From fccc2ed881e71db81ecba1f7d2f0e5acc473671f Mon Sep 17 00:00:00 2001 From: Carlos Monastyrski Date: Mon, 20 Oct 2025 13:37:02 -0300 Subject: [PATCH] PKI: EST passphrase fix and UI fixes --- backend/src/server/routes/index.ts | 1 - .../server/routes/v3/certificates-router.ts | 131 +++--------------- .../certificate-constants.ts | 33 ----- .../certificate-est-v3-service.test.ts | 11 +- .../certificate-est-v3-service.ts | 46 +++--- .../certificate-profile-service.ts | 2 +- .../certificate-template-v2-service.ts | 9 +- .../certificate-v3/certificate-v3-service.ts | 22 +-- .../hooks/api/certificateProfiles/queries.tsx | 4 + .../hooks/api/certificateProfiles/types.ts | 1 + .../components/AlgorithmSelectors.tsx | 8 +- .../components/CertificateIssuanceModal.tsx | 23 ++- .../components/SubjectAltNamesField.tsx | 16 +-- .../components/certificateUtils.ts | 59 ++------ .../components/useCertificateTemplate.ts | 28 ++-- .../CreateTemplateModal.tsx | 32 ++--- .../shared/certificate-constants.ts | 8 +- 17 files changed, 122 insertions(+), 312 deletions(-) diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 12f26e381..e206c0cdc 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -2127,7 +2127,6 @@ export const registerRoutes = async ( const certificateEstV3Service = certificateEstV3ServiceFactory({ internalCertificateAuthorityService, - certificateTemplateDAL, certificateTemplateV2Service, certificateAuthorityDAL, certificateAuthorityCertDAL, diff --git a/backend/src/server/routes/v3/certificates-router.ts b/backend/src/server/routes/v3/certificates-router.ts index de8d2bef1..549310738 100644 --- a/backend/src/server/routes/v3/certificates-router.ts +++ b/backend/src/server/routes/v3/certificates-router.ts @@ -1,38 +1,25 @@ -import * as x509 from "@peculiar/x509"; import { z } from "zod"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { ApiDocsTags } from "@app/lib/api-docs"; -import { BadRequestError } from "@app/lib/errors"; import { ms } from "@app/lib/ms"; import { writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; import { ACMESANType, - CertExtendedKeyUsageOIDToName, CertificateOrderStatus, CertKeyAlgorithm, - CertKeyUsage, - CertSignatureAlgorithm, - mapLegacyAltNameType, - TAltNameMapping + CertSignatureAlgorithm } from "@app/services/certificate/certificate-types"; -import { parseDistinguishedName } from "@app/services/certificate-authority/certificate-authority-fns"; -import { - validateAndMapAltNameType, - validateCaDateField -} from "@app/services/certificate-authority/certificate-authority-validators"; +import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators"; import { CertExtendedKeyUsageType, CertKeyUsageType, - CertSubjectAlternativeNameType, - mapLegacyExtendedKeyUsageToStandard, - mapLegacyKeyUsageToStandard + CertSubjectAlternativeNameType } from "@app/services/certificate-common/certificate-constants"; import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils"; import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators"; -import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types"; interface CertificateRequestForService { commonName?: string; @@ -66,67 +53,6 @@ const validateDateOrder = (data: { notBefore?: string; notAfter?: string }) => { return true; }; -const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => { - let csrPem = csr; - if (!csr.includes("-----BEGIN CERTIFICATE REQUEST-----")) { - try { - csrPem = Buffer.from(csr, "base64").toString("utf8"); - } catch (error) { - throw new BadRequestError({ message: "Invalid base64 CSR encoding" }); - } - } - - const csrObj = new x509.Pkcs10CertificateRequest(csrPem); - const subject = parseDistinguishedName(csrObj.subject); - - const certificateRequest: TCertificateRequest = { - commonName: subject.commonName, - organization: subject.organization, - organizationUnit: subject.ou, - locality: subject.locality, - state: subject.province, - country: subject.country - }; - - const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension; - if (csrKeyUsageExtension) { - const csrKeyUsages = Object.values(CertKeyUsage).filter( - // eslint-disable-next-line no-bitwise - (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0 - ); - certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard); - } - - const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension; - if (csrExtendedKeyUsageExtension) { - const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages - .map((ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string]) - .filter((eku) => eku !