Flatten compliance portal package layout

Remove the root complianceportal package and the resolver facade that existed only to break an IAM import cycle. Admin policies, domain URL helpers, and actions live under management; visitor OAuth metadata, brand URLs, and public read paths live under visitor. Drop the duplicate trust API magic-link mutations now that Connect handles portal auth, and stop IAM from owning compliance page email branding. Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-07-17 16:19:39 +02:00
parent 4cec74c1a1
commit 7e0d187dcf
57 changed files with 737 additions and 1061 deletions
--- a/pkg/server/api/api.go
+++ b/pkg/server/api/api.go
@@ -34,6 +34,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/connector"
@@ -70,6 +71,7 @@ type (
 		Trust             *visitor.Service
 		ESign             *esign.Service
 		Management        *management.Service
+		CertManager       *certmanager.Service
 		AccessReview      *accessreview.Service
 		AgentRun          *agentrun.Service
 		Slack             *slack.Service
@@ -192,6 +194,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.IAM,
 			cfg.ESign,
 			cfg.Management,
+			cfg.CertManager,
 			cfg.AccessReview,
 			cfg.AgentRun,
 			cfg.Mailman,
@@ -225,6 +228,7 @@ func NewServer(cfg Config) (*Server, error) {
 			cfg.Logger.Named("mcp.v1"),
 			cfg.Probo,
 			cfg.Management,
+			cfg.CertManager,
 			cfg.ResourceAlias,
 			cfg.ThirdParty,
 			cfg.IAM,
--- a/pkg/server/api/complianceportal/oauth.go
+++ b/pkg/server/api/complianceportal/oauth.go
@@ -15,23 +15,23 @@
 package complianceportal

 import (
-	portal "go.probo.inc/probo/pkg/complianceportal"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 )

 const (
-	VisitorOAuthScope = portal.VisitorOAuthScope
+	VisitorOAuthScope = visitor.VisitorOAuthScope
 	GraphQLPath       = "/graphql"
-	CIMDMetadataPath  = portal.CIMDMetadataPath
-	BrandLogoPath     = portal.BrandLogoPath
-	BrandDarkLogoPath = portal.BrandDarkLogoPath
+	CIMDMetadataPath  = visitor.CIMDMetadataPath
+	BrandLogoPath     = visitor.BrandLogoPath
+	BrandDarkLogoPath = visitor.BrandDarkLogoPath
 	OAuthInitiatePath = "/initiate"
-	OAuthCallbackPath = portal.OAuthCallbackPath
+	OAuthCallbackPath = visitor.OAuthCallbackPath
 )

 func CIMDClientIDURL(portalBaseURL string) (string, error) {
-	return portal.CIMDClientIDURL(portalBaseURL)
+	return visitor.CIMDClientIDURL(portalBaseURL)
 }

 func OAuthCallbackURL(portalBaseURL string) (string, error) {
-	return portal.OAuthCallbackURL(portalBaseURL)
+	return visitor.OAuthCallbackURL(portalBaseURL)
 }
--- a/pkg/server/api/complianceportal/v1/auth_resolvers.go
+++ b/pkg/server/api/complianceportal/v1/auth_resolvers.go
@@ -10,150 +10,14 @@ import (
 	"errors"

 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/baseurl"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
-	"go.probo.inc/probo/pkg/saferedirect"
 	"go.probo.inc/probo/pkg/server/api/authn"
 	"go.probo.inc/probo/pkg/server/api/complianceportal"
 	"go.probo.inc/probo/pkg/server/api/complianceportal/v1/types"
 	"go.probo.inc/probo/pkg/server/gqlutils"
 )

-// SendMagicLink is the resolver for the sendMagicLink field.
-func (r *mutationResolver) SendMagicLink(ctx context.Context, input types.SendMagicLinkInput) (*types.SendMagicLinkPayload, error) {
-	trustCenter := complianceportal.CompliancePageFromContext(ctx)
-
-	baseURL := complianceportal.CompliancePageBaseURLFromContext(ctx)
-
-	safeRedirect := saferedirect.New(saferedirect.StaticHosts(baseurl.MustParse(*baseURL).Host()))
-
-	if input.Continue != nil {
-		_, ok := safeRedirect.Validate(ctx, *input.Continue)
-		if !ok {
-			return nil, gqlutils.Invalidf(ctx, "invalid continue URL")
-		}
-	}
-
-	req := &iam.SendMagicLinkRequest{
-		Email:            input.Email,
-		CompliancePageID: &trustCenter.ID,
-		OrganizationID:   &trustCenter.OrganizationID,
-		URLPath:          "verify-magic-link",
-		Continue:         input.Continue,
-	}
-
-	if err := r.iam.AuthService.SendMagicLink(ctx, req); err != nil {
-		r.logger.ErrorCtx(ctx, "cannot send magic link", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	return nil, nil
-}
-
-// VerifyMagicLink is the resolver for the verifyMagicLink field.
-func (r *mutationResolver) VerifyMagicLink(ctx context.Context, input types.VerifyMagicLinkInput) (*types.VerifyMagicLinkPayload, error) {
-	session := authn.SessionFromContext(ctx)
-	identity := authn.IdentityFromContext(ctx)
-
-	email, err := r.iam.AuthService.GetMagicLinkEmail(ctx, input.Token)
-	if err != nil {
-		if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
-			return nil, gqlutils.TokenExpired(ctx, err)
-		}
-
-		if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
-			return nil, gqlutils.Invalid(ctx, err)
-		}
-
-		r.logger.ErrorCtx(ctx, "cannot get magic link email", log.Error(err))
-
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	var continueURL *string
-
-	switch {
-	case session == nil:
-		var err error
-
-		identity, session, continueURL, err = r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
-		if err != nil {
-			if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
-				return nil, gqlutils.TokenExpired(ctx, err)
-			}
-
-			if _, ok := errors.AsType[*iam.ErrTokenAlreadyUsed](err); ok {
-				return nil, gqlutils.TokenAlreadyUsed(ctx, err)
-			}
-
-			if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
-
-			r.logger.ErrorCtx(ctx, "cannot open session with magic link", log.Error(err))
-
-			return nil, gqlutils.Internal(ctx)
-		}
-	case identity.EmailAddress != email:
-		if err := r.iam.SessionService.CloseSession(ctx, session.ID); err != nil {
-			r.logger.ErrorCtx(ctx, "cannot close session", log.Error(err))
-			return nil, gqlutils.Internal(ctx)
-		}
-
-		var err error
-
-		identity, session, continueURL, err = r.iam.AuthService.OpenSessionWithMagicLink(ctx, input.Token)
-		if err != nil {
-			if _, ok := errors.AsType[*iam.ErrExpiredToken](err); ok {
-				return nil, gqlutils.TokenExpired(ctx, err)
-			}
-
-			if _, ok := errors.AsType[*iam.ErrTokenAlreadyUsed](err); ok {
-				return nil, gqlutils.TokenAlreadyUsed(ctx, err)
-			}
-
-			if _, ok := errors.AsType[*iam.ErrInvalidToken](err); ok {
-				return nil, gqlutils.Invalid(ctx, err)
-			}
-
-			r.logger.ErrorCtx(ctx, "cannot open session with magic link", log.Error(err))
-
-			return nil, gqlutils.Internal(ctx)
-		}
-	}
-
-	req := gqlutils.HTTPRequestFromContext(ctx)
-	if req == nil {
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	host, ok := complianceportal.TrustedRequestHost(req)
-	if !ok {
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	session.Data = coredata.SessionDataForHost(host)
-	if err := r.iam.SessionService.UpdateSessionData(ctx, session.ID, session.Data); err != nil {
-		r.logger.ErrorCtx(ctx, "cannot bind session to host", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	trustCenter := complianceportal.CompliancePageFromContext(ctx)
-
-	if _, err := r.trust.ProvisionPortalMember(ctx, trustCenter.ID, identity.ID); err != nil {
-		r.logger.ErrorCtx(ctx, "cannot provision member", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
-	}
-
-	w := gqlutils.HTTPResponseWriterFromContext(ctx)
-	r.sessionCookie.Set(w, session)
-
-	return &types.VerifyMagicLinkPayload{
-		Continue: continueURL,
-	}, nil
-}
-
 // UpdateFullName is the resolver for the updateFullName field.
 func (r *mutationResolver) UpdateFullName(ctx context.Context, input types.UpdateFullNameInput) (*types.UpdateFullNamePayload, error) {
 	identity := authn.IdentityFromContext(ctx)
--- a/pkg/server/api/complianceportal/v1/base_resolvers.go
+++ b/pkg/server/api/complianceportal/v1/base_resolvers.go
@@ -132,7 +132,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error

