PKI: EST passphrase fix and UI fixes

backend/src/server/routes/index.ts

@@ -2127,7 +2127,6 @@ export const registerRoutes = async (
 
   const certificateEstV3Service = certificateEstV3ServiceFactory({
     internalCertificateAuthorityService,
-    certificateTemplateDAL,
     certificateTemplateV2Service,
     certificateAuthorityDAL,
     certificateAuthorityCertDAL,

backend/src/server/routes/v3/certificates-router.ts

@@ -1,38 +1,25 @@
-import * as x509 from "@peculiar/x509";
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags } from "@app/lib/api-docs";
-import { BadRequestError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import {
   ACMESANType,
-  CertExtendedKeyUsageOIDToName,
   CertificateOrderStatus,
   CertKeyAlgorithm,
-  CertKeyUsage,
+  CertSignatureAlgorithm
-  CertSignatureAlgorithm,
-  mapLegacyAltNameType,
-  TAltNameMapping
 } from "@app/services/certificate/certificate-types";
-import { parseDistinguishedName } from "@app/services/certificate-authority/certificate-authority-fns";
+import { validateCaDateField } from "@app/services/certificate-authority/certificate-authority-validators";
-import {
-  validateAndMapAltNameType,
-  validateCaDateField
-} from "@app/services/certificate-authority/certificate-authority-validators";
 import {
   CertExtendedKeyUsageType,
   CertKeyUsageType,
-  CertSubjectAlternativeNameType,
+  CertSubjectAlternativeNameType
-  mapLegacyExtendedKeyUsageToStandard,
-  mapLegacyKeyUsageToStandard
 } from "@app/services/certificate-common/certificate-constants";
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
-import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
 
 interface CertificateRequestForService {
   commonName?: string;
@@ -66,67 +53,6 @@ const validateDateOrder = (data: { notBefore?: string; notAfter?: string }) => {
   return true;
 };
 
