUsages]);
 
   const filteredExtendedKeyUsages = useMemo(() => {
-    if (allowedExtendedKeyUsages.length === 0) return EXTENDED_KEY_USAGES_OPTIONS;
     return EXTENDED_KEY_USAGES_OPTIONS.filter(({ value }) =>
       allowedExtendedKeyUsages.includes(value)
     );
   }, [allowedExtendedKeyUsages]);
 
-  const availableSignatureAlgorithms = useMemo(() => {
-    if (allowedSignatureAlgorithms.length === 0) {
-      return SIGNATURE_ALGORITHMS_OPTIONS;
+  const mapBackendSanTypeToFrontend = (backendType: string): string => {
+    switch (backendType) {
+      case "dns_name":
+        return "dns";
+      case "ip_address":
+        return "ip";
+      case "email":
+        return "email";
+      case "uri":
+        return "uri";
+      default:
+        return backendType;
     }
+  };
+
+  const availableSignatureAlgorithms = useMemo(() => {
     return allowedSignatureAlgorithms.map((templateAlgorithm) => {
       const apiAlgorithm = mapTemplateSignatureAlgorithmToApi(templateAlgorithm);
       return {
@@ -193,9 +220,6 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
   }, [allowedSignatureAlgorithms]);
 
   const availableKeyAlgorithms = useMemo(() => {
-    if (allowedKeyAlgorithms.length === 0) {
-      return certKeyAlgorithms;
-    }
     return allowedKeyAlgorithms.map((templateAlgorithm) => {
       const apiAlgorithm = mapTemplateKeyAlgorithmToApi(templateAlgorithm);
       return {
@@ -247,6 +271,33 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
       setRequiredKeyUsages(templateData.keyUsages?.required || []);
       setRequiredExtendedKeyUsages(templateData.extendedKeyUsages?.required || []);
 
+      if (templateData.sans && templateData.sans.length > 0) {
+        const sanTypes: string[] = [];
+        templateData.sans.forEach((sanPolicy) => {
+          const frontendType = mapBackendSanTypeToFrontend(sanPolicy.type);
+          if (!sanTypes.includes(frontendType)) {
+            sanTypes.push(frontendType);
+          }
+        });
+        setAllowedSanTypes(sanTypes);
+        setShouldShowSanSection(true);
+      } else {
+        setAllowedSanTypes([]);
+        setShouldShowSanSection(false);
+        setValue("subjectAltNames", []);
+      }
+
+      if (templateData.subject && templateData.subject.length > 0) {
+        setShouldShowSubjectSection(true);
+        const currentSubjectAttrs = watch("subjectAttributes");
+        if (!currentSubjectAttrs || currentSubjectAttrs.length === 0) {
+          setValue("subjectAttributes", [{ type: "common_name", value: "" }]);
+        }
+      } else {
+        setShouldShowSubjectSection(false);
+        setValue("subjectAttributes", undefined);
+      }
+
       const initialKeyUsages: Record<string, boolean> = {};
       const initialExtendedKeyUsages: Record<string, boolean> = {};
 
@@ -261,7 +312,7 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
       setValue("keyUsages", initialKeyUsages);
       setValue("extendedKeyUsages", initialExtendedKeyUsages);
     }
-  }, [templateData, selectedProfile, setValue, popUp?.certificateIssuance?.isOpen]);
+  }, [templateData, selectedProfile, setValue, watch, popUp?.certificateIssuance?.isOpen]);
 
   useEffect(() => {
     if (cert) {
@@ -299,22 +350,19 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
   }, [popUp?.certificateIssuance?.isOpen, profileId, cert, setValue]);
 
   const getAttributeValue = useCallback(
-    (subjectAttributes: typeof schema._type.subjectAttributes, type: string) => {
-      const foundAttr = subjectAttributes.find((attr) => attr.type === type);
+    (subjectAttributes: FormData["subjectAttributes"], type: string) => {
+      const foundAttr = subjectAttributes?.find((attr) => attr.type === type);
       return foundAttr?.value || "";
     },
     []
   );
 
