PKI: EST passphrase fix and UI fixes

2026-09-22 13:39:35 +00:00 · 2025-10-20 13:37:02 -03:00
parent 2b169e9c95
commit fccc2ed881
17 changed files with 122 additions and 312 deletions
--- a/backend/src/server/routes/index.ts
+++ b/backend/src/server/routes/index.ts
@@ -2127,7 +2127,6 @@ export const registerRoutes = async (

  const certificateEstV3Service = certificateEstV3ServiceFactory({
    internalCertificateAuthorityService,
-    certificateTemplateDAL,
    certificateTemplateV2Service,
    certificateAuthorityDAL,
    certificateAuthorityCertDAL,
--- a/backend/src/server/routes/v3/certificates-router.ts
+++ b/backend/src/server/routes/v3/certificates-router.ts
@@ -1,38 +1,25 @@
-import * as x509 from "@peculiar/x509";
 import { z } from "zod";

 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags } from "@app/lib/api-docs";
-import { BadRequestError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import {
  ACMESANType,
-  CertExtendedKeyUsageOIDToName,
  CertificateOrderStatus,
  CertKeyAlgorithm,
-  CertKeyUsage,
-  CertSignatureAlgorithm,
-  mapLegacyAltNameType,
-  TAltNameMapping
+  CertSignatureAlgorithm
 } from "@app/services/certificate/certificate-types";
-import { parseDistinguishedName } from "@app/services/certificate-authority/certificate-authority-fns";
-import {
-  validateAndMapAltNameType,
-  validateCaDateField
-} from "@app/services/certificate-authority/certificate-authority-validators";
+import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators";
 import {
  CertExtendedKeyUsageType,
  CertKeyUsageType,
-  CertSubjectAlternativeNameType,
-  mapLegacyExtendedKeyUsageToStandard,
-  mapLegacyKeyUsageToStandard
+  CertSubjectAlternativeNameType
 } from "@app/services/certificate-common/certificate-constants";
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
-import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";

 interface CertificateRequestForService {
  commonName?: string;
@@ -66,67 +53,6 @@ const validateDateOrder = (data: { notBefore?: string; notAfter?: string }) => {
  return true;
 };