-const extractCertificateRequestFromCSR = (csr: string): TCertificateRequest => {
-  let csrPem = csr;
-  if (!csr.includes("-----BEGIN CERTIFICATE REQUEST-----")) {
-    try {
-      csrPem = Buffer.from(csr, "base64").toString("utf8");
-    } catch (error) {
-      throw new BadRequestError({ message: "Invalid base64 CSR encoding" });
-    }
-  }
-
-  const csrObj = new x509.Pkcs10CertificateRequest(csrPem);
-  const subject = parseDistinguishedName(csrObj.subject);
-
-  const certificateRequest: TCertificateRequest = {
-    commonName: subject.commonName,
-    organization: subject.organization,
-    organizationUnit: subject.ou,
-    locality: subject.locality,
-    state: subject.province,
-    country: subject.country
-  };
-
-  const csrKeyUsageExtension = csrObj.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
-  if (csrKeyUsageExtension) {
-    const csrKeyUsages = Object.values(CertKeyUsage).filter(
-      // eslint-disable-next-line no-bitwise
-      (keyUsage) => (x509.KeyUsageFlags[keyUsage] & csrKeyUsageExtension.usages) !== 0
-    );
-    certificateRequest.keyUsages = csrKeyUsages.map(mapLegacyKeyUsageToStandard);
-  }
-
-  const csrExtendedKeyUsageExtension = csrObj.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
-  if (csrExtendedKeyUsageExtension) {
-    const csrExtendedKeyUsages = csrExtendedKeyUsageExtension.usages
-      .map((ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string])
-      .filter((eku) => eku !== undefined);
-    certificateRequest.extendedKeyUsages = csrExtendedKeyUsages.map(mapLegacyExtendedKeyUsageToStandard);
-  }
-
-  const sanExtension = csrObj.extensions.find((ext) => ext.type === "2.5.29.17");
-  if (sanExtension) {
-    const sanNames = new x509.GeneralNames(sanExtension.value);
-    const altNamesArray: TAltNameMapping[] = sanNames.items
-      .filter((value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip")
-      .map((name): TAltNameMapping => {
-        const altNameType = validateAndMapAltNameType(name.value);
-        if (!altNameType) {
-          throw new BadRequestError({ message: `Invalid altName from CSR: ${name.value}` });
-        }
-        return altNameType;
-      });
-
-    certificateRequest.subjectAlternativeNames = altNamesArray.map((altName) => ({
-      type: mapLegacyAltNameType(altName.type),
-      value: altName.value
-    }));
-  }
-
-  return certificateRequest;
-};
-
 export const registerCertificatesRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -140,7 +66,6 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
       body: z
         .object({
           profileId: z.string().uuid(),
-          csr: z.string().trim().optional(),
           commonName: validateTemplateRegexField.optional(),
           ttl: z
             .string()
@@ -182,43 +107,19 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
-      let certificateRequestForService: CertificateRequestForService;
+      const certificateRequestForService: CertificateRequestForService = {
-
+        commonName: req.body.commonName,
-      if (req.body.csr) {
+        keyUsages: req.body.keyUsages,
-        try {
+        extendedKeyUsages: req.body.extendedKeyUsages,
-          const csrData = extractCertificateRequestFromCSR(req.body.csr);
+        altNames: req.body.altNames,
-
+        validity: {
-          certificateRequestForService = {
+          ttl: req.body.ttl
-            commonName: csrData.commonName,
+        },
-            keyUsages: csrData.keyUsages,
+        notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-            extendedKeyUsages: csrData.extendedKeyUsages,
+        notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-            altNames: csrData.subjectAlternativeNames,
+        signatureAlgorithm: req.body.signatureAlgorithm,
-            validity: {
+        keyAlgorithm: req.body.keyAlgorithm
-              ttl: req.body.ttl
+      };
-            },
-            notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-            notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-            signatureAlgorithm: req.body.signatureAlgorithm,
-            keyAlgorithm: req.body.keyAlgorithm
-          };
-        } catch (error) {
-          throw new BadRequestError({ message: `Invalid CSR: ${(error as Error).message}` });
-        }
-      } else {
-        certificateRequestForService = {
-          commonName: req.body.commonName,
-          keyUsages: req.body.keyUsages,
-          extendedKeyUsages: req.body.extendedKeyUsages,
-          altNames: req.body.altNames,
-          validity: {
-            ttl: req.body.ttl
-          },
-          notBefore: req.body.notBefore ? new Date(req.body.notBefore) : undefined,
-          notAfter: req.body.notAfter ? new Date(req.body.notAfter) : undefined,
-          signatureAlgorithm: req.body.signatureAlgorithm,
-          keyAlgorithm: req.body.keyAlgorithm
-        };
-      }
 
       const mappedCertificateRequest = mapEnumsForValidation(certificateRequestForService);
 

backend/src/services/certificate-common/certificate-constants.ts

@@ -55,39 +55,6 @@ export enum CertSubjectAttributeType {
   COUNTRY = "country"
 }
 
-export const mapSANTypeToLegacy = (type: CertSubjectAlternativeNameType): string => {
-  switch (type) {
-    case CertSubjectAlternativeNameType.DNS_NAME:
-      return "dns";
-    case CertSubjectAlternativeNameType.IP_ADDRESS:
-      return "ip";
-    case CertSubjectAlternativeNameType.EMAIL:
-      return "email";
-    case CertSubjectAlternativeNameType.URI:
-      return "uri";
-    default:
-      return type;
-  }
-};
-
-export const mapLegacySANTypeToStandard = (type: string): CertSubjectAlternativeNameType => {
-  switch (type) {
-    case "dns":
-    case "dns_name":
-      return CertSubjectAlternativeNameType.DNS_NAME;
-    case "ip":
-    case "ip_address":
-      return CertSubjectAlternativeNameType.IP_ADDRESS;
-    case "email":
-      return CertSubjectAlternativeNameType.EMAIL;
-    case "uri":
-    case "url":
-      return CertSubjectAlternativeNameType.URI;
-    default:
-      throw new Error(`Unknown SAN type: ${type}`);
-  }
-};
-
 export const mapKeyUsageToLegacy = (usage: CertKeyUsageType): string => {
   switch (usage) {
     case CertKeyUsageType.DIGITAL_SIGNATURE:

backend/src/services/certificate-est-v3/certificate-est-v3-service.test.ts

@@ -123,6 +123,12 @@ vi.mock("@app/services/certificate/certificate-types", () => ({
     };
     return mapping[type] || type;
   }),
+  TAltNameType: {
+    EMAIL: "email",
+    DNS: "dns",
+    IP: "ip",
+    URL: "url"
+  },
   CertExtendedKeyUsageOIDToName: {
     "1.3.6.1.5.5.7.3.1": "serverAuth",
     "1.3.6.1.5.5.7.3.2": "clientAuth",
@@ -161,10 +167,6 @@ describe("CertificateEstV3Service Security Fix", () => {
     signCertFromCa: vi.fn()
   };
 
