Migrate from DNS to HTTP challenge

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/coredata/custom_domain.go

@@ -33,11 +33,10 @@ type (
 		ID                      gid.GID                `db:"id"`
 		OrganizationID          gid.GID                `db:"organization_id"`
 		Domain                  string                 `db:"domain"`
-		VerificationStatus         CustomDomainVerificationStatus `db:"verification_status"`
+		HTTPChallengeToken      *string                `db:"http_challenge_token"`
-		VerificationMethod         *string                        `db:"verification_method"`
+		HTTPChallengeKeyAuth    *string                `db:"http_challenge_key_auth"`
-		VerificationToken          []byte                         `db:"-"` // Decrypted value
+		HTTPChallengeURL        *string                `db:"http_challenge_url"`
-		EncryptedVerificationToken []byte                         `db:"encrypted_verification_token"`
+		HTTPOrderURL            *string                `db:"http_order_url"`
-		AcmeChallengeRecord        *string                        `db:"acme_challenge_record"`
 		SSLCertificate          *tls.Certificate       `db:"-"` // Parsed certificate
 		SSLCertificatePEM       []byte                 `db:"-"` // Decrypted PEM
 		EncryptedSSLCertificate []byte                 `db:"encrypted_ssl_certificate"`
@@ -49,9 +48,6 @@ type (
 		IsActive                bool                   `db:"is_active"`
 		CreatedAt               time.Time              `db:"created_at"`
 		UpdatedAt               time.Time              `db:"updated_at"`
-		VerifiedAt                 *time.Time                     `db:"verified_at"`
-		LastVerificationAttempt    *time.Time                     `db:"last_verification_attempt"`
-		VerificationAttempts       int                            `db:"verification_attempts"`
 	}
 
 	CustomDomains []*CustomDomain
@@ -63,23 +59,23 @@ func NewCustomDomain(orgID gid.GID, domain string) *CustomDomain {
 		ID:             gid.New(orgID.TenantID(), CustomDomainEntityType),
 		OrganizationID: orgID,
 		Domain:         domain,
-		VerificationStatus:   CustomDomainVerificationStatusPending,
 		IsActive:       false,
-		VerificationAttempts: 0,
 		CreatedAt:      now,
 		UpdatedAt:      now,
 	}
 }
 
-func (cd *CustomDomain) CursorKey(orderBy CustomDomainOrderField) page.CursorKey {
+func (cd *CustomDomain) CursorKey(field CustomDomainOrderField) page.CursorKey {
-	switch orderBy {
+	switch field {
 	case CustomDomainOrderFieldCreatedAt:
 		return page.NewCursorKey(cd.ID, cd.CreatedAt)
 	case CustomDomainOrderFieldDomain:
 		return page.NewCursorKey(cd.ID, cd.Domain)
-	default:
+	case CustomDomainOrderFieldUpdatedAt:
-		panic(fmt.Sprintf("unsupported order by: %s", orderBy))
+		return page.NewCursorKey(cd.ID, cd.UpdatedAt)
 	}
+
+	panic(fmt.Sprintf("unsupported order by: %s", field))
 }
 
 func (cd *CustomDomain) LoadByID(
@@ -94,10 +90,10 @@ SELECT
 	id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -105,10 +101,7 @@ SELECT
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 FROM
 	custom_domains
 WHERE
@@ -134,15 +127,91 @@ LIMIT 1
 
 	*cd = customDomain
 
-	// Decrypt verification token
+	// Decrypt SSL certificate
-	if len(cd.EncryptedVerificationToken) > 0 {
+	if len(cd.EncryptedSSLCertificate) > 0 {
-		decrypted, err := cipher.Decrypt(cd.EncryptedVerificationToken, encryptionKey)
+		decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
 		if err != nil {
-			return fmt.Errorf("cannot decrypt verification token: %w", err)
+			return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
 		}
-		cd.VerificationToken = decrypted
+		cd.SSLCertificatePEM = decrypted
 	}
 