== undefined); - certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard); - } - - const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17"); - if (sanExtension) { - const sanNames = new x509.GeneralNames(sanExtension.value); - const altNamesArray: TAltNameMapping[] = sanNames.items - .filter((value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip") - .map((name): TAltNameMapping => { - const altNameType = validateAndMapAltNameType(name.value); - if (!altNameType) { - throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` }); - } - return altNameType; - }); - - certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({ - type: mapLegacyAltNameType(altName.type), - value: altName.value - })); - } - - return certificateRequest; -}; - export const registerCertificatesRouter = async (server: FastifyZodProvider) => { server.route({ method: "POST", @@ -140,7 +66,6 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) => body: z .object({ profileId: z.string().uuid(), - csr: z.string().trim().optional(), commonName: validateTemplateRegexField.optional(), ttl: z .string() @@ -182,43 +107,19 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) => }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - let certificateRequestForService: CertificateRequestForService; - - if (req.body.csr) { - try { - const csrData = extractCertificateRequestFromCSR(req.body.csr); - - certificateRequestForService = { - commonName: csrData.commonName, - keyUsages: csrData.keyUsages, - extendedKeyUsages: csrData.extendedKeyUsages, - altNames: csrData.subjectAlternativeNames, - validity: { - ttl: req.body.ttl - }, - notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined, - notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined, - signatureAlgorithm: req.body.signatureAlgorithm, - keyAlgorithm: req.body.keyAlgorithm - }; - } catch (error) { - throw new BadRequestError({ message: `Invalid CSR: ${(error as Error).message}` }); - } - } else { - certificateRequestForService = { - commonName: req.body.commonName, - keyUsages: req.body.keyUsages, - extendedKeyUsages: req.body.extendedKeyUsages, - altNames: req.body.altNames, - validity: { - ttl: req.body.ttl - }, - notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined, - notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined, - signatureAlgorithm: req.body.signatureAlgorithm, - keyAlgorithm: req.body.keyAlgorithm - }; - } + const certificateRequestForService: CertificateRequestForService = { + commonName: req.body.commonName, + keyUsages: req.body.keyUsages, + extendedKeyUsages: req.body.extendedKeyUsages, + altNames: req.body.altNames, + validity: { + ttl: req.body.ttl + }, + notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined, + notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined, + signatureAlgorithm: req.body.signatureAlgorithm, + keyAlgorithm: req.body.keyAlgorithm + }; const mappedCertificateRequest = mapEnumsForValidation(certificateRequestForService); diff --git a/backend/src/services/certificate-common/certificate-constants.ts b/backend/src/services/certificate-common/certificate-constants.ts index 937be6cad..bbd589110 100644 --- a/backend/src/services/certificate-common/certificate-constants.ts +++ b/backend/src/services/certificate-common/certificate-constants.ts @@ -55,39 +55,6 @@ export enum CertSubjectAttributeType { COUNTRY = "country" } -export const mapSANTypeToLegacy = (type: CertSubjectAlternativeNameType): string => { - switch (type) { - case CertSubjectAlternativeNameType.DNS_NAME: - return "dns"; - case CertSubjectAlternativeNameType.IP_ADDRESS: - return "ip"; - case