 		trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, id)
 		if err != nil {
-			if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
+			if errors.Is(err, visitor.ErrPortalFileNotFound) || errors.Is(err, visitor.ErrPortalFileNotVisible) {
 				return nil, gqlutils.NotFoundf(ctx, "node %q not found", id)
 			}

--- a/pkg/server/api/complianceportal/v1/graphql/auth.graphql
+++ b/pkg/server/api/complianceportal/v1/graphql/auth.graphql
@@ -1,30 +1,9 @@
 extend type Mutation {
-  sendMagicLink(input: SendMagicLinkInput!): SendMagicLinkPayload
-    @authentication(required: OPTIONAL)
-  verifyMagicLink(input: VerifyMagicLinkInput!): VerifyMagicLinkPayload
-    @authentication(required: OPTIONAL)
  updateFullName(input: UpdateFullNameInput!): UpdateFullNamePayload
    @authentication(required: PRESENT) @sessionOnly
  signOut: SignOutPayload! @authentication(required: PRESENT) @sessionOnly
 }

-input SendMagicLinkInput {
-  email: EmailAddr!
-  continue: String
-}
-
-type SendMagicLinkPayload {
-  success: Boolean!
-}
-
-input VerifyMagicLinkInput {
-  token: String!
-}
-
-type VerifyMagicLinkPayload {
-  continue: String
-}
-
 input UpdateFullNameInput {
  fullName: String!
 }
--- a/pkg/server/api/complianceportal/v1/mux.go
+++ b/pkg/server/api/complianceportal/v1/mux.go
@@ -22,7 +22,6 @@ import (
 	"go.gearno.de/kit/log"
 	"go.gearno.de/x/ref"
 	"go.probo.inc/probo/pkg/baseurl"
-	page "go.probo.inc/probo/pkg/complianceportal"
 	visitor "go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/esign"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -148,7 +147,7 @@ func compliancePageHeadData() HeadDataFunc {
 		}

 		if tc.LogoFileID != nil && compliancePageBaseURL != nil {
-			faviconURL, err := page.BrandLogoURL(*compliancePageBaseURL)
+			faviconURL, err := visitor.BrandLogoURL(*compliancePageBaseURL)
 			if err == nil {
 				headData.FaviconURL = faviconURL
 			}
--- a/pkg/server/api/complianceportal/v1/oauth_client_metadata_handler.go
+++ b/pkg/server/api/complianceportal/v1/oauth_client_metadata_handler.go
@@ -19,7 +19,7 @@ import (
 	"net/http"

 	"go.gearno.de/kit/httpserver"
-	portal "go.probo.inc/probo/pkg/complianceportal"
+	"go.probo.inc/probo/pkg/complianceportal/visitor"
 	"go.probo.inc/probo/pkg/server/api/complianceportal"
 )

@@ -38,7 +38,7 @@ func (h *oauthClientMetadataHandler) ServeHTTP(w http.ResponseWriter, r *http.Re
 		return
 	}

-	doc, err := portal.BuildClientMetadataDocument(compliancePage, *baseURL)
+	doc, err := visitor.BuildClientMetadataDocument(compliancePage, *baseURL)
 	if err != nil {
 		httpserver.RenderError(w, http.StatusInternalServerError, errInternal)
 		return
--- a/pkg/server/api/complianceportal/v1/trust_center_resolvers.go
+++ b/pkg/server/api/complianceportal/v1/trust_center_resolvers.go
@@ -467,7 +467,7 @@ func (r *mutationResolver) ExportTrustCenterFile(ctx context.Context, input type

 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, input.TrustCenterFileID)
 	if err != nil {
-		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrPortalFileNotFound) || errors.Is(err, visitor.ErrPortalFileNotVisible) {
 			return nil, gqlutils.NotFoundf(ctx, "trust center file %q not found", input.TrustCenterFileID)
 		}

@@ -620,7 +620,7 @@ func (r *mutationResolver) RequestTrustCenterFileAccess(ctx context.Context, inp

 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, input.TrustCenterFileID)
 	if err != nil {
-		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrPortalFileNotFound) || errors.Is(err, visitor.ErrPortalFileNotVisible) {
 			return nil, gqlutils.NotFoundf(ctx, "trust center file %q not found", input.TrustCenterFileID)
 		}

@@ -836,7 +836,7 @@ func (r *trustCenterResolver) SubprocessorCategories(ctx context.Context, obj *t
 	trustCenter := complianceportal.CompliancePageFromContext(ctx)
 	scope := coredata.NewScopeFromObjectID(obj.ID)

-	categories, err := r.trust.ListDistinctTrustCenterCategoriesForOrganizationID(ctx, scope, trustCenter.OrganizationID)
+	categories, err := r.trust.ListDistinctPortalCategoriesForOrganizationID(ctx, scope, trustCenter.OrganizationID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list subprocessor categories", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -850,7 +850,7 @@ func (r *trustCenterResolver) SubprocessorCountries(ctx context.Context, obj *ty
 	trustCenter := complianceportal.CompliancePageFromContext(ctx)
 	scope := coredata.NewScopeFromObjectID(obj.ID)

-	countries, err := r.trust.ListDistinctTrustCenterCountriesForOrganizationID(ctx, scope, trustCenter.OrganizationID)
+	countries, err := r.trust.ListDistinctPortalCountriesForOrganizationID(ctx, scope, trustCenter.OrganizationID)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot list subprocessor countries", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -986,7 +986,7 @@ func (r *trustCenterFileResolver) IsUserAuthorized(ctx context.Context, obj *typ

 	trustCenterFile, err := trustService.GetPortalFile(ctx, scope, trustCenter.OrganizationID, obj.ID)
 	if err != nil {
-		if errors.Is(err, visitor.ErrTrustCenterFileNotFound) || errors.Is(err, visitor.ErrTrustCenterFileNotVisible) {
+		if errors.Is(err, visitor.ErrPortalFileNotFound) || errors.Is(err, visitor.ErrPortalFileNotVisible) {
 			return false, gqlutils.NotFoundf(ctx, "trust center file %q not found", obj.ID)
 		}