-const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => {
-  let csrPem = csr;
-  if (!csr.includes("-----BEGIN CERTIFICATE REQUEST-----")) {
-    try {
-      csrPem = Buffer.from(csr, "base64").toString("utf8");
-    } catch (error) {
-      throw new BadRequestError({ message: "Invalid base64 CSR encoding" });
-    }
-  }
-
-  const csrObj = new x509.Pkcs10CertificateRequest(csrPem);
-  const subject = parseDistinguishedName(csrObj.subject);
-
-  const certificateRequest: TCertificateRequest = {
-    commonName: subject.commonName,
-    organization: subject.organization,
-    organizationUnit: subject.ou,
-    locality: subject.locality,
-    state: subject.province,
-    country: subject.country
-  };
-
-  const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
-  if (csrKeyUsageExtension) {
-    const csrKeyUsages = Object.values(CertKeyUsage).filter(
-      // eslint-disable-next-line no-bitwise
-      (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
-    );
-    certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard);
-  }
-
-  const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
-  if (csrExtendedKeyUsageExtension) {
-    const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages
-      .map((ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string])
-      .filter((eku) => eku !== undefined);
-    certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard);
-  }
-
-  const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
-  if (sanExtension) {
-    const sanNames = new x509.GeneralNames(sanExtension.value);
-    const altNamesArray: TAltNameMapping[] = sanNames.items
-      .filter((value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip")
-      .map((name): TAltNameMapping => {
-        const altNameType = validateAndMapAltNameType(name.value);
-        if (!altNameType) {
-          throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` });
-        }
-        return altNameType;
-      });
-
-    certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({
-      type: mapLegacyAltNameType(altName.type),
-      value: altName.value
-    }));
-  }
-
-  return certificateRequest;
-};
-
 export const registerCertificatesRouter = async (server: FastifyZodProvider) => {
  server.route({
    method: "POST",
@@ -140,7 +66,6 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
      body: z
        .object({
          profileId: z.string().uuid(),
-          csr: z.string().trim().optional(),
          commonName: validateTemplateRegexField.optional(),
          ttl: z
            .string()
@@ -182,43 +107,19 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
    },
    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
    handler: async (req) => {
-      let certificateRequestForService: CertificateRequestForService;
-
-      if (req.body.csr) {
-        try {
-          const csrData = extractCertificateRequestFromCSR(req.body.csr);
-
-          certificateRequestForService = {
-            commonName: csrData.commonName,
-            keyUsages: csrData.keyUsages,
-            extendedKeyUsages: csrData.extendedKeyUsages,
-            altNames: csrData.subjectAlternativeNames,
-            validity: {
-              ttl: req.body.ttl
-            },
-            notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-            notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-            signatureAlgorithm: req.body.signatureAlgorithm,
-            keyAlgorithm: req.body.keyAlgorithm
-          };
-        } catch (error) {
-          throw new BadRequestError({ message: `Invalid CSR: ${(error as Error).message}` });
-        }
-      } else {
-        certificateRequestForService = {
-          commonName: req.body.commonName,
-          keyUsages: req.body.keyUsages,
-          extendedKeyUsages: req.body.extendedKeyUsages,
-          altNames: req.body.altNames,
-          validity: {
-            ttl: req.body.ttl
-          },
-          notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-          notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-          signatureAlgorithm: req.body.signatureAlgorithm,
-          keyAlgorithm: req.body.keyAlgorithm
-        };
-      }
+      const certificateRequestForService: CertificateRequestForService = {
+        commonName: req.body.commonName,
+        keyUsages: req.body.keyUsages,
+        extendedKeyUsages: req.body.extendedKeyUsages,
+        altNames: req.body.altNames,
+        validity: {
+          ttl: req.body.ttl
+        },
+        notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
+        notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
+        signatureAlgorithm: req.body.signatureAlgorithm,
+        keyAlgorithm: req.body.keyAlgorithm
+      };

      const mappedCertificateRequest = mapEnumsForValidation(certificateRequestForService);

--- a/backend/src/services/certificate-common/certificate-constants.ts
+++ b/backend/src/services/certificate-common/certificate-constants.ts
@@ -55,39 +55,6 @@ export enum CertSubjectAttributeType {
  COUNTRY = "country"
 }

-export const mapSANTypeToLegacy = (type: CertSubjectAlternativeNameType): string => {
-  switch (type) {
-    case CertSubjectAlternativeNameType.DNS_NAME:
-      return "dns";
-    case CertSubjectAlternativeNameType.IP_ADDRESS:
-      return "ip";
-    case CertSubjectAlternativeNameType.EMAIL:
-      return "email";
-    case CertSubjectAlternativeNameType.URI:
-      return "uri";
-    default:
-      return type;
-  }
-};
-
-export const mapLegacySANTypeToStandard = (type: string): CertSubjectAlternativeNameType => {
-  switch (type) {
-    case "dns":
-    case "dns_name":
-      return CertSubjectAlternativeNameType.DNS_NAME;
-    case "ip":
-    case "ip_address":
-      return CertSubjectAlternativeNameType.IP_ADDRESS;
-    case "email":
-      return CertSubjectAlternativeNameType.EMAIL;
-    case "uri":
-    case "url":
-      return CertSubjectAlternativeNameType.URI;
-    default:
-      throw new Error(`Unknown SAN type: ${type}`);
-  }
-};
-
 export const mapKeyUsageToLegacy = (usage: CertKeyUsageType): string => {
  switch (usage) {
    case CertKeyUsageType.DIGITAL_SIGNATURE:
--- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
+++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts
@@ -123,6 +123,12 @@ vi.mock("@app/services/certificate/certificate-types", () => ({
    };
    return mapping[type] || type;
  }),
+  TAltNameType: {
+    EMAIL: "email",
+    DNS: "dns",
+    IP: "ip",
+    URL: "url"
+  },
  CertExtendedKeyUsageOIDToName: {
    "1.3.6.1.5.5.7.3.1": "serverAuth",
    "1.3.6.1.5.5.7.3.2": "clientAuth",
@@ -161,10 +167,6 @@ describe("CertificateEstV3Service Security Fix", () => {
    signCertFromCa: vi.fn()
  };

