add ability to use own signing cert

lib/accounts.rb

@@ -42,22 +42,19 @@ module Accounts
     new_template
   end
 
-  def load_signing_certs(account)
-    certs =
+  def load_signing_pkcs(account)
+    cert_data =
       if Docuseal.multitenant?
         Docuseal::CERTS
       else
         EncryptedConfig.find_by(account:, key: EncryptedConfig::ESIGN_CERTS_KEY).value
       end
 
-    {
-      cert: OpenSSL::X509::Certificate.new(certs['cert']),
-      key: OpenSSL::PKey::RSA.new(certs['key']),
-      sub_ca: OpenSSL::X509::Certificate.new(certs['sub_ca']),
-      sub_key: OpenSSL::PKey::RSA.new(certs['sub_key']),
-      root_ca: OpenSSL::X509::Certificate.new(certs['root_ca']),
-      root_key: OpenSSL::PKey::RSA.new(certs['root_key'])
-    }
+    if (default_cert = cert_data['custom']&.find { |e| e['status'] == 'default' })
+      OpenSSL::PKCS12.new(Base64.urlsafe_decode64(default_cert['data']), default_cert['password'])
+    else
+      GenerateCertificate.load_pkcs(cert_data)
+    end
   end
 
   def can_send_emails?(account)

lib/generate_certificate.rb

@@ -87,4 +87,19 @@ module GenerateCertificate
 
     [cert, key]
   end
+
+  def load_pkcs(cert_data)
+    cert = OpenSSL::X509::Certificate.new(cert_data['cert'])
+    key = OpenSSL::PKey::RSA.new(cert_data['key'])
+    sub_ca = OpenSSL::X509::Certificate.new(cert_data['sub_ca'])
+    root_ca = OpenSSL::X509::Certificate.new(cert_data['root_ca'])
+
+    OpenSSL::PKCS12.create(
+      '',
+      '',
+      key,
+      cert,
+      [sub_ca, root_ca]
+    )
+  end
 end

lib/submissions/generate_result_attachments.rb

@@ -28,7 +28,7 @@ module Submissions
 
       template = submitter.submission.template
 
-      certs = Accounts.load_signing_certs(submitter.submission.template.account)
+      pkcs = Accounts.load_signing_pkcs(submitter.submission.template.account)
 
       pdfs_index = build_pdfs_index(submitter)
 
@@ -171,7 +171,7 @@ module Submissions
         submitter.submission.template_schema.map do |item|
           pdf = pdfs_index[item['attachment_uuid']]
 
-          attachment = save_signed_pdf(pdf:, submitter:, certs:, uuid: item['attachment_uuid'], name: item['name'])
+          attachment = save_signed_pdf(pdf:, submitter:, pkcs:, uuid: item['attachment_uuid'], name: item['name'])
 
           image_pdfs << pdf if original_documents.find { |a| a.uuid == item['attachment_uuid'] }.image?
 
@@ -189,7 +189,7 @@ module Submissions
         save_signed_pdf(
           pdf: images_pdf,
           submitter:,
-          certs:,
+          pkcs:,
           uuid: images_pdf_uuid(original_documents.select(&:image?)),
           name: template.name
         )
@@ -198,15 +198,15 @@ module Submissions
     end
     # rubocop:enable Metrics
 
-    def save_signed_pdf(pdf:, submitter:, certs:, uuid:, name:)
+    def save_signed_pdf(pdf:, submitter:, pkcs:, uuid:, name:)
       io = StringIO.new
 
       pdf.trailer.info[:Creator] = INFO_CREATOR
 
       pdf.sign(io, reason: format(SIGN_REASON, email: submitter.email),
-                   certificate: certs[:cert],
-                   key: certs[:key],
-                   certificate_chain: [certs[:sub_ca], certs[:root_ca]])
+                   certificate: pkcs.certificate,
+                   key: pkcs.key,
+                   certificate_chain: pkcs.ca_certs || [])
 
       ActiveStorage::Attachment.create!(
         uuid:,