feat(M36): onboarding wizard for first-run experience

4-step wizard (Connect CA → Deploy Agent → Add Certificate → Done) shown
on fresh installs when no user-configured issuers or certificates exist.
Auto-seeded env var issuers (source="env") are excluded from first-run
detection. Wizard state latches to prevent query refetches from dismissing
it mid-flow. Split docker-compose into clean default (wizard-compatible)
and demo override (seed_demo.sql). Added missing migrations 000009/000010
to test compose.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -36,7 +36,7 @@ gantt
         47 days                :crit, 2020-01-01, 47d
 ```
 
-> **Actively maintained — shipping weekly.** Found something? [Open a GitHub issue](https://github.com/shankar0123/certctl/issues) — issues get triaged same-day. CI runs 1,554+ tests with race detection, static analysis, and vulnerability scanning on every commit.
+> **Actively maintained — shipping weekly.** Found something? [Open a GitHub issue](https://github.com/shankar0123/certctl/issues) — issues get triaged same-day. CI runs the full test suite with race detection, static analysis, and vulnerability scanning on every commit.
 
 ## Why certctl Exists
 
@@ -294,7 +294,7 @@ CI runs on every push: `go vet`, `go test -race`, `golangci-lint`, `govulncheck`
 Core lifecycle management — Local CA + ACME v2 issuers, NGINX target connector, agent-side key generation, API auth + rate limiting, React dashboard, CI pipeline with coverage gates, Docker images on GHCR.
 
 ### V2: Operational Maturity — Shipped
-30+ milestones, 1,554+ tests. Sub-CA mode, ACME DNS-01/DNS-PERSIST-01, step-ca, Vault PKI, DigiCert CertCentral, OpenSSL/Custom CA issuers. NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS targets. RFC 5280 revocation with CRL + OCSP. Certificate profiles, ownership tracking, approval workflows. Filesystem and network certificate discovery. Prometheus metrics, dashboard charts, agent fleet overview. EST server (RFC 7030), ACME ARI (RFC 9702), certificate export, S/MIME support, Helm chart, MCP server, CLI, scheduled digest emails. Slack, Teams, PagerDuty, OpsGenie, SMTP notifications. Compliance mapping (SOC 2, PCI-DSS 4.0, NIST SP 800-57). See the [Feature Inventory](docs/features.md) for details.
+30+ milestones, extensively tested with CI-enforced coverage gates. Sub-CA mode, ACME DNS-01/DNS-PERSIST-01, step-ca, Vault PKI, DigiCert CertCentral, OpenSSL/Custom CA issuers. NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, Postfix, Dovecot, IIS targets. RFC 5280 revocation with CRL + OCSP. Certificate profiles, ownership tracking, approval workflows. Filesystem and network certificate discovery. Prometheus metrics, dashboard charts, agent fleet overview. EST server (RFC 7030), ACME ARI (RFC 9702), certificate export, S/MIME support, Helm chart, MCP server, CLI, scheduled digest emails. Slack, Teams, PagerDuty, OpsGenie, SMTP notifications. Compliance mapping (SOC 2, PCI-DSS 4.0, NIST SP 800-57). See the [Feature Inventory](docs/features.md) for details.
 
 **Coming in v2.1.0:** Dynamic issuer and target configuration via GUI (no env var restarts), first-run onboarding wizard.
 

cmd/server/main.go

@@ -16,15 +16,8 @@ import (
 	"github.com/shankar0123/certctl/internal/api/middleware"
 	"github.com/shankar0123/certctl/internal/api/router"
 	"github.com/shankar0123/certctl/internal/config"
+	"github.com/shankar0123/certctl/internal/crypto"
 	"github.com/shankar0123/certctl/internal/domain"
-	acmeissuer "github.com/shankar0123/certctl/internal/connector/issuer/acme"
-	"github.com/shankar0123/certctl/internal/connector/issuer/local"
-	digicertissuer "github.com/shankar0123/certctl/internal/connector/issuer/digicert"
-	opensslissuer "github.com/shankar0123/certctl/internal/connector/issuer/openssl"
-	stepcaissuer "github.com/shankar0123/certctl/internal/connector/issuer/stepca"
-	googlecasissuer "github.com/shankar0123/certctl/internal/connector/issuer/googlecas"
-	sectigoissuer "github.com/shankar0123/certctl/internal/connector/issuer/sectigo"
-	vaultissuer "github.com/shankar0123/certctl/internal/connector/issuer/vault"
 	notifyemail "github.com/shankar0123/certctl/internal/connector/notifier/email"
 	notifyopsgenie "github.com/shankar0123/certctl/internal/connector/notifier/opsgenie"
 	notifypagerduty "github.com/shankar0123/certctl/internal/connector/notifier/pagerduty"
@@ -85,143 +78,18 @@ func main() {
 	ownerRepo := postgres.NewOwnerRepository(db)
 	logger.Info("initialized all repositories")
 
-	// Initialize Local CA issuer connector.
-	// In sub-CA mode (CERTCTL_CA_CERT_PATH + CERTCTL_CA_KEY_PATH set), loads a pre-signed
-	// CA cert+key from disk. All issued certs chain to the upstream root (e.g., ADCS).
-	// Otherwise, generates an ephemeral self-signed CA for development/demo.
-	localCAConfig := &local.Config{}
-	if cfg.CA.CertPath != "" && cfg.CA.KeyPath != "" {
-		localCAConfig.CACertPath = cfg.CA.CertPath
-		localCAConfig.CAKeyPath = cfg.CA.KeyPath
-		logger.Info("Local CA configured in sub-CA mode",
-			"cert_path", cfg.CA.CertPath,
-			"key_path", cfg.CA.KeyPath)
+	// Initialize dynamic issuer registry.
+	// Issuers are loaded from the database (with AES-GCM encrypted config).
+	// On first boot with an empty database, env var issuers are seeded automatically.
+	var encryptionKey []byte
+	if cfg.Encryption.ConfigEncryptionKey != "" {
+		encryptionKey = crypto.DeriveKey(cfg.Encryption.ConfigEncryptionKey)
+		logger.Info("config encryption enabled (AES-256-GCM)")
 	} else {
-		logger.Info("Local CA configured in self-signed mode (ephemeral)")
-	}
-	localCA := local.New(localCAConfig, logger)
-	logger.Info("initialized Local CA issuer connector")
-
-	// Initialize ACME issuer connector (for Let's Encrypt, ZeroSSL, Sectigo, Google Trust Services, etc.)
-	// Supports HTTP-01 (default), DNS-01 (for wildcards), and DNS-PERSIST-01 (standing record) challenge types.
-	// EAB (External Account Binding) required by ZeroSSL, Google Trust Services, SSL.com.
-	acmeConnector := acmeissuer.New(&acmeissuer.Config{
-		DirectoryURL:           os.Getenv("CERTCTL_ACME_DIRECTORY_URL"),
-		Email:                  os.Getenv("CERTCTL_ACME_EMAIL"),
-		EABKid:                 os.Getenv("CERTCTL_ACME_EAB_KID"),
-		EABHmac:                os.Getenv("CERTCTL_ACME_EAB_HMAC"),
-		ChallengeType:          os.Getenv("CERTCTL_ACME_CHALLENGE_TYPE"),
-		DNSPresentScript:       os.Getenv("CERTCTL_ACME_DNS_PRESENT_SCRIPT"),
-		DNSCleanUpScript:       os.Getenv("CERTCTL_ACME_DNS_CLEANUP_SCRIPT"),
-		DNSPersistIssuerDomain: os.Getenv("CERTCTL_ACME_DNS_PERSIST_ISSUER_DOMAIN"),
-		Insecure:               cfg.ACME.Insecure,
-	}, logger)
-	logger.Info("initialized ACME issuer connector")
-
-	// Initialize step-ca issuer connector (for Smallstep private CA).
-	// Uses the native /sign API with JWK provisioner authentication.
-	stepcaConnector := stepcaissuer.New(&stepcaissuer.Config{
-		CAURL:               os.Getenv("CERTCTL_STEPCA_URL"),
-		RootCertPath:        os.Getenv("CERTCTL_STEPCA_ROOT_CERT"),
-		ProvisionerName:     os.Getenv("CERTCTL_STEPCA_PROVISIONER"),
-		ProvisionerKeyPath:  os.Getenv("CERTCTL_STEPCA_KEY_PATH"),
-		ProvisionerPassword: os.Getenv("CERTCTL_STEPCA_PASSWORD"),
-	}, logger)
-	logger.Info("initialized step-ca issuer connector")
-
-	// Initialize OpenSSL/Custom CA issuer connector (for script-based CA integrations).
-	// Delegates certificate signing to user-provided scripts.
-	opensslConnector := opensslissuer.New(&opensslissuer.Config{
-		SignScript:     os.Getenv("CERTCTL_OPENSSL_SIGN_SCRIPT"),
-		RevokeScript:   os.Getenv("CERTCTL_OPENSSL_REVOKE_SCRIPT"),
-		CRLScript:      os.Getenv("CERTCTL_OPENSSL_CRL_SCRIPT"),
-		TimeoutSeconds: getEnvIntDefault(os.Getenv("CERTCTL_OPENSSL_TIMEOUT_SECONDS"), 30),
-	}, logger)
-	logger.Info("initialized OpenSSL/Custom CA issuer connector")
-
-	// Initialize Vault PKI issuer connector (for HashiCorp Vault internal PKI).
-	// Uses the Vault HTTP API with token authentication.
-	vaultConnector := vaultissuer.New(&vaultissuer.Config{
-		Addr:  os.Getenv("CERTCTL_VAULT_ADDR"),
-		Token: os.Getenv("CERTCTL_VAULT_TOKEN"),
-		Mount: getEnvDefault("CERTCTL_VAULT_MOUNT", "pki"),
-		Role:  os.Getenv("CERTCTL_VAULT_ROLE"),
-		TTL:   getEnvDefault("CERTCTL_VAULT_TTL", "8760h"),
-	}, logger)
-	logger.Info("initialized Vault PKI issuer connector")
-
-	// Initialize DigiCert CertCentral issuer connector (for enterprise public CA).
-	// Uses the DigiCert REST API with async order model.
-	digicertConnector := digicertissuer.New(&digicertissuer.Config{
-		APIKey:      os.Getenv("CERTCTL_DIGICERT_API_KEY"),
-		OrgID:       os.Getenv("CERTCTL_DIGICERT_ORG_ID"),
-		ProductType: getEnvDefault("CERTCTL_DIGICERT_PRODUCT_TYPE", "ssl_basic"),
-		BaseURL:     getEnvDefault("CERTCTL_DIGICERT_BASE_URL", "https://www.digicert.com/services/v2"),
-	}, logger)
-	logger.Info("initialized DigiCert CertCentral issuer connector")
-
-	// Initialize Sectigo SCM issuer connector (for enterprise public CA).
-	// Uses the Sectigo SCM REST API with async order model.
-	sectigoConnector := sectigoissuer.New(&sectigoissuer.Config{
-		CustomerURI: cfg.Sectigo.CustomerURI,
-		Login:       cfg.Sectigo.Login,
-		Password:    cfg.Sectigo.Password,
-		OrgID:       cfg.Sectigo.OrgID,
-		CertType:    cfg.Sectigo.CertType,
-		Term:        cfg.Sectigo.Term,
-		BaseURL:     cfg.Sectigo.BaseURL,
-	}, logger)
-	logger.Info("initialized Sectigo SCM issuer connector")
-
-	// Initialize Google CAS issuer connector (for GCP private CA).
-	// Uses the Google CAS REST API with OAuth2 service account auth.