-  const formatSubjectAltNames = useCallback(
-    (subjectAltNames: typeof schema._type.subjectAltNames) => {
-      return subjectAltNames
-        .filter((san) => san.value.trim())
-        .map((san) => san.value.trim())
-        .join(", ");
-    },
-    []
-  );
+  const formatSubjectAltNames = useCallback((subjectAltNames: FormData["subjectAltNames"]) => {
+    return subjectAltNames
+      .filter((san) => san.value.trim())
+      .map((san) => san.value.trim())
+      .join(", ");
+  }, []);
 
   const filterUsages = useCallback(<T extends Record<string, boolean>>(usages: T) => {
     return Object.entries(usages)
@@ -350,28 +398,40 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
           return;
         }
 
-        const commonName = getAttributeValue(subjectAttributes, "common_name");
-        if (!commonName.trim()) {
-          createNotification({
-            text: "Common name is required.",
-            type: "error"
-          });
-          return;
+        let commonName = "";
+        if (shouldShowSubjectSection && subjectAttributes && subjectAttributes.length > 0) {
+          commonName = getAttributeValue(subjectAttributes, "common_name");
+          if (!commonName.trim()) {
+            createNotification({
+              text: "Common name is required.",
+              type: "error"
+            });
+            return;
+          }
         }
 
-        const { serialNumber, certificate, certificateChain, privateKey } = await createCertificate(
-          {
-            profileId: formProfileId,
-            projectSlug: currentProject.slug,
-            commonName,
-            subjectAltNames: formatSubjectAltNames(subjectAltNames),
-            ttl,
-            signatureAlgorithm,
-            keyAlgorithm,
-            keyUsages: filterUsages(keyUsages) as CertKeyUsage[],
-            extendedKeyUsages: filterUsages(extendedKeyUsages) as CertExtendedKeyUsage[]
+        const certificateRequest: any = {
+          profileId: formProfileId,
+          projectSlug: currentProject.slug,
+          ttl,
+          signatureAlgorithm,
+          keyAlgorithm,
+          keyUsages: filterUsages(keyUsages) as CertKeyUsage[],
+          extendedKeyUsages: filterUsages(extendedKeyUsages) as CertExtendedKeyUsage[]
+        };
+
+        if (shouldShowSubjectSection && commonName) {
+          certificateRequest.commonName = commonName;
+        }
+        if (shouldShowSanSection && subjectAltNames && subjectAltNames.length > 0) {
+          const formattedSans = formatSubjectAltNames(subjectAltNames);
+          if (formattedSans) {
+            certificateRequest.subjectAltNames = formattedSans;
           }
-        );
+        }
+
+        const { serialNumber, certificate, certificateChain, privateKey } =
+          await createCertificate(certificateRequest);
 
         setCertificateDetails({
           serialNumber,
@@ -399,7 +459,8 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
     [
       currentProject?.slug,
       createCertificate,
-      reset,
+      shouldShowSubjectSection,
+      shouldShowSanSection,
       getAttributeValue,
       formatSubjectAltNames,
       filterUsages
@@ -517,47 +578,132 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
 
