feat: add create-only root certificate API (#7033)

* feat: add create-only root certificate API [skip ci]

* fix: harden root certificate API handling

packages/validation/src/certificates.ts

@@ -4,6 +4,20 @@ import { createCustomErrorParams } from "./form/i18n";
 
 export const certificateValidFileNameSchema = z.string().regex(/^[\w\-. ]+$/);
 
+export const rootCertificateFileNameSchema = z
+  .string()
+  .max(128)
+  .regex(/^[a-zA-Z0-9][a-zA-Z0-9._-]*\.(crt|pem)$/);
+
+export const rootCertificateMetadataSchema = z.object({
+  fileName: rootCertificateFileNameSchema,
+  sha256: z.string(),
+  fingerprint256: z.string(),
+  ca: z.literal(true),
+  validFrom: z.string(),
+  validTo: z.string(),
+});
+
 export const checkCertificateFile: z.core.CheckFn<File> = (context) => {
   const result = certificateValidFileNameSchema.safeParse(context.value.name);
   if (!result.success) {