feat(pki): add default TTL setting to certificate profiles by saifsmailbox98 · Pull Request #5238 · Infisical/infisical

saifsmailbox98 · 2026-01-22T18:07:30Z

Context

Certificate profiles now support an optional default TTL setting that serves as a fallback validity period when a TTL is not explicitly specified in the certificate request.

ACME and certificate issuance services can now use the profile's default TTL when no explicit TTL is provided in the request

Screenshots

Steps to verify the change

Create a policy with a max validity, create a profile with a default TTL (<= policy's max validity), use Certbot (ACME) to issue a certificate and it should use the default TTL provided.

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

… screenshot

maidul98 · 2026-01-22T18:08:11Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-01-22T18:11:29Z

Greptile Overview

Greptile Summary

This PR adds optional default TTL support to certificate profiles, serving as a fallback when certificates are requested without an explicit TTL. The implementation follows a clear priority hierarchy: request TTL > profile default TTL > flow-specific default (47d for ACME, 90d for EST).

Key Changes:

Added nullable defaultTtlDays column to certificate profiles via idempotent migration
Created resolveEffectiveTtl function with validation to ensure profile defaults don't exceed policy max validity
Updated ACME, EST, and API certificate issuance flows to use the new TTL resolution logic
Made API TTL parameter optional (previously required) to support profile defaults
Added frontend UI with checkbox-enabled TTL input, unit conversion (days/months/years), and client-side validation
Documentation updated to explain the default TTL feature

Issues Found:

Empty string fallback in certificate-router.ts:222 could cause inconsistent behavior with the TTL resolution logic

Overall Assessment:
The implementation is well-structured with proper validation at both frontend and backend layers. The TTL resolution priority is clearly documented and consistently applied across enrollment flows. The one logic issue found should be addressed to ensure robustness.

Confidence Score: 4/5

This PR is mostly safe to merge with one logic issue that should be fixed
Score reflects solid implementation with clear validation and documentation, but the empty string fallback in the certificate router could cause unexpected behavior in edge cases where no TTL is provided
Pay close attention to backend/src/server/routes/v1/certificate-router.ts - the empty string fallback on line 222 needs correction

Important Files Changed

Filename	Overview
backend/src/services/certificate-v3/certificate-v3-fns.ts	New `resolveEffectiveTtl` function with clear priority order and validation
backend/src/services/certificate-v3/certificate-v3-service.ts	Integrates TTL resolution logic across issuance flows, with potential empty string issue
backend/src/services/certificate-profile/certificate-profile-service.ts	Validation ensures default TTL doesn't exceed policy max validity on create/update
backend/src/server/routes/v1/certificate-router.ts	TTL made optional in API, but empty string fallback could cause issues
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx	UI with checkbox-enabled TTL input, conversion helpers, and client-side validation

greptile-apps

_{10 files reviewed, 5 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/services/certificate-v3/certificate-v3-service.ts

...src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx

…fectiveTtl` utility, and enhance validation logic.

…al screenshot

…lt-certificate-ttl-values-to-profiles # Conflicts: # backend/src/services/certificate-v3/certificate-v3-service.ts

backend/src/db/migrations/20260127212335_add-default-ttl-to-certificate-profiles.ts

…vices, refine TTL resolution logic, and enhance validation and defaults handling

…g explicit error

saifsmailbox98 · 2026-01-26T18:38:06Z

@greptile review this

greptile-apps

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-01-26T18:48:52Z

Additional Comments (1)

backend/src/server/routes/v1/certificate-router.ts
Empty string fallback doesn't match resolveEffectiveTtl behavior. When attributes?.ttl is undefined, this passes an empty string ("") to the certificate order flow. However, resolveEffectiveTtl in certificate-v3-fns.ts:93 checks if (flowDefaultTtl) which treats empty string as truthy, bypassing the error throw and potentially causing unexpected behavior.

Either pass undefined instead of "", or ensure the downstream logic handles empty strings consistently.

          validity: { ttl: attributes?.ttl },

…defaultTtlDays

saifsmailbox98 · 2026-01-26T19:14:40Z

Additional Comments (1)
backend/src/server/routes/v1/certificate-router.ts Empty string fallback doesn't match resolveEffectiveTtl behavior. When attributes?.ttl is undefined, this passes an empty string ("") to the certificate order flow. However, resolveEffectiveTtl in certificate-v3-fns.ts:93 checks if (flowDefaultTtl) which treats empty string as truthy, bypassing the error throw and potentially causing unexpected behavior.