-  const mockCertificateTemplateDAL = {
-    findById: vi.fn()
-  };
-
  const mockCertificateTemplateV2Service = {
    validateCertificateRequest: vi.fn()
  };
@@ -230,7 +232,6 @@ describe("CertificateEstV3Service Security Fix", () => {

    service = certificateEstV3ServiceFactory({
      internalCertificateAuthorityService: mockInternalCertificateAuthorityService,
-      certificateTemplateDAL: mockCertificateTemplateDAL,
      certificateTemplateV2Service: mockCertificateTemplateV2Service,
      certificateAuthorityDAL: mockCertificateAuthorityDAL,
      certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL,
--- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
+++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts
@@ -7,7 +7,8 @@ import {
  CertExtendedKeyUsageOIDToName,
  CertKeyUsage,
  mapLegacyAltNameType,
-  TAltNameMapping
+  TAltNameMapping,
+  TAltNameType
 } from "@app/services/certificate/certificate-types";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
@@ -25,7 +26,6 @@ import {
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
-import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
 import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
 import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
 import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal";
@@ -38,7 +38,6 @@ import { TLicenseServiceFactory } from "../../ee/services/license/license-servic

 type TCertificateEstV3ServiceFactoryDep = {
  internalCertificateAuthorityService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa">;
-  certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "findById">;
  certificateTemplateV2Service: Pick<TCertificateTemplateV2ServiceFactory, "validateCertificateRequest">;
  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
@@ -53,7 +52,6 @@ export type TCertificateEstV3ServiceFactory = ReturnType<typeof certificateEstV3

 export const certificateEstV3ServiceFactory = ({
  internalCertificateAuthorityService,
-  certificateTemplateDAL,
  certificateTemplateV2Service,
  certificateAuthorityCertDAL,
  certificateAuthorityDAL,
@@ -98,7 +96,11 @@ export const certificateEstV3ServiceFactory = ({
      const sanNames = new x509.GeneralNames(sanExtension.value);
      const altNamesArray: TAltNameMapping[] = sanNames.items
        .filter(
-          (value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip"
+          (value) =>
+            value.type === TAltNameType.EMAIL ||
+            value.type === TAltNameType.DNS ||
+            value.type === TAltNameType.IP ||
+            value.type === TAltNameType.URL
        )
        .map((name): TAltNameMapping => {
          const altNameType = validateAndMapAltNameType(name.value);
@@ -257,13 +259,6 @@ export const certificateEstV3ServiceFactory = ({
      });
    }

-    const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
-    if (!certTemplate) {
-      throw new NotFoundError({
-        message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
-      });
-    }
-
    const leafCertificate = extractX509CertFromChain(decodeURIComponent(sslClientCert))?.[0];

    if (!leafCertificate) {
@@ -272,7 +267,7 @@ export const certificateEstV3ServiceFactory = ({

    const cert = new x509.X509Certificate(leafCertificate);
    const caCertChains = await getCaCertChains({
-      caId: certTemplate.caId,
+      caId: profile.caId,
      certificateAuthorityCertDAL,
      certificateAuthorityDAL,
      projectDAL,
@@ -374,17 +369,10 @@ export const certificateEstV3ServiceFactory = ({
      });
    }

-    const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
-    if (!certTemplate) {
-      throw new NotFoundError({
-        message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
-      });
-    }
-
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
    if (!ca?.internalCa?.id) {
      throw new NotFoundError({
-        message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found`
+        message: `Internal Certificate Authority with ID '${profile.caId}' not found`
      });
    }