             {(selectedProfile || profileId) && (
               <>
-                <Controller
-                  control={control}
-                  name="subjectAttributes"
-                  render={({ field: { onChange, value }, fieldState: { error } }) => (
-                    <FormControl
-                      label="Subject Attributes"
-                      isRequired
-                      errorText={error?.message}
-                      isError={Boolean(error)}
-                    >
-                      <div className="space-y-2">
-                        {value.map((attr, index) => (
-                          // eslint-disable-next-line react/no-array-index-key
-                          <div key={`subject-attr-${index}`} className="flex items-center gap-2">
-                            <Select
-                              value={attr.type}
-                              onValueChange={(newType) => {
-                                const newValue = [...value];
-                                newValue[index] = {
-                                  ...attr,
-                                  type: newType as typeof attr.type
-                                };
-                                onChange(newValue);
-                              }}
-                              className="w-48"
+                {shouldShowSubjectSection && (
+                  <Controller
+                    control={control}
+                    name="subjectAttributes"
+                    render={({ field: { onChange, value }, fieldState: { error } }) => (
+                      <FormControl
+                        label="Subject Attributes"
+                        isRequired
+                        errorText={error?.message}
+                        isError={Boolean(error)}
+                      >
+                        <div className="space-y-2">
+                          {(value || []).map((attr, index) => (
+                            // eslint-disable-next-line react/no-array-index-key
+                            <div key={`subject-attr-${index}`} className="flex items-center gap-2">
+                              <Select
+                                value={attr.type}
+                                onValueChange={(newType) => {
+                                  const newValue = [...(value || [])];
+                                  newValue[index] = {
+                                    ...attr,
+                                    type: newType as typeof attr.type
+                                  };
+                                  onChange(newValue);
+                                }}
+                                className="w-48"
+                              >
+                                <SelectItem value="common_name">Common Name</SelectItem>
+                              </Select>
+                              <Input
+                                value={attr.value}
+                                onChange={(e) => {
+                                  const newValue = [...(value || [])];
+                                  newValue[index] = { ...attr, value: e.target.value };
+                                  onChange(newValue);
+                                }}
+                                placeholder="example.com"
+                                className="flex-1"
+                              />
+                              {(value || []).length > 1 && (
+                                <IconButton
+                                  ariaLabel="Remove Subject Attribute"
+                                  variant="plain"
+                                  size="sm"
+                                  onClick={() => {
+                                    const newValue = (value || []).filter((_, i) => i !== index);
+                                    onChange(newValue);
+                                  }}
+                                >
+                                  <FontAwesomeIcon icon={faTrash} />
+                                </IconButton>
+                              )}
+                            </div>
+                          ))}
+                          <Button
+                            type="button"
+                            variant="outline_bg"
+                            size="xs"
+                            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                            onClick={() => {
+                              onChange([...(value || []), { type: "common_name", value: "" }]);
+                            }}
+                            className="w-full"
+                          >
+                            Add Subject Attribute
+                          </Button>
+                        </div>
+                      </FormControl>
+                    )}
+                  />
+                )}
+
+                {shouldShowSanSection && (
+                  <Controller
+                    control={control}
+                    name="subjectAltNames"
+                    render={({ field: { onChange, value }, fieldState: { error } }) => (
+                      <FormControl
+                        label="Subject Alternative Names (SANs)"
+                        errorText={error?.message}
+                        isError={Boolean(error)}
+                      >
+                        <div className="space-y-2">
+                          {value.map((san, index) => (
+                            <div
+                              // eslint-disable-next-line react/no-array-index-key
+                              key={`subject-alt-name-${index}`}
+                              className="flex items-center gap-2"
                             >
-                              <SelectItem value="common_name">Common Name</SelectItem>
-                            </Select>
-                            <Input
-                              value={attr.value}
-                              onChange={(e) => {
-                                const newValue = [...value];
-                                newValue[index] = { ...attr, value: e.target.value };
-                                onChange(newValue);
-                              }}
-                              placeholder="example.com"
-                              className="flex-1"
-                            />
-                            {value.length > 1 && (
+                              <Select
+                                value={san.type}
+                                onValueChange={(newType) => {
+                                  const newValue = [...value];
+                                  newValue[index] = {
+                                    ...san,
+                                    type: newType as "dns" | "ip" | "email" | "uri"
+                                  };
+                                  onChange(newValue);
+                                }}
+                                className="w-24"
+                              >