--- a/pkg/server/api/console/v1/base_resolvers.go
+++ b/pkg/server/api/console/v1/base_resolvers.go
@@ -14,7 +14,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
-	"go.probo.inc/probo/pkg/complianceportal"
+	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/probo"
@@ -335,7 +335,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			return types.NewTransferImpactAssessment(tia), nil
 		}
 	case coredata.TrustCenterEntityType:
-		action = complianceportal.ActionCompliancePortalGet
+		action = management.ActionCompliancePortalGet
 		loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {
 			trustCenter, err := r.management.Get(ctx, scope, id)
 			if err != nil {
@@ -345,7 +345,7 @@ func (r *queryResolver) Node(ctx context.Context, id gid.GID) (types.Node, error
 			return types.NewTrustCenter(trustCenter), nil
 		}
 	case coredata.TrustCenterAccessEntityType:
-		action = complianceportal.ActionCompliancePortalAccessGet
+		action = management.ActionCompliancePortalAccessGet
 		loadNode = func(ctx context.Context, scope *coredata.Scope, id gid.GID) (types.Node, error) {
 			trustCenterAccess, err := r.management.GetAccess(ctx, scope, id)
 			if err != nil {
--- a/pkg/server/api/console/v1/graphql_handler.go
+++ b/pkg/server/api/console/v1/graphql_handler.go
@@ -27,6 +27,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/connector/provider"
@@ -51,6 +52,7 @@ func NewGraphQLHandler(
 	resourceAliasSvc *resourcealias.Service,
 	esignSvc *esign.Service,
 	managementSvc *management.Service,
+	certManagerSvc *certmanager.Service,
 	accessReviewSvc *accessreview.Service,
 	agentRunSvc *agentrun.Service,
 	mailmanSvc *mailman.Service,
@@ -75,6 +77,7 @@ func NewGraphQLHandler(
 			iam:               iamSvc,
 			esign:             esignSvc,
 			management:        managementSvc,
+			certManager:       certManagerSvc,
 			accessReview:      accessReviewSvc,
 			agentRun:          agentRunSvc,
 			mailman:           mailmanSvc,
--- a/pkg/server/api/console/v1/mailing_list_resolvers.go
+++ b/pkg/server/api/console/v1/mailing_list_resolvers.go
@@ -11,7 +11,7 @@ import (
 	"fmt"

 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/complianceportal"
+	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/mailman"
 	"go.probo.inc/probo/pkg/page"
@@ -23,7 +23,7 @@ import (

 // Subscribers is the resolver for the subscribers field on MailingList.
 func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListSubscriberConnection, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionMailingListSubscriberList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionMailingListSubscriberList); err != nil {
 		return nil, err
 	}

@@ -45,7 +45,7 @@ func (r *mailingListResolver) Subscribers(ctx context.Context, obj *types.Mailin

 // Updates is the resolver for the updates field on MailingList.
 func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingList, first *int, after *page.CursorKey, last *int, before *page.CursorKey) (*types.MailingListUpdateConnection, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionMailingListUpdateList); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionMailingListUpdateList); err != nil {
 		return nil, err
 	}

@@ -67,7 +67,7 @@ func (r *mailingListResolver) Updates(ctx context.Context, obj *types.MailingLis

 // TotalCount is the resolver for the totalCount field.
 func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListSubscriberConnection) (int, error) {
-	if _, err := r.authorize(ctx, obj.ParentID, complianceportal.ActionMailingListSubscriberList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, management.ActionMailingListSubscriberList); err != nil {
 		return 0, err
 	}

@@ -89,7 +89,7 @@ func (r *mailingListSubscriberConnectionResolver) TotalCount(ctx context.Context

 // TotalCount is the resolver for the totalCount field on MailingListUpdateConnection.
 func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, obj *types.MailingListUpdateConnection) (int, error) {
-	if _, err := r.authorize(ctx, obj.ParentID, complianceportal.ActionMailingListUpdateList); err != nil {
+	if _, err := r.authorize(ctx, obj.ParentID, management.ActionMailingListUpdateList); err != nil {
 		return 0, err
 	}

@@ -104,7 +104,7 @@ func (r *mailingListUpdateConnectionResolver) TotalCount(ctx context.Context, ob

 // CreateMailingListUpdate is the resolver for the createMailingListUpdate field.
 func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input types.CreateMailingListUpdateInput) (*types.CreateMailingListUpdatePayload, error) {
-	if _, err := r.authorize(ctx, input.MailingListID, complianceportal.ActionMailingListUpdateCreate); err != nil {
+	if _, err := r.authorize(ctx, input.MailingListID, management.ActionMailingListUpdateCreate); err != nil {
 		return nil, err
 	}

@@ -133,7 +133,7 @@ func (r *mutationResolver) CreateMailingListUpdate(ctx context.Context, input ty

 // UpdateMailingListUpdate is the resolver for the updateMailingListUpdate field.
 func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input types.UpdateMailingListUpdateInput) (*types.UpdateMailingListUpdatePayload, error) {
-	if _, err := r.authorize(ctx, input.ID, complianceportal.ActionMailingListUpdateUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, management.ActionMailingListUpdateUpdate); err != nil {
 		return nil, err
 	}

@@ -170,7 +170,7 @@ func (r *mutationResolver) UpdateMailingListUpdate(ctx context.Context, input ty

 // SendMailingListUpdate is the resolver for the sendMailingListUpdate field.
 func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input types.SendMailingListUpdateInput) (*types.SendMailingListUpdatePayload, error) {
-	if _, err := r.authorize(ctx, input.ID, complianceportal.ActionMailingListUpdateUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, management.ActionMailingListUpdateUpdate); err != nil {
 		return nil, err
 	}

@@ -196,7 +196,7 @@ func (r *mutationResolver) SendMailingListUpdate(ctx context.Context, input type

 // DeleteMailingListUpdate is the resolver for the deleteMailingListUpdate field.
 func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input types.DeleteMailingListUpdateInput) (*types.DeleteMailingListUpdatePayload, error) {
-	if _, err := r.authorize(ctx, input.ID, complianceportal.ActionMailingListUpdateDelete); err != nil {
+	if _, err := r.authorize(ctx, input.ID, management.ActionMailingListUpdateDelete); err != nil {
 		return nil, err
 	}

@@ -217,7 +217,7 @@ func (r *mutationResolver) DeleteMailingListUpdate(ctx context.Context, input ty

 // UpdateMailingList is the resolver for the updateMailingList field.
 func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.UpdateMailingListInput) (*types.UpdateMailingListPayload, error) {
-	if _, err := r.authorize(ctx, input.ID, complianceportal.ActionMailingListUpdate); err != nil {
+	if _, err := r.authorize(ctx, input.ID, management.ActionMailingListUpdate); err != nil {
 		return nil, err
 	}

@@ -234,7 +234,7 @@ func (r *mutationResolver) UpdateMailingList(ctx context.Context, input types.Up

 // CreateMailingListSubscriber is the resolver for the createMailingListSubscriber field.
 func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, input types.CreateMailingListSubscriberInput) (*types.CreateMailingListSubscriberPayload, error) {
-	if _, err := r.authorize(ctx, input.MailingListID, complianceportal.ActionMailingListSubscriberCreate); err != nil {
+	if _, err := r.authorize(ctx, input.MailingListID, management.ActionMailingListSubscriberCreate); err != nil {
 		return nil, err
 	}