@@ -396,15 +384,17 @@ export const certificateEstV3ServiceFactory = ({
      kmsService
    });

-    const certificateChain = extractX509CertFromChain(caCertChain);
-    if (!certificateChain || certificateChain.length === 0) {
-      throw new BadRequestError({
-        message: "Invalid CA certificate chain: unable to extract certificates"
-      });
+    let certificates: x509.X509Certificate[] = [];
+    if (caCertChain && caCertChain.trim()) {
+      try {
+        certificates = extractX509CertFromChain(caCertChain).map((cert) => new x509.X509Certificate(cert));
+      } catch (error) {
+        certificates = [];
+      }
    }

-    const certificates = certificateChain.map((cert) => new x509.X509Certificate(cert));
    const caCertificate = new x509.X509Certificate(caCert);
+
    return convertRawCertsToPkcs7([caCertificate.rawData, ...certificates.map((cert) => cert.rawData)]);
  };

--- a/backend/src/services/certificate-profile/certificate-profile-service.ts
+++ b/backend/src/services/certificate-profile/certificate-profile-service.ts
@@ -805,7 +805,7 @@ export const certificateProfileServiceFactory = ({
      isEnabled: true,
      caChain: profile.estConfig.caChain,
      disableBootstrapCertValidation: profile.estConfig.disableBootstrapCaValidation,
-      hashedPassphrase: ""
+      hashedPassphrase: profile.estConfig.passphrase
    };
  };

--- a/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
+++ b/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
@@ -41,12 +41,9 @@ export const certificateTemplateV2ServiceFactory = ({
    attributes.forEach((attr) => {
      const existing = consolidated.get(attr.type);
      if (existing) {
-        consolidated.set(attr.type, {
-          ...attr,
-          allowed: [...new Set([...(existing.allowed || []), ...(attr.allowed || [])])],
-          required: [...new Set([...(existing.required || []), ...(attr.required || [])])],
-          denied: [...new Set([...(existing.denied || []), ...(attr.denied || [])])]
-        } as T);
+        throw new ForbiddenRequestError({
+          message: `Duplicate attribute type '${attr.type}' found in request. Each attribute type must appear only once.`
+        });
      } else {
        consolidated.set(attr.type, attr);
      }
--- a/backend/src/services/certificate-v3/certificate-v3-service.ts
+++ b/backend/src/services/certificate-v3/certificate-v3-service.ts
@@ -193,21 +193,13 @@ export const certificateV3ServiceFactory = ({
      subjectAlternativeNames: certificateRequest.altNames
    });

-    let template;
-    try {
-      template = await certificateTemplateV2Service.getTemplateV2ById({
-        actor,
-        actorId,
-        actorAuthMethod,
-        actorOrgId,
-        templateId: profile.certificateTemplateId
-      });
-    } catch (error) {
-      throw new BadRequestError({
-        message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.`
-      });
-    }
-
+    const template = await certificateTemplateV2Service.getTemplateV2ById({
+      actor,
+      actorId,
+      actorAuthMethod,
+      actorOrgId,
+      templateId: profile.certificateTemplateId
+    });
    if (!template) {
      throw new NotFoundError({ message: "Certificate template not found for this profile" });
    }
--- a/frontend/src/hooks/api/certificateProfiles/queries.tsx
+++ b/frontend/src/hooks/api/certificateProfiles/queries.tsx
@@ -22,6 +22,7 @@ export const certificateProfileKeys = {
    search?: string;
    includeMetrics?: boolean;
    includeConfigs?: boolean;
+    enrollmentType?: string;
    expiringDays?: number;
  }) => ["certificate-profiles", "list", params],
  getById: (profileId: string) => ["certificate-profiles", "get-by-id", profileId],
@@ -52,6 +53,7 @@ export const useListCertificateProfiles = ({
  search,
  includeMetrics = false,
  includeConfigs = false,
+  enrollmentType,
  expiringDays = 7
 }: TListCertificateProfilesDTO) => {
  return useQuery({
@@ -62,6 +64,7 @@ export const useListCertificateProfiles = ({
      search,
      includeMetrics,
      includeConfigs,
+      enrollmentType,
      expiringDays
    }),
    queryFn: async () => {
@@ -76,6 +79,7 @@ export const useListCertificateProfiles = ({
          search,
          includeMetrics,
          includeConfigs,
+          enrollmentType,
          expiringDays
        }
      });
--- a/frontend/src/hooks/api/certificateProfiles/types.ts
+++ b/frontend/src/hooks/api/certificateProfiles/types.ts
@@ -83,6 +83,7 @@ export type TListCertificateProfilesDTO = {
  search?: string;
  includeMetrics?: boolean;
  includeConfigs?: boolean;
+  enrollmentType?: "api" | "est";
  expiringDays?: number;
 };