Either pass undefined instead of "", or ensure the downstream logic handles empty strings consistently.
          validity: { ttl: attributes?.ttl },

Aren't both falsy?

backend/src/services/certificate-profile/certificate-profile-service.ts

backend/src/services/certificate-v3/certificate-v3-fns.ts

…es and update its usage

…ltTtlDays is used when no explicit TTL is provided

…icate processing. Rename migration

saifsmailbox98 added 2 commits January 22, 2026 23:24

Add default TTL setting to certificate profiles

1d74c8b

Document default certificate TTL setting in profiles and update modal…

25550f7

… screenshot

saifsmailbox98 requested a review from carlosmonastyrski January 22, 2026 18:07

saifsmailbox98 marked this pull request as ready for review January 22, 2026 18:07

mintlify bot deployed to staging - docs January 22, 2026 18:09 View deployment

greptile-apps bot reviewed Jan 22, 2026

View reviewed changes

saifsmailbox98 added 2 commits January 23, 2026 00:27

Refine default TTL behavior in certificate profiles, add `calculateEf…

b10f469

…fectiveTtl` utility, and enhance validation logic.

Adjust default TTL input styling in CreateProfileModal and update mod…

ab352ab

…al screenshot

mintlify bot deployed to staging - docs January 22, 2026 19:14 View deployment

Format

1b51267

mintlify bot deployed to staging - docs January 23, 2026 19:40 View deployment

Merge remote-tracking branch 'origin/main' into saif/pki-98-add-defau…

4d4b92a

…lt-certificate-ttl-values-to-profiles # Conflicts: # backend/src/services/certificate-v3/certificate-v3-service.ts

saifsmailbox98 force-pushed the saif/pki-98-add-default-certificate-ttl-values-to-profiles branch from 33aa9b0 to 4d4b92a Compare January 23, 2026 20:18

mintlify bot deployed to staging - docs January 23, 2026 20:47 View deployment

carlosmonastyrski requested changes Jan 24, 2026

View reviewed changes

saifsmailbox98 added 3 commits January 26, 2026 23:42

Replace calculateEffectiveTtl with resolveEffectiveTtl across ser…

743bd57

…vices, refine TTL resolution logic, and enhance validation and defaults handling

Make duration field nullable in CreateProfileModal validation schema

0785260

Refine resolveEffectiveTtl to handle missing TTL sources by throwin…

bcd5fe9

…g explicit error

greptile-apps bot reviewed Jan 26, 2026

View reviewed changes

Update test to validate flow default TTL handling when profile lacks …

779afe0

…defaultTtlDays

saifsmailbox98 requested a review from carlosmonastyrski January 26, 2026 20:15

carlosmonastyrski requested changes Jan 27, 2026

View reviewed changes

backend/src/services/certificate-profile/certificate-profile-service.ts Outdated Show resolved Hide resolved

backend/src/services/certificate-v3/certificate-v3-fns.ts Outdated Show resolved Hide resolved

Refactor validateDefaultTtlDaysAgainstPolicy to simplify dependenci…

125628f

…es and update its usage

saifsmailbox98 requested a review from carlosmonastyrski January 27, 2026 13:08

Add TTL resolution to self-signed and approval paths so profile defau…

fb84a6e

…ltTtlDays is used when no explicit TTL is provided

saifsmailbox98 and others added 2 commits January 28, 2026 03:08

Inject default TTL into certificate request during self-signed certif…

6711b84

…icate processing. Rename migration

Small fix on findMatchingCertificates

b19eb0e

carlosmonastyrski approved these changes Jan 28, 2026

View reviewed changes

saifsmailbox98 merged commit c43f7c7 into main Jan 28, 2026
14 of 15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(pki): add default TTL setting to certificate profiles#5238

feat(pki): add default TTL setting to certificate profiles#5238
saifsmailbox98 merged 14 commits intomainfrom
saif/pki-98-add-default-certificate-ttl-values-to-profiles

saifsmailbox98 commented Jan 22, 2026 •

edited

Loading

Uh oh!

maidul98 commented Jan 22, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Jan 22, 2026 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Jan 26, 2026

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot commented Jan 26, 2026

Uh oh!

saifsmailbox98 commented Jan 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

saifsmailbox98 commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

maidul98 commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Jan 26, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot commented Jan 26, 2026

Uh oh!

saifsmailbox98 commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saifsmailbox98 commented Jan 22, 2026 •

edited

Loading

maidul98 commented Jan 22, 2026 •

edited

Loading

greptile-apps bot commented Jan 22, 2026 •

edited

Loading

saifsmailbox98 commented Jan 26, 2026 •

edited

Loading