Merge pull request #7059 from Infisical/feat/PKI-152

feat: add DigiCert code-sign support

Author: carlosmonastyrski

backend/src/db/migrations/20260630173512_add-certificates-digicert-order-index.ts

@@ -0,0 +1,40 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+const INDEX_NAME = "certificates_digicert_order_idx";
+const MIGRATION_TIMEOUT = 60 * 60 * 1000;
+const MIGRATION_LOCK_TIMEOUT = 30 * 1000;
+
+export async function up(knex: Knex): Promise<void> {
+  const stmtResult = await knex.raw("SHOW statement_timeout");
+  const originalStatementTimeout = stmtResult.rows[0].statement_timeout;
+  const lockResult = await knex.raw("SHOW lock_timeout");
+  const originalLockTimeout = lockResult.rows[0].lock_timeout;
+
+  try {
+    await knex.raw(`SET statement_timeout = ${MIGRATION_TIMEOUT}`);
+    await knex.raw(`SET lock_timeout = ${MIGRATION_LOCK_TIMEOUT}`);
+
+    if (
+      (await knex.schema.hasTable(TableName.Certificate)) &&
+      (await knex.schema.hasColumn(TableName.Certificate, "externalMetadata"))
+    ) {
+      await knex.raw(`
+        CREATE INDEX CONCURRENTLY IF NOT EXISTS "${INDEX_NAME}"
+        ON ${TableName.Certificate} ("caId", ("externalMetadata"->>'orderId'))
+        WHERE "externalMetadata"->>'type' = 'digicert'
+      `);
+    }
+  } finally {
+    await knex.raw(`SET statement_timeout = '${originalStatementTimeout}'`);
+    await knex.raw(`SET lock_timeout = '${originalLockTimeout}'`);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.raw(`DROP INDEX CONCURRENTLY IF EXISTS "${INDEX_NAME}"`);
+}
+
+const config = { transaction: false };
+export { config };

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -55,6 +55,7 @@ import {
 } from "@app/services/secret-sync/secret-sync-types";
 import { TDuplicateSecretAttributes } from "@app/services/secret-v2-bridge/secret-v2-bridge-types";
 import { CertKeySource } from "@app/services/signer/signer-enums";
+import { TSignerExternalConfigurationInput } from "@app/services/signer/signer-types";
 import { TWebhookPayloads } from "@app/services/webhook/webhook-types";
 import { WorkflowIntegration } from "@app/services/workflow-integration/workflow-integration-types";
 
@@ -4929,6 +4930,7 @@ interface CreatePkiSignerEvent {
     approvalPolicyId?: string | null;
     keySource?: CertKeySource;
     hsmConnectorId?: string | null;
+    externalConfiguration?: TSignerExternalConfigurationInput;
   };
 }
 
@@ -5017,6 +5019,7 @@ interface ReissuePkiSignerCertificateEvent {
     keySource?: string;
     hsmConnectorId?: string;
     hsmKeyAlgorithm?: string;
+    externalConfiguration?: TSignerExternalConfigurationInput;
   };
 }
 

backend/src/server/routes/index.ts

@@ -3321,6 +3321,7 @@ export const registerRoutes = async (
     certificateAuthorityDAL,
     signerIssuanceService,
     internalCertificateAuthorityService,
+    digicertFns: digicertCaFns,
     projectDAL,
     kmsService,
     permissionService,

backend/src/server/routes/v1/app-connection-routers/digicert-connection-router.ts