--- a/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx
@@ -33,6 +33,7 @@ export const AlgorithmSelectors = ({
              label="Signature Algorithm"
              errorText={signatureError}
              isError={Boolean(signatureError)}
+              isRequired
            >
              <Select
                defaultValue=""
@@ -62,7 +63,12 @@ export const AlgorithmSelectors = ({
          control={control}
          name="keyAlgorithm"
          render={({ field: { onChange, ...field } }) => (
-            <FormControl label="Key Algorithm" errorText={keyError} isError={Boolean(keyError)}>
+            <FormControl
+              label="Key Algorithm"
+              errorText={keyError}
+              isError={Boolean(keyError)}
+              isRequired
+            >
              <Select
                defaultValue=""
                {...field}
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
@@ -25,15 +25,11 @@ import { useListCertificateProfiles } from "@app/hooks/api/certificateProfiles";
 import { CertExtendedKeyUsage, CertKeyUsage } from "@app/hooks/api/certificates/enums";
 import { useGetCertificateTemplateV2ById } from "@app/hooks/api/certificateTemplates/queries";
 import { UsePopUpState } from "@app/hooks/usePopUp";
+import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";

 import { AlgorithmSelectors } from "./AlgorithmSelectors";
 import { CertificateContent } from "./CertificateContent";
-import {
-  filterUsages,
-  formatSubjectAltNames,
-  FrontendSanType,
-  getAttributeValue
-} from "./certificateUtils";
+import { filterUsages, formatSubjectAltNames, getAttributeValue } from "./certificateUtils";
 import { KeyUsageSection } from "./KeyUsageSection";
 import { SubjectAltNamesField } from "./SubjectAltNamesField";
 import { useCertificateTemplate } from "./useCertificateTemplate";
@@ -61,7 +57,7 @@ const createSchema = (shouldShowSubjectSection: boolean) => {
    subjectAltNames: z
      .array(
        z.object({
-          type: z.nativeEnum(FrontendSanType),
+          type: z.nativeEnum(CertSubjectAlternativeNameType),
          value: z.string().min(1, "Value is required")
        })
      )
@@ -125,7 +121,8 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }

  const { data: profilesData } = useListCertificateProfiles({
    projectId: currentProject?.id || "",
-    includeMetrics: false
+    includeMetrics: false,
+    enrollmentType: "api"
  });

  const { mutateAsync: createCertificate } = useCreateCertificateV3();
@@ -206,11 +203,13 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
        subjectAltNames: cert.subjectAltNames
          ? cert.subjectAltNames.split(",").map((name) => {
              const trimmed = name.trim();
-              if (trimmed.includes("@")) return { type: FrontendSanType.EMAIL, value: trimmed };
+              if (trimmed.includes("@"))
+                return { type: CertSubjectAlternativeNameType.EMAIL, value: trimmed };
              if (trimmed.match(/^\d+\.\d+\.\d+\.\d+$/))
-                return { type: FrontendSanType.IP, value: trimmed };
-              if (trimmed.startsWith("http")) return { type: FrontendSanType.URI, value: trimmed };
-              return { type: FrontendSanType.DNS, value: trimmed };
+                return { type: CertSubjectAlternativeNameType.IP_ADDRESS, value: trimmed };
+              if (trimmed.startsWith("http"))
+                return { type: CertSubjectAlternativeNameType.URI, value: trimmed };
+              return { type: CertSubjectAlternativeNameType.DNS_NAME, value: trimmed };
            })
          : [],
        ttl: "",
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx
@@ -3,17 +3,13 @@ import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";

 import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2";
+import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";