@@ -268,7 +268,7 @@ func (r *mutationResolver) CreateMailingListSubscriber(ctx context.Context, inpu

 // DeleteMailingListSubscriber is the resolver for the deleteMailingListSubscriber field.
 func (r *mutationResolver) DeleteMailingListSubscriber(ctx context.Context, input types.DeleteMailingListSubscriberInput) (*types.DeleteMailingListSubscriberPayload, error) {
-	if _, err := r.authorize(ctx, input.ID, complianceportal.ActionMailingListSubscriberDelete); err != nil {
+	if _, err := r.authorize(ctx, input.ID, management.ActionMailingListSubscriberDelete); err != nil {
 		return nil, err
 	}

--- a/pkg/server/api/console/v1/organization_resolvers.go
+++ b/pkg/server/api/console/v1/organization_resolvers.go
@@ -13,7 +13,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
-	"go.probo.inc/probo/pkg/complianceportal"
+	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/gid"
 	"go.probo.inc/probo/pkg/iam"
@@ -1159,7 +1159,7 @@ func (r *organizationResolver) AgentRuns(ctx context.Context, obj *types.Organiz

 // TrustCenter is the resolver for the trustCenter field.
 func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organization) (*types.TrustCenter, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalGet)
 	if err != nil {
 		return nil, err
 	}
@@ -1175,7 +1175,7 @@ func (r *organizationResolver) TrustCenter(ctx context.Context, obj *types.Organ

 // TrustCenterFiles is the resolver for the trustCenterFiles field.
 func (r *organizationResolver) TrustCenterFiles(ctx context.Context, obj *types.Organization, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterFileOrderField]) (*types.TrustCenterFileConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalFileList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalFileList)
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/server/api/console/v1/resolver.go
+++ b/pkg/server/api/console/v1/resolver.go
@@ -35,6 +35,7 @@ import (
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/agentrun"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/connector"
 	"go.probo.inc/probo/pkg/connector/provider"
@@ -67,6 +68,7 @@ type (
 		iam               *iam.Service
 		esign             *esign.Service
 		management        *management.Service
+		certManager       *certmanager.Service
 		accessReview      *accessreview.Service
 		agentRun          *agentrun.Service
 		mailman           *mailman.Service
@@ -90,10 +92,14 @@ func (r *Resolver) newCustomDomainType(
 	scope coredata.Scoper,
 	domain *coredata.CustomDomain,
 ) (*types.CustomDomain, error) {
-	cert, err := r.management.GetCertificate(ctx, scope, domain)
-	if err != nil {
-		r.logger.ErrorCtx(ctx, "cannot load certificate", log.Error(err))
-		return nil, gqlutils.Internal(ctx)
+	var cert *coredata.Certificate
+	if domain != nil && domain.CertificateID != nil {
+		var err error
+		cert, err = r.certManager.Get(ctx, scope, *domain.CertificateID)
+		if err != nil {
+			r.logger.ErrorCtx(ctx, "cannot load certificate", log.Error(err))
+			return nil, gqlutils.Internal(ctx)
+		}
 	}

 	return types.NewCustomDomain(domain, cert, r.customDomainCname), nil
@@ -106,6 +112,7 @@ func NewMux(
 	iamSvc *iam.Service,
 	esignSvc *esign.Service,
 	managementSvc *management.Service,
+	certManagerSvc *certmanager.Service,
 	accessReviewSvc *accessreview.Service,
 	agentRunSvc *agentrun.Service,
 	mailmanSvc *mailman.Service,
@@ -131,6 +138,7 @@ func NewMux(
 		resourceAliasSvc,
 		esignSvc,
 		managementSvc,
+		certManagerSvc,
 		accessReviewSvc,
 		agentRunSvc,
 		mailmanSvc,
--- a/pkg/server/api/console/v1/trust_center_resolvers.go
+++ b/pkg/server/api/console/v1/trust_center_resolvers.go
@@ -12,7 +12,6 @@ import (

 	"github.com/vikstrous/dataloadgen"
 	"go.gearno.de/kit/log"
-	"go.probo.inc/probo/pkg/complianceportal"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/coredata"
 	"go.probo.inc/probo/pkg/iam"
@@ -60,7 +59,7 @@ func (r *customDomainResolver) Permission(ctx context.Context, obj *types.Custom

 // UpdateTrustCenter is the resolver for the updateTrustCenter field.
 func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.UpdateTrustCenterInput) (*types.UpdateTrustCenterPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalUpdate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +94,7 @@ func (r *mutationResolver) UpdateTrustCenter(ctx context.Context, input types.Up

 // UploadTrustCenterNda is the resolver for the uploadTrustCenterNDA field.
 func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types.UploadTrustCenterNDAInput) (*types.UploadTrustCenterNDAPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalNonDisclosureAgreementUpload)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalNonDisclosureAgreementUpload)
 	if err != nil {
 		return nil, err
 	}
@@ -125,7 +124,7 @@ func (r *mutationResolver) UploadTrustCenterNda(ctx context.Context, input types

 // DeleteTrustCenterNda is the resolver for the deleteTrustCenterNDA field.
 func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types.DeleteTrustCenterNDAInput) (*types.DeleteTrustCenterNDAPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalNonDisclosureAgreementDelete)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalNonDisclosureAgreementDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -143,7 +142,7 @@ func (r *mutationResolver) DeleteTrustCenterNda(ctx context.Context, input types

 // UpdateTrustCenterBrand is the resolver for the updateTrustCenterBrand field.
 func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input types.UpdateTrustCenterBrandInput) (*types.UpdateTrustCenterBrandPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalUpdate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -204,7 +203,7 @@ func (r *mutationResolver) UpdateTrustCenterBrand(ctx context.Context, input typ

 // UpdateTrustCenterAccess is the resolver for the updateTrustCenterAccess field.
 func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input types.UpdateTrustCenterAccessInput) (*types.UpdateTrustCenterAccessPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalAccessUpdate)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalAccessUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -262,7 +261,7 @@ func (r *mutationResolver) UpdateTrustCenterAccess(ctx context.Context, input ty

 // DeleteTrustCenterAccess is the resolver for the deleteTrustCenterAccess field.
 func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input types.DeleteTrustCenterAccessInput) (*types.DeleteTrustCenterAccessPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalAccessDelete)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalAccessDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -279,7 +278,7 @@ func (r *mutationResolver) DeleteTrustCenterAccess(ctx context.Context, input ty

 // CreateTrustCenterReference is the resolver for the createTrustCenterReference field.
 func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input types.CreateTrustCenterReferenceInput) (*types.CreateTrustCenterReferencePayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalReferenceCreate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalReferenceCreate)
 	if err != nil {
 		return nil, err
 	}
@@ -316,7 +315,7 @@ func (r *mutationResolver) CreateTrustCenterReference(ctx context.Context, input

 // UpdateTrustCenterReference is the resolver for the updateTrustCenterReference field.
 func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input types.UpdateTrustCenterReferenceInput) (*types.UpdateTrustCenterReferencePayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalReferenceUpdate)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalReferenceUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -356,7 +355,7 @@ func (r *mutationResolver) UpdateTrustCenterReference(ctx context.Context, input