-  const mockCertificateTemplateDAL = {
-    findById: vi.fn()
-  };
-
   const mockCertificateTemplateV2Service = {
     validateCertificateRequest: vi.fn()
   };
@@ -230,7 +232,6 @@ describe("CertificateEstV3Service Security Fix", () => {
 
     service = certificateEstV3ServiceFactory({
       internalCertificateAuthorityService: mockInternalCertificateAuthorityService,
-      certificateTemplateDAL: mockCertificateTemplateDAL,
       certificateTemplateV2Service: mockCertificateTemplateV2Service,
       certificateAuthorityDAL: mockCertificateAuthorityDAL,
       certificateAuthorityCertDAL: mockCertificateAuthorityCertDAL,

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

@@ -7,7 +7,8 @@ import {
   CertExtendedKeyUsageOIDToName,
   CertKeyUsage,
   mapLegacyAltNameType,
-  TAltNameMapping
+  TAltNameMapping,
+  TAltNameType
 } from "@app/services/certificate/certificate-types";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
@@ -25,7 +26,6 @@ import {
 import { mapEnumsForValidation } from "@app/services/certificate-common/certificate-utils";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import { EnrollmentType } from "@app/services/certificate-profile/certificate-profile-types";
-import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
 import { TCertificateTemplateV2ServiceFactory } from "@app/services/certificate-template-v2/certificate-template-v2-service";
 import { TCertificateRequest } from "@app/services/certificate-template-v2/certificate-template-v2-types";
 import { TEstEnrollmentConfigDALFactory } from "@app/services/enrollment-config/est-enrollment-config-dal";
@@ -38,7 +38,6 @@ import { TLicenseServiceFactory } from "../../ee/services/license/license-servic
 
 type TCertificateEstV3ServiceFactoryDep = {
   internalCertificateAuthorityService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa">;
-  certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "findById">;
   certificateTemplateV2Service: Pick<TCertificateTemplateV2ServiceFactory, "validateCertificateRequest">;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
@@ -53,7 +52,6 @@ export type TCertificateEstV3ServiceFactory = ReturnType<typeof certificateEstV3
 
 export const certificateEstV3ServiceFactory = ({
   internalCertificateAuthorityService,
-  certificateTemplateDAL,
   certificateTemplateV2Service,
   certificateAuthorityCertDAL,
   certificateAuthorityDAL,
@@ -98,7 +96,11 @@ export const certificateEstV3ServiceFactory = ({
       const sanNames = new x509.GeneralNames(sanExtension.value);
       const altNamesArray: TAltNameMapping[] = sanNames.items
         .filter(
-          (value) => value.type === "email" || value.type === "dns" || value.type === "url" || value.type === "ip"
+          (value) =>
+            value.type === TAltNameType.EMAIL ||
+            value.type === TAltNameType.DNS ||
+            value.type === TAltNameType.IP ||
+            value.type === TAltNameType.URL
         )
         .map((name): TAltNameMapping => {
           const altNameType = validateAndMapAltNameType(name.value);
@@ -257,13 +259,6 @@ export const certificateEstV3ServiceFactory = ({
       });
     }
 
-    const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
-    if (!certTemplate) {
-      throw new NotFoundError({
-        message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
-      });
-    }
-
     const leafCertificate = extractX509CertFromChain(decodeURIComponent(sslClientCert))?.[0];
 
     if (!leafCertificate) {
@@ -272,7 +267,7 @@ export const certificateEstV3ServiceFactory = ({
 
     const cert = new x509.X509Certificate(leafCertificate);
     const caCertChains = await getCaCertChains({
-      caId: certTemplate.caId,
+      caId: profile.caId,
       certificateAuthorityCertDAL,
       certificateAuthorityDAL,
       projectDAL,
@@ -374,17 +369,10 @@ export const certificateEstV3ServiceFactory = ({
       });
     }
 