-	googlecasConnector := googlecasissuer.New(&googlecasissuer.Config{
-		Project:     cfg.GoogleCAS.Project,
-		Location:    cfg.GoogleCAS.Location,
-		CAPool:      cfg.GoogleCAS.CAPool,
-		Credentials: cfg.GoogleCAS.Credentials,
-		TTL:         cfg.GoogleCAS.TTL,
-	}, logger)
-	logger.Info("initialized Google CAS issuer connector")
-
-	// Build issuer registry: maps issuer IDs (from database) to connector implementations.
-	// "iss-local" matches the seed data issuer ID for the Local CA.
-	// "iss-acme-staging" and "iss-acme-prod" are conventional IDs for ACME issuers.
-	// "iss-stepca" is the step-ca private CA connector.
-	// "iss-openssl" is the custom CA/OpenSSL connector.
-	issuerRegistry := map[string]service.IssuerConnector{
-		"iss-local":        service.NewIssuerConnectorAdapter(localCA),
-		"iss-acme-staging": service.NewIssuerConnectorAdapter(acmeConnector),
-		"iss-acme-prod":    service.NewIssuerConnectorAdapter(acmeConnector),
-		"iss-stepca":       service.NewIssuerConnectorAdapter(stepcaConnector),
-		"iss-openssl":      service.NewIssuerConnectorAdapter(opensslConnector),
+		logger.Warn("CERTCTL_CONFIG_ENCRYPTION_KEY not set — issuer configs stored in plaintext (not recommended for production)")
 	}
 
-	// Conditionally register Vault PKI (only if CERTCTL_VAULT_ADDR is set)
-	if os.Getenv("CERTCTL_VAULT_ADDR") != "" {
-		issuerRegistry["iss-vault"] = service.NewIssuerConnectorAdapter(vaultConnector)
-		logger.Info("Vault PKI issuer registered", "id", "iss-vault")
-	}
-
-	// Conditionally register DigiCert (only if CERTCTL_DIGICERT_API_KEY is set)
-	if os.Getenv("CERTCTL_DIGICERT_API_KEY") != "" {
-		issuerRegistry["iss-digicert"] = service.NewIssuerConnectorAdapter(digicertConnector)
-		logger.Info("DigiCert CertCentral issuer registered", "id", "iss-digicert")
-	}
-
-	// Conditionally register Sectigo SCM (only if all 3 auth credentials are set)
-	if cfg.Sectigo.CustomerURI != "" && cfg.Sectigo.Login != "" && cfg.Sectigo.Password != "" {
-		issuerRegistry["iss-sectigo"] = service.NewIssuerConnectorAdapter(sectigoConnector)
-		logger.Info("Sectigo SCM issuer registered", "id", "iss-sectigo")
-	}
-
-	// Conditionally register Google CAS (only if project and credentials are set)
-	if cfg.GoogleCAS.Project != "" && cfg.GoogleCAS.Credentials != "" {
-		issuerRegistry["iss-googlecas"] = service.NewIssuerConnectorAdapter(googlecasConnector)
-		logger.Info("Google CAS issuer registered", "id", "iss-googlecas")
-	}
-
-	logger.Info("issuer registry configured", "issuers", len(issuerRegistry))
+	issuerRegistry := service.NewIssuerRegistry(logger)
 
 	// Initialize revocation repository
 	revocationRepo := postgres.NewRevocationRepository(db)
@@ -309,8 +177,15 @@ func main() {
 	jobService := service.NewJobService(jobRepo, renewalService, deploymentService, logger)
 	agentService := service.NewAgentService(agentRepo, certificateRepo, jobRepo, targetRepo, auditService, issuerRegistry, renewalService)
 	agentService.SetProfileRepo(profileRepo)
-	issuerService := service.NewIssuerService(issuerRepo, auditService)
-	targetService := service.NewTargetService(targetRepo, auditService)
+	issuerService := service.NewIssuerService(issuerRepo, auditService, issuerRegistry, encryptionKey, logger)
+
+	// Seed issuers from env vars on first boot (empty database only), then build registry
+	issuerService.SeedFromEnvVars(context.Background(), cfg)
+	if err := issuerService.BuildRegistry(context.Background()); err != nil {
+		logger.Error("failed to build issuer registry from database", "error", err)
+	}
+	logger.Info("issuer registry loaded", "issuers", issuerRegistry.Len())
+	targetService := service.NewTargetService(targetRepo, auditService, agentRepo, encryptionKey, logger)
 	profileService := service.NewProfileService(profileRepo, auditService)
 	teamService := service.NewTeamService(teamRepo, auditService)
 	ownerService := service.NewOwnerService(ownerRepo, auditService)
@@ -447,7 +322,7 @@ func main() {
 	})
 	// Register EST (RFC 7030) handlers if enabled
 	if cfg.EST.Enabled {
-		issuerConn, ok := issuerRegistry[cfg.EST.IssuerID]
+		issuerConn, ok := issuerRegistry.Get(cfg.EST.IssuerID)
 		if !ok {
 			logger.Error("EST issuer not found in registry", "issuer_id", cfg.EST.IssuerID)
 			os.Exit(1)
@@ -645,22 +520,3 @@ func main() {
 	logger.Info("certctl server stopped")
 }
 
-// getEnvDefault reads an environment variable with a default fallback.
-func getEnvDefault(key, defaultVal string) string {
-	if val := os.Getenv(key); val != "" {
-		return val
-	}
-	return defaultVal
-}
-
-// getEnvIntDefault parses an integer from a string with a default fallback.
-func getEnvIntDefault(s string, defaultVal int) int {
-	if s == "" {
-		return defaultVal
-	}
-	val, err := strconv.Atoi(s)
-	if err != nil {
-		return defaultVal
-	}
-	return val
-}

deploy/docker-compose.demo.yml

@@ -0,0 +1,14 @@
+# Demo mode: pre-populated dashboard with 15 certificates, 5 agents, issuers, etc.
+# Use this to showcase certctl's dashboard with realistic data.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml up --build
+#
+# To start fresh (wipe previous data):
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml down -v
+#   docker compose -f docker-compose.yml -f docker-compose.demo.yml up --build
+
+services:
+  postgres:
+    volumes:
+      - ../migrations/seed_demo.sql:/docker-entrypoint-initdb.d/030_seed_demo.sql

deploy/docker-compose.test.yml

@@ -45,8 +45,10 @@ services:
       - ../migrations/000006_discovery.up.sql:/docker-entrypoint-initdb.d/006_discovery.sql
       - ../migrations/000007_network_discovery.up.sql:/docker-entrypoint-initdb.d/007_network_discovery.sql
       - ../migrations/000008_verification.up.sql:/docker-entrypoint-initdb.d/008_verification.sql
-      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/010_seed.sql
-      - ../migrations/seed_test.sql:/docker-entrypoint-initdb.d/015_seed_test.sql
+      - ../migrations/000009_issuer_config.up.sql:/docker-entrypoint-initdb.d/009_issuer_config.sql
+      - ../migrations/000010_target_config.up.sql:/docker-entrypoint-initdb.d/010_target_config.sql
+      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/020_seed.sql
+      - ../migrations/seed_test.sql:/docker-entrypoint-initdb.d/025_seed_test.sql
       # No seed_demo.sql — start with a clean database for real testing
     networks:
       certctl-test:

deploy/docker-compose.yml

@@ -19,8 +19,9 @@ services:
       - ../migrations/000006_discovery.up.sql:/docker-entrypoint-initdb.d/006_discovery.sql
       - ../migrations/000007_network_discovery.up.sql:/docker-entrypoint-initdb.d/007_network_discovery.sql
       - ../migrations/000008_verification.up.sql:/docker-entrypoint-initdb.d/008_verification.sql
-      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/010_seed.sql
-      - ../migrations/seed_demo.sql:/docker-entrypoint-initdb.d/011_seed_demo.sql
+      - ../migrations/000009_issuer_config.up.sql:/docker-entrypoint-initdb.d/009_issuer_config.sql
+      - ../migrations/000010_target_config.up.sql:/docker-entrypoint-initdb.d/010_target_config.sql
+      - ../migrations/seed.sql:/docker-entrypoint-initdb.d/020_seed.sql
     networks:
       - certctl-network
     healthcheck:

docs/architecture.md

@@ -964,27 +964,25 @@ This data flow is pull-based and non-blocking. Agents discover at their own pace
 
 ## Testing Strategy
 
-certctl uses a layered testing approach aligned with the handler → service → repository architecture, with 1050+ tests across six layers (service, handler, integration, connector, frontend, and scheduler). The goal is high-confidence regression prevention at the service and handler layers, where the most complex business logic lives, combined with integration tests that exercise the full request path from HTTP to database.
+certctl is extensively tested across eight layers with CI-enforced coverage gates that act as regression floors. The goal is high-confidence regression prevention at the service and handler layers (where the most complex business logic lives), combined with integration tests that exercise the full request path from HTTP to database.
 
-**Service layer unit tests** (`internal/service/*_test.go`) — ~238 test functions across 15 files with mock repositories. These test all business logic in isolation: certificate CRUD with validation, certificate revocation (success, already-revoked, archived, invalid reason, all RFC 5280 reason codes, issuer notification, notification service integration, OCSP/CRL generation), agent lifecycle (registration, heartbeat, CSR submission with both keygen modes), job state machine (creation, processing, cancellation, retry logic), policy evaluation (all 5 rule types, violation creation), renewal and issuance flow (server-side and agent-side keygen paths), notification deduplication (threshold tag matching, channel routing), team/owner/agent group CRUD with pagination and audit recording, issuer service CRUD with connection testing, and the issuer connector adapter (type translation between connector and service layers including revocation). Mock repositories are simple structs with function fields, avoiding heavy mocking frameworks — this keeps tests readable and avoids coupling to mock library APIs.
+**Service layer unit tests** (`internal/service/*_test.go`) — Mock-based tests across all service files covering certificate CRUD, revocation (all RFC 5280 reason codes, OCSP/CRL generation), agent lifecycle, job state machine, policy evaluation, renewal/issuance flow (both keygen modes), notification deduplication, team/owner/agent group CRUD, issuer service CRUD with connection testing, and the issuer connector adapter. Mock repositories are simple structs with function fields — no heavy mocking frameworks.
 
-**Handler layer tests** (`internal/api/handler/*_test.go`) — ~257 test functions across 11 files using Go's `httptest` package. Every handler file has a corresponding test file: certificates (50 tests including revocation, DER CRL, and OCSP), agents (28 tests), jobs (21 tests including approve/reject), notifications (11 tests), policies (19 tests), profiles (18 tests), issuers (17 tests), targets (17 tests), agent groups (12 tests), teams (26 tests), and owners (21 tests). Each test file follows the same pattern: a mock service struct with function fields, `httptest.NewRecorder` for capturing responses, and a shared `contextWithRequestID()` helper. Tests cover the happy path, input validation (missing fields, invalid JSON, empty IDs, name length limits), error propagation from the service layer, method-not-allowed responses, and pagination parameters.
+**Handler layer tests** (`internal/api/handler/*_test.go`) — Every handler file has a corresponding test file using Go's `httptest` package: certificates (including revocation, DER CRL, OCSP), agents, jobs (including approve/reject), notifications, policies, profiles, issuers, targets, agent groups, teams, owners, discovery, network scan, verification, export, EST, digest, stats, and metrics. Tests cover the happy path, input validation, error propagation, method-not-allowed, and pagination.