-import {
-  FrontendSanType,
-  getSanPlaceholder,
-  getSanTypeLabels,
-  SubjectAltName
-} from "./certificateUtils";
+import { getSanPlaceholder, getSanTypeLabels, SubjectAltName } from "./certificateUtils";

 type SubjectAltNamesFieldProps = {
  control: Control<any>;
-  allowedSanTypes: FrontendSanType[];
+  allowedSanTypes: CertSubjectAlternativeNameType[];
  error?: string;
 };

@@ -44,7 +40,7 @@ export const SubjectAltNamesField = ({
                    const newValue = [...value];
                    newValue[index] = {
                      ...san,
-                      type: newType as FrontendSanType
+                      type: newType as CertSubjectAlternativeNameType
                    };
                    onChange(newValue);
                  }}
@@ -86,7 +82,9 @@ export const SubjectAltNamesField = ({
              leftIcon={<FontAwesomeIcon icon={faPlus} />}
              onClick={() => {
                const defaultType =
-                  allowedSanTypes.length > 0 ? allowedSanTypes[0] : FrontendSanType.DNS;
+                  allowedSanTypes.length > 0
+                    ? allowedSanTypes[0]
+                    : CertSubjectAlternativeNameType.DNS_NAME;
                onChange([...value, { type: defaultType, value: "" }]);
              }}
              className="w-full"
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts
@@ -1,51 +1,14 @@
 import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";

-export enum FrontendSanType {
-  DNS = "dns",
-  IP = "ip",
-  EMAIL = "email",
-  URI = "uri"
-}
-
-export const mapBackendSanTypeToFrontend = (backendType: string): FrontendSanType => {
-  switch (backendType) {
-    case CertSubjectAlternativeNameType.DNS_NAME:
-      return FrontendSanType.DNS;
-    case CertSubjectAlternativeNameType.IP_ADDRESS:
-      return FrontendSanType.IP;
-    case CertSubjectAlternativeNameType.EMAIL:
-      return FrontendSanType.EMAIL;
-    case CertSubjectAlternativeNameType.URI:
-      return FrontendSanType.URI;
-    default:
-      return backendType as FrontendSanType;
-  }
-};
-
-export const mapFrontendSanTypeToBackend = (frontendType: FrontendSanType): string => {
-  switch (frontendType) {
-    case FrontendSanType.DNS:
-      return CertSubjectAlternativeNameType.DNS_NAME;
-    case FrontendSanType.IP:
-      return CertSubjectAlternativeNameType.IP_ADDRESS;
-    case FrontendSanType.EMAIL:
-      return CertSubjectAlternativeNameType.EMAIL;
-    case FrontendSanType.URI:
-      return CertSubjectAlternativeNameType.URI;
-    default:
-      return frontendType;
-  }
-};
-
-export const getSanPlaceholder = (sanType: FrontendSanType): string => {
+export const getSanPlaceholder = (sanType: CertSubjectAlternativeNameType): string => {
  switch (sanType) {
-    case FrontendSanType.DNS:
+    case CertSubjectAlternativeNameType.DNS_NAME:
      return "example.com or *.example.com";
-    case FrontendSanType.IP:
+    case CertSubjectAlternativeNameType.IP_ADDRESS:
      return "192.168.1.1";
-    case FrontendSanType.EMAIL:
+    case CertSubjectAlternativeNameType.EMAIL:
      return "admin@example.com";
-    case FrontendSanType.URI:
+    case CertSubjectAlternativeNameType.URI:
      return "https://example.com";
    default:
      return "Enter value";
@@ -53,14 +16,14 @@ export const getSanPlaceholder = (sanType: FrontendSanType): string => {
 };