-    const certTemplate = await certificateTemplateDAL.findById(profile.certificateTemplateId);
+    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
-    if (!certTemplate) {
-      throw new NotFoundError({
-        message: `Certificate template with ID '${profile.certificateTemplateId}' not found`
-      });
-    }
-
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
     if (!ca?.internalCa?.id) {
       throw new NotFoundError({
-        message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found`
+        message: `Internal Certificate Authority with ID '${profile.caId}' not found`
       });
     }
 
@@ -396,15 +384,17 @@ export const certificateEstV3ServiceFactory = ({
       kmsService
     });
 
-    const certificateChain = extractX509CertFromChain(caCertChain);
+    let certificates: x509.X509Certificate[] = [];
-    if (!certificateChain || certificateChain.length === 0) {
+    if (caCertChain && caCertChain.trim()) {
-      throw new BadRequestError({
+      try {
-        message: "Invalid CA certificate chain: unable to extract certificates"
+        certificates = extractX509CertFromChain(caCertChain).map((cert) => new x509.X509Certificate(cert));
-      });
+      } catch (error) {
+        certificates = [];
+      }
     }
 
-    const certificates = certificateChain.map((cert) => new x509.X509Certificate(cert));
     const caCertificate = new x509.X509Certificate(caCert);
+
     return convertRawCertsToPkcs7([caCertificate.rawData, ...certificates.map((cert) => cert.rawData)]);
   };
 

backend/src/services/certificate-profile/certificate-profile-service.ts

@@ -805,7 +805,7 @@ export const certificateProfileServiceFactory = ({
       isEnabled: true,
       caChain: profile.estConfig.caChain,
       disableBootstrapCertValidation: profile.estConfig.disableBootstrapCaValidation,
-      hashedPassphrase: ""
+      hashedPassphrase: profile.estConfig.passphrase
     };
   };
 

backend/src/services/certificate-template-v2/certificate-template-v2-service.ts

@@ -41,12 +41,9 @@ export const certificateTemplateV2ServiceFactory = ({
     attributes.forEach((attr) => {
       const existing = consolidated.get(attr.type);
       if (existing) {
-        consolidated.set(attr.type, {
+        throw new ForbiddenRequestError({
-          ...attr,
+          message: `Duplicate attribute type '${attr.type}' found in request. Each attribute type must appear only once.`
-          allowed: [...new Set([...(existing.allowed || []), ...(attr.allowed || [])])],
+        });
-          required: [...new Set([...(existing.required || []), ...(attr.required || [])])],
-          denied: [...new Set([...(existing.denied || []), ...(attr.denied || [])])]
-        } as T);
       } else {
         consolidated.set(attr.type, attr);
       }

backend/src/services/certificate-v3/certificate-v3-service.ts

@@ -193,21 +193,13 @@ export const certificateV3ServiceFactory = ({
       subjectAlternativeNames: certificateRequest.altNames
     });
 
-    let template;
+    const template = await certificateTemplateV2Service.getTemplateV2ById({
-    try {
+      actor,
-      template = await certificateTemplateV2Service.getTemplateV2ById({
+      actorId,
-        actor,
+      actorAuthMethod,
-        actorId,
+      actorOrgId,
-        actorAuthMethod,
+      templateId: profile.certificateTemplateId
-        actorOrgId,
+    });
-        templateId: profile.certificateTemplateId
-      });
-    } catch (error) {
-      throw new BadRequestError({
-        message: `Certificate profile is using a legacy template (${profile.certificateTemplateId}) that doesn't support security validation policies. Please migrate to a template v2 for proper security enforcement.`
-      });
-    }
-
     if (!template) {
       throw new NotFoundError({ message: "Certificate template not found for this profile" });
     }