 
-**Integration tests** (`internal/integration/`) — Two test files exercising the full stack from HTTP request through router, handler, service, and postgres repository layers. `lifecycle_test.go` has 11 subtests covering the complete certificate lifecycle: team/owner creation, certificate creation, issuer verification, renewal trigger, job verification, agent registration, CSR submission, deployment, and status reporting. `negative_test.go` has 14 subtests covering error paths, 19 M11b endpoint tests, and 8 revocation endpoint tests (M15a+M15b): nonexistent resource lookups (404s), invalid request bodies (malformed JSON, missing required fields), invalid CSR submission, heartbeat for nonexistent agents, wrong HTTP methods on list endpoints, empty list responses, renewal on nonexistent certificates, expired certificate lifecycle, team/owner/agent group CRUD validation, revocation success, already-revoked rejection, not-found revocation, JSON CRL retrieval, DER CRL retrieval, OCSP response retrieval, and short-lived cert exemption. Both use a shared `setupTestServer()` that builds a fully-wired server with real postgres repositories and the Local CA issuer connector. A third file, `e2e_test.go`, contains 8 cross-milestone test functions with 48+ subtests that exercise features across milestones end-to-end: M10 agent metadata via heartbeat, M11 profiles/teams/owners/agent-groups CRUD, M12 issuer registry verification, M13 GUI operation endpoints, M14 stats and metrics, M15 revocation and CRL, M16 notification channels, and M20 enhanced query API (sorting, cursor pagination, sparse fields, time-range filters).
+**Integration tests** (`internal/integration/`) — Three test files exercising the full stack from HTTP request through router, handler, service, and repository layers. `lifecycle_test.go` covers the complete certificate lifecycle (team/owner creation through deployment and status reporting). `negative_test.go` covers error paths, endpoint validation, and revocation scenarios. `e2e_test.go` exercises cross-milestone features end-to-end (agent metadata, profiles, issuer registry, GUI operations, stats, revocation, notifications, enhanced query API).
 
-**Frontend tests** (`web/src/api/client.test.ts`, `web/src/api/utils.test.ts`) — 86 Vitest tests covering the API client, stats/metrics endpoints, and utility functions. The API client tests mock `globalThis.fetch` and verify all endpoint functions (certificates, agents, jobs, policies, issuers, targets, notifications, audit, stats, metrics, health) send correct HTTP methods, URLs, headers, and request bodies. They also test API key management (store/retrieve/clear), auth header propagation, 401 event dispatching, and error handling (server messages, error fields, status text fallback). The stats/metrics endpoint tests verify correct query parameter handling and response shape validation. The utility tests use `vi.useFakeTimers()` for deterministic date testing and cover `formatDate`, `formatDateTime`, `timeAgo`, `daysUntil`, and `expiryColor`. The test environment uses jsdom with `@testing-library/jest-dom` matchers.
+**Go integration tests** (`deploy/test/integration_test.go`) — Runs against the live Docker Compose test environment with real CA backends (Local CA, Pebble ACME, step-ca). Covers health checks, agent heartbeat, issuance, renewal, revocation, CRL/OCSP, EST enrollment, S/MIME, discovery, network scanning, and deployment verification using `crypto/x509` for cert parsing and `crypto/tls` for live TLS verification.
 
-**CLI tests** (`internal/cli/client_test.go`) — 14 tests covering all 10 CLI subcommands with httptest mock servers, PEM parsing for bulk import, auth header verification, and JSON/table output formatting.
+**Frontend tests** (`web/src/api/`) — Vitest tests covering the full API client (all endpoint functions with fetch mocking), stats/metrics endpoints, utility functions, and auth flows. Test environment uses jsdom with `@testing-library/jest-dom` matchers.
 
-**CI pipeline** (`.github/workflows/ci.yml`) — Two parallel jobs: Go (build, vet, race detection, static analysis, vulnerability scanning, test with coverage, coverage threshold enforcement) and Frontend (TypeScript type check, Vitest test suite, Vite production build). The Go job runs `go test -race` on service, handler, middleware, and scheduler packages to catch data races. It runs `golangci-lint` with 11 linters (errcheck, govet, staticcheck, unused, gosimple, ineffassign, typecheck, gocritic, gosec, bodyclose, noctx) configured in `.golangci.yml`. It runs `govulncheck ./...` to scan dependencies for known CVEs. Coverage thresholds are enforced per-layer: service 60%, handler 60%, domain 40%, middleware 50%. These thresholds act as regression floors — they can only go up. Connector tests are included via `./internal/connector/issuer/...` and `./internal/connector/target/...` (covers Local CA, ACME, step-ca, NGINX, Apache, HAProxy, Traefik, and Caddy packages with unit tests for certificate signing logic, DNS solver, issuer validation, and deployment flows). The Frontend job runs `npx vitest run` between the TypeScript check and production build steps.
+**Connector tests** (`internal/connector/`) — Issuer connectors (Local CA self-signed/sub-CA modes, ACME DNS-01/DNS-PERSIST-01, step-ca, OpenSSL, Vault PKI, DigiCert, Sectigo, Google CAS — all with httptest mock servers). Target connectors (NGINX, Apache, HAProxy, Traefik, Caddy, Envoy, IIS with mock PowerShell executor, F5 BIG-IP with mock iControl client, Postfix/Dovecot). Notifier connectors (Slack, Teams, PagerDuty, OpsGenie).
 
-**Connector tests** (`internal/connector/`) — 57 test functions covering issuer, target, and notifier connectors. The Local CA connector has tests for self-signed and sub-CA modes (RSA, ECDSA, config validation, non-CA cert rejection). The ACME DNS solver has 10 tests for script-based DNS-01 and DNS-PERSIST-01 challenges (6 DNS-01 tests + 4 DNS-PERSIST-01 tests covering `PresentPersist` success, no-script error, script failure, and wildcard domain handling). The step-ca connector has tests with a mock HTTP server for issuance, renewal, revocation, and error paths. The OpenSSL/Custom CA connector has 14 tests covering config validation, issuance success/failure/timeout, renewal, revocation, and CRL generation. The NGINX target connector has 13 tests covering config validation, certificate deployment (file writing, permissions, validate/reload commands), and deployment validation. Apache httpd and HAProxy connectors each have 3 tests covering config validation, deployment, and validation flows. Traefik and Caddy connectors have tests covering file-based deployment and (for Caddy) dual-mode API/file configuration. Notifier connector tests span 20 tests across Slack (5), Teams (4), PagerDuty (6), and OpsGenie (5) — verifying channel identity, payload formatting, HTTP error handling, connection failures, auth headers, and configuration defaults.
+**Scheduler tests** (`internal/scheduler/scheduler_test.go`) — Idempotency guards (`sync/atomic.Bool`), `WaitForCompletion` success and timeout paths, and multi-loop concurrency safety.
 
-**Scheduler tests** (`internal/scheduler/scheduler_test.go`) — Tests for idempotency guards (`sync/atomic.Bool` CompareAndSwap prevents concurrent loop ticks), `WaitForCompletion` success and timeout paths, and multi-loop idempotency.
+**Fuzz tests** (`internal/validation/`, `internal/domain/`) — Go native fuzz tests for command validation (`ValidateShellCommand`, `ValidateDomainName`, `ValidateACMEToken`) and revocation domain parsing.
 
-**Fuzz tests** (`internal/validation/command_fuzz_test.go`, `internal/domain/revocation_fuzz_test.go`) — Go native fuzz tests (`testing/fuzz`) for command validation functions and revocation domain parsing. These exercise `ValidateShellCommand`, `ValidateDomainName`, and `ValidateACMEToken` with random inputs to discover edge cases.
-
-**What's not tested and why:** Postgres repository implementations (`internal/repository/postgres/`) require a real database and are tested only through integration tests, not unit tests — a `testcontainers-go` scaffolding for isolated PostgreSQL instances is planned. Target connectors for F5 BIG-IP and IIS are interface stubs (implementation planned for V3). The ACME connector requires a real ACME server (tested manually against Let's Encrypt staging). These are all candidates for future expansion as the test infrastructure matures.
+**CI pipeline** (`.github/workflows/ci.yml`) — Two parallel jobs. Go: build, vet, `go test -race`, `golangci-lint` (11 linters), `govulncheck`, test with coverage, per-layer coverage threshold enforcement (service 60%, handler 60%, domain 40%, middleware 50%). Frontend: TypeScript type check, Vitest, Vite production build.
 
 ## What's Next
 

docs/features.md

@@ -1286,11 +1286,11 @@ The web dashboard is the primary operational interface for certctl. Built with *
 - **Docker Tags** — `:latest`, `:v{version}` (`shankar0123.docker.scarf.sh/certctl-server`, `shankar0123.docker.scarf.sh/certctl-agent`)
 
 ### Test Suite
-- **Unit Tests** — 1,088+ test functions across service, handler, middleware, domain layers
-- **Integration Tests** — End-to-end workflows (issuance→renewal→deployment)
+- **Unit Tests** — Extensive coverage across service, handler, middleware, domain, and connector layers
+- **Integration Tests** — End-to-end workflows (issuance→renewal→deployment) against live Docker Compose environment
 - **Negative Tests** — Malformed input, nonexistent resources, error conditions
-- **Frontend Tests** — 211 Vitest tests (API client, utilities, stats/metrics, full endpoint coverage)
-- **Total Coverage** — 1,554+ tests (Go + frontend combined)
+- **Frontend Tests** — Vitest suite covering API client, utilities, stats/metrics, and full endpoint coverage
+- **CI Gates** — Per-layer coverage thresholds (service 60%, handler 60%, domain 40%, middleware 50%), race detection, static analysis, vulnerability scanning
 
 ### Licensing
 - **License** — Business Source License 1.1 (BSL 1.1)
@@ -1492,6 +1492,6 @@ Each guide includes an evidence summary table mapping specific criteria to certc
 | **MCP Tools** | 76 (16 resource domains) |
 | **CLI Subcommands** | 10 |
 | **Database Tables** | 19 |
-| **Test Suite** | 1,554+ tests (Go backend + frontend) |
+| **Test Suite** | Extensively tested with CI-enforced coverage gates |
 | **Environment Variables** | 41+ configuration options |
 

docs/why-certctl.md

@@ -70,7 +70,7 @@ The three differentiators above get the headlines, but the feature surface is wi
 
 **Full REST API** — 97 OpenAPI 3.1-documented operations. CLI tool with 10 subcommands. Helm chart for Kubernetes deployment. Scheduled certificate digest emails. Certificate export in PEM and PKCS#12. S/MIME support with EKU-aware issuance.
 
-**1,554 tests** — Go backend with race detection, static analysis (golangci-lint), and vulnerability scanning (govulncheck) on every commit. Frontend test suite. CI runs on every push.
+**Extensively tested** — Go backend with race detection, static analysis (golangci-lint), and vulnerability scanning (govulncheck) on every commit. CI-enforced per-layer coverage thresholds. Frontend test suite. Every push is gated.