 // DeleteTrustCenterReference is the resolver for the deleteTrustCenterReference field.
 func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input types.DeleteTrustCenterReferenceInput) (*types.DeleteTrustCenterReferencePayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalReferenceDelete)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalReferenceDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -373,7 +372,7 @@ func (r *mutationResolver) DeleteTrustCenterReference(ctx context.Context, input

 // CreateComplianceFramework is the resolver for the createComplianceFramework field.
 func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input types.CreateComplianceFrameworkInput) (*types.CreateComplianceFrameworkPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionComplianceFrameworkCreate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionComplianceFrameworkCreate)
 	if err != nil {
 		return nil, err
 	}
@@ -402,7 +401,7 @@ func (r *mutationResolver) CreateComplianceFramework(ctx context.Context, input

 // UpdateComplianceFramework is the resolver for the updateComplianceFramework field.
 func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input types.UpdateComplianceFrameworkInput) (*types.UpdateComplianceFrameworkPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionComplianceFrameworkUpdateRank)
+	scope, err := r.authorize(ctx, input.ID, management.ActionComplianceFrameworkUpdateRank)
 	if err != nil {
 		return nil, err
 	}
@@ -428,7 +427,7 @@ func (r *mutationResolver) UpdateComplianceFramework(ctx context.Context, input

 // DeleteComplianceFramework is the resolver for the deleteComplianceFramework field.
 func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input types.DeleteComplianceFrameworkInput) (*types.DeleteComplianceFrameworkPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionComplianceFrameworkDelete)
+	scope, err := r.authorize(ctx, input.ID, management.ActionComplianceFrameworkDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -455,7 +454,7 @@ func (r *mutationResolver) DeleteComplianceFramework(ctx context.Context, input

 // CreateComplianceCustomLink is the resolver for the createComplianceCustomLink field.
 func (r *mutationResolver) CreateComplianceCustomLink(ctx context.Context, input types.CreateComplianceCustomLinkInput) (*types.CreateComplianceCustomLinkPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionComplianceCustomLinkCreate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionComplianceCustomLinkCreate)
 	if err != nil {
 		return nil, err
 	}
@@ -485,7 +484,7 @@ func (r *mutationResolver) CreateComplianceCustomLink(ctx context.Context, input

 // UpdateComplianceCustomLink is the resolver for the updateComplianceCustomLink field.
 func (r *mutationResolver) UpdateComplianceCustomLink(ctx context.Context, input types.UpdateComplianceCustomLinkInput) (*types.UpdateComplianceCustomLinkPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionComplianceCustomLinkUpdate)
+	scope, err := r.authorize(ctx, input.ID, management.ActionComplianceCustomLinkUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -513,7 +512,7 @@ func (r *mutationResolver) UpdateComplianceCustomLink(ctx context.Context, input

 // DeleteComplianceCustomLink is the resolver for the deleteComplianceCustomLink field.
 func (r *mutationResolver) DeleteComplianceCustomLink(ctx context.Context, input types.DeleteComplianceCustomLinkInput) (*types.DeleteComplianceCustomLinkPayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionComplianceCustomLinkDelete)
+	scope, err := r.authorize(ctx, input.ID, management.ActionComplianceCustomLinkDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -535,7 +534,7 @@ func (r *mutationResolver) DeleteComplianceCustomLink(ctx context.Context, input

 // CreateTrustCenterFile is the resolver for the createTrustCenterFile field.
 func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input types.CreateTrustCenterFileInput) (*types.CreateTrustCenterFilePayload, error) {
-	scope, err := r.authorize(ctx, input.OrganizationID, complianceportal.ActionCompliancePortalFileCreate)
+	scope, err := r.authorize(ctx, input.OrganizationID, management.ActionCompliancePortalFileCreate)
 	if err != nil {
 		return nil, err
 	}
@@ -572,7 +571,7 @@ func (r *mutationResolver) CreateTrustCenterFile(ctx context.Context, input type

 // UpdateTrustCenterFile is the resolver for the updateTrustCenterFile field.
 func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input types.UpdateTrustCenterFileInput) (*types.UpdateTrustCenterFilePayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalFileUpdate)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalFileUpdate)
 	if err != nil {
 		return nil, err
 	}
@@ -603,7 +602,7 @@ func (r *mutationResolver) UpdateTrustCenterFile(ctx context.Context, input type

 // GetTrustCenterFile is the resolver for the getTrustCenterFile field.
 func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.GetTrustCenterFileInput) (*types.GetTrustCenterFilePayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalFileGet)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalFileGet)
 	if err != nil {
 		return nil, err
 	}
@@ -621,7 +620,7 @@ func (r *mutationResolver) GetTrustCenterFile(ctx context.Context, input types.G

 // DeleteTrustCenterFile is the resolver for the deleteTrustCenterFile field.
 func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input types.DeleteTrustCenterFileInput) (*types.DeleteTrustCenterFilePayload, error) {
-	scope, err := r.authorize(ctx, input.ID, complianceportal.ActionCompliancePortalFileDelete)
+	scope, err := r.authorize(ctx, input.ID, management.ActionCompliancePortalFileDelete)
 	if err != nil {
 		return nil, err
 	}
@@ -638,7 +637,7 @@ func (r *mutationResolver) DeleteTrustCenterFile(ctx context.Context, input type

 // CreateCustomDomain is the resolver for the createCustomDomain field.
 func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.CreateCustomDomainInput) (*types.CreateCustomDomainPayload, error) {
-	scope, err := r.authorize(ctx, input.TrustCenterID, complianceportal.ActionCustomDomainCreate)
+	scope, err := r.authorize(ctx, input.TrustCenterID, management.ActionCustomDomainCreate)
 	if err != nil {
 		return nil, err
 	}
@@ -674,13 +673,13 @@ func (r *mutationResolver) CreateCustomDomain(ctx context.Context, input types.C

 // DeleteCustomDomain is the resolver for the deleteCustomDomain field.
 func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.DeleteCustomDomainInput) (*types.DeleteCustomDomainPayload, error) {
-	scope, err := r.authorize(ctx, input.CustomDomainID, complianceportal.ActionCustomDomainDelete)
+	scope, err := r.authorize(ctx, input.CustomDomainID, management.ActionCustomDomainDelete)
 	if err != nil {
 		return nil, err
 	}

 	if err := r.management.RemoveCustomDomain(ctx, scope, input.CustomDomainID); err != nil {
-		if errors.Is(err, complianceportal.ErrCustomDomainManaged) {
+		if errors.Is(err, management.ErrCustomDomainManaged) {
 			return nil, gqlutils.Conflictf(ctx, "managed domain cannot be deleted")
 		}

@@ -696,7 +695,7 @@ func (r *mutationResolver) DeleteCustomDomain(ctx context.Context, input types.D

 // Logo is the resolver for the logo field.
 func (r *trustCenterResolver) Logo(ctx context.Context, obj *types.TrustCenter) (*types.File, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalGet); err != nil {
 		return nil, err
 	}

@@ -709,7 +708,7 @@ func (r *trustCenterResolver) Logo(ctx context.Context, obj *types.TrustCenter)

 // DarkLogo is the resolver for the darkLogo field.
 func (r *trustCenterResolver) DarkLogo(ctx context.Context, obj *types.TrustCenter) (*types.File, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalGet); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalGet); err != nil {
 		return nil, err
 	}

@@ -722,7 +721,7 @@ func (r *trustCenterResolver) DarkLogo(ctx context.Context, obj *types.TrustCent