+	// Decrypt SSL private key
+	if len(cd.EncryptedSSLPrivateKey) > 0 {
+		decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt SSL private key: %w", err)
+		}
+		cd.SSLPrivateKeyPEM = decrypted
+	}
+
+	// Parse certificate and key into tls.Certificate if both are present
+	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
+		fullCertPEM := string(cd.SSLCertificatePEM)
+		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
+			fullCertPEM += "\n" + *cd.SSLCertificateChain
+		}
+
+		tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), cd.SSLPrivateKeyPEM)
+		if err != nil {
+			return fmt.Errorf("cannot parse certificate and key: %w", err)
+		}
+		cd.SSLCertificate = &tlsCert
+	}
+
+	return nil
+}
+
+func (cd *CustomDomain) LoadByIDForUpdate(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	encryptionKey cipher.EncryptionKey,
+	domainID gid.GID,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	domain,
+	http_challenge_token,
+	http_challenge_key_auth,
+	http_challenge_url,
+	http_order_url,
+	encrypted_ssl_certificate,
+	encrypted_ssl_private_key,
+	ssl_certificate_chain,
+	ssl_status,
+	ssl_expires_at,
+	is_active,
+	created_at,
+	updated_at
+FROM
+	custom_domains
+WHERE
+	%s
+	AND id = @domain_id
+LIMIT 1
+FOR UPDATE
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"domain_id": domainID}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query custom domain for update: %w", err)
+	}
+
+	customDomain, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[CustomDomain])
+	if err != nil {
+		return fmt.Errorf("cannot collect custom domain: %w", err)
+	}
+
+	*cd = customDomain
+
 	// Decrypt SSL certificate
 	if len(cd.EncryptedSSLCertificate) > 0 {
 		decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
@@ -162,8 +231,7 @@ LIMIT 1
 	}
 
 	// Parse certificate and key into tls.Certificate if both are present
-	if cd.SSLCertificatePEM != nil && cd.SSLPrivateKeyPEM != nil {
+	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
-		// Build full certificate PEM with chain if present
 		fullCertPEM := string(cd.SSLCertificatePEM)
 		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
 			fullCertPEM += "\n" + *cd.SSLCertificateChain
@@ -191,10 +259,10 @@ SELECT
 	id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -202,17 +270,14 @@ SELECT
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 FROM
 	custom_domains
 WHERE
 	%s
-	domain = @domain
+	AND domain = @domain
 LIMIT 1
-	`
+`
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
@@ -231,15 +296,6 @@ LIMIT 1
 
 	*cd = customDomain
 
-	// Decrypt verification token
-	if len(cd.EncryptedVerificationToken) > 0 {
-		decrypted, err := cipher.Decrypt(cd.EncryptedVerificationToken, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot decrypt verification token: %w", err)
-		}
-		cd.VerificationToken = decrypted
-	}
-
 	// Decrypt SSL certificate
 	if len(cd.EncryptedSSLCertificate) > 0 {
 		decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
@@ -259,8 +315,7 @@ LIMIT 1
 	}
 
 	// Parse certificate and key into tls.Certificate if both are present
-	if cd.SSLCertificatePEM != nil && cd.SSLPrivateKeyPEM != nil {
+	if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
-		// Build full certificate PEM with chain if present
 		fullCertPEM := string(cd.SSLCertificatePEM)
 		if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
 			fullCertPEM += "\n" + *cd.SSLCertificateChain
@@ -281,13 +336,8 @@ func (cd *CustomDomain) Insert(
 	conn pg.Conn,
 	scope Scoper,
 	encryptionKey cipher.EncryptionKey,
-	verificationToken []byte,
 ) error {
-	encryptedToken, err := cipher.Encrypt(verificationToken, encryptionKey)
+	var err error
-	if err != nil {
-		return fmt.Errorf("cannot encrypt verification token: %w", err)
-	}
-
 	var encryptedCert []byte
 	if len(cd.SSLCertificatePEM) > 0 {
 		encryptedCert, err = cipher.Encrypt(cd.SSLCertificatePEM, encryptionKey)
@@ -310,10 +360,10 @@ INSERT INTO custom_domains (
 	tenant_id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -321,19 +371,16 @@ INSERT INTO custom_domains (
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 ) VALUES (
 	@id,
 	@tenant_id,
 	@organization_id,
 	@domain,
-	@verification_status,
+	@http_challenge_token,
-	@verification_method,
+	@http_challenge_key_auth,
-	@encrypted_verification_token,
+	@http_challenge_url,
-	@acme_challenge_record,
+	@http_order_url,
 	@encrypted_ssl_certificate,
 	@encrypted_ssl_private_key,
 	@ssl_certificate_chain,
@@ -341,10 +388,7 @@ INSERT INTO custom_domains (
 	@ssl_expires_at,
 	@is_active,
 	@created_at,
-	@updated_at,
+	@updated_at
-	@verified_at,
-	@last_verification_attempt,
-	@verification_attempts
 )
 `
 
