feat(pki): adds automated intermediate CA signing and auto-renewal using AD CS by saifsmailbox98 · Pull Request #5738 · Infisical/infisical

saifsmailbox98 · 2026-03-17T16:14:56Z

Context

Adds automated intermediate CA signing and auto-renewal using AD CS

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

…isted regex

linear · 2026-03-17T16:15:01Z

PKI-91 Add External CA Support for AD CS linked to Internal Infisical Intermediate CA

maidul98 · 2026-03-17T16:15:41Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-03-17T16:21:55Z

Greptile Summary

This PR adds automated intermediate CA signing and auto-renewal via Azure Active Directory Certificate Services (ADCS), mirroring the existing Venafi integration. It introduces a new AzureAdCs signing config type, a BullMQ job for async certificate installation (CaAdcsInstall), an ADCS-specific HTTP client for CSR submission and polling, and the corresponding frontend install/edit forms and audit log events.

Key changes:

Backend: New adcs-signing-fns.ts handles CSR submission, polling, and CA chain retrieval using the ADCS web enrollment (/certsrv/) endpoints. Validity period and template fields are properly sanitized with RE2 patterns. The ca-auto-renewal-queue.ts adds a processAdcsCertificateIssuance helper and queueAdcsInstall entry point, both consistent with the Venafi design.
Frontend: AdcsCaInstallForm.tsx handles the initial install flow; CaSigningConfigSection.tsx adds an ADCS edit modal. The install form validates validityPeriod with a regex, but the edit modal's adcsEditSchema omits that validation, allowing invalid values (e.g. "1y") to be submitted — these are then silently accepted client-side but rejected server-side. The edit modal's helper text also lists "1y" as an example, which is not a valid format per the backend schema.
API/Docs: New POST /:caId/install-certificate-adcs endpoint and documentation are added.

Confidence Score: 3/5

Mostly safe to merge; a frontend validation gap in the ADCS edit modal should be addressed before release.
The backend implementation is solid — CRLF sanitization, validity period validation, error handling, and permission checks are all present. The main gap is in the frontend: the ADCS signing-config edit modal (CaSigningConfigSection.tsx) lacks the validityPeriod format validation that the install form has, and the helper text references "1y" as valid when the backend only accepts the ^\d+d$ format. This will cause confusing server-side errors for users editing the config. There are also minor RE2 convention deviations (string.match(re2Instance) instead of re2Instance.match(string)) that are consistent with how they were addressed for similar calls in the codebase.
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx — missing validityPeriod format validation in adcsEditSchema and misleading helper text.

Important Files Changed

Filename	Overview
backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts	Core ADCS integration: submits CSR, polls for certificate, fetches CA chain. Uses RE2 for regex but calls native `string.match(re2Instance)` in two places (lines 126, 134) instead of `re2Instance.match(string)`. CRLF sanitization, validity period validation, and request ID parsing are all implemented correctly.
backend/src/services/certificate-authority/ca-signing-config/ca-signing-config-service.ts	Service layer for signing config CRUD and certificate installation. ADCS path mirrors the Venafi path: validates permissions, checks config type, validates destination config schema, and queues async install. No issues found.
backend/src/services/certificate-authority/ca-auto-renewal-queue.ts	BullMQ queue processor adds ADCS issuance path parallel to the existing Venafi path. The synchronous polling loop in processAdcsCertificateIssuance can block the daily renewal batch job for up to 5 minutes per ADCS CA, but this matches the existing Venafi behavior. Error handling correctly updates renewal status on failure.
backend/src/server/routes/v1/certificate-authority-routers/internal-certificate-authority-router.ts	Adds the POST /:caId/install-certificate-adcs endpoint with correct rate limiting, authentication, Zod validation, audit logging (INSTALL_CA_CERT_ADCS), and 202 async response. Correctly uses CERTIFICATE_AUTHORITIES.INSTALL_CERT_ADCS.caId description.
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaSigningConfigSection.tsx	ADCS edit modal's adcsEditSchema (lines 90-94) is missing the validityPeriod format regex (^\d+d$) present in the install form, allowing invalid formats to pass client-side validation. The helper text on line 376 also references "1y" as an example, which is rejected by the backend.
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaInstallCertModal/AdcsCaInstallForm.tsx	Install form for ADCS certificates. Uses native JS regex /^\d+d$/ in the Zod schema (line 35) instead of an RE2 instance per project conventions. Logic for create-vs-update and queuing install is correct.