 
 ## How certctl Compares
 

internal/api/handler/target_handler_test.go

@@ -13,11 +13,12 @@ import (
 
 // MockTargetService is a mock implementation of TargetService interface.
 type MockTargetService struct {
-	ListTargetsFn  func(page, perPage int) ([]domain.DeploymentTarget, int64, error)
-	GetTargetFn    func(id string) (*domain.DeploymentTarget, error)
-	CreateTargetFn func(target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
-	UpdateTargetFn func(id string, target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
-	DeleteTargetFn func(id string) error
+	ListTargetsFn        func(page, perPage int) ([]domain.DeploymentTarget, int64, error)
+	GetTargetFn          func(id string) (*domain.DeploymentTarget, error)
+	CreateTargetFn       func(target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
+	UpdateTargetFn       func(id string, target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
+	DeleteTargetFn       func(id string) error
+	TestTargetConnectionFn func(id string) error
 }
 
 func (m *MockTargetService) ListTargets(page, perPage int) ([]domain.DeploymentTarget, int64, error) {
@@ -55,6 +56,13 @@ func (m *MockTargetService) DeleteTarget(id string) error {
 	return nil
 }
 
+func (m *MockTargetService) TestTargetConnection(id string) error {
+	if m.TestTargetConnectionFn != nil {
+		return m.TestTargetConnectionFn(id)
+	}
+	return nil
+}
+
 func TestListTargets_Success(t *testing.T) {
 	now := time.Now()
 	t1 := domain.DeploymentTarget{
@@ -419,3 +427,69 @@ func TestDeleteTarget_EmptyID(t *testing.T) {
 		t.Fatalf("expected status 400, got %d", w.Code)
 	}
 }
+
+func TestTestTargetConnection_Success(t *testing.T) {
+	mock := &MockTargetService{
+		TestTargetConnectionFn: func(id string) error {
+			return nil
+		},
+	}
+
+	handler := NewTargetHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/targets/t-nginx-01/test", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.TestTargetConnection(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var resp map[string]interface{}
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if resp["status"] != "success" {
+		t.Errorf("expected status 'success', got %v", resp["status"])
+	}
+}
+
+func TestTestTargetConnection_Failed(t *testing.T) {
+	mock := &MockTargetService{
+		TestTargetConnectionFn: func(id string) error {
+			return ErrMockServiceFailed
+		},
+	}
+
+	handler := NewTargetHandler(mock)
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/targets/t-nginx-01/test", nil)
+	req = req.WithContext(contextWithRequestID())
+	w := httptest.NewRecorder()
+
+	handler.TestTargetConnection(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("expected status 200, got %d", w.Code)
+	}
+
+	var resp map[string]interface{}
+	if err := json.NewDecoder(w.Body).Decode(&resp); err != nil {
+		t.Fatalf("failed to decode response: %v", err)
+	}
+	if resp["status"] != "failed" {
+		t.Errorf("expected status 'failed', got %v", resp["status"])
+	}
+}
+
+func TestTestTargetConnection_MethodNotAllowed(t *testing.T) {
+	handler := NewTargetHandler(&MockTargetService{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/targets/t-nginx-01/test", nil)
+	w := httptest.NewRecorder()
+
+	handler.TestTargetConnection(w, req)
+
+	if w.Code != http.StatusMethodNotAllowed {
+		t.Fatalf("expected status 405, got %d", w.Code)
+	}
+}

internal/api/handler/targets.go

@@ -17,6 +17,7 @@ type TargetService interface {
 	CreateTarget(target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
 	UpdateTarget(id string, target domain.DeploymentTarget) (*domain.DeploymentTarget, error)
 	DeleteTarget(id string) error
+	TestTargetConnection(id string) error
 }
 
 // TargetHandler handles HTTP requests for deployment target operations.
@@ -189,3 +190,36 @@ func (h TargetHandler) DeleteTarget(w http.ResponseWriter, r *http.Request) {
 
 	w.WriteHeader(http.StatusNoContent)
 }
+
+// TestTargetConnection tests target connectivity by checking the assigned agent's heartbeat.
+// POST /api/v1/targets/{id}/test
+func (h TargetHandler) TestTargetConnection(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		Error(w, http.StatusMethodNotAllowed, "Method not allowed")
+		return
+	}
+
+	requestID := middleware.GetRequestID(r.Context())
+
+	// Extract target ID from path: /api/v1/targets/{id}/test
+	path := strings.TrimPrefix(r.URL.Path, "/api/v1/targets/")
+	parts := strings.Split(path, "/")
+	if len(parts) < 2 || parts[0] == "" {
+		ErrorWithRequestID(w, http.StatusBadRequest, "Target ID is required", requestID)
+		return
+	}
+	id := parts[0]
+
+	if err := h.svc.TestTargetConnection(id); err != nil {
+		JSON(w, http.StatusOK, map[string]interface{}{
+			"status":  "failed",
+			"message": err.Error(),
+		})
+		return
+	}
+
+	JSON(w, http.StatusOK, map[string]interface{}{
+		"status":  "success",
+		"message": "Agent is online and reachable",
+	})
+}

internal/api/router/router.go

@@ -126,6 +126,7 @@ func (r *Router) RegisterHandlers(reg HandlerRegistry) {
 	r.Register("GET /api/v1/targets/{id}", http.HandlerFunc(reg.Targets.GetTarget))
 	r.Register("PUT /api/v1/targets/{id}", http.HandlerFunc(reg.Targets.UpdateTarget))
 	r.Register("DELETE /api/v1/targets/{id}", http.HandlerFunc(reg.Targets.DeleteTarget))
+	r.Register("POST /api/v1/targets/{id}/test", http.HandlerFunc(reg.Targets.TestTargetConnection))
 
 	// Agents routes: /api/v1/agents
 	r.Register("GET /api/v1/agents", http.HandlerFunc(reg.Agents.ListAgents))

internal/config/config.go

@@ -30,6 +30,14 @@ type Config struct {
 	Sectigo      SectigoConfig
 	GoogleCAS    GoogleCASConfig
 	Digest       DigestConfig
+	Encryption   EncryptionConfig
+}
+
+// EncryptionConfig contains configuration for encrypting sensitive data at rest.
+type EncryptionConfig struct {
+	// ConfigEncryptionKey is the passphrase used to derive AES-256-GCM keys for encrypting
+	// issuer config secrets in the database. If empty, configs are stored in plaintext (development only).
+	ConfigEncryptionKey string
 }
 
 // NotifierConfig contains configuration for notification connectors.
@@ -598,6 +606,9 @@ func Load() (*Config, error) {
 			Interval:   getEnvDuration("CERTCTL_DIGEST_INTERVAL", 24*time.Hour),
 			Recipients: getEnvList("CERTCTL_DIGEST_RECIPIENTS", nil),
 		},
+		Encryption: EncryptionConfig{
+			ConfigEncryptionKey: getEnv("CERTCTL_CONFIG_ENCRYPTION_KEY", ""),
+		},
 	}
 
 	if err := cfg.Validate(); err != nil {

internal/connector/issuer/factory.go

@@ -0,0 +1,4 @@
+package issuer
+
+// Factory has been moved to internal/connector/issuerfactory to avoid import cycles.
+// See issuerfactory.NewFromConfig().

internal/connector/issuer/factory_test.go

@@ -0,0 +1,3 @@
+package issuer
+
+// Factory tests have been moved to internal/connector/issuerfactory.

internal/connector/issuerfactory/factory.go

@@ -0,0 +1,87 @@
+package issuerfactory
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"github.com/shankar0123/certctl/internal/connector/issuer"
+	"github.com/shankar0123/certctl/internal/connector/issuer/acme"
+	"github.com/shankar0123/certctl/internal/connector/issuer/digicert"
+	"github.com/shankar0123/certctl/internal/connector/issuer/googlecas"
+	"github.com/shankar0123/certctl/internal/connector/issuer/local"
+	"github.com/shankar0123/certctl/internal/connector/issuer/openssl"
+	"github.com/shankar0123/certctl/internal/connector/issuer/sectigo"
+	"github.com/shankar0123/certctl/internal/connector/issuer/stepca"
+	"github.com/shankar0123/certctl/internal/connector/issuer/vault"
+)
+
+// NewFromConfig instantiates an issuer connector from its type string and config JSON.
+// The config JSON keys use snake_case matching the connector Config struct json tags.
+// This replaces the manual wiring in cmd/server/main.go.
+func NewFromConfig(issuerType string, configJSON json.RawMessage, logger *slog.Logger) (issuer.Connector, error) {
+	if len(configJSON) == 0 {
+		configJSON = []byte("{}")
+	}
+
+	switch issuerType {
+	case "local", "GenericCA":
+		var cfg local.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid Local CA config: %w", err)
+		}
+		return local.New(&cfg, logger), nil
+
+	case "ACME":
+		var cfg acme.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid ACME config: %w", err)
+		}
+		return acme.New(&cfg, logger), nil
+
+	case "StepCA":
+		var cfg stepca.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid step-ca config: %w", err)
+		}
+		return stepca.New(&cfg, logger), nil
+
+	case "OpenSSL":
+		var cfg openssl.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid OpenSSL config: %w", err)
+		}
+		return openssl.New(&cfg, logger), nil
+
+	case "VaultPKI":
+		var cfg vault.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid Vault PKI config: %w", err)
+		}
+		return vault.New(&cfg, logger), nil
+
+	case "DigiCert":
+		var cfg digicert.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid DigiCert config: %w", err)
+		}
+		return digicert.New(&cfg, logger), nil
+
+	case "Sectigo":
+		var cfg sectigo.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid Sectigo config: %w", err)
+		}
+		return sectigo.New(&cfg, logger), nil
+
+	case "GoogleCAS":
+		var cfg googlecas.Config
+		if err := json.Unmarshal(configJSON, &cfg); err != nil {
+			return nil, fmt.Errorf("invalid Google CAS config: %w", err)
+		}
+		return googlecas.New(&cfg, logger), nil
+
+	default:
+		return nil, fmt.Errorf("unknown issuer type: %q", issuerType)
+	}
+}

internal/connector/issuerfactory/factory_test.go

@@ -0,0 +1,138 @@
+package issuerfactory
+
+import (
+	"encoding/json"
+	"log/slog"
+	"os"
+	"testing"
+)
+
+func testLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+}
+
+func TestNewFromConfig_LocalCA(t *testing.T) {
+	cfg := json.RawMessage(`{"ca_common_name":"Test CA"}`)
+	conn, err := NewFromConfig("local", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(local) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_GenericCA_Alias(t *testing.T) {
+	cfg := json.RawMessage(`{}`)
+	conn, err := NewFromConfig("GenericCA", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(GenericCA) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_ACME(t *testing.T) {
+	cfg := json.RawMessage(`{"directory_url":"https://acme-staging-v02.api.letsencrypt.org/directory","email":"test@example.com"}`)
+	conn, err := NewFromConfig("ACME", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(ACME) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_StepCA(t *testing.T) {
+	cfg := json.RawMessage(`{"ca_url":"https://ca.internal:9000","provisioner_name":"test"}`)
+	conn, err := NewFromConfig("StepCA", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(StepCA) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_OpenSSL(t *testing.T) {
+	cfg := json.RawMessage(`{"sign_script":"/path/to/sign.sh"}`)
+	conn, err := NewFromConfig("OpenSSL", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(OpenSSL) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_VaultPKI(t *testing.T) {
+	cfg := json.RawMessage(`{"addr":"https://vault:8200","token":"hvs.test","mount":"pki","role":"web","ttl":"8760h"}`)
+	conn, err := NewFromConfig("VaultPKI", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(VaultPKI) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_DigiCert(t *testing.T) {
+	cfg := json.RawMessage(`{"api_key":"test-key","org_id":"123","product_type":"ssl_basic"}`)
+	conn, err := NewFromConfig("DigiCert", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(DigiCert) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_Sectigo(t *testing.T) {
+	cfg := json.RawMessage(`{"customer_uri":"test-org","login":"api-user","password":"secret","org_id":1}`)
+	conn, err := NewFromConfig("Sectigo", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(Sectigo) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_GoogleCAS(t *testing.T) {
+	cfg := json.RawMessage(`{"project":"my-project","location":"us-central1","ca_pool":"my-pool","credentials":"/path/to/creds.json"}`)
+	conn, err := NewFromConfig("GoogleCAS", cfg, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig(GoogleCAS) failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestNewFromConfig_UnknownType(t *testing.T) {
+	cfg := json.RawMessage(`{}`)
+	_, err := NewFromConfig("UnknownCA", cfg, testLogger())
+	if err == nil {
+		t.Fatal("expected error for unknown type")
+	}
+}
+
+func TestNewFromConfig_MalformedJSON(t *testing.T) {
+	cfg := json.RawMessage(`{invalid json}`)
+	_, err := NewFromConfig("ACME", cfg, testLogger())
+	if err == nil {
+		t.Fatal("expected error for malformed JSON")
+	}
+}
+
+func TestNewFromConfig_EmptyConfig(t *testing.T) {
+	// Empty config should work — connectors have defaults
+	conn, err := NewFromConfig("local", nil, testLogger())
+	if err != nil {
+		t.Fatalf("NewFromConfig with nil config failed: %v", err)
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}

internal/crypto/encryption.go

@@ -0,0 +1,103 @@
+// Package crypto provides AES-256-GCM encryption for sensitive configuration data.