 // Nda is the resolver for the nda field.
 func (r *trustCenterResolver) Nda(ctx context.Context, obj *types.TrustCenter) (*types.File, error) {
-	hasPermission, err := r.Resolver.Permission(ctx, obj, complianceportal.ActionCompliancePortalGetNda)
+	hasPermission, err := r.Resolver.Permission(ctx, obj, management.ActionCompliancePortalGetNda)
 	if err != nil {
 		r.logger.ErrorCtx(ctx, "cannot authorize", log.Error(err))
 		return nil, gqlutils.Internal(ctx)
@@ -764,7 +763,7 @@ func (r *trustCenterResolver) Organization(ctx context.Context, obj *types.Trust

 // Accesses is the resolver for the accesses field.
 func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterAccessOrderField]) (*types.TrustCenterAccessConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalAccessList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalAccessList)
 	if err != nil {
 		return nil, err
 	}
@@ -794,7 +793,7 @@ func (r *trustCenterResolver) Accesses(ctx context.Context, obj *types.TrustCent

 // References is the resolver for the references field.
 func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterReferenceOrderField]) (*types.TrustCenterReferenceConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalReferenceList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalReferenceList)
 	if err != nil {
 		return nil, err
 	}
@@ -824,7 +823,7 @@ func (r *trustCenterResolver) References(ctx context.Context, obj *types.TrustCe

 // ComplianceFrameworks is the resolver for the complianceFrameworks field.
 func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceFrameworkOrderField]) (*types.ComplianceFrameworkConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionComplianceFrameworkList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionComplianceFrameworkList)
 	if err != nil {
 		return nil, err
 	}
@@ -854,7 +853,7 @@ func (r *trustCenterResolver) ComplianceFrameworks(ctx context.Context, obj *typ

 // CustomLinks is the resolver for the customLinks field.
 func (r *trustCenterResolver) CustomLinks(ctx context.Context, obj *types.TrustCenter, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.ComplianceCustomLinkOrderField]) (*types.ComplianceCustomLinkConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionComplianceCustomLinkList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionComplianceCustomLinkList)
 	if err != nil {
 		return nil, err
 	}
@@ -884,7 +883,7 @@ func (r *trustCenterResolver) CustomLinks(ctx context.Context, obj *types.TrustC

 // MailingList is the resolver for the mailingList field.
 func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustCenter) (*types.MailingList, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionMailingListSubscriberList)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionMailingListSubscriberList)
 	if err != nil {
 		return nil, err
 	}
@@ -908,7 +907,7 @@ func (r *trustCenterResolver) MailingList(ctx context.Context, obj *types.TrustC

 // DefaultDomain is the resolver for the defaultDomain field.
 func (r *trustCenterResolver) DefaultDomain(ctx context.Context, obj *types.TrustCenter) (*types.CustomDomain, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCustomDomainGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCustomDomainGet)
 	if err != nil {
 		return nil, err
 	}
@@ -928,7 +927,7 @@ func (r *trustCenterResolver) DefaultDomain(ctx context.Context, obj *types.Trus

 // CustomDomain is the resolver for the customDomain field.
 func (r *trustCenterResolver) CustomDomain(ctx context.Context, obj *types.TrustCenter) (*types.CustomDomain, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCustomDomainGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCustomDomainGet)
 	if err != nil {
 		return nil, err
 	}
@@ -948,7 +947,7 @@ func (r *trustCenterResolver) CustomDomain(ctx context.Context, obj *types.Trust

 // PublicURL is the resolver for the publicUrl field.
 func (r *trustCenterResolver) PublicURL(ctx context.Context, obj *types.TrustCenter) (string, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalGet)
 	if err != nil {
 		return "", err
 	}
@@ -969,7 +968,7 @@ func (r *trustCenterResolver) Permission(ctx context.Context, obj *types.TrustCe

 // NdaSignature is the resolver for the ndaSignature field.
 func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types.TrustCenterAccess) (*types.ElectronicSignature, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalAccessGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalAccessGet)
 	if err != nil {
 		return nil, err
 	}
@@ -993,7 +992,7 @@ func (r *trustCenterAccessResolver) NdaSignature(ctx context.Context, obj *types

 // PendingRequestCount is the resolver for the pendingRequestCount field.
 func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalAccessGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalAccessGet)
 	if err != nil {
 		return 0, err
 	}
@@ -1009,7 +1008,7 @@ func (r *trustCenterAccessResolver) PendingRequestCount(ctx context.Context, obj

 // ActiveCount is the resolver for the activeCount field.
 func (r *trustCenterAccessResolver) ActiveCount(ctx context.Context, obj *types.TrustCenterAccess) (int, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalAccessGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalAccessGet)
 	if err != nil {
 		return 0, err
 	}
@@ -1045,7 +1044,7 @@ func (r *trustCenterAccessResolver) Profile(ctx context.Context, obj *types.Trus

 // AvailableDocumentAccesses is the resolver for the availableDocumentAccesses field.
 func (r *trustCenterAccessResolver) AvailableDocumentAccesses(ctx context.Context, obj *types.TrustCenterAccess, first *int, after *page.CursorKey, last *int, before *page.CursorKey, orderBy *types.OrderBy[coredata.TrustCenterDocumentAccessOrderField]) (*types.TrustCenterDocumentAccessConnection, error) {
-	scope, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalAccessGet)
+	scope, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalAccessGet)
 	if err != nil {
 		return nil, err
 	}
@@ -1156,7 +1155,7 @@ func (r *trustCenterDocumentAccessResolver) Audit(ctx context.Context, obj *type

 // TrustCenterFile is the resolver for the trustCenterFile field.
 func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context, obj *types.TrustCenterDocumentAccess) (*types.TrustCenterFile, error) {
-	scope, err := r.authorize(ctx, obj.TrustCenterAccessID, complianceportal.ActionCompliancePortalFileGet)
+	scope, err := r.authorize(ctx, obj.TrustCenterAccessID, management.ActionCompliancePortalFileGet)
 	if err != nil {
 		return nil, err
 	}
@@ -1176,7 +1175,7 @@ func (r *trustCenterDocumentAccessResolver) TrustCenterFile(ctx context.Context,

 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterDocumentAccessConnection) (int, error) {
-	scope, err := r.authorize(ctx, obj.ParentID, complianceportal.ActionCompliancePortalDocumentAccessList)
+	scope, err := r.authorize(ctx, obj.ParentID, management.ActionCompliancePortalDocumentAccessList)
 	if err != nil {
 		return 0, err
 	}
@@ -1192,7 +1191,7 @@ func (r *trustCenterDocumentAccessConnectionResolver) TotalCount(ctx context.Con

 // File is the resolver for the file field.
 func (r *trustCenterFileResolver) File(ctx context.Context, obj *types.TrustCenterFile) (*types.File, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalFileGetFileUrl); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalFileGetFileUrl); err != nil {
 		return nil, err
 	}

@@ -1243,7 +1242,7 @@ func (r *trustCenterFileResolver) Permission(ctx context.Context, obj *types.Tru

 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterFileConnection) (int, error) {
-	scope, err := r.authorize(ctx, obj.ParentID, complianceportal.ActionCompliancePortalFileList)
+	scope, err := r.authorize(ctx, obj.ParentID, management.ActionCompliancePortalFileList)
 	if err != nil {
 		return 0, err
 	}
@@ -1259,7 +1258,7 @@ func (r *trustCenterFileConnectionResolver) TotalCount(ctx context.Context, obj

