[Manuthor]

Summary

Lets an online KMS run a delegated (sub) CA whose private key never leaves the HSM, with an offline root signing the sub-CA CSR using its own HSM key. Full rationale: documentation/adr/2026-10-23-hsm-backed-sub-ca-csr-and-oracle-signing.md.

Server

• CSR generation: new POST /certificates/csr. The CSR is signed by the HSM through the crypto oracle and needs only the Sign permission on the key. An extractable HSM key is refused.
• Oracle signing: Certify/ReCertify, GenerateCrl and the OCSP responder sign HSM CA keys through the crypto oracle. The structure is built with a placeholder key, re-signed by the HSM, and verified against the real public key before use.
  • Algorithms: RSA and EC (SHA-256) and, in non-FIPS builds, Ed25519/Ed448 (raw TBS).
  • ML-DSA/SLH-DSA HSM CA keys remain unsupported (no PQC key types in the HSM layer).
• CRL regeneration: CrlRequester::{User, Server}. Post-Revoke and cron regeneration reads the issuer certificate directly, and the signing key is authorized as the issuer certificate's owner (never the caller). For hsm:: keys that owner still needs a grant or HSM-admin rights (documented as NEG-002).
• Self-signed HSM root: certifying an HSM public key <sk>_pk derives <sk> as the private-key link, for both issuer lookup and the certificate's PrivateKeyLink.
• OCSP fix: verify_issuer_hashes_match_ca answered unauthorized for every non-self-signed CA, because it hashed the CA's issuer name. It now hashes the CA's own subject, so OCSP works for sub-CAs (HSM or not).
• _serial=<HEX> tag: added to every stored certificate (Certify, ReCertify, Import, Register, PKCS#12). Existing certificates are backfilled once at startup on SQLite, PostgreSQL, MySQL/MariaDB and Redis-Findex, gated by a marker. The SQL inserts are conflict-tolerant so multi-node starts are safe.
• SCEP still returns NotSupported for a sensitive HSM CA key; EST works.

CLI

• ckms certificates generate-csr (+ regenerated CLI docs).

UI

• Certificates > Generate CSR page, with en/fr/zh-CN translations and a Playwright spec.
• Includes a prettier reformat of ui/src/utils/utils.ts required by the format hook.

Docs

• ADR, use-case guide use_cases/pki-sub-ca-csr.md, changelog entry, log reference.

Behaviour changes

• Every hsm:: issuer key (including non-sensitive ones that used to be exported) now signs through the oracle for Certify, ReCertify, CRL and OCSP. HSM CA keys other than RSA/EC/Ed25519/Ed448 are rejected with NotSupported; a P-384 HSM CA signs ecdsa-with-SHA256.
• One-time _serial= tag write on the first start after upgrade.

Verification

• Unit and server tests (FIPS and non-FIPS): oracle_signing, sub_ca_tests, crl_tests, revoke_tests, enrollment_tests, certify, OCSP, test_validate, plus a crypto unit test for the sub-CA OCSP hash fix.
• HSM scenario test_hsm_all on SoftHSM2 (FIPS and non-FIPS): HSM root, sub-CA CSR, leaf, CRL, Ed25519 sub-CA, and OCSP good/revoked signed by the HSM.
• Database tests on live PostgreSQL, MySQL and Redis containers: test_db_postgresql (+ multihost, failover), test_db_mysql, test_db_redis_with_findex.
• Clippy clean in both modes.

Not covered

• Only SoftHSM2 was run, not the other HSM vendors.
• The serial-tag backfill is tested with a seeded legacy certificate on SQLite and Redis only; on PostgreSQL and MySQL it ran against an empty certificate set.
• pgsql::tests::test_db_postgresql_tls_sslmode_matrix was not run successfully (needs a TLS server).