+package crypto
+
+import (
+	"crypto/aes"
+	"crypto/cipher"
+	"crypto/rand"
+	"crypto/sha256"
+	"fmt"
+	"io"
+
+	"golang.org/x/crypto/pbkdf2"
+)
+
+// Encrypt encrypts plaintext using AES-256-GCM with a random 12-byte nonce prepended to the output.
+// The key must be exactly 32 bytes (AES-256). Returns [12-byte nonce][ciphertext+tag].
+func Encrypt(plaintext []byte, key []byte) ([]byte, error) {
+	if len(key) != 32 {
+		return nil, fmt.Errorf("encryption key must be exactly 32 bytes, got %d", len(key))
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create AES cipher: %w", err)
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GCM: %w", err)
+	}
+
+	nonce := make([]byte, gcm.NonceSize())
+	if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
+		return nil, fmt.Errorf("failed to generate nonce: %w", err)
+	}
+
+	ciphertext := gcm.Seal(nonce, nonce, plaintext, nil)
+	return ciphertext, nil
+}
+
+// Decrypt decrypts ciphertext that was encrypted with Encrypt.
+// Expects format: [12-byte nonce][ciphertext+tag]. Key must be exactly 32 bytes.
+func Decrypt(ciphertext []byte, key []byte) ([]byte, error) {
+	if len(key) != 32 {
+		return nil, fmt.Errorf("encryption key must be exactly 32 bytes, got %d", len(key))
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create AES cipher: %w", err)
+	}
+
+	gcm, err := cipher.NewGCM(block)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create GCM: %w", err)
+	}
+
+	nonceSize := gcm.NonceSize()
+	if len(ciphertext) < nonceSize {
+		return nil, fmt.Errorf("ciphertext too short: %d bytes", len(ciphertext))
+	}
+
+	nonce, ciphertextBody := ciphertext[:nonceSize], ciphertext[nonceSize:]
+	plaintext, err := gcm.Open(nil, nonce, ciphertextBody, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt: %w", err)
+	}
+
+	return plaintext, nil
+}
+
+// DeriveKey derives a 32-byte AES-256 key from a passphrase using PBKDF2-SHA256.
+// Uses a fixed application-specific salt and 100,000 iterations for resistance
+// to brute-force attacks on weak passphrases.
+func DeriveKey(passphrase string) []byte {
+	// Fixed salt is acceptable here because:
+	// 1. Each certctl instance has its own passphrase
+	// 2. The salt prevents generic rainbow table attacks
+	// 3. Per-user salts are unnecessary (single server key, not user passwords)
+	salt := []byte("certctl-config-encryption-v1")
+	return pbkdf2.Key([]byte(passphrase), salt, 100000, 32, sha256.New)
+}
+
+// EncryptIfKeySet encrypts plaintext if a key is provided, otherwise returns plaintext unchanged.
+// This supports the development/demo fallback where encryption isn't configured.
+func EncryptIfKeySet(plaintext []byte, key []byte) ([]byte, bool, error) {
+	if len(key) == 0 {
+		return plaintext, false, nil
+	}
+	encrypted, err := Encrypt(plaintext, key)
+	if err != nil {
+		return nil, false, err
+	}
+	return encrypted, true, nil
+}
+
+// DecryptIfKeySet decrypts ciphertext if a key is provided, otherwise returns ciphertext unchanged.
+func DecryptIfKeySet(ciphertext []byte, key []byte) ([]byte, error) {
+	if len(key) == 0 {
+		return ciphertext, nil
+	}
+	return Decrypt(ciphertext, key)
+}

internal/crypto/encryption_test.go

@@ -0,0 +1,188 @@
+package crypto
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestEncryptDecryptRoundTrip(t *testing.T) {
+	key := DeriveKey("test-passphrase")
+	plaintext := []byte(`{"api_key":"secret123","org_id":"456"}`)
+
+	encrypted, err := Encrypt(plaintext, key)
+	if err != nil {
+		t.Fatalf("Encrypt failed: %v", err)
+	}
+
+	if bytes.Equal(encrypted, plaintext) {
+		t.Fatal("encrypted data should differ from plaintext")
+	}
+
+	decrypted, err := Decrypt(encrypted, key)
+	if err != nil {
+		t.Fatalf("Decrypt failed: %v", err)
+	}
+
+	if !bytes.Equal(decrypted, plaintext) {
+		t.Fatalf("round-trip failed: got %q, want %q", decrypted, plaintext)
+	}
+}
+
+func TestDecryptWrongKey(t *testing.T) {
+	key1 := DeriveKey("key-one")
+	key2 := DeriveKey("key-two")
+	plaintext := []byte("sensitive config data")
+
+	encrypted, err := Encrypt(plaintext, key1)
+	if err != nil {
+		t.Fatalf("Encrypt failed: %v", err)
+	}
+
+	_, err = Decrypt(encrypted, key2)
+	if err == nil {
+		t.Fatal("expected error when decrypting with wrong key")
+	}
+}
+
+func TestDecryptTamperedCiphertext(t *testing.T) {
+	key := DeriveKey("test-key")
+	plaintext := []byte("important data")
+
+	encrypted, err := Encrypt(plaintext, key)
+	if err != nil {
+		t.Fatalf("Encrypt failed: %v", err)
+	}
+
+	// Tamper with the ciphertext (flip a byte after the nonce)
+	if len(encrypted) > 13 {
+		encrypted[13] ^= 0xFF
+	}
+
+	_, err = Decrypt(encrypted, key)
+	if err == nil {
+		t.Fatal("expected error when decrypting tampered ciphertext")
+	}
+}
+
+func TestEncryptEmptyPlaintext(t *testing.T) {
+	key := DeriveKey("test-key")
+	plaintext := []byte{}
+
+	encrypted, err := Encrypt(plaintext, key)
+	if err != nil {
+		t.Fatalf("Encrypt empty plaintext failed: %v", err)
+	}
+
+	decrypted, err := Decrypt(encrypted, key)
+	if err != nil {
+		t.Fatalf("Decrypt empty plaintext failed: %v", err)
+	}
+
+	if !bytes.Equal(decrypted, plaintext) {
+		t.Fatalf("empty plaintext round-trip failed: got %q", decrypted)
+	}
+}
+
+func TestEncryptInvalidKeyLength(t *testing.T) {
+	_, err := Encrypt([]byte("data"), []byte("short-key"))
+	if err == nil {
+		t.Fatal("expected error for invalid key length")
+	}
+}
+
+func TestDecryptInvalidKeyLength(t *testing.T) {
+	_, err := Decrypt([]byte("some-ciphertext-data"), []byte("short-key"))
+	if err == nil {
+		t.Fatal("expected error for invalid key length")
+	}
+}
+
+func TestDecryptTooShortCiphertext(t *testing.T) {
+	key := DeriveKey("test-key")
+	_, err := Decrypt([]byte("short"), key)
+	if err == nil {
+		t.Fatal("expected error for too-short ciphertext")
+	}
+}
+
+func TestDeriveKeyDeterministic(t *testing.T) {
+	key1 := DeriveKey("same-passphrase")
+	key2 := DeriveKey("same-passphrase")
+	if !bytes.Equal(key1, key2) {
+		t.Fatal("DeriveKey should be deterministic")
+	}
+	if len(key1) != 32 {
+		t.Fatalf("DeriveKey should return 32 bytes, got %d", len(key1))
+	}
+}
+
+func TestDeriveKeyDifferentPassphrases(t *testing.T) {
+	key1 := DeriveKey("passphrase-one")
+	key2 := DeriveKey("passphrase-two")
+	if bytes.Equal(key1, key2) {
+		t.Fatal("different passphrases should produce different keys")
+	}
+}
+
+func TestEncryptIfKeySet_WithKey(t *testing.T) {
+	key := DeriveKey("test-key")
+	plaintext := []byte("config data")
+
+	result, wasEncrypted, err := EncryptIfKeySet(plaintext, key)
+	if err != nil {
+		t.Fatalf("EncryptIfKeySet failed: %v", err)
+	}
+	if !wasEncrypted {
+		t.Fatal("expected wasEncrypted=true when key provided")
+	}
+	if bytes.Equal(result, plaintext) {
+		t.Fatal("result should be encrypted")
+	}
+
+	decrypted, err := DecryptIfKeySet(result, key)
+	if err != nil {
+		t.Fatalf("DecryptIfKeySet failed: %v", err)
+	}
+	if !bytes.Equal(decrypted, plaintext) {
+		t.Fatalf("round-trip failed: got %q", decrypted)
+	}
+}
+
+func TestEncryptIfKeySet_NilKey(t *testing.T) {
+	plaintext := []byte("config data")
+
+	result, wasEncrypted, err := EncryptIfKeySet(plaintext, nil)
+	if err != nil {
+		t.Fatalf("EncryptIfKeySet with nil key failed: %v", err)
+	}
+	if wasEncrypted {
+		t.Fatal("expected wasEncrypted=false when key is nil")
+	}
+	if !bytes.Equal(result, plaintext) {
+		t.Fatal("result should be unchanged plaintext when key is nil")
+	}
+}
+
+func TestDecryptIfKeySet_NilKey(t *testing.T) {
+	data := []byte("plaintext config data")
+
+	result, err := DecryptIfKeySet(data, nil)
+	if err != nil {
+		t.Fatalf("DecryptIfKeySet with nil key failed: %v", err)
+	}
+	if !bytes.Equal(result, data) {
+		t.Fatal("result should be unchanged when key is nil")
+	}
+}
+
+func TestEncryptProducesDifferentCiphertexts(t *testing.T) {
+	key := DeriveKey("test-key")
+	plaintext := []byte("same data")
+
+	enc1, _ := Encrypt(plaintext, key)
+	enc2, _ := Encrypt(plaintext, key)
+
+	if bytes.Equal(enc1, enc2) {
+		t.Fatal("encrypting same plaintext twice should produce different ciphertexts (random nonce)")
+	}
+}

internal/domain/connector.go

@@ -7,25 +7,33 @@ import (
 
 // Issuer represents a certificate authority or ACME provider.
 type Issuer struct {
-	ID        string          `json:"id"`
-	Name      string          `json:"name"`
-	Type      IssuerType      `json:"type"`
-	Config    json.RawMessage `json:"config"`
-	Enabled   bool            `json:"enabled"`
-	CreatedAt time.Time       `json:"created_at"`
-	UpdatedAt time.Time       `json:"updated_at"`
+	ID              string          `json:"id"`
+	Name            string          `json:"name"`
+	Type            IssuerType      `json:"type"`
+	Config          json.RawMessage `json:"config"`
+	EncryptedConfig []byte          `json:"-"`                         // AES-GCM encrypted full config (never exposed via API)
+	Enabled         bool            `json:"enabled"`
+	LastTestedAt    *time.Time      `json:"last_tested_at,omitempty"`
+	TestStatus      string          `json:"test_status,omitempty"`
+	Source          string          `json:"source,omitempty"`
+	CreatedAt       time.Time       `json:"created_at"`
+	UpdatedAt       time.Time       `json:"updated_at"`
 }
 
 // DeploymentTarget represents a target system where certificates are deployed.
 type DeploymentTarget struct {
-	ID        string          `json:"id"`
-	Name      string          `json:"name"`
-	Type      TargetType      `json:"type"`
-	AgentID   string          `json:"agent_id"`
-	Config    json.RawMessage `json:"config"`
-	Enabled   bool            `json:"enabled"`
-	CreatedAt time.Time       `json:"created_at"`
-	UpdatedAt time.Time       `json:"updated_at"`
+	ID              string          `json:"id"`
+	Name            string          `json:"name"`
+	Type            TargetType      `json:"type"`
+	AgentID         string          `json:"agent_id"`
+	Config          json.RawMessage `json:"config"`
+	EncryptedConfig []byte          `json:"-"`                         // AES-GCM encrypted full config (never exposed via API)
+	Enabled         bool            `json:"enabled"`
+	LastTestedAt    *time.Time      `json:"last_tested_at,omitempty"`
+	TestStatus      string          `json:"test_status,omitempty"`
+	Source          string          `json:"source,omitempty"`
+	CreatedAt       time.Time       `json:"created_at"`
+	UpdatedAt       time.Time       `json:"updated_at"`
 }
 
 // Agent represents an agent running on a target system.