@@ -353,10 +397,10 @@ INSERT INTO custom_domains (
 		"tenant_id":                 scope.GetTenantID(),
 		"organization_id":           cd.OrganizationID,
 		"domain":                    cd.Domain,
-		"verification_status":          cd.VerificationStatus,
+		"http_challenge_token":      cd.HTTPChallengeToken,
-		"verification_method":          cd.VerificationMethod,
+		"http_challenge_key_auth":   cd.HTTPChallengeKeyAuth,
-		"encrypted_verification_token": encryptedToken,
+		"http_challenge_url":        cd.HTTPChallengeURL,
-		"acme_challenge_record":        cd.AcmeChallengeRecord,
+		"http_order_url":            cd.HTTPOrderURL,
 		"encrypted_ssl_certificate": encryptedCert,
 		"encrypted_ssl_private_key": encryptedKey,
 		"ssl_certificate_chain":     cd.SSLCertificateChain,
@@ -365,9 +409,6 @@ INSERT INTO custom_domains (
 		"is_active":                 cd.IsActive,
 		"created_at":                cd.CreatedAt,
 		"updated_at":                cd.UpdatedAt,
-		"verified_at":                  cd.VerifiedAt,
-		"last_verification_attempt":    cd.LastVerificationAttempt,
-		"verification_attempts":        cd.VerificationAttempts,
 	}
 
 	_, err = conn.Exec(ctx, q, args)
@@ -375,8 +416,6 @@ INSERT INTO custom_domains (
 		return fmt.Errorf("cannot insert custom domain: %w", err)
 	}
 
-	cd.VerificationToken = verificationToken
-	cd.EncryptedVerificationToken = encryptedToken
 	cd.EncryptedSSLCertificate = encryptedCert
 	cd.EncryptedSSLPrivateKey = encryptedKey
 
@@ -389,15 +428,6 @@ func (cd *CustomDomain) Update(
 	scope Scoper,
 	encryptionKey cipher.EncryptionKey,
 ) error {
-	var encryptedToken []byte
-	if len(cd.VerificationToken) > 0 {
-		var err error
-		encryptedToken, err = cipher.Encrypt(cd.VerificationToken, encryptionKey)
-		if err != nil {
-			return fmt.Errorf("cannot encrypt verification token: %w", err)
-		}
-	}
-
 	var encryptedCert []byte
 	if len(cd.SSLCertificatePEM) > 0 {
 		var err error
@@ -420,20 +450,17 @@ func (cd *CustomDomain) Update(
 UPDATE
 	custom_domains
 SET
-	verification_status = @verification_status,
+	http_challenge_token = @http_challenge_token,
-	verification_method = @verification_method,
+	http_challenge_key_auth = @http_challenge_key_auth,
-	encrypted_verification_token = @encrypted_verification_token,
+	http_challenge_url = @http_challenge_url,
-	acme_challenge_record = @acme_challenge_record,
+	http_order_url = @http_order_url,
 	encrypted_ssl_certificate = @encrypted_ssl_certificate,
 	encrypted_ssl_private_key = @encrypted_ssl_private_key,
 	ssl_certificate_chain = @ssl_certificate_chain,
 	ssl_status = @ssl_status,
 	ssl_expires_at = @ssl_expires_at,
 	is_active = @is_active,
-	updated_at = @updated_at,
+	updated_at = @updated_at
-	verified_at = @verified_at,
-	last_verification_attempt = @last_verification_attempt,
-	verification_attempts = @verification_attempts
 WHERE
 	%s
 	AND id = @id
@@ -443,20 +470,17 @@ WHERE
 