+                                {allowedSanTypes.includes("dns") && (
+                                  <SelectItem value="dns">DNS</SelectItem>
+                                )}
+                                {allowedSanTypes.includes("ip") && (
+                                  <SelectItem value="ip">IP</SelectItem>
+                                )}
+                                {allowedSanTypes.includes("email") && (
+                                  <SelectItem value="email">Email</SelectItem>
+                                )}
+                                {allowedSanTypes.includes("uri") && (
+                                  <SelectItem value="uri">URI</SelectItem>
+                                )}
+                              </Select>
+                              <Input
+                                value={san.value}
+                                onChange={(e) => {
+                                  const newValue = [...value];
+                                  newValue[index] = { ...san, value: e.target.value };
+                                  onChange(newValue);
+                                }}
+                                placeholder={getSanPlaceholder(san.type)}
+                                className="flex-1"
+                              />
                               <IconButton
-                                ariaLabel="Remove Subject Attribute"
+                                ariaLabel="Remove SAN"
                                 variant="plain"
                                 size="sm"
                                 onClick={() => {
@@ -567,98 +713,30 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
                               >
                                 <FontAwesomeIcon icon={faTrash} />
                               </IconButton>
-                            )}
-                          </div>
-                        ))}
-                        <Button
-                          type="button"
-                          variant="outline_bg"
-                          size="xs"
-                          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-                          onClick={() => {
-                            onChange([...value, { type: "common_name", value: "" }]);
-                          }}
-                          className="w-full"
-                        >
-                          Add Subject Attribute
-                        </Button>
-                      </div>
-                    </FormControl>
-                  )}
-                />
-
-                <Controller
-                  control={control}
-                  name="subjectAltNames"
-                  render={({ field: { onChange, value }, fieldState: { error } }) => (
-                    <FormControl
-                      label="Subject Alternative Names (SANs)"
-                      errorText={error?.message}
-                      isError={Boolean(error)}
-                    >
-                      <div className="space-y-2">
-                        {value.map((san, index) => (
-                          <div
-                            // eslint-disable-next-line react/no-array-index-key
-                            key={`subject-alt-name-${index}`}
-                            className="flex items-center gap-2"
+                            </div>
+                          ))}
+                          <Button
+                            type="button"
+                            variant="outline_bg"
+                            size="xs"
+                            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+                            onClick={() => {
+                              const defaultType =
+                                allowedSanTypes.length > 0 ? allowedSanTypes[0] : "dns";
+                              onChange([
+                                ...value,
+                                { type: defaultType as "dns" | "ip" | "email" | "uri", value: "" }
+                              ]);
+                            }}
+                            className="w-full"
                           >
-                            <Select
-                              value={san.type}
-                              onValueChange={(newType) => {
-                                const newValue = [...value];
-                                newValue[index] = {
-                                  ...san,
-                                  type: newType as "dns" | "ip" | "email" | "uri"
-                                };
-                                onChange(newValue);
-                              }}
-                              className="w-24"
-                            >
-                              <SelectItem value="dns">DNS</SelectItem>
-                              <SelectItem value="ip">IP</SelectItem>
-                              <SelectItem value="email">Email</SelectItem>
-                              <SelectItem value="uri">URI</SelectItem>
-                            </Select>
-                            <Input
-                              value={san.value}
-                              onChange={(e) => {
-                                const newValue = [...value];
-                                newValue[index] = { ...san, value: e.target.value };
-                                onChange(newValue);
-                              }}
-                              placeholder={getSanPlaceholder(san.type)}
-                              className="flex-1"
-                            />
-                            <IconButton
-                              ariaLabel="Remove SAN"
-                              variant="plain"
-                              size="sm"
-                              onClick={() => {
-                                const newValue = value.filter((_, i) => i !== index);
-                                onChange(newValue);
-                              }}
-                            >
-                              <FontAwesomeIcon icon={faTrash} />
-                            </IconButton>
-                          </div>
-                        ))}
-                        <Button
-                          type="button"
-                          variant="outline_bg"
-                          size="xs"
-                          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-                          onClick={() => {
-                            onChange([...value, { type: "dns", value: "" }]);
-                          }}
-                          className="w-full"
-                        >
-                          Add SAN
-                        </Button>
-                      </div>
-                    </FormControl>
-                  )}
-                />
+                            Add SAN
+                          </Button>
+                        </div>
+                      </FormControl>
+                    )}
+                  />
+                )}
 