internal/integration/lifecycle_test.go

@@ -43,9 +43,8 @@ func TestCertificateLifecycle(t *testing.T) {
 	localCA := local.New(nil, logger)
 
 	// Build issuer registry with adapter
-	issuerRegistry := map[string]service.IssuerConnector{
-		"iss-local": service.NewIssuerConnectorAdapter(localCA),
-	}
+	issuerRegistry := service.NewIssuerRegistry(logger)
+	issuerRegistry.Set("iss-local", service.NewIssuerConnectorAdapter(localCA))
 
 	// Initialize services (following dependency graph)
 	auditService := service.NewAuditService(auditRepo)
@@ -67,7 +66,7 @@ func TestCertificateLifecycle(t *testing.T) {
 	deploymentService := service.NewDeploymentService(jobRepo, targetRepo, agentRepo, certRepo, auditService, notificationService)
 	jobService := service.NewJobService(jobRepo, renewalService, deploymentService, logger)
 	agentService := service.NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, renewalService)
-	issuerService := service.NewIssuerService(issuerRepo, auditService)
+	issuerService := service.NewIssuerService(issuerRepo, auditService, issuerRegistry, nil, slog.Default())
 
 	// Initialize handlers
 	certificateHandler := handler.NewCertificateHandler(certificateService)
@@ -90,7 +89,8 @@ func TestCertificateLifecycle(t *testing.T) {
 	verificationHandler := handler.NewVerificationHandler(&mockVerificationService{})
 
 	// EST handler — uses real Local CA issuer via ESTService
-	estService := service.NewESTService("iss-local", issuerRegistry["iss-local"], auditService, logger)
+	localCAConnector, _ := issuerRegistry.Get("iss-local")
+	estService := service.NewESTService("iss-local", localCAConnector, auditService, logger)
 	estHandler := handler.NewESTHandler(estService)
 
 	// Create router and register handlers
@@ -786,6 +786,14 @@ func (m *mockTargetRepository) Create(ctx context.Context, target *domain.Deploy
 	return nil
 }
 
+func (m *mockTargetRepository) CreateIfNotExists(ctx context.Context, target *domain.DeploymentTarget) (bool, error) {
+	if _, exists := m.targets[target.ID]; exists {
+		return false, nil
+	}
+	m.targets[target.ID] = target
+	return true, nil
+}
+
 func (m *mockTargetRepository) Update(ctx context.Context, target *domain.DeploymentTarget) error {
 	m.targets[target.ID] = target
 	return nil
@@ -954,6 +962,14 @@ func (m *mockIssuerRepository) Update(ctx context.Context, issuer *domain.Issuer
 	return nil
 }
 
+func (m *mockIssuerRepository) CreateIfNotExists(ctx context.Context, issuer *domain.Issuer) (bool, error) {
+	if _, exists := m.issuers[issuer.ID]; exists {
+		return false, nil
+	}
+	m.issuers[issuer.ID] = issuer
+	return true, nil
+}
+
 func (m *mockIssuerRepository) Delete(ctx context.Context, id string) error {
 	delete(m.issuers, id)
 	return nil
@@ -1001,6 +1017,10 @@ func (m *mockTargetService) DeleteTarget(id string) error {
 	return m.targetRepo.Delete(context.Background(), id)
 }
 
+func (m *mockTargetService) TestTargetConnection(id string) error {
+	return nil // No-op for integration tests
+}
+
 type mockTeamService struct{}
 
 func (m *mockTeamService) ListTeams(page, perPage int) ([]domain.Team, int64, error) {

internal/integration/negative_test.go

@@ -36,9 +36,8 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 	logger := slog.New(slog.NewTextHandler(io.Discard, nil))
 	localCA := local.New(nil, logger)
 
-	issuerRegistry := map[string]service.IssuerConnector{
-		"iss-local": service.NewIssuerConnectorAdapter(localCA),
-	}
+	issuerRegistry := service.NewIssuerRegistry(logger)
+	issuerRegistry.Set("iss-local", service.NewIssuerConnectorAdapter(localCA))
 
 	revocationRepo := newMockRevocationRepository()
 
@@ -59,7 +58,7 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 	deploymentService := service.NewDeploymentService(jobRepo, targetRepo, agentRepo, certRepo, auditService, notificationService)
 	jobService := service.NewJobService(jobRepo, renewalService, deploymentService, logger)
 	agentService := service.NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, renewalService)
-	issuerService := service.NewIssuerService(issuerRepo, auditService)
+	issuerService := service.NewIssuerService(issuerRepo, auditService, issuerRegistry, nil, logger)
 
 	certificateHandler := handler.NewCertificateHandler(certificateService)
 	issuerHandler := handler.NewIssuerHandler(issuerService)
@@ -81,7 +80,8 @@ func setupTestServer(t *testing.T) (*httptest.Server, *mockCertificateRepository
 	verificationHandler := handler.NewVerificationHandler(&mockVerificationService{})
 
 	// EST handler — uses real Local CA issuer via ESTService
-	estService := service.NewESTService("iss-local", issuerRegistry["iss-local"], auditService, logger)
+	localCAConnector, _ := issuerRegistry.Get("iss-local")
+	estService := service.NewESTService("iss-local", localCAConnector, auditService, logger)
 	estHandler := handler.NewESTHandler(estService)
 
 	r := router.New()

internal/repository/interfaces.go

@@ -51,6 +51,9 @@ type IssuerRepository interface {
 	Get(ctx context.Context, id string) (*domain.Issuer, error)
 	// Create stores a new issuer.
 	Create(ctx context.Context, issuer *domain.Issuer) error
+	// CreateIfNotExists creates an issuer only if the ID doesn't already exist (ON CONFLICT DO NOTHING).
+	// Returns true if created, false if already existed.
+	CreateIfNotExists(ctx context.Context, issuer *domain.Issuer) (bool, error)
 	// Update modifies an existing issuer.
 	Update(ctx context.Context, issuer *domain.Issuer) error
 	// Delete removes an issuer.
@@ -65,6 +68,9 @@ type TargetRepository interface {
 	Get(ctx context.Context, id string) (*domain.DeploymentTarget, error)
 	// Create stores a new target.
 	Create(ctx context.Context, target *domain.DeploymentTarget) error
+	// CreateIfNotExists creates a target only if the ID doesn't already exist (ON CONFLICT DO NOTHING).
+	// Returns true if created, false if already existed.
+	CreateIfNotExists(ctx context.Context, target *domain.DeploymentTarget) (bool, error)
 	// Update modifies an existing target.
 	Update(ctx context.Context, target *domain.DeploymentTarget) error
 	// Delete removes a target.

internal/repository/postgres/issuer.go

@@ -22,7 +22,9 @@ func NewIssuerRepository(db *sql.DB) *IssuerRepository {
 // List returns all issuers
 func (r *IssuerRepository) List(ctx context.Context) ([]*domain.Issuer, error) {
 	rows, err := r.db.QueryContext(ctx, `
-		SELECT id, name, type, config, enabled, created_at, updated_at
+		SELECT id, name, type, config, COALESCE(encrypted_config, NULL), enabled,
+		       last_tested_at, COALESCE(test_status, 'untested'), COALESCE(source, 'database'),
+		       created_at, updated_at
 		FROM issuers
 		ORDER BY created_at DESC
 	`)
@@ -36,7 +38,9 @@ func (r *IssuerRepository) List(ctx context.Context) ([]*domain.Issuer, error) {
 	for rows.Next() {
 		var issuer domain.Issuer
 		if err := rows.Scan(&issuer.ID, &issuer.Name, &issuer.Type, &issuer.Config,
-			&issuer.Enabled, &issuer.CreatedAt, &issuer.UpdatedAt); err != nil {
+			&issuer.EncryptedConfig, &issuer.Enabled,
+			&issuer.LastTestedAt, &issuer.TestStatus, &issuer.Source,
+			&issuer.CreatedAt, &issuer.UpdatedAt); err != nil {
 			return nil, fmt.Errorf("failed to scan issuer: %w", err)
 		}
 		issuers = append(issuers, &issuer)
@@ -53,11 +57,15 @@ func (r *IssuerRepository) List(ctx context.Context) ([]*domain.Issuer, error) {
 func (r *IssuerRepository) Get(ctx context.Context, id string) (*domain.Issuer, error) {
 	var issuer domain.Issuer
 	err := r.db.QueryRowContext(ctx, `
-		SELECT id, name, type, config, enabled, created_at, updated_at
+		SELECT id, name, type, config, COALESCE(encrypted_config, NULL), enabled,
+		       last_tested_at, COALESCE(test_status, 'untested'), COALESCE(source, 'database'),
+		       created_at, updated_at
 		FROM issuers
 		WHERE id = $1
 	`, id).Scan(&issuer.ID, &issuer.Name, &issuer.Type, &issuer.Config,
-		&issuer.Enabled, &issuer.CreatedAt, &issuer.UpdatedAt)
+		&issuer.EncryptedConfig, &issuer.Enabled,
+		&issuer.LastTestedAt, &issuer.TestStatus, &issuer.Source,
+		&issuer.CreatedAt, &issuer.UpdatedAt)
 
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -75,11 +83,22 @@ func (r *IssuerRepository) Create(ctx context.Context, issuer *domain.Issuer) er
 		issuer.ID = uuid.New().String()
 	}
 
+	source := issuer.Source
+	if source == "" {
+		source = "database"
+	}
+	testStatus := issuer.TestStatus
+	if testStatus == "" {
+		testStatus = "untested"
+	}
+
 	err := r.db.QueryRowContext(ctx, `
-		INSERT INTO issuers (id, name, type, config, enabled, created_at, updated_at)
-		VALUES ($1, $2, $3, $4, $5, $6, $7)
+		INSERT INTO issuers (id, name, type, config, encrypted_config, enabled,
+		                     last_tested_at, test_status, source, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
 		RETURNING id
-	`, issuer.ID, issuer.Name, issuer.Type, issuer.Config, issuer.Enabled,
+	`, issuer.ID, issuer.Name, issuer.Type, issuer.Config, issuer.EncryptedConfig,
+		issuer.Enabled, issuer.LastTestedAt, testStatus, source,
 		issuer.CreatedAt, issuer.UpdatedAt).Scan(&issuer.ID)
 
 	if err != nil {
@@ -89,6 +108,40 @@ func (r *IssuerRepository) Create(ctx context.Context, issuer *domain.Issuer) er
 	return nil
 }
 
+// CreateIfNotExists creates an issuer only if the ID doesn't already exist.
+// Used for env var seeding on first boot. Returns true if created, false if already existed.
