Fix #2937

server/routers/certificates/createCertificate.ts

@@ -23,6 +23,12 @@ export async function createCertificate(
         throw new Error(`Domain with ID ${domainId} not found`);
     }
 
+    // Note: certificates.domain has a global UNIQUE constraint (it is not
+    // scoped per-domainId), so existence must be checked by domain value
+    // alone. Filtering on domainId here as well can cause this check to
+    // miss an existing cert (e.g. if it was stored under a different but
+    // still-valid domainId), leading to an INSERT that then fails on the
+    // unique constraint.
     let existing: Certificate[] = [];
     if (domainRecord.type == "ns" || domainRecord.type == "wildcard") {
         const domainLevelDown = domain.split(".").slice(1).join(".");
@@ -32,8 +38,6 @@ export async function createCertificate(
             .select()
             .from(certificates)
             .where(
-                and(
-                    eq(certificates.domainId, domainId),
                 or(
                     eq(certificates.domain, domain),
                     and(
@@ -44,19 +48,13 @@ export async function createCertificate(
                         )
                     )
                 )
-                )
             );
     } else {
         // For non-NS domains, we only match exact domain names
         existing = await trx
             .select()
             .from(certificates)
-            .where(
-                and(
-                    eq(certificates.domainId, domainId),
-                    eq(certificates.domain, domain) // exact match for non-NS domains
-                )
-            );
+            .where(eq(certificates.domain, domain)); // exact match for non-NS domains
     }
 
     if (existing.length > 0) {
@@ -87,8 +85,13 @@ export async function createCertificate(
         }
     }
 
-    // No cert found, create a new one in pending state
-    await trx.insert(certificates).values({
+    // No cert found, create a new one in pending state. onConflictDoNothing
+    // guards against the domain having been inserted concurrently (or under
+    // a different domainId) between the existence check above and this
+    // insert, since certificates.domain is globally unique.
+    await trx
+        .insert(certificates)
+        .values({
             domain: domainToWrite,
             domainId,
             wildcard:
@@ -98,5 +101,6 @@ export async function createCertificate(
             status: "pending",
             updatedAt: Math.floor(Date.now() / 1000),
             createdAt: Math.floor(Date.now() / 1000)
-    });
+        })
+        .onConflictDoNothing();
 }