                 <Controller
                   control={control}
@@ -744,85 +822,89 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
                 </div>
 
                 <Accordion type="single" collapsible className="w-full">
-                  <AccordionItem value="key-usages">
-                    <AccordionTrigger>Key Usages</AccordionTrigger>
-                    <AccordionContent>
-                      <div className="grid grid-cols-2 gap-2 pl-2">
-                        {filteredKeyUsages.map(({ label, value }) => {
-                          const isRequired = requiredKeyUsages.includes(value);
-                          return (
-                            <Controller
-                              key={label}
-                              control={control}
-                              name={`keyUsages.${value}` as any}
-                              render={({ field }) => (
-                                <div className="flex items-center space-x-3">
-                                  <Checkbox
-                                    id={`key-usage-${value}`}
-                                    isChecked={field.value || false}
-                                    onCheckedChange={(checked) => {
-                                      if (!isRequired) {
-                                        field.onChange(checked);
-                                      }
-                                    }}
-                                    isDisabled={isRequired}
-                                  />
-                                  <div className="flex items-center gap-2">
-                                    <FormLabel
+                  {filteredKeyUsages.length > 0 && (
+                    <AccordionItem value="key-usages">
+                      <AccordionTrigger>Key Usages</AccordionTrigger>
+                      <AccordionContent>
+                        <div className="grid grid-cols-2 gap-2 pl-2">
+                          {filteredKeyUsages.map(({ label, value }) => {
+                            const isRequired = requiredKeyUsages.includes(value);
+                            return (
+                              <Controller
+                                key={label}
+                                control={control}
+                                name={`keyUsages.${value}` as any}
+                                render={({ field }) => (
+                                  <div className="flex items-center space-x-3">
+                                    <Checkbox
                                       id={`key-usage-${value}`}
-                                      className={`text-sm ${isRequired ? "text-mineshaft-200" : "cursor-pointer text-mineshaft-300"}`}
-                                      label={label}
+                                      isChecked={field.value || false}
+                                      onCheckedChange={(checked) => {
+                                        if (!isRequired) {
+                                          field.onChange(checked);
+                                        }
+                                      }}
+                                      isDisabled={isRequired}
                                     />
-                                    {isRequired && <span className="text-xs">(Required)</span>}
+                                    <div className="flex items-center gap-2">
+                                      <FormLabel
+                                        id={`key-usage-${value}`}
+                                        className={`text-sm ${isRequired ? "text-mineshaft-200" : "cursor-pointer text-mineshaft-300"}`}
+                                        label={label}
+                                      />
+                                      {isRequired && <span className="text-xs">(Required)</span>}
+                                    </div>
                                   </div>
-                                </div>
-                              )}
-                            />
-                          );
-                        })}
-                      </div>
-                    </AccordionContent>
-                  </AccordionItem>
+                                )}
+                              />
+                            );
+                          })}
+                        </div>
+                      </AccordionContent>
+                    </AccordionItem>
+                  )}
 
-                  <AccordionItem value="extended-key-usages">
-                    <AccordionTrigger>Extended Key Usages</AccordionTrigger>
-                    <AccordionContent>
-                      <div className="grid grid-cols-2 gap-2 pl-2">
-                        {filteredExtendedKeyUsages.map(({ label, value }) => {
-                          const isRequired = requiredExtendedKeyUsages.includes(value);
-                          return (
-                            <Controller
-                              key={label}
-                              control={control}
-                              name={`extendedKeyUsages.${value}` as any}
-                              render={({ field }) => (
-                                <div className="flex items-center space-x-3">
-                                  <Checkbox
-                                    id={`ext-key-usage-${value}`}
-                                    isChecked={field.value || false}
-                                    onCheckedChange={(checked) => {
-                                      if (!isRequired) {
-                                        field.onChange(checked);
-                                      }
-                                    }}
-                                    isDisabled={isRequired}
-                                  />
-                                  <div className="flex items-center gap-2">
-                                    <FormLabel
+                  {filteredExtendedKeyUsages.length > 0 && (
+                    <AccordionItem value="extended-key-usages">
+                      <AccordionTrigger>Extended Key Usages</AccordionTrigger>
+                      <AccordionContent>
+                        <div className="grid grid-cols-2 gap-2 pl-2">
+                          {filteredExtendedKeyUsages.map(({ label, value }) => {
+                            const isRequired = requiredExtendedKeyUsages.includes(value);
+                            return (
+                              <Controller
+                                key={label}
+                                control={control}
+                                name={`extendedKeyUsages.${value}` as any}
+                                render={({ field }) => (
+                                  <div className="flex items-center space-x-3">
+                                    <Checkbox
                                       id={`ext-key-usage-${value}`}
-                                      className={`text-sm ${isRequired ? "text-mineshaft-200" : "cursor-pointer text-mineshaft-300"}`}
-                                      label={label}
+                                      isChecked={field.value || false}
+                                      onCheckedChange={(checked) => {
+                                        if (!isRequired) {
+                                          field.onChange(checked);
+                                        }
+                                      }}
+                                      isDisabled={isRequired}
                                     />
-                                    {isRequired && <span className="text-xs">(Required)</span>}
+                                    <div className="flex items-center gap-2">
+                                      <FormLabel
+                                        id={`ext-key-usage-${value}`}
+                                        className={`text-sm ${isRequired ? "text-mineshaft-200" : "cursor-pointer text-mineshaft-300"}`}
+                                        label={label}
+                                      />
+                                      {isRequired && <span className="text-xs">(Required)</span>}
+                                    </div>
                                   </div>
-                                </div>
-                              )}
-                            />
-                          );
-                        })}
-                      </div>
-                    </AccordionContent>
-                  </AccordionItem>
+                                )}
+                              />
+                            );
+                          })}
+                        </div>
+                      </AccordionContent>
+                    </AccordionItem>
+                  )}
                 </Accordion>
               </>
             )}
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx b/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
index d2dfc414d..44deedf7d 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
@@ -52,7 +52,7 @@ export const PoliciesPage = () => {
               />
 