frontend/src/hooks/api/certificateProfiles/queries.tsx

@@ -22,6 +22,7 @@ export const certificateProfileKeys = {
     search?: string;
     includeMetrics?: boolean;
     includeConfigs?: boolean;
+    enrollmentType?: string;
     expiringDays?: number;
   }) => ["certificate-profiles", "list", params],
   getById: (profileId: string) => ["certificate-profiles", "get-by-id", profileId],
@@ -52,6 +53,7 @@ export const useListCertificateProfiles = ({
   search,
   includeMetrics = false,
   includeConfigs = false,
+  enrollmentType,
   expiringDays = 7
 }: TListCertificateProfilesDTO) => {
   return useQuery({
@@ -62,6 +64,7 @@ export const useListCertificateProfiles = ({
       search,
       includeMetrics,
       includeConfigs,
+      enrollmentType,
       expiringDays
     }),
     queryFn: async () => {
@@ -76,6 +79,7 @@ export const useListCertificateProfiles = ({
           search,
           includeMetrics,
           includeConfigs,
+          enrollmentType,
           expiringDays
         }
       });

frontend/src/hooks/api/certificateProfiles/types.ts

@@ -83,6 +83,7 @@ export type TListCertificateProfilesDTO = {
   search?: string;
   includeMetrics?: boolean;
   includeConfigs?: boolean;
+  enrollmentType?: "api" | "est";
   expiringDays?: number;
 };
 

frontend/src/pages/cert-manager/CertificatesPage/components/AlgorithmSelectors.tsx

@@ -33,6 +33,7 @@ export const AlgorithmSelectors = ({
               label="Signature Algorithm"
               errorText={signatureError}
               isError={Boolean(signatureError)}
+              isRequired
             >
               <Select
                 defaultValue=""
@@ -62,7 +63,12 @@ export const AlgorithmSelectors = ({
           control={control}
           name="keyAlgorithm"
           render={({ field: { onChange, ...field } }) => (
-            <FormControl label="Key Algorithm" errorText={keyError} isError={Boolean(keyError)}>
+            <FormControl
+              label="Key Algorithm"
+              errorText={keyError}
+              isError={Boolean(keyError)}
+              isRequired
+            >
               <Select
                 defaultValue=""
                 {...field}

frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx

@@ -25,15 +25,11 @@ import { useListCertificateProfiles } from "@app/hooks/api/certificateProfiles";
 import { CertExtendedKeyUsage, CertKeyUsage } from "@app/hooks/api/certificates/enums";
 import { useGetCertificateTemplateV2ById } from "@app/hooks/api/certificateTemplates/queries";
 import { UsePopUpState } from "@app/hooks/usePopUp";
+import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";
 
 import { AlgorithmSelectors } from "./AlgorithmSelectors";
 import { CertificateContent } from "./CertificateContent";
-import {
+import { filterUsages, formatSubjectAltNames, getAttributeValue } from "./certificateUtils";
-  filterUsages,
-  formatSubjectAltNames,
-  FrontendSanType,
-  getAttributeValue
-} from "./certificateUtils";
 import { KeyUsageSection } from "./KeyUsageSection";
 import { SubjectAltNamesField } from "./SubjectAltNamesField";
 import { useCertificateTemplate } from "./useCertificateTemplate";
@@ -61,7 +57,7 @@ const createSchema = (shouldShowSubjectSection: boolean) => {
     subjectAltNames: z
       .array(
         z.object({
-          type: z.nativeEnum(FrontendSanType),
+          type: z.nativeEnum(CertSubjectAlternativeNameType),
           value: z.string().min(1, "Value is required")
         })
       )
@@ -125,7 +121,8 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
 
   const { data: profilesData } = useListCertificateProfiles({
     projectId: currentProject?.id || "",
-    includeMetrics: false
+    includeMetrics: false,
+    enrollmentType: "api"
   });
 
   const { mutateAsync: createCertificate } = useCreateCertificateV3();
@@ -206,11 +203,13 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle, profileId }
         subjectAltNames: cert.subjectAltNames
           ? cert.subjectAltNames.split(",").map((name) => {
               const trimmed = name.trim();
-              if (trimmed.includes("@")) return { type: FrontendSanType.EMAIL, value: trimmed };
+              if (trimmed.includes("@"))
+                return { type: CertSubjectAlternativeNameType.EMAIL, value: trimmed };
               if (trimmed.match(/^\d+\.\d+\.\d+\.\d+$/))
-                return { type: FrontendSanType.IP, value: trimmed };
+                return { type: CertSubjectAlternativeNameType.IP_ADDRESS, value: trimmed };
-              if (trimmed.startsWith("http")) return { type: FrontendSanType.URI, value: trimmed };
+              if (trimmed.startsWith("http"))
-              return { type: FrontendSanType.DNS, value: trimmed };
+                return { type: CertSubjectAlternativeNameType.URI, value: trimmed };
+              return { type: CertSubjectAlternativeNameType.DNS_NAME, value: trimmed };
             })
           : [],
         ttl: "",