_{Last reviewed commit: 2410278}

backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts

.../src/server/routes/v1/certificate-authority-routers/internal-certificate-authority-router.ts

saifsmailbox98 · 2026-03-17T16:47:03Z

@greptile review this PR

saifsmailbox98 · 2026-03-17T17:00:31Z

@greptile review this PR again based on my responses to your comments

backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts

backend/src/services/certificate-authority/ca-signing-config/ca-signing-config-types.ts

… check

saifsmailbox98 · 2026-03-17T17:32:50Z

@greptile review this PR based on my previous responses

backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts

saifsmailbox98 · 2026-03-17T17:55:53Z

@greptile review this PR based on my previous responses

…`) in schema and helper text.

backend/src/ee/services/audit-log/audit-log-types.ts

… ADCS errors, increased timeouts

…diate CA signing

…eps, update Venafi and ADCS images

saifsmailbox98 added 6 commits March 17, 2026 20:47

add AD CS automated signing support for intermediate CAs

9186a5d

Remove developer mode overrides for CA auto-renewal cron scheduling

3984343

clean up ADCS external CA code: proper Zod schemas, gated queries, ho…

a49e534

…isted regex

Clarify AD CS signing process in documentation

4fbf966

Update Azure AD CS guide: clarify "Install CA Certificate" step

7fca41d

Clarify Azure AD CS selection step in documentation

d48f65b

mintlify bot deployed to staging - docs March 17, 2026 16:17 View deployment

greptile-apps bot reviewed Mar 17, 2026

View reviewed changes

Sanitize ADCS template name and fix copy-paste API doc reference

6e4df19

Fix ADCS status override discarding already-extracted certificate

09291ad

greptile-apps bot reviewed Mar 17, 2026

View reviewed changes

backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts Outdated Show resolved Hide resolved

backend/src/services/certificate-authority/ca-signing-config/ca-signing-config-types.ts Outdated Show resolved Hide resolved

Validate ADCS validity period to days-only format and add ms() return…

72d5602

… check

greptile-apps bot reviewed Mar 17, 2026

View reviewed changes

backend/src/services/certificate-authority/ca-signing-config/adcs-signing-fns.ts Outdated Show resolved Hide resolved

Replace inline regex in schemas/functions with precompiled RE2 patterns

2410278

Validate ADCS validity period to enforce days-only format (`<number>d…

2660774

…`) in schema and helper text.

saifsmailbox98 requested a review from carlosmonastyrski March 17, 2026 18:19

carlosmonastyrski requested changes Mar 19, 2026

View reviewed changes

Address PR review: template dropdown, integer validity period, better…

ecdc221

… ADCS errors, increased timeouts

saifsmailbox98 requested a review from carlosmonastyrski March 20, 2026 00:24

saifsmailbox98 added 2 commits March 20, 2026 17:38

Fix CA renewal flow to support ADCS alongside Venafi

988e8a9

Restructure ADCS docs with top-level tabs for External CA and Interme…

40345a8

…diate CA signing

mintlify bot deployed to staging - docs March 20, 2026 12:41 View deployment

Update PKI documentation: add ADCS auto-renewal and manual renewal st…

c7b43f2

…eps, update Venafi and ADCS images

mintlify bot deployed to staging - docs March 20, 2026 20:42 View deployment

carlosmonastyrski approved these changes Mar 20, 2026

View reviewed changes

saifsmailbox98 merged commit 61a3b4a into main Mar 20, 2026
12 of 13 checks passed

Conversation

saifsmailbox98 commented Mar 17, 2026

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear bot commented Mar 17, 2026

Uh oh!

maidul98 commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 17, 2026

Uh oh!

saifsmailbox98 commented Mar 17, 2026

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 17, 2026

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 17, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

maidul98 commented Mar 17, 2026 •

edited

Loading

greptile-apps bot commented Mar 17, 2026 •

edited

Loading