 export const getSanTypeLabels = () => ({
-  [FrontendSanType.DNS]: "DNS",
-  [FrontendSanType.IP]: "IP",
-  [FrontendSanType.EMAIL]: "Email",
-  [FrontendSanType.URI]: "URI"
+  [CertSubjectAlternativeNameType.DNS_NAME]: "DNS",
+  [CertSubjectAlternativeNameType.IP_ADDRESS]: "IP",
+  [CertSubjectAlternativeNameType.EMAIL]: "Email",
+  [CertSubjectAlternativeNameType.URI]: "URI"
 });

 export type SubjectAltName = {
-  type: FrontendSanType;
+  type: CertSubjectAlternativeNameType;
  value: string;
 };

@@ -68,7 +31,7 @@ export const formatSubjectAltNames = (subjectAltNames: SubjectAltName[]) => {
  return subjectAltNames
    .filter((san) => san.value.trim())
    .map((san) => ({
-      type: mapFrontendSanTypeToBackend(san.type),
+      type: san.type,
      value: san.value.trim()
    }));
 };
--- a/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts
+++ b/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts
@@ -6,12 +6,11 @@ import {
  KEY_USAGES_OPTIONS
 } from "@app/hooks/api/certificates/constants";
 import {
+  CertSubjectAlternativeNameType,
  mapTemplateKeyAlgorithmToApi,
  mapTemplateSignatureAlgorithmToApi
 } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";

-import { FrontendSanType, mapBackendSanTypeToFrontend } from "./certificateUtils";
-
 export type TemplateConstraints = {
  allowedKeyUsages: string[];
  allowedExtendedKeyUsages: string[];
@@ -19,7 +18,7 @@ export type TemplateConstraints = {
  requiredExtendedKeyUsages: string[];
  allowedSignatureAlgorithms: string[];
  allowedKeyAlgorithms: string[];
-  allowedSanTypes: FrontendSanType[];
+  allowedSanTypes: CertSubjectAlternativeNameType[];
  shouldShowSanSection: boolean;
  shouldShowSubjectSection: boolean;
 };
@@ -39,10 +38,10 @@ export const useCertificateTemplate = (
    allowedSignatureAlgorithms: [],
    allowedKeyAlgorithms: [],
    allowedSanTypes: [
-      FrontendSanType.DNS,
-      FrontendSanType.IP,
-      FrontendSanType.EMAIL,
-      FrontendSanType.URI
+      CertSubjectAlternativeNameType.DNS_NAME,
+      CertSubjectAlternativeNameType.IP_ADDRESS,
+      CertSubjectAlternativeNameType.EMAIL,
+      CertSubjectAlternativeNameType.URI
    ],
    shouldShowSanSection: true,
    shouldShowSubjectSection: true
@@ -87,10 +86,10 @@ export const useCertificateTemplate = (
      allowedSignatureAlgorithms: [],
      allowedKeyAlgorithms: [],
      allowedSanTypes: [
-        FrontendSanType.DNS,
-        FrontendSanType.IP,
-        FrontendSanType.EMAIL,
-        FrontendSanType.URI
+        CertSubjectAlternativeNameType.DNS_NAME,
+        CertSubjectAlternativeNameType.IP_ADDRESS,
+        CertSubjectAlternativeNameType.EMAIL,
+        CertSubjectAlternativeNameType.URI
      ],
      shouldShowSanSection: true,
      shouldShowSubjectSection: true
@@ -124,11 +123,10 @@ export const useCertificateTemplate = (