frontend/src/pages/cert-manager/CertificatesPage/components/SubjectAltNamesField.tsx

@@ -3,17 +3,13 @@ import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2";
+import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";
 
-import {
+import { getSanPlaceholder, getSanTypeLabels, SubjectAltName } from "./certificateUtils";
-  FrontendSanType,
-  getSanPlaceholder,
-  getSanTypeLabels,
-  SubjectAltName
-} from "./certificateUtils";
 
 type SubjectAltNamesFieldProps = {
   control: Control<any>;
-  allowedSanTypes: FrontendSanType[];
+  allowedSanTypes: CertSubjectAlternativeNameType[];
   error?: string;
 };
 
@@ -44,7 +40,7 @@ export const SubjectAltNamesField = ({
                     const newValue = [...value];
                     newValue[index] = {
                       ...san,
-                      type: newType as FrontendSanType
+                      type: newType as CertSubjectAlternativeNameType
                     };
                     onChange(newValue);
                   }}
@@ -86,7 +82,9 @@ export const SubjectAltNamesField = ({
               leftIcon={<FontAwesomeIcon icon={faPlus} />}
               onClick={() => {
                 const defaultType =
-                  allowedSanTypes.length > 0 ? allowedSanTypes[0] : FrontendSanType.DNS;
+                  allowedSanTypes.length > 0
+                    ? allowedSanTypes[0]
+                    : CertSubjectAlternativeNameType.DNS_NAME;
                 onChange([...value, { type: defaultType, value: "" }]);
               }}
               className="w-full"

frontend/src/pages/cert-manager/CertificatesPage/components/certificateUtils.ts

@@ -1,51 +1,14 @@
 import { CertSubjectAlternativeNameType } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";
 
-export enum FrontendSanType {
+export const getSanPlaceholder = (sanType: CertSubjectAlternativeNameType): string => {
-  DNS = "dns",
-  IP = "ip",
-  EMAIL = "email",
-  URI = "uri"
-}
-
-export const mapBackendSanTypeToFrontend = (backendType: string): FrontendSanType => {
-  switch (backendType) {
-    case CertSubjectAlternativeNameType.DNS_NAME:
-      return FrontendSanType.DNS;
-    case CertSubjectAlternativeNameType.IP_ADDRESS:
-      return FrontendSanType.IP;
-    case CertSubjectAlternativeNameType.EMAIL:
-      return FrontendSanType.EMAIL;
-    case CertSubjectAlternativeNameType.URI:
-      return FrontendSanType.URI;
-    default:
-      return backendType as FrontendSanType;
-  }
-};
-
-export const mapFrontendSanTypeToBackend = (frontendType: FrontendSanType): string => {
-  switch (frontendType) {
-    case FrontendSanType.DNS:
-      return CertSubjectAlternativeNameType.DNS_NAME;
-    case FrontendSanType.IP:
-      return CertSubjectAlternativeNameType.IP_ADDRESS;
-    case FrontendSanType.EMAIL:
-      return CertSubjectAlternativeNameType.EMAIL;
-    case FrontendSanType.URI:
-      return CertSubjectAlternativeNameType.URI;
-    default:
-      return frontendType;
-  }
-};
-
-export const getSanPlaceholder = (sanType: FrontendSanType): string => {
   switch (sanType) {
-    case FrontendSanType.DNS:
+    case CertSubjectAlternativeNameType.DNS_NAME:
       return "example.com or *.example.com";
-    case FrontendSanType.IP:
+    case CertSubjectAlternativeNameType.IP_ADDRESS:
       return "192.168.1.1";
-    case FrontendSanType.EMAIL:
+    case CertSubjectAlternativeNameType.EMAIL:
       return "admin@example.com";
-    case FrontendSanType.URI:
+    case CertSubjectAlternativeNameType.URI:
       return "https://example.com";
     default:
       return "Enter value";
@@ -53,14 +16,14 @@ export const getSanPlaceholder = (sanType: FrontendSanType): string => {
 };
 