CertSubjectAlternativeNameType.EMAIL: - return "email"; - case CertSubjectAlternativeNameType.URI: - return "uri"; - default: - return type; - } -}; - -export const mapLegacySANTypeToStandard = (type: string): CertSubjectAlternativeNameType => { - switch (type) { - case "dns": - case "dns_name": - return CertSubjectAlternativeNameType.DNS_NAME; - case "ip": - case "ip_address": - return CertSubjectAlternativeNameType.IP_ADDRESS; - case "email": - return CertSubjectAlternativeNameType.EMAIL; - case "uri": - case "url": - return CertSubjectAlternativeNameType.URI; - default: - throw new Error(`Unknown SAN type: ${type}`); - } -}; - export const mapKeyUsageToLegacy = (usage: CertKeyUsageType): string => { switch (usage) { case CertKeyUsageType.DIGITAL_SIGNATURE: diff --git a/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts b/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts index c5f8b9759..23b1a0d5f 100644 --- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts +++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts @@ -123,6 +123,12 @@ vi.mock("@app/services/certificate/certificate-types", () => ({ }; return mapping[type] || type; }), + TAltNameType: { + EMAIL: "email", + DNS: "dns", + IP: "ip", + URL: "url" + }, CertExtendedKeyUsageOIDToName: { "1.3.6.1.5.5.7.3.1": "serverAuth", "1.3.6.1.5.5.7.3.2": "clientAuth", @@ -161,10 +167,6 @@ describe("CertificateEstV3Service Security Fix", () => { signCertFromCa: vi.fn() }; - const mockCertificateTemplateDAL = { - findById: vi.fn() - }; - const mockCertificateTemplateV2Service = { validateCertificateRequest: vi.fn() }; @@ -230,7 +232,6 @@ describe("CertificateEstV3Service Security Fix", () => { service = certificateEstV3ServiceFactory({ internalCertificateAuthorityService: mockInternalCertificateAuthorityService, - certificateTemplateDAL: mockCertificateTemplateDAL, certificateTemplateV2Service: mockCertificateTemplateV2Service, certificateAuthorityDAL: mockCertificateAuthorityDAL, certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL, diff --git a/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts b/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts index 6c052b0ac..89c575180 100644 --- a/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts +++ b/backend/src/services/certificate-est-v3/certificate-est-v3-service.ts @@ -7,7 +7,8 @@ import { CertExtendedKeyUsageOIDToName, CertKeyUsage, mapLegacyAltNameType, - TAltNameMapping + TAltNameMapping, + TAltNameType } from "@app/services/certificate/certificate-types"; import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal"; import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal"; @@ -25,7 +26,6 @@ import { import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils"; import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal"; import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types"; -import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal"; import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service"; import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types"; import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal"; @@ -38,7 +38,6 @@ import { TLicenseServiceFactory } from "../../ee/services/license/license-servic type TCertificateEstV3ServiceFactoryDep = { internalCertificateAuthorityService: Pick; - certificateTemplateDAL: Pick; certificateTemplateV2Service: Pick; certificateAuthorityDAL: Pick; certificateAuthorityCertDAL: Pick; @@ -53,7 +52,6 @@ export type TCertificateEstV3ServiceFactory = ReturnType value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip" + (value) => + value.type === TAltNameType.EMAIL || + value.type === TAltNameType.DNS || + value.type === TAltNameType.IP || + value.type === TAltNameType.URL ) .map((name): TAltNameMapping => { const altNameType = validateAndMapAltNameType(name.value); @@ -257,13 +259,6 @@ export const certificateEstV3ServiceFactory = ({ }); } - const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId); - if (!certTemplate) { - throw new NotFoundError({ - message: `Certificate template with ID '${profile.certificateTemplateId}' not found` - }); - } - const leafCertificate = extractX509CertFromChain(decodeURIComponent(sslClientCert))?.