 // Logo is the resolver for the logo field.
 func (r *trustCenterReferenceResolver) Logo(ctx context.Context, obj *types.TrustCenterReference) (*types.File, error) {
-	if _, err := r.authorize(ctx, obj.ID, complianceportal.ActionCompliancePortalReferenceGetLogoUrl); err != nil {
+	if _, err := r.authorize(ctx, obj.ID, management.ActionCompliancePortalReferenceGetLogoUrl); err != nil {
 		return nil, err
 	}

@@ -1273,7 +1272,7 @@ func (r *trustCenterReferenceResolver) Permission(ctx context.Context, obj *type

 // TotalCount is the resolver for the totalCount field.
 func (r *trustCenterReferenceConnectionResolver) TotalCount(ctx context.Context, obj *types.TrustCenterReferenceConnection) (int, error) {
-	scope, err := r.authorize(ctx, obj.ParentID, complianceportal.ActionCompliancePortalReferenceList)
+	scope, err := r.authorize(ctx, obj.ParentID, management.ActionCompliancePortalReferenceList)
 	if err != nil {
 		return 0, err
 	}
--- a/pkg/server/api/mcp/v1/resolver.go
+++ b/pkg/server/api/mcp/v1/resolver.go
@@ -31,6 +31,7 @@ import (
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/coredata"
@@ -49,6 +50,7 @@ import (
 type Resolver struct {
 	proboSvc       *probo.Service
 	management     *management.Service
+	certManager    *certmanager.Service
 	resourceAlias  *resourcealias.Service
 	thirdPartySvc  *thirdparty.Service
 	iamSvc         *iam.Service
--- a/pkg/server/api/mcp/v1/schema.resolvers.go
+++ b/pkg/server/api/mcp/v1/schema.resolvers.go
@@ -14,7 +14,6 @@ import (
 	"github.com/modelcontextprotocol/go-sdk/mcp"
 	"go.gearno.de/kit/log"
 	"go.probo.inc/probo/pkg/accessreview"
-	"go.probo.inc/probo/pkg/complianceportal"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/coredata"
@@ -4884,7 +4883,7 @@ func (r *Resolver) DeleteRightsRequestTool(ctx context.Context, req *mcp.CallToo
 // GetTrustCenterTool handles the getTrustCenter tool
 // Get the trust center for an organization
 func (r *Resolver) GetTrustCenterTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTrustCenterInput) (*mcp.CallToolResult, types.GetTrustCenterOutput, error) {
-	scope, err := r.Authorize(ctx, input.OrganizationID, complianceportal.ActionCompliancePortalGet)
+	scope, err := r.Authorize(ctx, input.OrganizationID, management.ActionCompliancePortalGet)
 	if err != nil {
 		return nil, types.GetTrustCenterOutput{}, err
 	}
@@ -4931,7 +4930,7 @@ func (r *Resolver) GetTrustCenterTool(ctx context.Context, req *mcp.CallToolRequ
 // UpdateTrustCenterTool handles the updateTrustCenter tool
 // Update the trust center settings
 func (r *Resolver) UpdateTrustCenterTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrustCenterInput) (*mcp.CallToolResult, types.UpdateTrustCenterOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalUpdate)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalUpdate)
 	if err != nil {
 		return nil, types.UpdateTrustCenterOutput{}, err
 	}
@@ -4969,7 +4968,7 @@ func (r *Resolver) UpdateTrustCenterTool(ctx context.Context, req *mcp.CallToolR
 // ListTrustCenterReferencesTool handles the listTrustCenterReferences tool
 // List all references for a trust center
 func (r *Resolver) ListTrustCenterReferencesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrustCenterReferencesInput) (*mcp.CallToolResult, types.ListTrustCenterReferencesOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalReferenceList)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalReferenceList)
 	if err != nil {
 		return nil, types.ListTrustCenterReferencesOutput{}, err
 	}
@@ -5015,7 +5014,7 @@ func (r *Resolver) ListTrustCenterReferencesTool(ctx context.Context, req *mcp.C
 // AddTrustCenterReferenceTool handles the addTrustCenterReference tool
 // Add a new reference to the trust center
 func (r *Resolver) AddTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTrustCenterReferenceInput) (*mcp.CallToolResult, types.AddTrustCenterReferenceOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionCompliancePortalReferenceCreate)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionCompliancePortalReferenceCreate)
 	if err != nil {
 		return nil, types.AddTrustCenterReferenceOutput{}, err
 	}
@@ -5046,7 +5045,7 @@ func (r *Resolver) AddTrustCenterReferenceTool(ctx context.Context, req *mcp.Cal
 // UpdateTrustCenterReferenceTool handles the updateTrustCenterReference tool
 // Update a trust center reference
 func (r *Resolver) UpdateTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTrustCenterReferenceInput) (*mcp.CallToolResult, types.UpdateTrustCenterReferenceOutput, error) {
-	scope, err := r.Authorize(ctx, input.ID, complianceportal.ActionCompliancePortalReferenceUpdate)
+	scope, err := r.Authorize(ctx, input.ID, management.ActionCompliancePortalReferenceUpdate)
 	if err != nil {
 		return nil, types.UpdateTrustCenterReferenceOutput{}, err
 	}
@@ -5081,7 +5080,7 @@ func (r *Resolver) UpdateTrustCenterReferenceTool(ctx context.Context, req *mcp.
 // DeleteTrustCenterReferenceTool handles the deleteTrustCenterReference tool
 // Delete a trust center reference
 func (r *Resolver) DeleteTrustCenterReferenceTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrustCenterReferenceInput) (*mcp.CallToolResult, types.DeleteTrustCenterReferenceOutput, error) {
-	scope, err := r.Authorize(ctx, input.ID, complianceportal.ActionCompliancePortalReferenceDelete)
+	scope, err := r.Authorize(ctx, input.ID, management.ActionCompliancePortalReferenceDelete)
 	if err != nil {
 		return nil, types.DeleteTrustCenterReferenceOutput{}, err
 	}
@@ -5099,7 +5098,7 @@ func (r *Resolver) DeleteTrustCenterReferenceTool(ctx context.Context, req *mcp.
 // ListTrustCenterFilesTool handles the listTrustCenterFiles tool
 // List all files for the trust center
 func (r *Resolver) ListTrustCenterFilesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTrustCenterFilesInput) (*mcp.CallToolResult, types.ListTrustCenterFilesOutput, error) {
-	scope, err := r.Authorize(ctx, input.OrganizationID, complianceportal.ActionCompliancePortalFileList)
+	scope, err := r.Authorize(ctx, input.OrganizationID, management.ActionCompliancePortalFileList)
 	if err != nil {
 		return nil, types.ListTrustCenterFilesOutput{}, err
 	}
@@ -5142,7 +5141,7 @@ func (r *Resolver) ListTrustCenterFilesTool(ctx context.Context, req *mcp.CallTo
 // DeleteTrustCenterFileTool handles the deleteTrustCenterFile tool
 // Delete a trust center file
 func (r *Resolver) DeleteTrustCenterFileTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteTrustCenterFileInput) (*mcp.CallToolResult, types.DeleteTrustCenterFileOutput, error) {
-	scope, err := r.Authorize(ctx, input.ID, complianceportal.ActionCompliancePortalFileDelete)
+	scope, err := r.Authorize(ctx, input.ID, management.ActionCompliancePortalFileDelete)
 	if err != nil {
 		return nil, types.DeleteTrustCenterFileOutput{}, err
 	}
@@ -5160,7 +5159,7 @@ func (r *Resolver) DeleteTrustCenterFileTool(ctx context.Context, req *mcp.CallT
 // ListComplianceCustomLinksTool handles the listComplianceCustomLinks tool
 // List all custom links for a trust center
 func (r *Resolver) ListComplianceCustomLinksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListComplianceCustomLinksInput) (*mcp.CallToolResult, types.ListComplianceCustomLinksOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionComplianceCustomLinkList)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionComplianceCustomLinkList)
 	if err != nil {
 		return nil, types.ListComplianceCustomLinksOutput{}, err
 	}
@@ -5192,7 +5191,7 @@ func (r *Resolver) ListComplianceCustomLinksTool(ctx context.Context, req *mcp.C
 // AddComplianceCustomLinkTool handles the addComplianceCustomLink tool
 // Add a new custom link to the trust center
 func (r *Resolver) AddComplianceCustomLinkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddComplianceCustomLinkInput) (*mcp.CallToolResult, types.AddComplianceCustomLinkOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionComplianceCustomLinkCreate)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionComplianceCustomLinkCreate)
 	if err != nil {
 		return nil, types.AddComplianceCustomLinkOutput{}, err
 	}
@@ -5217,7 +5216,7 @@ func (r *Resolver) AddComplianceCustomLinkTool(ctx context.Context, req *mcp.Cal
 // UpdateComplianceCustomLinkTool handles the updateComplianceCustomLink tool
 // Update a compliance custom link
 func (r *Resolver) UpdateComplianceCustomLinkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateComplianceCustomLinkInput) (*mcp.CallToolResult, types.UpdateComplianceCustomLinkOutput, error) {
-	scope, err := r.Authorize(ctx, input.ID, complianceportal.ActionComplianceCustomLinkUpdate)
+	scope, err := r.Authorize(ctx, input.ID, management.ActionComplianceCustomLinkUpdate)
 	if err != nil {
 		return nil, types.UpdateComplianceCustomLinkOutput{}, err
 	}
@@ -5251,7 +5250,7 @@ func (r *Resolver) UpdateComplianceCustomLinkTool(ctx context.Context, req *mcp.
 // DeleteComplianceCustomLinkTool handles the deleteComplianceCustomLink tool
 // Delete a compliance custom link
 func (r *Resolver) DeleteComplianceCustomLinkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteComplianceCustomLinkInput) (*mcp.CallToolResult, types.DeleteComplianceCustomLinkOutput, error) {
-	scope, err := r.Authorize(ctx, input.ID, complianceportal.ActionComplianceCustomLinkDelete)
+	scope, err := r.Authorize(ctx, input.ID, management.ActionComplianceCustomLinkDelete)
 	if err != nil {
 		return nil, types.DeleteComplianceCustomLinkOutput{}, err
 	}
@@ -5274,7 +5273,7 @@ func (r *Resolver) DeleteComplianceCustomLinkTool(ctx context.Context, req *mcp.
 // CreateCustomDomainTool handles the createCustomDomain tool
 // Create a custom domain for a compliance page
 func (r *Resolver) CreateCustomDomainTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateCustomDomainInput) (*mcp.CallToolResult, types.CreateCustomDomainOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionCustomDomainCreate)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionCustomDomainCreate)
 	if err != nil {
 		return nil, types.CreateCustomDomainOutput{}, err
 	}
@@ -5288,9 +5287,12 @@ func (r *Resolver) CreateCustomDomainTool(ctx context.Context, req *mcp.CallTool
 		return nil, types.CreateCustomDomainOutput{}, fmt.Errorf("cannot create custom domain: %w", err)
 	}

