[feature] Added X.509 Certificate Generator Templates

openwisp_controller/config/base/template.py

@@ -22,7 +22,11 @@
 
 logger = logging.getLogger(__name__)
 
-TYPE_CHOICES = (("generic", _("Generic")), ("vpn", _("VPN-client")))
+TYPE_CHOICES = (
+    ("generic", _("Generic")),
+    ("vpn", _("VPN-client")),
+    ("cert", _("Certificate")),
+)
 
 
 def default_auto_cert():
@@ -55,6 +59,28 @@ class AbstractTemplate(ShareableOrgMixinUniqueName, BaseConfig):
         null=True,
         on_delete=models.CASCADE,
     )
+    ca = models.ForeignKey(
+        get_model_name("django_x509", "Ca"),
+        on_delete=models.CASCADE,
+        verbose_name=_("Certificate Authority"),
+        blank=True,
+        null=True,
+        help_text=_(
+            "The Certificate Authority that will sign certificates generated "
+            "by this template."
+        ),
+    )
+    blueprint_cert = models.ForeignKey(
+        get_model_name("django_x509", "Cert"),
+        on_delete=models.SET_NULL,
+        verbose_name=_("Blueprint Certificate"),
+        blank=True,
+        null=True,
+        help_text=_(
+            "Optional: Select an unassigned certificate to copy extensions and "
+            "properties from."
+        ),
+    )
     type = models.CharField(
         _("type"),
         max_length=16,
@@ -222,6 +248,8 @@ def clean(self, *args, **kwargs):
         * if flagged as required forces it also to be default
         """
         self._validate_org_relation("vpn")
+        self._validate_org_relation("ca")
+        self._validate_org_relation("blueprint_cert")
         if not self.default_values:
             self.default_values = {}
         if not isinstance(self.default_values, dict):
@@ -234,15 +262,53 @@ def clean(self, *args, **kwargs):
             )
         elif self.type != "vpn":
             self.vpn = None
-            self.auto_cert = False
+            if self.type != "cert":
+                self.auto_cert = False
         if self.type == "vpn" and not self.config:
             self.config = self.vpn.auto_client(
                 auto_cert=self.auto_cert, template_backend_class=self.backend_class
             )
+        if self.type == "cert":
+            if not self.ca:
+                raise ValidationError(
+                    {
+                        "ca": _(
+                            "A Certificate Authority is required when the template "
+                            "type is certificate."
+                        )
+                    }
+                )
+            if self.blueprint_cert and self.blueprint_cert.ca_id != self.ca_id:
+                raise ValidationError(
+                    {
+                        "blueprint_cert": _(
+                            "The selected certificate must match the selected "
+                            "Certificate Authority."
+                        )
+                    }
+                )
+            if self.blueprint_cert and hasattr(
+                self.blueprint_cert, "devicecertificate_set"
+            ):
+                if self.blueprint_cert.devicecertificate_set.exists():
+                    raise ValidationError(
+                        {
+                            "blueprint_cert": _(
+                                "This certificate is already assigned to a device. "
+                                "Please select an unassigned certificate to use as a "
+                                "blueprint."
+                            )
+                        }
+                    )
+            if not self.config:
+                self.config = {}
+        else:
+            self.ca = None
+            self.blueprint_cert = None
         if self.required and not self.default:
             self.default = True
         super().clean(*args, **kwargs)
-        if not self.config:
+        if not self.config and self.type != "cert":
             raise ValidationError(_("The configuration field cannot be empty."))
 
     def get_context(self, system=False):

openwisp_controller/config/migrations/0064_template_blueprint_cert_template_ca_and_more.py

@@ -0,0 +1,59 @@
+# Generated by Django 5.2.14 on 2026-05-26 19:18
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("config", "0063_replace_jsonfield_with_django_builtin"),
+        migrations.swappable_dependency(settings.DJANGO_X509_CA_MODEL),
+        migrations.swappable_dependency(settings.DJANGO_X509_CERT_MODEL),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="template",
+            name="blueprint_cert",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="Optional: Select an unassigned certificate to "
+                "copy extensions and properties from.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                to=settings.DJANGO_X509_CERT_MODEL,
+                verbose_name="Blueprint Certificate",
+            ),
+        ),
+        migrations.AddField(
+            model_name="template",
+            name="ca",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="The Certificate Authority that will sign "
+                "certificates generated by this template.",
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                to=settings.DJANGO_X509_CA_MODEL,
+                verbose_name="Certificate Authority",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="template",
+            name="type",
+            field=models.CharField(
+                choices=[
+                    ("generic", "Generic"),
+                    ("vpn", "VPN-client"),
+                    ("cert", "Certificate"),
+                ],
+                db_index=True,
+                default="generic",
+                help_text="template type, determines which features are available",
+                max_length=16,
+                verbose_name="type",
+            ),
+        ),
+    ]

tests/openwisp2/sample_config/migrations/0010_template_blueprint_cert_template_ca_and_more.py

@@ -0,0 +1,57 @@
+# Generated by Django 5.2.14 on 2026-05-26 19:52
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("sample_config", "0009_replace_jsonfield_with_django_builtin"),
+        ("sample_pki", "0004_alter_ca_extensions_alter_ca_key_length_and_more"),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name="template",
+            name="blueprint_cert",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="Optional: Select an unassigned certificate to copy "
+                "extensions and properties from.",
+                null=True,
+                on_delete=django.db.models.deletion.SET_NULL,
+                to="sample_pki.cert",
+                verbose_name="Blueprint Certificate",
+            ),
+        ),
+        migrations.AddField(
+            model_name="template",
+            name="ca",
+            field=models.ForeignKey(
+                blank=True,
+                help_text="The Certificate Authority that will sign certificates "
+                "generated by this template.",
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                to="sample_pki.ca",
+                verbose_name="Certificate Authority",
+            ),
+        ),
+        migrations.AlterField(
+            model_name="template",
+            name="type",
+            field=models.CharField(
+                choices=[
+                    ("generic", "Generic"),
+                    ("vpn", "VPN-client"),
+                    ("cert", "Certificate"),
+                ],
+                db_index=True,
+                default="generic",
+                help_text="template type, determines which features are available",
+                max_length=16,
+                verbose_name="type",
+            ),
+        ),
+    ]