[0]; if (!leafCertificate) { @@ -272,7 +267,7 @@ export const certificateEstV3ServiceFactory = ({ const cert = new x509.X509Certificate(leafCertificate); const caCertChains = await getCaCertChains({ - caId: certTemplate.caId, + caId: profile.caId, certificateAuthorityCertDAL, certificateAuthorityDAL, projectDAL, @@ -374,17 +369,10 @@ export const certificateEstV3ServiceFactory = ({ }); } - const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId); - if (!certTemplate) { - throw new NotFoundError({ - message: `Certificate template with ID '${profile.certificateTemplateId}' not found` - }); - } - - const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId); + const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId); if (!ca?.internalCa?.id) { throw new NotFoundError({ - message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found` + message: `Internal Certificate Authority with ID '${profile.caId}' not found` }); } @@ -396,15 +384,17 @@ export const certificateEstV3ServiceFactory = ({ kmsService }); - const certificateChain = extractX509CertFromChain(caCertChain); - if (!certificateChain || certificateChain.length === 0) { - throw new BadRequestError({ - message: "Invalid CA certificate chain: unable to extract certificates" - }); + let certificates: x509.X509Certificate[] = []; + if (caCertChain && caCertChain.trim()) { + try { + certificates = extractX509CertFromChain(caCertChain).map((cert) => new x509.X509Certificate(cert)); + } catch (error) { + certificates = []; + } } - const certificates = certificateChain.map((cert) => new x509.X509Certificate(cert)); const caCertificate = new x509.X509Certificate(caCert); + return convertRawCertsToPkcs7([caCertificate.rawData, ...certificates.map((cert) => cert.rawData)]); }; diff --git a/backend/src/services/certificate-profile/certificate-profile-service.ts b/backend/src/services/certificate-profile/certificate-profile-service.ts index d04e9c7cc..c43dee889 100644 --- a/backend/src/services/certificate-profile/certificate-profile-service.ts +++ b/backend/src/services/certificate-profile/certificate-profile-service.ts @@ -805,7 +805,7 @@ export const certificateProfileServiceFactory = ({ isEnabled: true, caChain: profile.estConfig.caChain, disableBootstrapCertValidation: profile.estConfig.disableBootstrapCaValidation, - hashedPassphrase: "" + hashedPassphrase: profile.estConfig.passphrase }; }; diff --git a/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts b/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts index 7531049cd..c1942b793 100644 --- a/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts +++ b/backend/src/services/certificate-template-v2/certificate-template-v2-service.ts @@ -41,12 +41,9 @@ export const certificateTemplateV2ServiceFactory = ({ attributes.forEach((attr) => { const existing = consolidated.get(attr.type); if (existing) { - consolidated.set(attr.type, { - ...attr, - allowed: [...new Set([...(existing.allowed || []), ...(attr.allowed || [])])], - required: [...new Set([...(existing.required || []), ...(attr.required || [])])], - denied: [...new Set([...(existing.denied || []), ...(attr.denied || [])])] - } as T); + throw new ForbiddenRequestError({ + message: `Duplicate attribute type '${attr.type}' found in request. Each attribute type must appear only once.` + }); } else { consolidated.set(attr.type, attr); } diff --git a/backend/src/services/certificate-v3/certificate-v3-service.ts b/backend/src/services/certificate-v3/certificate-v3-service.ts index bcdc33a53..e53602367 100644 --- a/backend/src/services/certificate-v3/certificate-v3-service.ts +++ b/backend/src/services/certificate-v3/certificate-v3-service.ts @@ -193,21 +193,13 @@ export const certificateV3ServiceFactory = ({ subjectAlternativeNames: certificateRequest.altNames }); - let template; - try { - template = await certificateTemplateV2Service.getTemplateV2ById({ - actor, - actorId, - actorAuthMethod, - actorOrgId, - templateId: profile.certificateTemplateId - }); - } catch (error) { - throw new BadRequestError({ - message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.