+func (r *IssuerRepository) CreateIfNotExists(ctx context.Context, issuer *domain.Issuer) (bool, error) {
+	source := issuer.Source
+	if source == "" {
+		source = "env"
+	}
+	testStatus := issuer.TestStatus
+	if testStatus == "" {
+		testStatus = "untested"
+	}
+
+	var id string
+	err := r.db.QueryRowContext(ctx, `
+		INSERT INTO issuers (id, name, type, config, encrypted_config, enabled,
+		                     last_tested_at, test_status, source, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+		ON CONFLICT (id) DO NOTHING
+		RETURNING id
+	`, issuer.ID, issuer.Name, issuer.Type, issuer.Config, issuer.EncryptedConfig,
+		issuer.Enabled, issuer.LastTestedAt, testStatus, source,
+		issuer.CreatedAt, issuer.UpdatedAt).Scan(&id)
+
+	if err != nil {
+		if err == sql.ErrNoRows {
+			// ON CONFLICT DO NOTHING — row already existed
+			return false, nil
+		}
+		return false, fmt.Errorf("failed to create issuer: %w", err)
+	}
+
+	return true, nil
+}
+
 // Update modifies an existing issuer
 func (r *IssuerRepository) Update(ctx context.Context, issuer *domain.Issuer) error {
 	result, err := r.db.ExecContext(ctx, `
@@ -96,10 +149,15 @@ func (r *IssuerRepository) Update(ctx context.Context, issuer *domain.Issuer) er
 			name = $1,
 			type = $2,
 			config = $3,
-			enabled = $4,
-			updated_at = $5
-		WHERE id = $6
-	`, issuer.Name, issuer.Type, issuer.Config, issuer.Enabled, issuer.UpdatedAt, issuer.ID)
+			encrypted_config = $4,
+			enabled = $5,
+			last_tested_at = $6,
+			test_status = $7,
+			updated_at = $8
+		WHERE id = $9
+	`, issuer.Name, issuer.Type, issuer.Config, issuer.EncryptedConfig,
+		issuer.Enabled, issuer.LastTestedAt, issuer.TestStatus,
+		issuer.UpdatedAt, issuer.ID)
 
 	if err != nil {
 		return fmt.Errorf("failed to update issuer: %w", err)

internal/repository/postgres/target.go

@@ -19,10 +19,40 @@ func NewTargetRepository(db *sql.DB) *TargetRepository {
 	return &TargetRepository{db: db}
 }
 
+// scanTarget scans a target row including optional M35 columns (encrypted_config, last_tested_at, test_status, source).
+func scanTarget(scanner interface {
+	Scan(dest ...interface{}) error
+}, target *domain.DeploymentTarget) error {
+	var lastTestedAt sql.NullTime
+	var testStatus sql.NullString
+	var source sql.NullString
+	if err := scanner.Scan(
+		&target.ID, &target.Name, &target.Type, &target.AgentID,
+		&target.Config, &target.EncryptedConfig, &target.Enabled,
+		&lastTestedAt, &testStatus, &source,
+		&target.CreatedAt, &target.UpdatedAt,
+	); err != nil {
+		return err
+	}
+	if lastTestedAt.Valid {
+		target.LastTestedAt = &lastTestedAt.Time
+	}
+	if testStatus.Valid {
+		target.TestStatus = testStatus.String
+	}
+	if source.Valid {
+		target.Source = source.String
+	}
+	return nil
+}
+
+// targetSelectColumns is the standard column list for target queries.
+const targetSelectColumns = `id, name, type, agent_id, config, COALESCE(encrypted_config, ''::bytea), enabled, last_tested_at, COALESCE(test_status, 'untested'), COALESCE(source, 'database'), created_at, updated_at`
+
 // List returns all targets
 func (r *TargetRepository) List(ctx context.Context) ([]*domain.DeploymentTarget, error) {
 	rows, err := r.db.QueryContext(ctx, `
-		SELECT id, name, type, agent_id, config, enabled, created_at, updated_at
+		SELECT `+targetSelectColumns+`
 		FROM deployment_targets
 		ORDER BY created_at DESC
 	`)
@@ -35,8 +65,7 @@ func (r *TargetRepository) List(ctx context.Context) ([]*domain.DeploymentTarget
 	var targets []*domain.DeploymentTarget
 	for rows.Next() {
 		var target domain.DeploymentTarget
-		if err := rows.Scan(&target.ID, &target.Name, &target.Type, &target.AgentID,
-			&target.Config, &target.Enabled, &target.CreatedAt, &target.UpdatedAt); err != nil {
+		if err := scanTarget(rows, &target); err != nil {
 			return nil, fmt.Errorf("failed to scan target: %w", err)
 		}
 		targets = append(targets, &target)
@@ -52,12 +81,11 @@ func (r *TargetRepository) List(ctx context.Context) ([]*domain.DeploymentTarget
 // Get retrieves a target by ID
 func (r *TargetRepository) Get(ctx context.Context, id string) (*domain.DeploymentTarget, error) {
 	var target domain.DeploymentTarget
-	err := r.db.QueryRowContext(ctx, `
-		SELECT id, name, type, agent_id, config, enabled, created_at, updated_at
+	err := scanTarget(r.db.QueryRowContext(ctx, `
+		SELECT `+targetSelectColumns+`
 		FROM deployment_targets
 		WHERE id = $1
-	`, id).Scan(&target.ID, &target.Name, &target.Type, &target.AgentID,
-		&target.Config, &target.Enabled, &target.CreatedAt, &target.UpdatedAt)
+	`, id), &target)
 
 	if err != nil {
 		if err == sql.ErrNoRows {
@@ -76,10 +104,11 @@ func (r *TargetRepository) Create(ctx context.Context, target *domain.Deployment
 	}
 
 	err := r.db.QueryRowContext(ctx, `
-		INSERT INTO deployment_targets (id, name, type, agent_id, config, enabled, created_at, updated_at)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+		INSERT INTO deployment_targets (id, name, type, agent_id, config, encrypted_config, enabled, last_tested_at, test_status, source, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
 		RETURNING id
-	`, target.ID, target.Name, target.Type, target.AgentID, target.Config, target.Enabled,
+	`, target.ID, target.Name, target.Type, target.AgentID, target.Config, target.EncryptedConfig,
+		target.Enabled, target.LastTestedAt, target.TestStatus, target.Source,
 		target.CreatedAt, target.UpdatedAt).Scan(&target.ID)
 
 	if err != nil {
@@ -89,6 +118,33 @@ func (r *TargetRepository) Create(ctx context.Context, target *domain.Deployment
 	return nil
 }
 
+// CreateIfNotExists creates a target only if the ID doesn't already exist (ON CONFLICT DO NOTHING).
+// Returns true if created, false if already existed.
+func (r *TargetRepository) CreateIfNotExists(ctx context.Context, target *domain.DeploymentTarget) (bool, error) {
+	if target.ID == "" {
+		target.ID = uuid.New().String()
+	}
+
+	result, err := r.db.ExecContext(ctx, `
+		INSERT INTO deployment_targets (id, name, type, agent_id, config, encrypted_config, enabled, last_tested_at, test_status, source, created_at, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+		ON CONFLICT (id) DO NOTHING
+	`, target.ID, target.Name, target.Type, target.AgentID, target.Config, target.EncryptedConfig,
+		target.Enabled, target.LastTestedAt, target.TestStatus, target.Source,
+		target.CreatedAt, target.UpdatedAt)
+
+	if err != nil {
+		return false, fmt.Errorf("failed to create target: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	return rows > 0, nil
+}
+
 // Update modifies an existing target
 func (r *TargetRepository) Update(ctx context.Context, target *domain.DeploymentTarget) error {
 	result, err := r.db.ExecContext(ctx, `
@@ -97,10 +153,16 @@ func (r *TargetRepository) Update(ctx context.Context, target *domain.Deployment
 			type = $2,
 			agent_id = $3,
 			config = $4,
-			enabled = $5,
-			updated_at = $6
-		WHERE id = $7
-	`, target.Name, target.Type, target.AgentID, target.Config, target.Enabled, target.UpdatedAt, target.ID)
+			encrypted_config = $5,
+			enabled = $6,
+			last_tested_at = $7,
+			test_status = $8,
+			source = $9,
+			updated_at = $10
+		WHERE id = $11
+	`, target.Name, target.Type, target.AgentID, target.Config, target.EncryptedConfig,
+		target.Enabled, target.LastTestedAt, target.TestStatus, target.Source,
+		target.UpdatedAt, target.ID)
 
 	if err != nil {
 		return fmt.Errorf("failed to update target: %w", err)
@@ -141,7 +203,7 @@ func (r *TargetRepository) Delete(ctx context.Context, id string) error {
 // ListByCertificate returns all targets for a given certificate
 func (r *TargetRepository) ListByCertificate(ctx context.Context, certID string) ([]*domain.DeploymentTarget, error) {
 	rows, err := r.db.QueryContext(ctx, `
-		SELECT dt.id, dt.name, dt.type, dt.agent_id, dt.config, dt.enabled, dt.created_at, dt.updated_at
+		SELECT dt.id, dt.name, dt.type, dt.agent_id, dt.config, COALESCE(dt.encrypted_config, ''::bytea), dt.enabled, dt.last_tested_at, COALESCE(dt.test_status, 'untested'), COALESCE(dt.source, 'database'), dt.created_at, dt.updated_at
 		FROM deployment_targets dt
 		INNER JOIN certificate_target_mappings ctm ON dt.id = ctm.target_id
 		WHERE ctm.certificate_id = $1
@@ -156,8 +218,7 @@ func (r *TargetRepository) ListByCertificate(ctx context.Context, certID string)
 	var targets []*domain.DeploymentTarget
 	for rows.Next() {
 		var target domain.DeploymentTarget
-		if err := rows.Scan(&target.ID, &target.Name, &target.Type, &target.AgentID,
-			&target.Config, &target.Enabled, &target.CreatedAt, &target.UpdatedAt); err != nil {
+		if err := scanTarget(rows, &target); err != nil {
 			return nil, fmt.Errorf("failed to scan target: %w", err)
 		}
 		targets = append(targets, &target)

internal/service/agent.go

@@ -21,7 +21,7 @@ type AgentService struct {
 	targetRepo     repository.TargetRepository
 	profileRepo    repository.CertificateProfileRepository
 	auditService   *AuditService
-	issuerRegistry map[string]IssuerConnector
+	issuerRegistry *IssuerRegistry
 	renewalService *RenewalService
 }
 
@@ -32,7 +32,7 @@ func NewAgentService(
 	jobRepo repository.JobRepository,
 	targetRepo repository.TargetRepository,
 	auditService *AuditService,
-	issuerRegistry map[string]IssuerConnector,
+	issuerRegistry *IssuerRegistry,
 	renewalService *RenewalService,
 ) *AgentService {
 	return &AgentService{
@@ -163,7 +163,7 @@ func (s *AgentService) SubmitCSR(ctx context.Context, agentID string, certID str
 		}
 
 		// Fallback: direct issuer signing (no AwaitingCSR job — ad-hoc CSR submission)
-		connector, ok := s.issuerRegistry[cert.IssuerID]
+		connector, ok := s.issuerRegistry.Get(cert.IssuerID)
 		if ok {
 			// Resolve EKUs from the certificate profile if available
 			var ekus []string

internal/service/agent_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -28,7 +29,7 @@ func TestRegisterAgent(t *testing.T) {
 	auditRepo := &mockAuditRepo{Events: []*domain.AuditEvent{}}
 	auditService := NewAuditService(auditRepo)
 
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -85,7 +86,7 @@ func TestHeartbeat(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -118,7 +119,7 @@ func TestHeartbeat_NotFound(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -175,7 +176,7 @@ func TestGetPendingWork(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -217,7 +218,8 @@ func TestGetPendingWork_OnlyReturnsAgentJobs(t *testing.T) {
 	targetRepo := &mockTargetRepo{Targets: make(map[string]*domain.DeploymentTarget)}
 	auditService := NewAuditService(&mockAuditRepo{})
 
-	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, make(map[string]IssuerConnector), nil)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
 	// Agent A should only see its job
 	jobsA, err := agentService.GetPendingWork(ctx, agentA)
@@ -268,7 +270,8 @@ func TestGetPendingWork_EmptyWhenNoJobsForAgent(t *testing.T) {
 	targetRepo := &mockTargetRepo{Targets: make(map[string]*domain.DeploymentTarget)}
 	auditService := NewAuditService(&mockAuditRepo{})
 
-	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, make(map[string]IssuerConnector), nil)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
 	jobs, err := agentService.GetPendingWork(ctx, agentA)
 	if err != nil {
@@ -302,7 +305,8 @@ func TestGetPendingWork_DeploymentAndCSR_Scoped(t *testing.T) {
 	targetRepo := &mockTargetRepo{Targets: make(map[string]*domain.DeploymentTarget)}
 	auditService := NewAuditService(&mockAuditRepo{})
 
-	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, make(map[string]IssuerConnector), nil)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
 	jobs, err := agentService.GetPendingWork(ctx, agentA)
 	if err != nil {
@@ -350,7 +354,7 @@ func TestReportJobStatus(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{Events: []*domain.AuditEvent{}}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -409,7 +413,7 @@ func TestMarkStaleAgentsOffline(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -475,7 +479,8 @@ func TestSubmitCSR(t *testing.T) {
 			NotAfter:  now.AddDate(1, 0, 0),
 		},
 	}
-	issuerRegistry := map[string]IssuerConnector{"iss-local": issuerConnector}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-local", issuerConnector)
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -524,7 +529,7 @@ func TestSubmitCSR_EmptyCSR(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 
@@ -572,7 +577,7 @@ func TestListAgents(t *testing.T) {
 	}
 	auditRepo := &mockAuditRepo{}
 	auditService := NewAuditService(auditRepo)
-	issuerRegistry := make(map[string]IssuerConnector)
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	agentService := NewAgentService(agentRepo, certRepo, jobRepo, targetRepo, auditService, issuerRegistry, nil)
 

internal/service/ca_operations.go

@@ -18,7 +18,7 @@ type CAOperationsSvc struct {
 	revocationRepo repository.RevocationRepository
 	certRepo       repository.CertificateRepository
 	profileRepo    repository.CertificateProfileRepository
-	issuerRegistry map[string]IssuerConnector
+	issuerRegistry *IssuerRegistry
 }
 
 // NewCAOperationsSvc creates a new CA operations service.