@@ -78,4 +78,78 @@ export const registerDigiCertConnectionRouter = async (server: FastifyZodProvide
       return server.services.appConnection.digicert.listProducts(connectionId, req.permission);
     }
   });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/organizations/:organizationId/validation`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "getDigiCertOrgValidation",
+      params: z.object({
+        connectionId: z.string().uuid(),
+        organizationId: z.coerce.number().int().positive()
+      }),
+      querystring: z.object({
+        productNameId: z.string().trim().min(1)
+      }),
+      response: {
+        200: z.object({
+          isValidated: z.boolean()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId, organizationId } = req.params;
+      const { productNameId } = req.query;
+      return server.services.appConnection.digicert.getOrgValidation(
+        connectionId,
+        organizationId,
+        productNameId,
+        req.permission
+      );
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/organizations/:organizationId/orders`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      operationId: "listDigiCertOrders",
+      params: z.object({
+        connectionId: z.string().uuid(),
+        organizationId: z.coerce.number().int().positive()
+      }),
+      querystring: z.object({
+        productNameId: z.string().trim().min(1)
+      }),
+      response: {
+        200: z
+          .object({
+            orderId: z.number(),
+            commonName: z.string(),
+            organizationName: z.string(),
+            status: z.string(),
+            validTill: z.string().optional()
+          })
+          .array()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId, organizationId } = req.params;
+      const { productNameId } = req.query;
+      return server.services.appConnection.digicert.listOrders(
+        connectionId,
+        organizationId,
+        productNameId,
+        req.permission
+      );
+    }
+  });
 };

backend/src/server/routes/v1/signer-routers/certificate-router.ts

@@ -8,7 +8,12 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CertKeySource } from "@app/services/signer/signer-enums";
 
-import { HSM_SUPPORTED_KEY_ALGORITHMS, SignerIdParamsSchema, SignerKeyAlgorithm } from "./schemas";
+import {
+  HSM_SUPPORTED_KEY_ALGORITHMS,
+  SignerExternalConfigurationSchema,
+  SignerIdParamsSchema,
+  SignerKeyAlgorithm
+} from "./schemas";
 
 export const registerSignerCertificateRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -32,7 +37,8 @@ export const registerSignerCertificateRouter = async (server: FastifyZodProvider
               keySource: z.nativeEnum(CertKeySource),
               hsmConnectorId: z.string().uuid().optional()
             })
-            .optional()
+            .optional(),
+          externalConfiguration: SignerExternalConfigurationSchema.optional()
         })
         .superRefine((data, ctx) => {
           if (data.certificate?.keySource !== CertKeySource.Hsm) return;
@@ -76,7 +82,8 @@ export const registerSignerCertificateRouter = async (server: FastifyZodProvider
             commonName: req.body.commonName,
             keyAlgorithm: req.body.keyAlgorithm,
             keySource: req.body.certificate?.keySource,
-            hsmConnectorId: req.body.certificate?.hsmConnectorId
+            hsmConnectorId: req.body.certificate?.hsmConnectorId,
+            externalConfiguration: req.body.externalConfiguration
           }
         }
       });

backend/src/server/routes/v1/signer-routers/lifecycle-router.ts

@@ -14,10 +14,32 @@ import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 import {
   ApprovalPolicyBodySchema,
   HSM_SUPPORTED_KEY_ALGORITHMS,
+  SignerExternalConfigurationSchema,
   SignerIdParamsSchema,
   SignerKeyAlgorithm
 } from "./schemas";
 
