Merge pull request #4834 from Infisical/fix/pki-csr-key-usage-check

Fix CSR KU/EKU check

backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts

@@ -613,39 +613,6 @@ describe("CertificateTemplateV2Service", () => {
       expect(result.isValid).toBe(true);
     });
 
-    it("should handle camelCase key usage mapping correctly", async () => {
-      const templateWithOptionalUsages = {
-        ...sampleTemplate,
-        keyUsages: {
-          requiredUsages: {
-            all: [CertKeyUsageType.DIGITAL_SIGNATURE, CertKeyUsageType.NON_REPUDIATION, CertKeyUsageType.KEY_AGREEMENT]
-          },
-          optionalUsages: { all: [CertKeyUsageType.CRL_SIGN, CertKeyUsageType.DECIPHER_ONLY] }
-        },
-        extendedKeyUsages: {
-          requiredUsages: { all: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING] },
-          optionalUsages: { all: [CertExtendedKeyUsageType.SERVER_AUTH, CertExtendedKeyUsageType.OCSP_SIGNING] }
-        }
-      };
-      mockCertificateTemplateV2DAL.findById.mockResolvedValue(templateWithOptionalUsages);
-
-      const requestWithCamelCaseUsages = {
-        ...validRequest,
-        keyUsages: [
-          CertKeyUsageType.DIGITAL_SIGNATURE,
-          CertKeyUsageType.NON_REPUDIATION,
-          CertKeyUsageType.KEY_AGREEMENT,
-          CertKeyUsageType.CRL_SIGN,
-          CertKeyUsageType.DECIPHER_ONLY
-        ],
-        extendedKeyUsages: [CertExtendedKeyUsageType.CLIENT_AUTH, CertExtendedKeyUsageType.CODE_SIGNING]
-      };
-
-      const result = await service.validateCertificateRequest("template-123", requestWithCamelCaseUsages);
-      expect(result.isValid).toBe(true);
-      expect(result.errors).toHaveLength(0);
-    });
-
     it("should validate wildcard patterns in allow attributes", async () => {
       const wildcardTemplate = {
         ...sampleTemplate,

backend/src/services/certificate-template-v2/certificate-template-v2-service.ts

@@ -482,7 +482,7 @@ export const certificateTemplateV2ServiceFactory = ({
       }
 
       // Check ALLOWED key usages - if present, all usages must be in allowed list
-      if (request.keyUsages && keyUsagePolicy && keyUsagePolicy.allowed && keyUsagePolicy.allowed.length > 0) {
+      if (request.keyUsages && keyUsagePolicy) {
         const allAllowedUsages = [...(keyUsagePolicy.required || []), ...(keyUsagePolicy.allowed || [])];
         const invalidUsages = request.keyUsages.filter((usage) => !allAllowedUsages.includes(usage));
         if (invalidUsages.length > 0) {
@@ -517,12 +517,7 @@ export const certificateTemplateV2ServiceFactory = ({
       }
 
       // Check ALLOWED extended key usages - if present, all usages must be in allowed list
-      if (
+      if (request.extendedKeyUsages && extendedKeyUsagePolicy) {
-        request.extendedKeyUsages &&
-        extendedKeyUsagePolicy &&
-        extendedKeyUsagePolicy.allowed &&
-        extendedKeyUsagePolicy.allowed.length > 0
-      ) {
         const allAllowedExtendedUsages = [
           ...(extendedKeyUsagePolicy.required || []),
           ...(extendedKeyUsagePolicy.allowed || [])

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -543,6 +543,10 @@ export const certificateV3ServiceFactory = ({
     const { keyAlgorithm: extractedKeyAlgorithm, signatureAlgorithm: extractedSignatureAlgorithm } =
       extractAlgorithmsFromCSR(csr);
 
+    mappedCertificateRequest.keyAlgorithm = extractedKeyAlgorithm;
+    mappedCertificateRequest.signatureAlgorithm = extractedSignatureAlgorithm;
+    mappedCertificateRequest.validity = validity;
+
     const validationResult = await certificateTemplateV2Service.validateCertificateRequest(
       profile.certificateTemplateId,
       mappedCertificateRequest