From 0c6f033d02113687ace0909651a9cdf8bb6d5169 Mon Sep 17 00:00:00 2001
From: Fu Diwei <fudiwei@sina.com>
Date: Fri, 22 May 2026 22:39:50 +0800
Subject: [PATCH] feat: enhance certificate download API with additional
 parameters for PFX and JKS formats

---
 internal/certificate/service.go     | 40 +++++++++++++++++++++++------
 internal/domain/dtos/certificate.go |  7 ++++-
 ui/src/api/certificates.ts          |  7 ++++-
 3 files changed, 44 insertions(+), 10 deletions(-)

diff --git a/internal/certificate/service.go b/internal/certificate/service.go
index c08660705..e6ca8b92a 100644
--- a/internal/certificate/service.go
+++ b/internal/certificate/service.go
@@ -16,6 +16,7 @@ import (
 	"github.com/certimate-go/certimate/internal/domain"
 	"github.com/certimate-go/certimate/internal/domain/dtos"
 	xcert "github.com/certimate-go/certimate/pkg/utils/cert"
+	xcertpfx "github.com/certimate-go/certimate/pkg/utils/cert/pfx"
 )
 
 type CertificateService struct {
@@ -116,9 +117,17 @@ func (s *CertificateService) DownloadCertificate(ctx context.Context, req *dtos.
 
 	case domain.CertificateFormatTypePFX:
 		{
-			const pfxPassword = "certimate"
+			pfxPassword := "certimate"
+			if req.PfxPassword != "" {
+				pfxPassword = req.PfxPassword
+			}
 
-			certPFX, err := xcert.TransformCertificateFromPEMToPFX(certificate.Certificate, certificate.PrivateKey, pfxPassword, nil)
+			pfxEncoder, err := xcertpfx.ResolvePfxEncoder(req.PfxEncoder)
+			if err != nil {
+				return nil, err
+			}
+
+			certPFX, err := xcert.TransformCertificateFromPEMToPFX(certificate.Certificate, certificate.PrivateKey, pfxPassword, pfxEncoder)
 			if err != nil {
 				return nil, err
 			}
@@ -133,11 +142,12 @@ func (s *CertificateService) DownloadCertificate(ctx context.Context, req *dtos.
 				}
 			}
 
-			keyWriter, err := zipWriter.Create("pfx-password.txt")
+			readmeWriter, err := zipWriter.Create("README.txt")
 			if err != nil {
 				return nil, err
 			} else {
-				_, err = keyWriter.Write([]byte(pfxPassword))
+				readme := fmt.Sprintf("[PFX Password]\n%s\n", pfxPassword)
+				_, err = readmeWriter.Write([]byte(readme))
 				if err != nil {
 					return nil, err
 				}
@@ -153,9 +163,22 @@ func (s *CertificateService) DownloadCertificate(ctx context.Context, req *dtos.
 
 	case domain.CertificateFormatTypeJKS:
 		{
-			const jksPassword = "certimate"
+			jksAlias := "certimate"
+			if req.JksAlias != "" {
+				jksAlias = req.JksAlias
+			}
 
-			certJKS, err := xcert.TransformCertificateFromPEMToJKS(certificate.Certificate, certificate.PrivateKey, jksPassword, jksPassword, jksPassword)
+			jksKeypass := "certimate"
+			if req.JksKeypass != "" {
+				jksKeypass = req.JksKeypass
+			}
+
+			jksStorepass := "certimate"
+			if req.JksStorepass != "" {
+				jksStorepass = req.JksStorepass
+			}
+
+			certJKS, err := xcert.TransformCertificateFromPEMToJKS(certificate.Certificate, certificate.PrivateKey, jksAlias, jksKeypass, jksStorepass)
 			if err != nil {
 				return nil, err
 			}
@@ -170,11 +193,12 @@ func (s *CertificateService) DownloadCertificate(ctx context.Context, req *dtos.
 				}
 			}
 
-			keyWriter, err := zipWriter.Create("jks-password.txt")
+			readmeWriter, err := zipWriter.Create("README.txt")
 			if err != nil {
 				return nil, err
 			} else {
-				_, err = keyWriter.Write([]byte(jksPassword))
+				readme := fmt.Sprintf("[JKS Alias]\n%s\n\n[JKS Key Password]\n%s\n\n[JKS Store Password]\n%s\n", jksAlias, jksKeypass, jksStorepass)
+				_, err = readmeWriter.Write([]byte(readme))
 				if err != nil {
 					return nil, err
 				}
diff --git a/internal/domain/dtos/certificate.go b/internal/domain/dtos/certificate.go
index a315f3f99..9a3cd4558 100644
--- a/internal/domain/dtos/certificate.go
+++ b/internal/domain/dtos/certificate.go
@@ -6,7 +6,12 @@ import (
 
 type CertificateDownloadReq struct {
 	CertificateId string                       `json:"-"`
-	FileFormat    domain.CertificateFormatType `json:"format"`
+	FileFormat    domain.CertificateFormatType `json:"fileFormat"`
+	PfxPassword   string                       `json:"pfxPassword,omitempty"`
+	PfxEncoder    string                       `json:"pfxEncoder,omitempty"`
+	JksAlias      string                       `json:"jksAlias,omitempty"`
+	JksKeypass    string                       `json:"jksKeypass,omitempty"`
+	JksStorepass  string                       `json:"jksStorepass,omitempty"`
 }
 
 type CertificateDownloadResp struct {
diff --git a/ui/src/api/certificates.ts b/ui/src/api/certificates.ts
index b35b34fcb..94ec4a259 100644
--- a/ui/src/api/certificates.ts
+++ b/ui/src/api/certificates.ts
@@ -2,7 +2,11 @@ import { type CertificateFormatType } from "@/domain/certificate";
 
 import { post as httpPost } from "./_api";
 
-export const download = (certificateId: string, format?: CertificateFormatType) => {
+export const download = (
+  certificateId: string,
+  format?: CertificateFormatType,
+  params?: { pfxPassword?: string; pfxEncoder?: string; jksAlias?: string; jksKeypass?: string; jksStorepass?: string }
+) => {
   type RespData = {
     zipBytes: string;
   };
@@ -11,6 +15,7 @@ export const download = (certificateId: string, format?: CertificateFormatType)
     url: `/api/certificates/${encodeURIComponent(certificateId)}/download`,
     body: {
       fileFormat: format,
+      ...params,
     },
   });
 };