+const SignerWithCertificateResponseSchema = PkiSignersSchema.extend({
+  certificateCommonName: z.string().nullable().optional(),
+  certificateSerialNumber: z.string().nullable().optional(),
+  certificateNotAfter: z.date().nullable().optional(),
+  certificateNotBefore: z.date().nullable().optional(),
+  certificateKeyAlgorithm: z.string().nullable().optional(),
+  certificateKeySource: z.string().nullable().optional(),
+  certificateHsmConnectorId: z.string().nullable().optional(),
+  certificateStatus: z.string().nullable().optional(),
+  certificateCaId: z.string().nullable().optional(),
+  approvalPolicyName: z.string().nullable().optional(),
+  externalOrder: z
+    .object({
+      provider: z.string(),
+      orderId: z.number(),
+      status: z.string().nullable()
+    })
+    .nullable()
+    .optional()
+});
+
 export const registerSignerLifecycleRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -45,6 +67,7 @@ export const registerSignerLifecycleRouter = async (server: FastifyZodProvider)
               hsmConnectorId: z.string().uuid().optional()
             })
             .optional(),
+          externalConfiguration: SignerExternalConfigurationSchema.optional(),
           approvalPolicyId: z.string().uuid().optional(),
           members: z
             .array(
@@ -100,7 +123,8 @@ export const registerSignerLifecycleRouter = async (server: FastifyZodProvider)
             certificateId: signer.certificateId,
             approvalPolicyId: signer.approvalPolicyId,
             keySource: req.body.certificate?.keySource,
-            hsmConnectorId: req.body.certificate?.hsmConnectorId
+            hsmConnectorId: req.body.certificate?.hsmConnectorId,
+            externalConfiguration: req.body.externalConfiguration
           }
         }
       });
@@ -187,18 +211,7 @@ export const registerSignerLifecycleRouter = async (server: FastifyZodProvider)
       description: "Get a code signing signer by ID",
       params: SignerIdParamsSchema,
       response: {
-        200: PkiSignersSchema.extend({
-          certificateCommonName: z.string().nullable().optional(),
-          certificateSerialNumber: z.string().nullable().optional(),
-          certificateNotAfter: z.date().nullable().optional(),
-          certificateNotBefore: z.date().nullable().optional(),
-          certificateKeyAlgorithm: z.string().nullable().optional(),
-          certificateKeySource: z.string().nullable().optional(),
-          certificateHsmConnectorId: z.string().nullable().optional(),
-          certificateStatus: z.string().nullable().optional(),
-          certificateCaId: z.string().nullable().optional(),
-          approvalPolicyName: z.string().nullable().optional()
-        })
+        200: SignerWithCertificateResponseSchema
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
@@ -267,6 +280,34 @@ export const registerSignerLifecycleRouter = async (server: FastifyZodProvider)
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/:signerId/issuance/check",
+    config: { rateLimit: writeLimit },
+    schema: {
+      hide: false,
+      operationId: "checkSignerIssuance",
+      tags: [ApiDocsTags.PkiSigners],
+      description:
+        "Poll the upstream CA for a pending signer's certificate immediately instead of waiting for the next scheduled check.",
+      params: SignerIdParamsSchema,
+      response: {
+        200: SignerWithCertificateResponseSchema
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const signer = await server.services.pkiSigner.checkIssuanceNow({
+        signerId: req.params.signerId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+      return signer;
+    }
+  });
+
   server.route({
     method: "PATCH",
     url: "/:signerId",

backend/src/server/routes/v1/signer-routers/schemas.ts

@@ -1,9 +1,24 @@
 import { z } from "zod";
 
 import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
 
 export const SignerIdParamsSchema = z.object({ signerId: z.string().uuid() });
 
+export const SignerExternalConfigurationSchema = z.discriminatedUnion("caType", [
+  z.object({
+    caType: z.literal(CaType.DIGICERT),
+    reissueFromExternalOrderId: z
+      .string()
+      .trim()
+      .min(1)
+      .optional()
+      .describe(
+        "Reissue into this existing DigiCert order instead of placing a new order (reuses the subscription slot)."
+      )
+  })
+]);
+
 export const SignerKeyAlgorithm = {
   values: [
     CertKeyAlgorithm.RSA_2048,

backend/src/services/app-connection/digicert/digicert-connection-errors.ts

@@ -5,9 +5,10 @@ type TDigiCertErrorResponse = { errors?: { code?: string; message?: string }[] }
 export const extractDigiCertErrorMessage = (error: unknown) => {
   if (error instanceof AxiosError) {
     const data = error.response?.data as TDigiCertErrorResponse | undefined;
-    const firstError = data?.errors?.[0];
-    if (firstError?.message) {
-      return firstError.code ? `${firstError.message} (${firstError.code})` : firstError.message;
+    // Include every error code, not just the first, so callers can match a code in any position.
+    const errors = (data?.errors ?? []).filter((e) => e?.message || e?.code);
+    if (errors.length) {
+      return errors.map((e) => (e.code ? `${e.message ?? ""} (${e.code})` : e.message)).join("; ");
     }
     return error.message || "Unknown error";
   }