      // Handle SAN types
      if (templateData.sans && templateData.sans.length > 0) {
-        const sanTypes: FrontendSanType[] = [];
+        const sanTypes: CertSubjectAlternativeNameType[] = [];
        templateData.sans.forEach((sanPolicy: any) => {
-          const frontendType = mapBackendSanTypeToFrontend(sanPolicy.type);
-          if (!sanTypes.includes(frontendType)) {
-            sanTypes.push(frontendType);
+          if (!sanTypes.includes(sanPolicy.type)) {
+            sanTypes.push(sanPolicy.type);
          }
        });
        newConstraints.allowedSanTypes = sanTypes;
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
@@ -62,9 +62,7 @@ interface Props {
 }

 const ATTRIBUTE_TYPE_LABELS: Record<(typeof SUBJECT_ATTRIBUTE_TYPE_OPTIONS)[number], string> = {
-  common_name: "Common Name (CN)",
-  organization: "Organization (O)",
-  country: "Country (C)"
+  common_name: "Common Name (CN)"
 };

 const SAN_TYPE_LABELS: Record<(typeof SAN_TYPE_OPTIONS)[number], string> = {
@@ -532,7 +530,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
        }
      >
        <form onSubmit={handleSubmit(onFormSubmit)} className="space-y-6">
-          <Accordion type="multiple" defaultValue={["basic"]} className="w-full">
+          <Accordion type="multiple" defaultValue={["basic", "algorithms"]} className="w-full">
            <div className="space-y-4">
              <Controller
                control={control}
@@ -774,18 +772,6 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
              </AccordionContent>
            </AccordionItem>

-            <AccordionItem value="usages" className="mt-4">
-              <AccordionTrigger>Key Usages</AccordionTrigger>
-              <AccordionContent>
-                <KeyUsagesSection
-                  watchedKeyUsages={watchedKeyUsages}
-                  watchedExtendedKeyUsages={watchedExtendedKeyUsages}
-                  onKeyUsagesChange={handleKeyUsagesChange}
-                  onExtendedKeyUsagesChange={handleExtendedKeyUsagesChange}
-                />
-              </AccordionContent>
-            </AccordionItem>
-
            <AccordionItem value="algorithms" className="mt-4">
              <AccordionTrigger>Algorithms</AccordionTrigger>
              <AccordionContent>
@@ -793,6 +779,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                  <div>
                    <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
                      Allowed Signature Algorithms
+                      <span className="ml-1 text-red-500">*</span>
                    </h4>
                    <Controller
                      control={control}
@@ -838,6 +825,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                  <div>
                    <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
                      Allowed Key Algorithms
+                      <span className="ml-1 text-red-500">*</span>
                    </h4>
                    <Controller
                      control={control}
@@ -883,6 +871,18 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
              </AccordionContent>
            </AccordionItem>

+            <AccordionItem value="usages" className="mt-4">
+              <AccordionTrigger>Key Usages</AccordionTrigger>
+              <AccordionContent>
+                <KeyUsagesSection
+                  watchedKeyUsages={watchedKeyUsages}
+                  watchedExtendedKeyUsages={watchedExtendedKeyUsages}
+                  onKeyUsagesChange={handleKeyUsagesChange}
+                  onExtendedKeyUsagesChange={handleExtendedKeyUsagesChange}
+                />
+              </AccordionContent>
+            </AccordionItem>
+
            <AccordionItem value="validity" className="mt-4">
              <AccordionTrigger>Certificate Validity</AccordionTrigger>
              <AccordionContent>
--- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts
+++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts
@@ -45,9 +45,7 @@ export enum CertDurationUnit {
 }

 export enum CertSubjectAttributeType {
-  COMMON_NAME = "common_name",
-  ORGANIZATION = "organization",
-  COUNTRY = "country"
+  COMMON_NAME = "common_name"
 }

 export const formatSANType = (type: CertSubjectAlternativeNameType): string => {
@@ -113,10 +111,6 @@ export const formatSubjectAttributeType = (type: CertSubjectAttributeType): stri
  switch (type) {
    case CertSubjectAttributeType.COMMON_NAME:
      return "Common Name (CN)";
-    case CertSubjectAttributeType.ORGANIZATION:
-      return "Organization";
-    case CertSubjectAttributeType.COUNTRY:
-      return "Country";
    default:
      return type;
  }