 	args := pgx.NamedArgs{
 		"id":                        cd.ID,
-		"verification_status":          cd.VerificationStatus,
+		"http_challenge_token":      cd.HTTPChallengeToken,
-		"verification_method":          cd.VerificationMethod,
+		"http_challenge_key_auth":   cd.HTTPChallengeKeyAuth,
-		"encrypted_verification_token": encryptedToken,
+		"http_challenge_url":        cd.HTTPChallengeURL,
-		"acme_challenge_record":        cd.AcmeChallengeRecord,
+		"http_order_url":            cd.HTTPOrderURL,
 		"encrypted_ssl_certificate": encryptedCert,
 		"encrypted_ssl_private_key": encryptedKey,
 		"ssl_certificate_chain":     cd.SSLCertificateChain,
 		"ssl_status":                cd.SSLStatus,
 		"ssl_expires_at":            cd.SSLExpiresAt,
 		"is_active":                 cd.IsActive,
-		"updated_at":                   cd.UpdatedAt,
+		"updated_at":                time.Now(),
-		"verified_at":                  cd.VerifiedAt,
-		"last_verification_attempt":    cd.LastVerificationAttempt,
-		"verification_attempts":        cd.VerificationAttempts,
 	}
 	maps.Copy(args, scope.SQLArguments())
 
@@ -465,7 +489,6 @@ WHERE
 		return fmt.Errorf("cannot update custom domain: %w", err)
 	}
 
-	cd.EncryptedVerificationToken = encryptedToken
 	cd.EncryptedSSLCertificate = encryptedCert
 	cd.EncryptedSSLPrivateKey = encryptedKey
 
@@ -477,7 +500,14 @@ func (cd *CustomDomain) Delete(
 	conn pg.Conn,
 	scope Scoper,
 ) error {
-	q := `DELETE FROM custom_domains WHERE %s AND id = @id`
+	q := `
+DELETE FROM
+	custom_domains
+WHERE
+	%s
+	AND id = @id
+`
+
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
 	args := pgx.NamedArgs{"id": cd.ID}
@@ -491,11 +521,12 @@ func (cd *CustomDomain) Delete(
 	return nil
 }
 
-func (cds *CustomDomains) ListCustomDomainsByOrganization(
+func (domains *CustomDomains) LoadByOrganizationID(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
-	organizationID gid.GID,
+	encryptionKey cipher.EncryptionKey,
+	orgID gid.GID,
 	cursor *page.Cursor[CustomDomainOrderField],
 ) error {
 	q := `
@@ -503,10 +534,10 @@ SELECT
 	id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -514,21 +545,18 @@ SELECT
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 FROM
 	custom_domains
 WHERE
 	%s
 	AND organization_id = @organization_id
-	AND %s
+	%s
-	`
+`
 
 	q = fmt.Sprintf(q, scope.SQLFragment(), cursor.SQLFragment())
 
-	args := pgx.NamedArgs{"organization_id": organizationID}
+	args := pgx.NamedArgs{"organization_id": orgID}
 	maps.Copy(args, scope.SQLArguments())
 	maps.Copy(args, cursor.SQLArguments())
 
@@ -537,17 +565,120 @@ WHERE
 		return fmt.Errorf("cannot query custom domains: %w", err)
 	}
 
-	domains, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
 	if err != nil {
 		return fmt.Errorf("cannot collect custom domains: %w", err)
 	}
 