` - }); - } - + const template = await certificateTemplateV2Service.getTemplateV2ById({ + actor, + actorId, + actorAuthMethod, + actorOrgId, + templateId: profile.certificateTemplateId + }); if (!template) { throw new NotFoundError({ message: "Certificate template not found for this profile" }); } diff --git a/frontend/src/hooks/api/certificateProfiles/queries.tsx b/frontend/src/hooks/api/certificateProfiles/queries.tsx index 3d5015517..abdc93ddb 100644 --- a/frontend/src/hooks/api/certificateProfiles/queries.tsx +++ b/frontend/src/hooks/api/certificateProfiles/queries.tsx @@ -22,6 +22,7 @@ export const certificateProfileKeys = { search?: string; includeMetrics?: boolean; includeConfigs?: boolean; + enrollmentType?: string; expiringDays?: number; }) => ["certificate-profiles", "list", params], getById: (profileId: string) => ["certificate-profiles", "get-by-id", profileId], @@ -52,6 +53,7 @@ export const useListCertificateProfiles = ({ search, includeMetrics = false, includeConfigs = false, + enrollmentType, expiringDays = 7 }: TListCertificateProfilesDTO) => { return useQuery({ @@ -62,6 +64,7 @@ export const useListCertificateProfiles = ({ search, includeMetrics, includeConfigs, + enrollmentType, expiringDays }), queryFn: async () => { @@ -76,6 +79,7 @@ export const useListCertificateProfiles = ({ search, includeMetrics, includeConfigs, + enrollmentType, expiringDays } }); diff --git a/frontend/src/hooks/api/certificateProfiles/types.ts b/frontend/src/hooks/api/certificateProfiles/types.ts index 54631e6d8..a9b6b7060 100644 --- a/frontend/src/hooks/api/certificateProfiles/types.ts +++ b/frontend/src/hooks/api/certificateProfiles/types.ts @@ -83,6 +83,7 @@ export type TListCertificateProfilesDTO = { search?: string; includeMetrics?: boolean; includeConfigs?: boolean; + enrollmentType?: "api" | "est"; expiringDays?: number; }; diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx index 25ec819ea..562dcb5e1 100644 --- a/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx +++ b/frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx @@ -33,6 +33,7 @@ export const AlgorithmSelectors = ({ label="Signature Algorithm" errorText={signatureError} isError={Boolean(signatureError)} + isRequired > { subjectAltNames: z .array( z.object({ - type: z.nativeEnum(FrontendSanType), + type: z.nativeEnum(CertSubjectAlternativeNameType), value: z.string().min(1, "Value is required") }) ) @@ -125,7 +121,8 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId } const { data: profilesData } = useListCertificateProfiles({ projectId: currentProject?.id || "", - includeMetrics: false + includeMetrics: false, + enrollmentType: "api" }); const { mutateAsync: createCertificate } = useCreateCertificateV3(); @@ -206,11 +203,13 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId } subjectAltNames: cert.subjectAltNames ? cert.subjectAltNames.split(",").map((name) => { const trimmed = name.trim(); - if (trimmed.includes("@")) return { type: FrontendSanType.EMAIL, value: trimmed }; + if (trimmed.includes("@")) + return { type: CertSubjectAlternativeNameType.EMAIL, value: trimmed }; if (trimmed.match(/^\d+\.\d+\.\d+\.\d+$/)) - return { type: FrontendSanType.IP, value: trimmed }; - if (trimmed.startsWith("http")) return { type: FrontendSanType.URI, value: trimmed }; - return { type: FrontendSanType.DNS, value: trimmed }; + return { type: CertSubjectAlternativeNameType.IP_ADDRESS, value: trimmed }; + if (trimmed.startsWith("http")) + return { type: CertSubjectAlternativeNameType.URI, value: trimmed }; + return { type: CertSubjectAlternativeNameType.DNS_NAME, value: trimmed }; }) : [], ttl: "", diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx b/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx index 4600a65f4..4614539e0 100644 --- a/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx +++ b/frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx @@ -3,17 +3,13 @@ import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2"; +import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants"; -import { - FrontendSanType, - getSanPlaceholder, - getSanTypeLabels, - SubjectAltName -} from "./certificateUtils"; +import { getSanPlaceholder, getSanTypeLabels, SubjectAltName } from "./certificateUtils"; type SubjectAltNamesFieldProps = { control: Control; - allowedSanTypes: FrontendSanType[]; + allowedSanTypes: CertSubjectAlternativeNameType[]; error?: string; }; @@ -44,7 +40,7 @@ export const SubjectAltNamesField = ({ const newValue = [...value]; newValue[index] = { ...san, - type: newType as FrontendSanType + type: newType as CertSubjectAlternativeNameType }; onChange(newValue); }} @@ -86,7 +82,9 @@ export const SubjectAltNamesField = ({ leftIcon={} onClick={() => { const defaultType = - allowedSanTypes.length > 0 ? allowedSanTypes[0] : FrontendSanType.DNS; + allowedSanTypes.length > 0 + ? allowedSanTypes[0] + : CertSubjectAlternativeNameType.DNS_NAME; onChange([...value, { type: defaultType, value: "" }]); }} className="w-full" diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts b/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts index 794219a86..7f16b87e0 100644 --- a/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts +++ b/frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts @@ -1,51 +1,14 @@ import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants"; -export enum FrontendSanType { - DNS = "dns", - IP = "ip", - EMAIL = "email", - URI = "uri" -} - -export const mapBackendSanTypeToFrontend = (backendType: string): FrontendSanType => { - switch (backendType) { - case CertSubjectAlternativeNameType.DNS_NAME: - return FrontendSanType.DNS; - case CertSubjectAlternativeNameType.IP_ADDRESS: - return FrontendSanType.IP; - case CertSubjectAlternativeNameType.EMAIL: - return FrontendSanType.EMAIL; - case CertSubjectAlternativeNameType.URI: - return FrontendSanType.URI; - default: - return backendType as FrontendSanType; - } -}; - -export const mapFrontendSanTypeToBackend = (frontendType: FrontendSanType): string => { - switch (frontendType) { - case FrontendSanType.DNS: - return CertSubjectAlternativeNameType.DNS_NAME; - case FrontendSanType.IP: - return CertSubjectAlternativeNameType.IP_ADDRESS; - case FrontendSanType.EMAIL: - return CertSubjectAlternativeNameType.EMAIL; - case FrontendSanType.URI: - return CertSubjectAlternativeNameType.URI; - default: - return frontendType; - } -}; - -export const getSanPlaceholder = (sanType: FrontendSanType): string => { +export const getSanPlaceholder = (sanType: CertSubjectAlternativeNameType): string => { switch (sanType) { - case FrontendSanType.DNS: + case CertSubjectAlternativeNameType.DNS_NAME: return "example.com or *.example.com"; - case FrontendSanType.IP: + case CertSubjectAlternativeNameType.IP_ADDRESS: return "192.168.1.1"; - case FrontendSanType.EMAIL: + case CertSubjectAlternativeNameType.EMAIL: return "admin@example.com"; - case FrontendSanType.URI: + case CertSubjectAlternativeNameType.URI: return "https://example.com"; default: return "Enter value"; @@ -53,14 +16,14 @@ export const getSanPlaceholder = (sanType: FrontendSanType): string => { }; export const getSanTypeLabels = () => ({ - [FrontendSanType.DNS]: "DNS", - [FrontendSanType.IP]: "IP", - [FrontendSanType.EMAIL]: "Email", - [FrontendSanType.URI]: "URI" + [CertSubjectAlternativeNameType.DNS_NAME]: "DNS", + [CertSubjectAlternativeNameType.IP_ADDRESS]: "IP", + [CertSubjectAlternativeNameType.EMAIL]: "Email", + [CertSubjectAlternativeNameType.URI]: "URI" }); export type SubjectAltName = { - type: FrontendSanType; + type: CertSubjectAlternativeNameType; value: string; }; @@ -68,7 +31,7 @@ export const formatSubjectAltNames = (subjectAltNames: SubjectAltName[]) => { return subjectAltNames .filter((san) => san.value.trim()) .map((san) => ({ - type: mapFrontendSanTypeToBackend(san.type), + type: san.type, value: san.value.trim() })); }; diff --git a/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts b/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts index 