-	cert, err := r.management.GetCertificate(ctx, scope, domain)
-	if err != nil {
-		return nil, types.CreateCustomDomainOutput{}, fmt.Errorf("cannot load certificate: %w", err)
+	var cert *coredata.Certificate
+	if domain.CertificateID != nil {
+		cert, err = r.certManager.Get(ctx, scope, *domain.CertificateID)
+		if err != nil {
+			return nil, types.CreateCustomDomainOutput{}, fmt.Errorf("cannot load certificate: %w", err)
+		}
 	}

 	return nil, types.CreateCustomDomainOutput{CustomDomain: types.NewCustomDomain(domain, cert)}, nil
@@ -5299,7 +5301,7 @@ func (r *Resolver) CreateCustomDomainTool(ctx context.Context, req *mcp.CallTool
 // DeleteCustomDomainTool handles the deleteCustomDomain tool
 // Delete the custom domain of a compliance page
 func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteCustomDomainInput) (*mcp.CallToolResult, types.DeleteCustomDomainOutput, error) {
-	scope, err := r.Authorize(ctx, input.TrustCenterID, complianceportal.ActionCustomDomainDelete)
+	scope, err := r.Authorize(ctx, input.TrustCenterID, management.ActionCustomDomainDelete)
 	if err != nil {
 		return nil, types.DeleteCustomDomainOutput{}, err
 	}
@@ -5313,9 +5315,12 @@ func (r *Resolver) DeleteCustomDomainTool(ctx context.Context, req *mcp.CallTool
 		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("compliance page has no custom domain")
 	}

-	cert, err := r.management.GetCertificate(ctx, scope, domain)
-	if err != nil {
-		return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("cannot load certificate: %w", err)
+	var cert *coredata.Certificate
+	if domain.CertificateID != nil {
+		cert, err = r.certManager.Get(ctx, scope, *domain.CertificateID)
+		if err != nil {
+			return nil, types.DeleteCustomDomainOutput{}, fmt.Errorf("cannot load certificate: %w", err)
+		}
 	}

 	deletedDomain := types.NewCustomDomain(domain, cert)
--- a/pkg/server/api/mcp/v1/v1_handler.go
+++ b/pkg/server/api/mcp/v1/v1_handler.go
@@ -29,6 +29,7 @@ import (
 	mcpgenmcp "go.probo.inc/mcpgen/mcp"
 	"go.probo.inc/probo/pkg/accessreview"
 	"go.probo.inc/probo/pkg/baseurl"
+	"go.probo.inc/probo/pkg/certmanager"
 	"go.probo.inc/probo/pkg/complianceportal/management"
 	"go.probo.inc/probo/pkg/cookiebanner"
 	"go.probo.inc/probo/pkg/filemanager"
@@ -46,6 +47,7 @@ func NewMux(
 	logger *log.Logger,
 	proboSvc *probo.Service,
 	managementSvc *management.Service,
+	certManagerSvc *certmanager.Service,
 	resourceAliasSvc *resourcealias.Service,
 	thirdPartySvc *thirdparty.Service,
 	iamSvc *iam.Service,
@@ -63,6 +65,7 @@ func NewMux(
 	resolver := &Resolver{
 		proboSvc:       proboSvc,
 		management:     managementSvc,
+		certManager:    certManagerSvc,
 		resourceAlias:  resourceAliasSvc,
 		thirdPartySvc:  thirdPartySvc,
 		iamSvc:         iamSvc,