-	*cds = domains
+	for _, cd := range result {
+		// Decrypt SSL certificate
+		if len(cd.EncryptedSSLCertificate) > 0 {
+			decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
+			if err != nil {
+				return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
+			}
+			cd.SSLCertificatePEM = decrypted
+		}
+
+		// Decrypt SSL private key
+		if len(cd.EncryptedSSLPrivateKey) > 0 {
+			decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
+			if err != nil {
+				return fmt.Errorf("cannot decrypt SSL private key: %w", err)
+			}
+			cd.SSLPrivateKeyPEM = decrypted
+		}
+
+		// Parse certificate and key into tls.Certificate if both are present
+		if len(cd.SSLCertificatePEM) > 0 && len(cd.SSLPrivateKeyPEM) > 0 {
+			fullCertPEM := string(cd.SSLCertificatePEM)
+			if cd.SSLCertificateChain != nil && *cd.SSLCertificateChain != "" {
+				fullCertPEM += "\n" + *cd.SSLCertificateChain
+			}
+
+			tlsCert, err := tls.X509KeyPair([]byte(fullCertPEM), cd.SSLPrivateKeyPEM)
+			if err != nil {
+				return fmt.Errorf("cannot parse certificate and key: %w", err)
+			}
+			cd.SSLCertificate = &tlsCert
+		}
+	}
+
+	*domains = result
+	return nil
+}
+
+func (cd *CustomDomain) LoadByHTTPChallengeToken(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	encryptionKey cipher.EncryptionKey,
+	token string,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	domain,
+	http_challenge_token,
+	http_challenge_key_auth,
+	http_challenge_url,
+	http_order_url,
+	encrypted_ssl_certificate,
+	encrypted_ssl_private_key,
+	ssl_certificate_chain,
+	ssl_status,
+	ssl_expires_at,
+	is_active,
+	created_at,
+	updated_at
+FROM
+	custom_domains
+WHERE
+	%s
+	AND http_challenge_token = @token
+LIMIT 1
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{"token": token}
+	maps.Copy(args, scope.SQLArguments())
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query custom domain: %w", err)
+	}
+
+	customDomain, err := pgx.CollectExactlyOneRow(rows, pgx.RowToStructByName[CustomDomain])
+	if err != nil {
+		return fmt.Errorf("cannot collect custom domain: %w", err)
+	}
+
+	*cd = customDomain
+
+	// Decrypt SSL certificate
+	if len(cd.EncryptedSSLCertificate) > 0 {
+		decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
+		}
+		cd.SSLCertificatePEM = decrypted
+	}
+
+	// Decrypt SSL private key
+	if len(cd.EncryptedSSLPrivateKey) > 0 {
+		decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
+		if err != nil {
+			return fmt.Errorf("cannot decrypt SSL private key: %w", err)
+		}
+		cd.SSLPrivateKeyPEM = decrypted
+	}
 
 	return nil
 }
 
-func (cds *CustomDomains) ListDomainsForRenewal(
+func (domains *CustomDomains) ListDomainsForRenewal(
 	ctx context.Context,
 	conn pg.Conn,
 	scope Scoper,
@@ -557,10 +688,10 @@ SELECT
 	id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -568,52 +699,51 @@ SELECT
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 FROM
 	custom_domains
 WHERE
 	%s
-	is_active = true
+	AND ssl_status = 'ACTIVE'
-	AND ssl_status = @ssl_status
+	AND ssl_expires_at IS NOT NULL
-	AND ssl_expires_at < NOW() + INTERVAL '30 days'
+	AND ssl_expires_at <= CURRENT_TIMESTAMP + INTERVAL '30 days'
 ORDER BY
 	ssl_expires_at ASC
 `
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{"ssl_status": CustomDomainSSLStatusActive}
+	args := pgx.NamedArgs{}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
 	if err != nil {
-		return fmt.Errorf("cannot query domains for renewal: %w", err)
+		return fmt.Errorf("cannot query custom domains for renewal: %w", err)
 	}
 
-	customDomains, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
 	if err != nil {
-		return fmt.Errorf("cannot collect domains: %w", err)
+		return fmt.Errorf("cannot collect custom domains: %w", err)
 	}
 
-	*cds = customDomains
+	*domains = result
-
 	return nil
 }
 
-func (cds *CustomDomains) LoadActiveCertificates(ctx context.Context, conn pg.Conn, scope Scoper) error {
+func (domains *CustomDomains) ListDomainsWithPendingHTTPChallenges(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+) error {
 	q := `
 SELECT
 	id,
-	tenant_id,
 	organization_id,
 	domain,
-	verification_status,
+	http_challenge_token,
-	verification_method,
+	http_challenge_key_auth,
-	encrypted_verification_token,
+	http_challenge_url,
-	acme_challenge_record,
+	http_order_url,
 	encrypted_ssl_certificate,
 	encrypted_ssl_private_key,
 	ssl_certificate_chain,
@@ -621,27 +751,68 @@ SELECT
 	ssl_expires_at,
 	is_active,
 	created_at,
-	updated_at,
+	updated_at
-	verified_at,
-	last_verification_attempt,
-	verification_attempts
 FROM
 	custom_domains
 WHERE
 	%s
-	is_active = @is_active
+	AND http_challenge_token IS NOT NULL
-	AND encrypted_ssl_certificate IS NOT NULL
+	AND ssl_status IN ('PROVISIONING', 'RENEWING')
-	AND ssl_status = @ssl_status
+`
-ORDER BY
-	ssl_expires_at DESC
-	`
 
 	q = fmt.Sprintf(q, scope.SQLFragment())
 
