feat(pki): manage imported certificates by attaching a certificate profile - #7961
Conversation
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
|
💬 Discussion in Slack: #pr-review-infisical-7961-feat-pki-manage-imported-certificates-by-attaching-a-ce Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
|
| Filename | Overview |
|---|---|
| backend/src/services/certificate/certificate-service.ts | Adds permission-checked profile linkage, provider metadata validation, imported-certificate persistence, and issuer verification for revocation. |
| backend/src/services/certificate-authority/digicert/digicert-certificate-authority-fns.ts | Adds DigiCert order ownership and certificate-serial validation before an imported certificate is linked. |
| backend/src/services/app-connection/digicert/digicert-connection-fns.ts | Adds capped, logged pagination for DigiCert order listings. |
| frontend/src/pages/cert-manager/CertificatesPage/components/CertificateImportProfileFields.tsx | Adds profile and provider-reference selectors, but the profile selector silently omits attached profiles after the first 100. |
| frontend/src/pages/cert-manager/CertificatesPage/components/CertificateImportModal.tsx | Integrates optional profile and provider metadata into PEM certificate imports. |
| docs/documentation/platform/pki/applications/certificates.mdx | Documents imported-certificate lifecycle behavior, but the expanded section violates the required Mintlify heading hierarchy. |
Reviews (1): Last reviewed commit: "feat(pki): manage imported certificates ..." | Re-trigger Greptile
Storybook preview🔍 View Chromatic build details Updated for |
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 5 · PR risk: 0/10 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6ac348b527
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
# Conflicts: # backend/src/services/certificate/certificate-service.ts
per-certificate profiles
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 36888793 | Triggered | Username Password | 2227995 | backend/src/ee/services/pam-account/pam-account-schemas.test.ts | View secret |
| 36605363 | Triggered | Username Password | 2227995 | backend/src/ee/services/pam-account-heartbeat/pam-account-heartbeat-service.test.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Context
Imported certificates had no certificate authority attached, so renewal, reissue and revocation all failed on them. You can now pick a certificate profile while importing into an Application.
The profile determines which authority signs the replacement when the certificate is renewed, and that is all Infisical needs to run the rest of the lifecycle.
Internal and self-signed profiles need nothing else. A DigiCert profile also asks for the CertCentral order ID, which you pick from a live list of that CA's orders instead of typing a number, and Infisical confirms the order really belongs to the certificate before linking it.
Revoking is refused when the profile's authority did not issue the certificate, because revocation only takes effect through the issuing authority.
Screenshots
Steps to verify the change
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).