Part of #40639.
Extend UpdateHostCertificates to insert host_mdm_managed_certificates rows when an ingested cert's Subject contains a fleet-<profile_uuid> marker but no matching managed-cert row exists. Today this function only updates existing rows — non-proxied flows (Hydrant, Okta SCEP) have no proxy step that would create the row at issuance.
Verify the extracted profile_uuid resolves to a profile installed on the host before inserting. Core change of Phase 2.
Part of #40639.
Extend
UpdateHostCertificatesto inserthost_mdm_managed_certificatesrows when an ingested cert's Subject contains afleet-<profile_uuid>marker but no matching managed-cert row exists. Today this function only updates existing rows — non-proxied flows (Hydrant, Okta SCEP) have no proxy step that would create the row at issuance.Verify the extracted profile_uuid resolves to a profile installed on the host before inserting. Core change of Phase 2.