From 86f308d7d10ba13e0ba6c84e7f48f82e1841f8c4 Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Fri, 7 Nov 2025 18:24:18 -0300 Subject: [PATCH 1/3] Fix CSR KU/EKU check --- .../certificate-template-v2-service.ts | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts b/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts index 0046ae0e5..656c12e64 100644 --- a/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts +++ b/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts @@ -482,7 +482,7 @@ export const certificateTemplateV2ServiceFactory = ({ } // Check ALLOWED key usages - if present, all usages must be in allowed list - if (request.keyUsages && keyUsagePolicy && keyUsagePolicy.allowed && keyUsagePolicy.allowed.length > 0) { + if (request.keyUsages && keyUsagePolicy) { const allAllowedUsages = [...(keyUsagePolicy.required || []), ...(keyUsagePolicy.allowed || [])]; const invalidUsages = request.keyUsages.filter((usage) => !allAllowedUsages.includes(usage)); if (invalidUsages.length > 0) { @@ -517,12 +517,7 @@ export const certificateTemplateV2ServiceFactory = ({ } // Check ALLOWED extended key usages - if present, all usages must be in allowed list - if ( - request.extendedKeyUsages && - extendedKeyUsagePolicy && - extendedKeyUsagePolicy.allowed && - extendedKeyUsagePolicy.allowed.length > 0 - ) { + if (request.extendedKeyUsages && extendedKeyUsagePolicy) { const allAllowedExtendedUsages = [ ...(extendedKeyUsagePolicy.required || []), ...(extendedKeyUsagePolicy.allowed || []) From 5b73f912e443391ce56aa67c1759986506d2ba68 Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Fri, 7 Nov 2025 18:57:14 -0300 Subject: [PATCH 2/3] Remove outdated pki unit test --- .../certificate-template-v2-service.test.ts | 33 ------------------- 1 file changed, 33 deletions(-) diff --git a/backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts b/backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts index daacc5dde..f73d516a6 100644 --- a/backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts +++ b/backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts @@ -613,39 +613,6 @@ describe("CertificateTemplateV2Service", () => { expect(result.isValid).toBe(true); }); - it("should handle camelCase key usage mapping correctly", async () => { - const templateWithOptionalUsages = { - ...sampleTemplate, - keyUsages: { - requiredUsages: { - all: [CertKeyUsageType.DIGITAL_SIGNATURE, CertKeyUsageType.NON_REPUDIATION, CertKeyUsageType.KEY_AGREEMENT] - }, - optionalUsages: { all: [CertKeyUsageType.CRL_SIGN, CertKeyUsageType.DECIPHER_ONLY] } - }, - extendedKeyUsages: { - requiredUsages: { all: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING] }, - optionalUsages: { all: [CertExtendedKeyUsageType.SERVER_AUTH, CertExtendedKeyUsageType.OCSP_SIGNING] } - } - }; - mockCertificateTemplateV2DAL.findById.mockResolvedValue(templateWithOptionalUsages); - - const requestWithCamelCaseUsages = { - ...validRequest, - keyUsages: [ - CertKeyUsageType.DIGITAL_SIGNATURE, - CertKeyUsageType.NON_REPUDIATION, - CertKeyUsageType.KEY_AGREEMENT, - CertKeyUsageType.CRL_SIGN, - CertKeyUsageType.DECIPHER_ONLY - ], - extendedKeyUsages: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING] - }; - - const result = await service.validateCertificateRequest("template-123", requestWithCamelCaseUsages); - expect(result.isValid).toBe(true); - expect(result.errors).toHaveLength(0); - }); - it("should validate wildcard patterns in allow attributes", async () => { const wildcardTemplate = { ...sampleTemplate, From 2e0a404e5251dfa8e6dee993c7e08741b02dbc67 Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Mon, 10 Nov 2025 16:09:06 -0300 Subject: [PATCH 3/3] Add missing validation fields on CSR flow --- .../src/services/certificate-v3/certificate-v3-service.ts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/backend/src/services/certificate-v3/certificate-v3-service.ts b/backend/src/services/certificate-v3/certificate-v3-service.ts index 7f4c6c637..dd27cd1b0 100644 --- a/backend/src/services/certificate-v3/certificate-v3-service.ts +++ b/backend/src/services/certificate-v3/certificate-v3-service.ts @@ -9,6 +9,7 @@ import { ProjectPermissionCertificateProfileActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; +import { TPkiAcmeAccountDALFactory } from "@app/ee/services/pki-acme/pki-acme-account-dal"; import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type"; import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal"; @@ -64,7 +65,6 @@ import { TSignCertificateFromProfileDTO, TUpdateRenewalConfigDTO } from "./certificate-v3-types"; -import { TPkiAcmeAccountDALFactory } from "@app/ee/services/pki-acme/pki-acme-account-dal"; type TCertificateV3ServiceFactoryDep = { certificateDAL: Pick; @@ -543,6 +543,10 @@ export const certificateV3ServiceFactory = ({ const { keyAlgorithm: extractedKeyAlgorithm, signatureAlgorithm: extractedSignatureAlgorithm } = extractAlgorithmsFromCSR(csr); + mappedCertificateRequest.keyAlgorithm = extractedKeyAlgorithm; + mappedCertificateRequest.signatureAlgorithm = extractedSignatureAlgorithm; + mappedCertificateRequest.validity = validity; + const validationResult = await certificateTemplateV2Service.validateCertificateRequest( profile.certificateTemplateId, mappedCertificateRequest