[devin-ai-integration]

Description

Fixes #298. Profile-managed certificates currently issue on every Agent startup, consuming CA quota during systemd restarts and reboots.

• Persist certificate identity, actual X.509 expiry, configuration fingerprint, and pending request IDs. State defaults to <certificate.path>.infisical-state.json; optional lifecycle.state-path supports restricted writable directories. No private keys are stored in state.
• Reuse healthy certificates, recover pre-upgrade identities through the profile, and repair missing or corrupt outputs from the existing bundle without placing another CA order.
• Resume asynchronous issuance/renewal, renew within renew-before-expiry, preserve periodic status checks, and lock state against concurrent processes.
• Fail closed on ambiguous request outcomes, revoked certificates, unreadable/corrupt state, and metadata errors. Definitively rejected requests can retry.
• Preserve reload hooks across interrupted delivery, retry lock takeover, validate symlink-safe paths and full chain digests, and apply omit-root changes without reissuing.
• Distinguish valid root-omitted empty chains from genuinely missing chains by validating the full stored bundle.
• Preserve externally managed CSR keys while validating CSR public keys and available local keys. Accept SAN-only certificate identities when the CA omits the subject common name.
• Keep certificate-ID distribution separate and document state placement and crash recovery in the example configuration.

Pre-upgrade recovery requires read access to the certificate profile. Keep state across restarts. A crash between submission and recording the response requires checking Infisical before restoring/removing state, rather than risking duplicate issuance.

Type

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests

Local tests use a mock API and generated X.509 certificates, without external CA requests. Coverage includes restart reuse with/without state, actual-expiry and periodic renewal, pending issuance/renewal, output repair, invalid identities and keys, SAN-only leaves, external CSR keys, changed configuration, interrupted delivery and reload hooks, retry safety, revocation, state locks and takeover, symlink-safe paths, permissions, and chain integrity/root policy.

Real-backend CI coverage includes default root omission and restart reuse against an internal CA, plus ACME/Pebble certificate reuse after restart. Only fixtures requiring a nonempty root chain explicitly include roots. The E2E package is compile-checked locally; execution runs in CI.

The following local commands pass:

go test -race -vet=off -count=5 -run 'TestManagedCertificate|TestCertificateStatePath' ./packages/cmd/
go test -race -vet=off -count=1 ./packages/cmd/... ./packages/api/... ./packages/agentvault/...
go test -race -count=1 ./packages/gateway-v2/... ./packages/pam/handlers/clickhouse/
go vet ./packages/api/...
go vet -printf=false ./packages/cmd/...
go build .
git diff --check
(cd e2e && go test -run "^$" ./agent)

Changed Go files are gofmt-clean. Full-repository formatting and vet report existing issues in unchanged files. Full go vet ./packages/... reports diagnostics in packages/cmd/run.go, packages/gateway-v2/connection.go, and packages/pam/handlers/kubernetes/proxy.go; Cmd tests disable vet to avoid existing dynamic Msgf diagnostics.

---

• I have read the contributing guide, agreed and acknowledged the code of conduct.

Link to Devin session: https://app.devin.ai/sessions/50f4661509d14da1b15820e86dc2b019
Open in Devin Desktop: https://app.devin.ai/desktop/session/50f4661509d14da1b15820e86dc2b019?variant=devin
Requested by: @ashwin-infisical

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds certificate state persistence and new API endpoint.

The PR appears safe to merge; no new actionable finding or outstanding previous finding remains.

Summary

The PR persists profile-managed certificate state so the Agent can reuse certificates after restart, resume requests, repair outputs, and renew according to actual X.509 expiry.

• Adds state locking, recovery, chain validation, and delivery-hook handling.
• Adds unit and end-to-end coverage for restart reuse and root-omitted chains.

_{Reviews (7) · Last reviewed commit: "test(agent): verify ACME certificate reu..."}

[devin-ai-integration]

Validation is complete on dcdbdb5. The real-backend internal-CA and ACME/Pebble suites verify certificate reuse after restart, default root omission, CSR enrollment, and unchanged certificate-ID distribution. All reported compatibility gaps have regression coverage.

Fixes made during validation:

• 4c6a8d5: Preserve externally managed CSR keys. A missing external key no longer blocks delivery/recovery, while available keys and the signed CSR public key remain validated. Added race-tested coverage for missing/existing keys, mismatches, repair, and restart reuse.
• f4534ca: Recognize SAN-only certificate identities when the CA omits the subject common name. The requested identity must be present in the SANs; unrelated SANs and conflicting nonempty common names remain rejected. Added signed-certificate issuance/restart coverage for CSR and generated-key modes.
• dcdbdb5: Restart the real-backend ACME/Pebble Agent and verify serial reuse without issuance or renewal.