9562220b3..871ad00a4 100644 --- a/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts +++ b/frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts @@ -6,12 +6,11 @@ import { KEY_USAGES_OPTIONS } from "@app/hooks/api/certificates/constants"; import { + CertSubjectAlternativeNameType, mapTemplateKeyAlgorithmToApi, mapTemplateSignatureAlgorithmToApi } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants"; -import { FrontendSanType, mapBackendSanTypeToFrontend } from "./certificateUtils"; - export type TemplateConstraints = { allowedKeyUsages: string[]; allowedExtendedKeyUsages: string[]; @@ -19,7 +18,7 @@ export type TemplateConstraints = { requiredExtendedKeyUsages: string[]; allowedSignatureAlgorithms: string[]; allowedKeyAlgorithms: string[]; - allowedSanTypes: FrontendSanType[]; + allowedSanTypes: CertSubjectAlternativeNameType[]; shouldShowSanSection: boolean; shouldShowSubjectSection: boolean; }; @@ -39,10 +38,10 @@ export const useCertificateTemplate = ( allowedSignatureAlgorithms: [], allowedKeyAlgorithms: [], allowedSanTypes: [ - FrontendSanType.DNS, - FrontendSanType.IP, - FrontendSanType.EMAIL, - FrontendSanType.URI + CertSubjectAlternativeNameType.DNS_NAME, + CertSubjectAlternativeNameType.IP_ADDRESS, + CertSubjectAlternativeNameType.EMAIL, + CertSubjectAlternativeNameType.URI ], shouldShowSanSection: true, shouldShowSubjectSection: true @@ -87,10 +86,10 @@ export const useCertificateTemplate = ( allowedSignatureAlgorithms: [], allowedKeyAlgorithms: [], allowedSanTypes: [ - FrontendSanType.DNS, - FrontendSanType.IP, - FrontendSanType.EMAIL, - FrontendSanType.URI + CertSubjectAlternativeNameType.DNS_NAME, + CertSubjectAlternativeNameType.IP_ADDRESS, + CertSubjectAlternativeNameType.EMAIL, + CertSubjectAlternativeNameType.URI ], shouldShowSanSection: true, shouldShowSubjectSection: true @@ -124,11 +123,10 @@ export const useCertificateTemplate = ( // Handle SAN types if (templateData.sans && templateData.sans.length > 0) { - const sanTypes: FrontendSanType[] = []; + const sanTypes: CertSubjectAlternativeNameType[] = []; templateData.sans.forEach((sanPolicy: any) => { - const frontendType = mapBackendSanTypeToFrontend(sanPolicy.type); - if (!sanTypes.includes(frontendType)) { - sanTypes.push(frontendType); + if (!sanTypes.includes(sanPolicy.type)) { + sanTypes.push(sanPolicy.type); } }); newConstraints.allowedSanTypes = sanTypes; diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx index cb5fabc99..a96beccad 100644 --- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx +++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx @@ -62,9 +62,7 @@ interface Props { } const ATTRIBUTE_TYPE_LABELS: Record<(typeof SUBJECT_ATTRIBUTE_TYPE_OPTIONS)[number], string> = { - common_name: "Common Name (CN)", - organization: "Organization (O)", - country: "Country (C)" + common_name: "Common Name (CN)" }; const SAN_TYPE_LABELS: Record<(typeof SAN_TYPE_OPTIONS)[number], string> = { @@ -532,7 +530,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create" } >
- +
- - Key Usages - - - - - Algorithms @@ -793,6 +779,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"

Allowed Signature Algorithms + *

Allowed Key Algorithms + *

+ + Key Usages + + + + + Certificate Validity diff --git a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts index 1a58d16d6..50b69a2e2 100644 --- a/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts +++ b/frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts @@ -45,9 +45,7 @@ export enum CertDurationUnit { } export enum CertSubjectAttributeType { - COMMON_NAME = "common_name", - ORGANIZATION = "organization", - COUNTRY = "country" + COMMON_NAME = "common_name" } export const formatSANType = (type: CertSubjectAlternativeNameType): string => { @@ -113,10 +111,6 @@ export const formatSubjectAttributeType = (type: CertSubjectAttributeType): stri switch (type) { case CertSubjectAttributeType.COMMON_NAME: return "Common Name (CN)"; - case CertSubjectAttributeType.ORGANIZATION: - return "Organization"; - case CertSubjectAttributeType.COUNTRY: - return "Country"; default: return type; }