               <Tabs value={activeTab} onValueChange={(value) => setActiveTab(value as TabSections)}>
-                <TabList className="mb-6 w-full">
+                <TabList className="w-full">
                   <div className="flex w-full border-b border-mineshaft-600">
                     <Tab value={TabSections.CertificateProfiles}>Certificate Profiles</Tab>
                     <Tab value={TabSections.CertificateTemplatesV2}>Certificate Templates</Tab>
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
index 884e663de..55262439a 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
@@ -27,8 +27,20 @@ import { useListCertificateTemplatesV2 } from "@app/hooks/api/certificateTemplat
 
 const createSchema = z
   .object({
-    slug: z.string().trim().min(1, "Profile slug is required"),
-    description: z.string().optional(),
+    slug: z
+      .string()
+      .trim()
+      .min(1, "Profile slug is required")
+      .max(255, "Profile slug must be less than 255 characters")
+      .regex(
+        /^[a-zA-Z0-9-_]+$/,
+        "Profile slug must contain only letters, numbers, hyphens, and underscores"
+      ),
+    description: z
+      .string()
+      .trim()
+      .max(1000, "Description must be less than 1000 characters")
+      .optional(),
     enrollmentType: z.enum(["api", "est"]),
     certificateAuthorityId: z.string().min(1, "Certificate Authority is required"),
     certificateTemplateId: z.string().min(1, "Certificate Template is required"),
@@ -36,8 +48,19 @@ const createSchema = z
       .object({
         disableBootstrapCaValidation: z.boolean().optional(),
         passphrase: z.string().min(1, "EST passphrase is required"),
-        caChain: z.string().min(1, "EST CA chain is required")
+        caChain: z.string().min(1, "EST CA chain is required").optional()
       })
+      .refine(
+        (data) => {
+          if (!data.disableBootstrapCaValidation && !data.caChain) {
+            return false;
+          }
+          return true;
+        },
+        {
+          message: "EST CA chain is required"
+        }
+      )
       .optional(),
     apiConfig: z
       .object({
@@ -63,8 +86,20 @@ const createSchema = z
 
 const editSchema = z
   .object({
-    slug: z.string().trim().min(1, "Profile slug is required"),
-    description: z.string().optional(),
+    slug: z
+      .string()
+      .trim()
+      .min(1, "Profile slug is required")
+      .max(255, "Profile slug must be less than 255 characters")
+      .regex(
+        /^[a-zA-Z0-9-_]+$/,
+        "Profile slug must contain only letters, numbers, hyphens, and underscores"
+      ),
+    description: z
+      .string()
+      .trim()
+      .max(1000, "Description must be less than 1000 characters")
+      .optional(),
     enrollmentType: z.enum(["api", "est"]),
     certificateAuthorityId: z.string().optional(),
     certificateTemplateId: z.string().optional(),
@@ -136,7 +171,7 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
           estConfig: {
             disableBootstrapCaValidation: profile.estConfig?.disableBootstrapCaValidation || false,
             passphrase: "",
-            caChain: ""
+            caChain: undefined
           },
           apiConfig: {
             autoRenew: profile.apiConfig?.autoRenew || false,
@@ -193,7 +228,11 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
         };
 
