Infisical Certificate Manager: Support CSR with unknown fields

[NothingTooSerious]

An enhancement is needed to support creating custom fields in the template policy or allow CSR with unknown fields to be transparently presented to the upstream CA for signing.

Often embedded clients do not support importing certificates, instead they generate a private key locally and create a CSR for signing. Typically the CSR can be presented to Lets Encrypt, signed and then successfully imported back into the embedded client.

This CSR may include fields that can not be removed, including:

• Country (C)
• State (ST)
• City / Locality (L)
• Organisation Name (O)
• Organisational Unit (OU)

Infisical does not support editing the template policy to handle CSR with such fields present. This prevents Infisical from forwarding the CSR to an upstream provider for signing.

Today, Infisical is very strict and rejects the CSR contains any unknown fields with the following error messages:

Bad Request

Certificate order validation failed: organization is not allowed by template policy (not defined in template), organizational_unit is not allowed by template policy (not defined in template), country is not allowed by template policy (not defined in template), state is not allowed by template policy (not defined in template), locality is not allowed by template policy (not defined in template).

Failed to request certificate: Request failed with status code 400

Reproduction

1. Go to certificate manager
2. Click on +Request
3. Choose Request Method Certificate Signing Request (CSR)
4. Select certificate profile
5. Paste in the CSR certificate request with fields like Country, State and Organisation Name present.
6. Click on Request Certificate

Expect a signed certificate, instead get the error messages.

[sheensantoscapadngan]

Hey @NothingTooSerious! You should be able to add these to your certificate policy since these fields are supported under the subject attributes

[NothingTooSerious]

Hi,
That worked a treat. I missed that there existed a drop down at that spot which offered more options.