feat(pki): add AWS ACM Public CA support

backend/package.json

@@ -140,6 +140,7 @@
   },
   "dependencies": {
     "@ai-sdk/anthropic": "^3.0.68",
+    "@aws-sdk/client-acm": "^3.1030.0",
     "@aws-sdk/client-acm-pca": "^3.992.0",
     "@aws-sdk/client-elasticache": "^3.637.0",
     "@aws-sdk/client-iam": "^3.525.0",

backend/src/db/migrations/20260416231234_add-external-metadata-to-certificates.ts

@@ -0,0 +1,24 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.Certificate)) {
+    const hasColumn = await knex.schema.hasColumn(TableName.Certificate, "externalMetadata");
+    if (!hasColumn) {
+      await knex.schema.alterTable(TableName.Certificate, (t) => {
+        t.jsonb("externalMetadata").nullable();
+      });
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.Certificate)) {
+    if (await knex.schema.hasColumn(TableName.Certificate, "externalMetadata")) {
+      await knex.schema.alterTable(TableName.Certificate, (t) => {
+        t.dropColumn("externalMetadata");
+      });
+    }
+  }
+}

backend/src/db/schemas/certificates.ts

@@ -44,7 +44,8 @@ export const CertificatesSchema = z.object({
   isCA: z.boolean().nullable().optional(),
   pathLength: z.number().nullable().optional(),
   source: z.string().nullable().optional(),
-  discoveryMetadata: z.unknown().nullable().optional()
+  discoveryMetadata: z.unknown().nullable().optional(),
+  externalMetadata: z.unknown().nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;

backend/src/lib/api-docs/constants.ts

@@ -2555,6 +2555,12 @@ export const CertificateAuthorities = {
       certificateAuthorityArn: `The ARN of the AWS Private Certificate Authority to use for issuing certificates.`,
       region: `The AWS region where the Private Certificate Authority is located.`
     },
+    AWS_ACM_PUBLIC_CA: {
+      appConnectionId: `The ID of the AWS App Connection to use for authenticating with AWS Certificate Manager (ACM). This connection must have permissions to request, describe, export, renew, and delete certificates.`,
+      dnsAppConnectionId: `The ID of the AWS App Connection to use for creating and managing Route 53 CNAME records required for ACM domain validation.`,
+      hostedZoneId: `The Route 53 hosted zone ID to use for ACM DNS validation CNAME records.`,
+      region: `The AWS region to use for the ACM API calls.`
+    },
     INTERNAL: {
       type: "The type of CA to create.",
       friendlyName: "A friendly name for the CA.",

backend/src/server/routes/v1/certificate-authority-routers/aws-acm-public-ca-certificate-authority-router.ts

@@ -0,0 +1,18 @@
+import {
+  AwsAcmPublicCaCertificateAuthoritySchema,
+  CreateAwsAcmPublicCaCertificateAuthoritySchema,
+  UpdateAwsAcmPublicCaCertificateAuthoritySchema
+} from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+
+import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
+
+export const registerAwsAcmPublicCaCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
+  registerCertificateAuthorityEndpoints({
+    caType: CaType.AWS_ACM_PUBLIC_CA,
+    server,
+    responseSchema: AwsAcmPublicCaCertificateAuthoritySchema,
+    createSchema: CreateAwsAcmPublicCaCertificateAuthoritySchema,
+    updateSchema: UpdateAwsAcmPublicCaCertificateAuthoritySchema
+  });
+};

backend/src/server/routes/v1/certificate-authority-routers/general-certificate-authority-router.ts

@@ -6,6 +6,7 @@ import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
+import { AwsAcmPublicCaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
 import { AwsPcaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-pca/aws-pca-certificate-authority-schemas";
 import { AzureAdCsCertificateAuthoritySchema } from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
@@ -15,7 +16,8 @@ const CertificateAuthoritySchema = z.discriminatedUnion("type", [
   InternalCertificateAuthoritySchema,
   AcmeCertificateAuthoritySchema,
   AzureAdCsCertificateAuthoritySchema,
-  AwsPcaCertificateAuthoritySchema
+  AwsPcaCertificateAuthoritySchema,
+  AwsAcmPublicCaCertificateAuthoritySchema
 ]);
 
 export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
@@ -73,6 +75,14 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
         req.permission
       );
 
+      const awsAcmPublicCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.AWS_ACM_PUBLIC_CA
+        },
+        req.permission
+      );
+
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         projectId: req.query.projectId,
@@ -83,7 +93,8 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
               ...(internalCas ?? []).map((ca) => ca.id),
               ...(acmeCas ?? []).map((ca) => ca.id),
               ...(azureAdCsCas ?? []).map((ca) => ca.id),
-              ...(awsPcaCas ?? []).map((ca) => ca.id)
+              ...(awsPcaCas ?? []).map((ca) => ca.id),
+              ...(awsAcmPublicCas ?? []).map((ca) => ca.id)
             ]
           }
         }
@@ -94,7 +105,8 @@ export const registerGeneralCertificateAuthorityRouter = async (server: FastifyZ
           ...(internalCas ?? []),
           ...(acmeCas ?? []),
           ...(azureAdCsCas ?? []),
-          ...(awsPcaCas ?? [])
+          ...(awsPcaCas ?? []),
+          ...(awsAcmPublicCas ?? [])
         ]
       };
     }