         if (data.enrollmentType === "est" && data.estConfig) {
-          createData.estConfig = data.estConfig;
+          createData.estConfig = {
+            passphrase: data.estConfig.passphrase,
+            caChain: data.estConfig.caChain || "",
+            disableBootstrapCaValidation: data.estConfig.disableBootstrapCaValidation
+          };
         } else if (data.enrollmentType === "api" && data.apiConfig) {
           createData.apiConfig = data.apiConfig;
         }
@@ -241,7 +280,7 @@ export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }
             name="slug"
             render={({ field, fieldState: { error } }) => (
               <FormControl
-                label="Profile Slug"
+                label="Name"
                 isRequired
                 isError={Boolean(error)}
                 errorText={error?.message}
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx
index 0b2b824a3..fc8292d78 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx
@@ -150,7 +150,7 @@ export const ProfileRow = ({ profile, onEditProfile, onDeleteProfile }: Props) =
     <Tr key={profile.id} className="h-10 transition-colors duration-100 hover:bg-mineshaft-700">
       <Td>
         <div className="flex items-center gap-2">
-          <div className="font-medium text-mineshaft-100">{profile.slug}</div>
+          <div className="text-mineshaft-300">{profile.slug}</div>
           {profile.description && (
             <Tooltip content={profile.description}>
               <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
index 4abe390a7..909a2e8ac 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
@@ -362,8 +362,8 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
     return {
       name: data.name,
       description: data.description,
-      subject: subject.length > 0 ? subject : undefined,
-      sans: sans.length > 0 ? sans : undefined,
+      subject,
+      sans,
       keyUsages: Object.keys(keyUsages).length > 0 ? keyUsages : undefined,
       extendedKeyUsages: Object.keys(extendedKeyUsages).length > 0 ? extendedKeyUsages : undefined,
       algorithms: Object.keys(algorithms).length > 0 ? algorithms : undefined,
@@ -614,7 +614,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                               required
                             />
 
-                            {watchedAttributes.length > 1 && (
+                            {watchedAttributes.length > 0 && (
                               <IconButton
                                 ariaLabel="Remove Attribute"
                                 variant="plain"
@@ -672,7 +672,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                               };
                               setValue("subjectAlternativeNames", newSans);
                             }}
-                            className="w-24"
+                            className="w-36"
                           >
                             {SAN_TYPE_OPTIONS.map((type) => (
                               <SelectItem key={type} value={type}>
@@ -719,7 +719,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                             required
                           />
 
-                          {watchedSans.length > 1 && (
+                          {watchedSans.length > 0 && (
                             <IconButton
                               ariaLabel="Remove SAN"
                               variant="plain"
@@ -755,7 +755,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                 <div className="space-y-6">
                   <div>
                     <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
-                      Signature Algorithms
+                      Allowed Signature Algorithms
                     </h4>
                     <Controller
                       control={control}
@@ -799,7 +799,9 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                   </div>
 
                   <div>
-                    <h4 className="mb-3 text-sm font-medium text-mineshaft-200">Key Algorithms</h4>
+                    <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
+                      Allowed Key Algorithms
+                    </h4>
                     <Controller
                       control={control}
                       name="keyAlgorithm.allowedKeyTypes"
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx
index 178fe7d17..8cb011706 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx
@@ -89,7 +89,7 @@ export const TemplateList = ({ onEditTemplate, onDeleteTemplate }: Props) => {
               >
                 <Td>
                   <div className="flex items-center gap-2">
-                    <div className="font-medium">{template.name}</div>
+                    <div className="text-mineshaft-300">{template.name}</div>
                     {template.description && (
                       <Tooltip content={template.description}>
                         <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/schemas.ts b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/schemas.ts
index b4f6fc9eb..861f4e5d9 100644
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/schemas.ts
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/schemas.ts
@@ -50,8 +50,20 @@ export const uiKeyAlgorithmSchema = z.object({
 });
 