 export const getSanTypeLabels = () => ({
-  [FrontendSanType.DNS]: "DNS",
+  [CertSubjectAlternativeNameType.DNS_NAME]: "DNS",
-  [FrontendSanType.IP]: "IP",
+  [CertSubjectAlternativeNameType.IP_ADDRESS]: "IP",
-  [FrontendSanType.EMAIL]: "Email",
+  [CertSubjectAlternativeNameType.EMAIL]: "Email",
-  [FrontendSanType.URI]: "URI"
+  [CertSubjectAlternativeNameType.URI]: "URI"
 });
 
 export type SubjectAltName = {
-  type: FrontendSanType;
+  type: CertSubjectAlternativeNameType;
   value: string;
 };
 
@@ -68,7 +31,7 @@ export const formatSubjectAltNames = (subjectAltNames: SubjectAltName[]) => {
   return subjectAltNames
     .filter((san) => san.value.trim())
     .map((san) => ({
-      type: mapFrontendSanTypeToBackend(san.type),
+      type: san.type,
       value: san.value.trim()
     }));
 };

frontend/src/pages/cert-manager/CertificatesPage/components/useCertificateTemplate.ts

@@ -6,12 +6,11 @@ import {
   KEY_USAGES_OPTIONS
 } from "@app/hooks/api/certificates/constants";
 import {
+  CertSubjectAlternativeNameType,
   mapTemplateKeyAlgorithmToApi,
   mapTemplateSignatureAlgorithmToApi
 } from "@app/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants";
 
-import { FrontendSanType, mapBackendSanTypeToFrontend } from "./certificateUtils";
-
 export type TemplateConstraints = {
   allowedKeyUsages: string[];
   allowedExtendedKeyUsages: string[];
@@ -19,7 +18,7 @@ export type TemplateConstraints = {
   requiredExtendedKeyUsages: string[];
   allowedSignatureAlgorithms: string[];
   allowedKeyAlgorithms: string[];
-  allowedSanTypes: FrontendSanType[];
+  allowedSanTypes: CertSubjectAlternativeNameType[];
   shouldShowSanSection: boolean;
   shouldShowSubjectSection: boolean;
 };
@@ -39,10 +38,10 @@ export const useCertificateTemplate = (
     allowedSignatureAlgorithms: [],
     allowedKeyAlgorithms: [],
     allowedSanTypes: [
-      FrontendSanType.DNS,
+      CertSubjectAlternativeNameType.DNS_NAME,
-      FrontendSanType.IP,
+      CertSubjectAlternativeNameType.IP_ADDRESS,
-      FrontendSanType.EMAIL,
+      CertSubjectAlternativeNameType.EMAIL,
-      FrontendSanType.URI
+      CertSubjectAlternativeNameType.URI
     ],
     shouldShowSanSection: true,
     shouldShowSubjectSection: true
@@ -87,10 +86,10 @@ export const useCertificateTemplate = (
       allowedSignatureAlgorithms: [],
       allowedKeyAlgorithms: [],
       allowedSanTypes: [
-        FrontendSanType.DNS,
+        CertSubjectAlternativeNameType.DNS_NAME,
-        FrontendSanType.IP,
+        CertSubjectAlternativeNameType.IP_ADDRESS,
-        FrontendSanType.EMAIL,
+        CertSubjectAlternativeNameType.EMAIL,
-        FrontendSanType.URI
+        CertSubjectAlternativeNameType.URI
       ],
       shouldShowSanSection: true,
       shouldShowSubjectSection: true
@@ -124,11 +123,10 @@ export const useCertificateTemplate = (
 
