feat: Custom Certificate Upload & Management#928
Merged
Wikid82 merged 72 commits intodevelopmentfrom Apr 15, 2026
Merged
Conversation
…ntation for security improvements
Wikid82
added
enhancement
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
…g model - Rewrote commit slicing guidance in Management, Planning, and subagent instruction files to enforce one-feature-one-PR with ordered logical commits - Removed multi-PR branching logic from the execution workflow - Prevents partial feature merges that cause user confusion on self-hosted tools - All cross-references now use "Commit N" instead of "PR-N"
Contributor
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Contributor
✅ Supply Chain Verification Results✅ PASSED 📦 SBOM Summary
🔍 Vulnerability Scan
📎 Artifacts
Generated by Supply Chain Verification workflow • View Details |
…traction - Implemented certificate parsing for PEM, DER, and PFX formats. - Added functions to validate key matches and certificate chains. - Introduced metadata extraction for certificates including common name, domains, and issuer organization. - Created unit tests for all new functionalities to ensure reliability and correctness.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ogging improvements
…n-major-updates fix(deps): update non-major-updates (feature/beta-release)
…n-major-updates fix(deps): update non-major-updates (feature/beta-release)
…ftprops-action-gh-release-3.x chore(deps): update softprops/action-gh-release action to v3 (feature/beta-release)
- Implemented CertificateExportDialog for exporting certificates in various formats (PEM, PFX, DER) with options to include private keys and set passwords. - Created CertificateUploadDialog for uploading certificates, including validation and support for multiple file types (certificates, private keys, chain files). - Updated DeleteCertificateDialog to use 'domains' instead of 'domain' for consistency. - Refactored BulkDeleteCertificateDialog and DeleteCertificateDialog tests to accommodate changes in certificate structure. - Added FileDropZone component for improved file upload experience. - Enhanced translation files with new keys for certificate management features. - Updated Certificates page to utilize the new CertificateUploadDialog and clean up the upload logic. - Adjusted Dashboard and ProxyHosts pages to reflect changes in certificate data structure.
…/query-core, globals, builtin-modules, knip, and undici to latest versions for improved functionality and security
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 76 out of 80 changed files in this pull request and generated no new comments.
Files not reviewed (1)
- frontend/package-lock.json: Language not supported
Comments suppressed due to low confidence (6)
backend/internal/services/certificate_validator.go:1
- In the DER key fallback path, if
x509.ParseECPrivateKeyfails the code returns an error wrappingerr(fromParsePKCS8PrivateKey) instead of the last failure (err2). This can produce misleading errors and hides the actual parsing failure. Prefer returning/wrappingerr2(or the most relevant/last error) in that branch.
frontend/src/components/ProxyHostForm.tsx:1 - This select still uses
cert.idfor the optionvalue, but the certificate API changes in this PR emphasize UUID-based operations (andidis deprecated/optional in the type). Ifidis missing, multiple options will collapse tovalue=\"0\", breaking selection and submission. Usecert.uuidas the stable key/value (and update the proxy host API/contract to accept UUID), or guarantee thatidis always provided by the certificates list endpoint and remove the?? 0fallback.
backend/internal/services/certificate_validator_test.go:1 - The subtest name says "self-signed cert validates" but the assertion expects an error (and the inline comment explains why). Rename the test case to match the expected behavior (e.g., "self-signed cert fails chain validation without trusted root") to keep intent clear.
package.json:1 - The added
vitestversion^4.1.4is not a version I’m aware of (as of my 2025-08 knowledge cutoff). Please double-check that this version exists in npm and aligns with your Vite/TypeScript setup; if not, pin to an available Vitest major that matches the repo’s tooling.
frontend/src/components/CertificateList.tsx:1 selectedIdsnow stores certificate UUID strings rather than numeric IDs. Renaming to something likeselectedUuids(and corresponding setters) would reduce confusion and help prevent future misuse.
backend/pkg/dnsprovider/custom/rfc2136_provider_test.go:1t.Fatal(...)already stops the test goroutine (viaFailNow), so thereturnis redundant and adds noise. Consider removing thereturnunless it’s needed to satisfy a specific linter rule in this repo (in which case, documenting that rationale would help).
…to version 7.25.0
…d attributes and adjusting test logic
…n-major-updates fix(deps): update non-major-updates (feature/beta-release)
…tions-upload-pages-artifact-5.x chore(deps): update actions/upload-pages-artifact action to v5 (feature/beta-release)
…UploadDialog tests
…tificateUploadDialog
…onents - Implement test to deselect a row checkbox in CertificateList by clicking it a second time. - Add test to close detail dialog via the close button in CertificateList. - Add test to close export dialog via the cancel button in CertificateList. - Add test to show KEY format badge when a .key file is uploaded in CertificateUploadDialog. - Add test to ensure no format badge is shown for unknown file extensions in CertificateUploadDialog.
…n-major-updates fix(deps): update non-major-updates (feature/beta-release)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add full custom certificate upload, validation, and management to Charon. Users can upload PEM certificates and private keys, validate them before acceptance, view certificate chain details, export in multiple formats, and receive expiry warnings — all through the management UI.
Closes #22
What Changed
Backend (Go)
Certificate Service (
certificate_service.go,certificate_validator.go)private_key_enccolumn, never plaintext at rest)API Handlers (
certificate_handler.go)POST /certificates/upload— upload cert + optional keyPOST /certificates/validate— validate without persistingPUT /certificates/:id— update name/metadataGET /certificates/:id— fetch single certificate with chain infoPOST /certificates/:id/export— export as PEM or PFXDELETE /certificates/:id— delete with in-use guardCaddy Integration (
caddy/config.go,caddy/manager.go)Model (
ssl_certificate.go)CertificateChain,KeyType,Issuer,Fingerprint,DomainsPrivateKeyexcluded from GORM (gorm:"-"); onlyPrivateKeyEncryptedpersistsFrontend (React/TypeScript)
New Components
CertificateUploadDialog— drag-and-drop PEM file upload with real-time validation previewCertificateExportDialog— PEM/PFX export with optional password and key inclusionCertificateDetailDialog— full certificate details, chain viewer, and metadataCertificateChainViewer— visual intermediate/root chain displayCertificateValidationPreview— pre-upload validation feedbackFileDropZone— reusable accessible file drop targetUpdated Components
CertificateList— integrated upload, export, and detail actionsCertificateStatusCard— domain-aware status badgesProxyHostForm— custom certificate selection in SSL configurationCertificatespage — simplified with hook-based data flowAPI Client (
certificates.ts)uploadCertificate,validateCertificate,exportCertificatedeleteCertificateto accept UUID stringsHook (
useCertificates.ts)i18n (
translation.json)Testing
Backend Unit Tests (125+ tests across 8 files)
certificate_service_coverage_test.go— 33 subtests covering all service functionscertificate_handler_coverage_test.go— 21 handler endpoint testscertificate_validator_test.go— chain, key-pair, and format validationcertificate_handler_test.go/certificate_handler_security_test.go— updated for new routesFrontend Unit Tests (14 test files)
E2E Tests (Playwright)
certificate-export.spec.ts— 14 end-to-end tests covering export dialog flowsInfrastructure
musl musl-utilsinapk upgrade)@axe-core/playwrightadded for accessibility testingAcceptance Criteria Status
Quality Gates