backend/src/server/routes/v1/certificate-authority-routers/index.ts

@@ -1,6 +1,7 @@
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
 
 import { registerAcmeCertificateAuthorityRouter } from "./acme-certificate-authority-router";
+import { registerAwsAcmPublicCaCertificateAuthorityRouter } from "./aws-acm-public-ca-certificate-authority-router";
 import { registerAwsPcaCertificateAuthorityRouter } from "./aws-pca-certificate-authority-router";
 import { registerAzureAdCsCertificateAuthorityRouter } from "./azure-ad-cs-certificate-authority-router";
 import { registerInternalCertificateAuthorityRouter } from "./internal-certificate-authority-router";
@@ -12,5 +13,6 @@ export const CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP: Record<CaType, (server:
     [CaType.INTERNAL]: registerInternalCertificateAuthorityRouter,
     [CaType.ACME]: registerAcmeCertificateAuthorityRouter,
     [CaType.AZURE_AD_CS]: registerAzureAdCsCertificateAuthorityRouter,
-    [CaType.AWS_PCA]: registerAwsPcaCertificateAuthorityRouter
+    [CaType.AWS_PCA]: registerAwsPcaCertificateAuthorityRouter,
+    [CaType.AWS_ACM_PUBLIC_CA]: registerAwsAcmPublicCaCertificateAuthorityRouter
   };

backend/src/server/routes/v2/certificate-authority-router.ts

@@ -6,6 +6,7 @@ import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
+import { AwsAcmPublicCaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-schemas";
 import { AwsPcaCertificateAuthoritySchema } from "@app/services/certificate-authority/aws-pca/aws-pca-certificate-authority-schemas";
 import { AzureAdCsCertificateAuthoritySchema } from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
 import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
@@ -15,7 +16,8 @@ const CertificateAuthoritySchema = z.discriminatedUnion("type", [
   InternalCertificateAuthoritySchema,
   AcmeCertificateAuthoritySchema,
   AzureAdCsCertificateAuthoritySchema,
-  AwsPcaCertificateAuthoritySchema
+  AwsPcaCertificateAuthoritySchema,
+  AwsAcmPublicCaCertificateAuthoritySchema
 ]);
 
 export const registerCaRouter = async (server: FastifyZodProvider) => {
@@ -73,6 +75,14 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         req.permission
       );
 
+      const awsAcmPublicCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
+        {
+          projectId: req.query.projectId,
+          type: CaType.AWS_ACM_PUBLIC_CA
+        },
+        req.permission
+      );
+
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
         projectId: req.query.projectId,
@@ -83,7 +93,8 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
               ...(internalCas ?? []).map((ca) => ca.id),
               ...(acmeCas ?? []).map((ca) => ca.id),
               ...(azureAdCsCas ?? []).map((ca) => ca.id),
-              ...(awsPcaCas ?? []).map((ca) => ca.id)
+              ...(awsPcaCas ?? []).map((ca) => ca.id),
+              ...(awsAcmPublicCas ?? []).map((ca) => ca.id)
             ]
           }
         }
@@ -94,7 +105,8 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
           ...(internalCas ?? []),
           ...(acmeCas ?? []),
           ...(azureAdCsCas ?? []),
-          ...(awsPcaCas ?? [])
+          ...(awsPcaCas ?? []),
+          ...(awsAcmPublicCas ?? [])
         ]
       };
     }

backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-client.ts

@@ -0,0 +1,60 @@
+import { ACMClient } from "@aws-sdk/client-acm";
+
+import { CustomAWSHasher } from "@app/lib/aws/hashing";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { NotFoundError } from "@app/lib/errors";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AWSRegion } from "@app/services/app-connection/app-connection-enums";
+import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
+import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
+import { TAwsConnection } from "@app/services/app-connection/aws/aws-connection-types";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+export const createAcmClient = async ({
+  appConnectionId,
+  region,
+  appConnectionDAL,
+  kmsService
+}: {
+  appConnectionId: string;
+  region: AWSRegion;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+}) => {
+  const appConnection = await appConnectionDAL.findById(appConnectionId);
+  if (!appConnection) {
+    throw new NotFoundError({ message: `App connection with ID '${appConnectionId}' not found` });
+  }
+
+  const decryptedConnection = (await decryptAppConnection(appConnection, kmsService)) as TAwsConnection;
+  const awsConfig = await getAwsConnectionConfig(decryptedConnection, region);
+
+  return new ACMClient({
+    sha256: CustomAWSHasher,
+    useFipsEndpoint: crypto.isFipsModeEnabled(),
+    credentials: awsConfig.credentials,
+    region: awsConfig.region
+  });
+};
+
+export const resolveDnsAwsConnection = async ({
+  dnsAppConnectionId,
+  appConnectionDAL,
+  kmsService
+}: {
+  dnsAppConnectionId: string;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
+  >;
+}) => {
+  const dnsAppConnection = await appConnectionDAL.findById(dnsAppConnectionId);
+  if (!dnsAppConnection) {
+    throw new NotFoundError({ message: `DNS app connection with ID '${dnsAppConnectionId}' not found` });
+  }
+  return (await decryptAppConnection(dnsAppConnection, kmsService)) as TAwsConnection;
+};

backend/src/services/certificate-authority/aws-acm-public-ca/aws-acm-public-ca-certificate-authority-enums.ts

@@ -0,0 +1,9 @@
+export enum AwsAcmValidationMethod {
+  DNS = "DNS"
+}
+
+/**
+ * ACM public certificates have a fixed validity period (as of 2025).
+ * See: https://docs.aws.amazon.com/acm/latest/userguide/managed-renewal.html
+ */
+export const AWS_ACM_CERTIFICATE_VALIDITY_DAYS = 198;