       // Handle SAN types
       if (templateData.sans && templateData.sans.length > 0) {
-        const sanTypes: FrontendSanType[] = [];
+        const sanTypes: CertSubjectAlternativeNameType[] = [];
         templateData.sans.forEach((sanPolicy: any) => {
-          const frontendType = mapBackendSanTypeToFrontend(sanPolicy.type);
+          if (!sanTypes.includes(sanPolicy.type)) {
-          if (!sanTypes.includes(frontendType)) {
+            sanTypes.push(sanPolicy.type);
-            sanTypes.push(frontendType);
           }
         });
         newConstraints.allowedSanTypes = sanTypes;

frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx

@@ -62,9 +62,7 @@ interface Props {
 }
 
 const ATTRIBUTE_TYPE_LABELS: Record<(typeof SUBJECT_ATTRIBUTE_TYPE_OPTIONS)[number], string> = {
-  common_name: "Common Name (CN)",
+  common_name: "Common Name (CN)"
-  organization: "Organization (O)",
-  country: "Country (C)"
 };
 
 const SAN_TYPE_LABELS: Record<(typeof SAN_TYPE_OPTIONS)[number], string> = {
@@ -532,7 +530,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
         }
       >
         <form onSubmit={handleSubmit(onFormSubmit)} className="space-y-6">
-          <Accordion type="multiple" defaultValue={["basic"]} className="w-full">
+          <Accordion type="multiple" defaultValue={["basic", "algorithms"]} className="w-full">
             <div className="space-y-4">
               <Controller
                 control={control}
@@ -774,18 +772,6 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
               </AccordionContent>
             </AccordionItem>
 
-            <AccordionItem value="usages" className="mt-4">
-              <AccordionTrigger>Key Usages</AccordionTrigger>
-              <AccordionContent>
-                <KeyUsagesSection
-                  watchedKeyUsages={watchedKeyUsages}
-                  watchedExtendedKeyUsages={watchedExtendedKeyUsages}
-                  onKeyUsagesChange={handleKeyUsagesChange}
-                  onExtendedKeyUsagesChange={handleExtendedKeyUsagesChange}
-                />
-              </AccordionContent>
-            </AccordionItem>
-
             <AccordionItem value="algorithms" className="mt-4">
               <AccordionTrigger>Algorithms</AccordionTrigger>
               <AccordionContent>
@@ -793,6 +779,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                   <div>
                     <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
                       Allowed Signature Algorithms
+                      <span className="ml-1 text-red-500">*</span>
                     </h4>
                     <Controller
                       control={control}
@@ -838,6 +825,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
                   <div>
                     <h4 className="mb-3 text-sm font-medium text-mineshaft-200">
                       Allowed Key Algorithms
+                      <span className="ml-1 text-red-500">*</span>
                     </h4>
                     <Controller
                       control={control}
@@ -883,6 +871,18 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
               </AccordionContent>
             </AccordionItem>
 
+            <AccordionItem value="usages" className="mt-4">
+              <AccordionTrigger>Key Usages</AccordionTrigger>
+              <AccordionContent>
+                <KeyUsagesSection
+                  watchedKeyUsages={watchedKeyUsages}
+                  watchedExtendedKeyUsages={watchedExtendedKeyUsages}
+                  onKeyUsagesChange={handleKeyUsagesChange}
+                  onExtendedKeyUsagesChange={handleExtendedKeyUsagesChange}
+                />
+              </AccordionContent>
+            </AccordionItem>
+
             <AccordionItem value="validity" className="mt-4">
               <AccordionTrigger>Certificate Validity</AccordionTrigger>
               <AccordionContent>

frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/certificate-constants.ts

@@ -45,9 +45,7 @@ export enum CertDurationUnit {
 }
 
 export enum CertSubjectAttributeType {
-  COMMON_NAME = "common_name",
+  COMMON_NAME = "common_name"
-  ORGANIZATION = "organization",
-  COUNTRY = "country"
 }
 
 export const formatSANType = (type: CertSubjectAlternativeNameType): string => {
@@ -113,10 +111,6 @@ export const formatSubjectAttributeType = (type: CertSubjectAttributeType): stri
   switch (type) {
     case CertSubjectAttributeType.COMMON_NAME:
       return "Common Name (CN)";
-    case CertSubjectAttributeType.ORGANIZATION:
-      return "Organization";
-    case CertSubjectAttributeType.COUNTRY:
-      return "Country";
     default:
       return type;
   }