 export const templateSchema = z.object({
-  name: z.string().trim().min(1, "Template name is required"),
-  description: z.string().optional(),
+  name: z
+    .string()
+    .trim()
+    .min(1, "Template name is required")
+    .max(255, "Template name must be less than 255 characters")
+    .regex(
+      /^[a-zA-Z0-9-_]+$/,
+      "Template name must contain only letters, numbers, hyphens, and underscores"
+    ),
+  description: z
+    .string()
+    .trim()
+    .max(1000, "Description must be less than 1000 characters")
+    .optional(),
   attributes: z.array(uiAttributeSchema).optional(),
   subjectAlternativeNames: z.array(uiSanSchema).optional(),
   keyUsages: uiKeyUsagesSchema.optional(),
@@ -86,8 +98,20 @@ export const apiSanSchema = z
   });
 
 export const apiTemplateSchema = z.object({
-  name: z.string().trim().min(1, "Template name is required"),
-  description: z.string().optional(),
+  name: z
+    .string()
+    .trim()
+    .min(1, "Template name is required")
+    .max(255, "Template name must be less than 255 characters")
+    .regex(
+      /^[a-zA-Z0-9-_]+$/,
+      "Template name must contain only letters, numbers, hyphens, and underscores"
+    ),
+  description: z
+    .string()
+    .trim()
+    .max(1000, "Description must be less than 1000 characters")
+    .optional(),
   subject: z.array(apiSubjectSchema).optional(),
   sans: z.array(apiSanSchema).optional(),
   keyUsages: z
@@ -106,14 +130,15 @@ export const apiTemplateSchema = z.object({
     .optional(),
   algorithms: z
     .object({
-      signature: z.array(z.string()).optional(),
-      keyAlgorithm: z.array(z.string()).optional()
+      signature: z.array(z.string().trim().min(1, "Algorithm cannot be empty")).optional(),
+      keyAlgorithm: z.array(z.string().trim().min(1, "Algorithm cannot be empty")).optional()
     })
     .optional(),
   validity: z
     .object({
       max: z
         .string()
+        .trim()
         .regex(/^[1-9]\d*[dhmy]$/, "Must be in format like '365d', '12m', '1y', or '24h'")
         .optional()
     })
diff --git a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
index ec5bfc62a..efd7b123b 100644
--- a/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
+++ b/frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
@@ -393,12 +393,8 @@ export const projectRoleFormSchema = z.object({
       })
         .array()
         .default([]),
-      [ProjectPermissionSub.CertificateProfiles]: CertificateProfilePolicyActionSchema.extend({
-        inverted: z.boolean().optional(),
-        conditions: ConditionSchema
-      })
-        .array()
-        .default([]),
+      [ProjectPermissionSub.CertificateProfiles]:
+        CertificateProfilePolicyActionSchema.array().default([]),
       [ProjectPermissionSub.SshCertificateAuthorities]: GeneralPolicyActionSchema.array().default(
         []
       ),
@@ -479,7 +475,6 @@ export const isConditionalSubjects = (
   subject === ProjectPermissionSub.SecretRotation ||
   subject === ProjectPermissionSub.PkiSubscribers ||
   subject === ProjectPermissionSub.CertificateTemplates ||
-  subject === ProjectPermissionSub.CertificateProfiles ||
   subject === ProjectPermissionSub.SecretSyncs ||
   subject === ProjectPermissionSub.PkiSyncs ||
   subject === ProjectPermissionSub.SecretEvents ||
@@ -1176,9 +1171,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ),
         [ProjectPermissionCertificateProfileActions.IssueCert]: action.includes(
           ProjectPermissionCertificateProfileActions.IssueCert
-        ),
-        conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
-        inverted
+        )
       });
 
       return;
@@ -2195,6 +2188,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
         {
           subject: ProjectPermissionSub.PkiSyncs,
           actions: [ProjectPermissionPkiSyncActions.Read]
+        },
+        {
+          subject: ProjectPermissionSub.CertificateProfiles,
+          actions: [ProjectPermissionCertificateProfileActions.Read]
         }
       ]
     },
@@ -2226,6 +2223,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
         {
           subject: ProjectPermissionSub.PkiSyncs,
           actions: Object.values(ProjectPermissionPkiSyncActions)
+        },
+        {
+          subject: ProjectPermissionSub.CertificateProfiles,
+          actions: Object.values(ProjectPermissionCertificateProfileActions)
         }
       ]
     },