-	args := pgx.NamedArgs{
+	args := pgx.NamedArgs{}
-		"is_active":  true,
+	maps.Copy(args, scope.SQLArguments())
-		"ssl_status": CustomDomainSSLStatusActive,
+
+	rows, err := conn.Query(ctx, q, args)
+	if err != nil {
+		return fmt.Errorf("cannot query custom domains with pending challenges: %w", err)
 	}
+
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
+	if err != nil {
+		return fmt.Errorf("cannot collect custom domains: %w", err)
+	}
+
+	*domains = result
+	return nil
+}
+
+func (domains *CustomDomains) LoadActiveCertificates(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	encryptionKey cipher.EncryptionKey,
+) error {
+	q := `
+SELECT
+	id,
+	organization_id,
+	domain,
+	http_challenge_token,
+	http_challenge_key_auth,
+	http_challenge_url,
+	http_order_url,
+	encrypted_ssl_certificate,
+	encrypted_ssl_private_key,
+	ssl_certificate_chain,
+	ssl_status,
+	ssl_expires_at,
+	is_active,
+	created_at,
+	updated_at
+FROM
+	custom_domains
+WHERE
+	%s
+	AND ssl_status = 'ACTIVE'
+	AND encrypted_ssl_certificate IS NOT NULL
+`
+
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
+	args := pgx.NamedArgs{}
 	maps.Copy(args, scope.SQLArguments())
 
 	rows, err := conn.Query(ctx, q, args)
@@ -649,12 +820,31 @@ ORDER BY
 		return fmt.Errorf("cannot query active certificates: %w", err)
 	}
 
-	customDomains, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
+	result, err := pgx.CollectRows(rows, pgx.RowToAddrOfStructByName[CustomDomain])
 	if err != nil {
-		return fmt.Errorf("cannot collect active certificates: %w", err)
+		return fmt.Errorf("cannot collect custom domains: %w", err)
 	}
 
-	*cds = customDomains
+	for _, cd := range result {
+		// Decrypt SSL certificate
+		if len(cd.EncryptedSSLCertificate) > 0 {
+			decrypted, err := cipher.Decrypt(cd.EncryptedSSLCertificate, encryptionKey)
+			if err != nil {
+				return fmt.Errorf("cannot decrypt SSL certificate: %w", err)
+			}
+			cd.SSLCertificatePEM = decrypted
+		}
 
+		// Decrypt SSL private key
+		if len(cd.EncryptedSSLPrivateKey) > 0 {
+			decrypted, err := cipher.Decrypt(cd.EncryptedSSLPrivateKey, encryptionKey)
+			if err != nil {
+				return fmt.Errorf("cannot decrypt SSL private key: %w", err)
+			}
+			cd.SSLPrivateKeyPEM = decrypted
+		}
+	}
+
+	*domains = result
 	return nil
 }

pkg/coredata/custom_domain_order_field.go

@@ -21,6 +21,7 @@ type CustomDomainOrderField string
 const (
 	CustomDomainOrderFieldCreatedAt CustomDomainOrderField = "CREATED_AT"
 	CustomDomainOrderFieldDomain    CustomDomainOrderField = "DOMAIN"
+	CustomDomainOrderFieldUpdatedAt CustomDomainOrderField = "UPDATED_AT"
 )
 
 func (f CustomDomainOrderField) Column() string {
@@ -29,6 +30,8 @@ func (f CustomDomainOrderField) Column() string {
 		return "created_at"
 	case CustomDomainOrderFieldDomain:
 		return "domain"
+	case CustomDomainOrderFieldUpdatedAt:
+		return "updated_at"
 	default:
 		panic(fmt.Sprintf("unsupported order by: %s", f))
 	}