@@ -35,7 +35,7 @@ func NewCAOperationsSvc(
 }
 
 // SetIssuerRegistry sets the issuer registry for CRL and OCSP operations.
-func (s *CAOperationsSvc) SetIssuerRegistry(registry map[string]IssuerConnector) {
+func (s *CAOperationsSvc) SetIssuerRegistry(registry *IssuerRegistry) {
 	s.issuerRegistry = registry
 }
 
@@ -49,7 +49,7 @@ func (s *CAOperationsSvc) GenerateDERCRL(issuerID string) ([]byte, error) {
 		return nil, fmt.Errorf("issuer registry not configured")
 	}
 
-	issuerConn, ok := s.issuerRegistry[issuerID]
+	issuerConn, ok := s.issuerRegistry.Get(issuerID)
 	if !ok {
 		return nil, fmt.Errorf("issuer not found: %s", issuerID)
 	}
@@ -104,7 +104,7 @@ func (s *CAOperationsSvc) GetOCSPResponse(issuerID string, serialHex string) ([]
 		return nil, fmt.Errorf("issuer registry not configured")
 	}
 
-	issuerConn, ok := s.issuerRegistry[issuerID]
+	issuerConn, ok := s.issuerRegistry.Get(issuerID)
 	if !ok {
 		return nil, fmt.Errorf("issuer not found: %s", issuerID)
 	}

internal/service/ca_operations_test.go

@@ -3,6 +3,7 @@
 package service
 
 import (
+	"log/slog"
 	"testing"
 	"time"
 
@@ -16,9 +17,9 @@ func newCAOperationsSvcTest() (*CAOperationsSvc, *mockRevocationRepo, *mockCertR
 	profileRepo := newMockProfileRepository()
 
 	caSvc := NewCAOperationsSvc(revocationRepo, certRepo, profileRepo)
-	caSvc.SetIssuerRegistry(map[string]IssuerConnector{
-		"iss-local": &mockIssuerConnector{},
-	})
+	registry := NewIssuerRegistry(slog.Default())
+	registry.Set("iss-local", &mockIssuerConnector{})
+	caSvc.SetIssuerRegistry(registry)
 
 	return caSvc, revocationRepo, certRepo
 }

internal/service/concurrent_test.go

@@ -3,6 +3,8 @@ package service
 import (
 	"context"
 	"fmt"
+	"log/slog"
+	"os"
 	"sync"
 	"testing"
 
@@ -130,13 +132,14 @@ func TestConcurrentAgentHeartbeats(t *testing.T) {
 		mockAgentRepo.AddAgent(agent)
 	}
 
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 	agentSvc := NewAgentService(
 		mockAgentRepo,
 		nil, // certRepo
 		nil, // jobRepo
 		nil, // targetRepo
 		nil, // auditService
-		make(map[string]IssuerConnector),
+		issuerRegistry,
 		nil, // renewalService
 	)
 
@@ -191,7 +194,7 @@ func TestConcurrentTargetCRUD(t *testing.T) {
 		Targets: make(map[string]*domain.DeploymentTarget),
 	}
 
-	targetSvc := NewTargetService(mockTargetRepo, nil)
+	targetSvc := NewTargetService(mockTargetRepo, nil, nil, nil, slog.New(slog.NewTextHandler(os.Stderr, nil)))
 
 	var mu sync.Mutex
 	createdTargets := make([]string, 0)
@@ -400,7 +403,7 @@ func TestConcurrentMixedOperations(t *testing.T) {
 	// Setup services
 	auditSvc := &AuditService{auditRepo: mockAuditRepo}
 	certSvc := NewCertificateService(mockCertRepo, nil, auditSvc)
-	targetSvc := NewTargetService(mockTargetRepo, auditSvc)
+	targetSvc := NewTargetService(mockTargetRepo, auditSvc, nil, nil, slog.New(slog.NewTextHandler(os.Stderr, nil)))
 
 	var wg sync.WaitGroup
 	errChan := make(chan error, 30)

internal/service/config_helpers.go

@@ -0,0 +1,42 @@
+package service
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+// sensitiveKeys are config key substrings that should be redacted in API responses.
+var sensitiveKeys = []string{"password", "secret", "token", "key", "hmac", "private", "credentials"}
+
+// isSensitiveConfigKey checks if a config key contains sensitive substrings.
+func isSensitiveConfigKey(key string) bool {
+	lower := strings.ToLower(key)
+	for _, s := range sensitiveKeys {
+		if strings.Contains(lower, s) {
+			return true
+		}
+	}
+	return false
+}
+
+// redactConfigJSON replaces sensitive values in a JSON config with "********".
+func redactConfigJSON(configJSON json.RawMessage) json.RawMessage {
+	var m map[string]interface{}
+	if err := json.Unmarshal(configJSON, &m); err != nil {
+		return configJSON // Not a JSON object, return as-is
+	}
+
+	for k, v := range m {
+		if isSensitiveConfigKey(k) {
+			if str, ok := v.(string); ok && str != "" {
+				m[k] = "********"
+			}
+		}
+	}
+
+	redacted, err := json.Marshal(m)
+	if err != nil {
+		return configJSON
+	}
+	return json.RawMessage(redacted)
+}

internal/service/context_test.go

@@ -2,6 +2,8 @@ package service
 
 import (
 	"context"
+	"log/slog"
+	"os"
 	"testing"
 	"time"
 
@@ -66,6 +68,7 @@ func TestRenewalService_ProcessWithCancelledContext(t *testing.T) {
 		notifierRegistry: make(map[string]Notifier),
 	}
 
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 	renewalSvc := NewRenewalService(
 		mockCertRepo,
 		mockJobRepo,
@@ -73,7 +76,7 @@ func TestRenewalService_ProcessWithCancelledContext(t *testing.T) {
 		mockProfileRepo,
 		mockAuditSvc,
 		mockNotifSvc,
-		make(map[string]IssuerConnector),
+		issuerRegistry,
 		"agent",
 	)
 
@@ -139,7 +142,7 @@ func TestTargetService_ListWithCancelledContext(t *testing.T) {
 	mockTargetRepo := &mockTargetRepo{
 		Targets: make(map[string]*domain.DeploymentTarget),
 	}
-	targetSvc := NewTargetService(mockTargetRepo, nil)
+	targetSvc := NewTargetService(mockTargetRepo, nil, nil, nil, slog.New(slog.NewTextHandler(os.Stderr, nil)))
 
 	_, _, err := targetSvc.List(ctx, 1, 50)
 
@@ -162,13 +165,14 @@ func TestAgentService_HeartbeatWithCancelledContext(t *testing.T) {
 		Hostname: "localhost",
 	})
 
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 	agentSvc := NewAgentService(
 		mockAgentRepo,
 		nil, // certRepo
 		nil, // jobRepo
 		nil, // targetRepo
 		nil, // auditService
-		make(map[string]IssuerConnector),
+		issuerRegistry,
 		nil, // renewalService
 	)
 
@@ -212,13 +216,14 @@ func TestAgentService_HeartbeatWithDeadlineExceeded(t *testing.T) {
 		Hostname: "localhost",
 	})
 
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 	agentSvc := NewAgentService(
 		mockAgentRepo,
 		nil, // certRepo
 		nil, // jobRepo
 		nil, // targetRepo
 		nil, // auditService
-		make(map[string]IssuerConnector),
+		issuerRegistry,
 		nil, // renewalService
 	)
 

internal/service/csr_renewal_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"errors"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -28,9 +29,8 @@ func newTestRenewalServiceForCSR(issuerErr error) *RenewalService {
 	})
 
 	issuerConnector := &mockIssuerConnector{Err: issuerErr}
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-local": issuerConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-local", issuerConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, profileRepo, auditSvc, notifSvc, issuerRegistry, "agent")
 	return svc

internal/service/issuer.go

@@ -2,31 +2,50 @@ package service
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log/slog"
+	"os"
 	"time"
 
+	"github.com/shankar0123/certctl/internal/config"
+	"github.com/shankar0123/certctl/internal/connector/issuerfactory"
+	"github.com/shankar0123/certctl/internal/crypto"
 	"github.com/shankar0123/certctl/internal/domain"
 	"github.com/shankar0123/certctl/internal/repository"
 )
 
 // IssuerService provides business logic for certificate issuer management.
 type IssuerService struct {
-	issuerRepo   repository.IssuerRepository
-	auditService *AuditService
+	issuerRepo    repository.IssuerRepository
+	auditService  *AuditService
+	registry      *IssuerRegistry
+	encryptionKey []byte
+	logger        *slog.Logger
 }
 
 // NewIssuerService creates a new issuer service.
 func NewIssuerService(
 	issuerRepo repository.IssuerRepository,
 	auditService *AuditService,
+	registry *IssuerRegistry,
+	encryptionKey []byte,
+	logger *slog.Logger,
 ) *IssuerService {
 	return &IssuerService{
-		issuerRepo:   issuerRepo,
-		auditService: auditService,
+		issuerRepo:    issuerRepo,
+		auditService:  auditService,
+		registry:      registry,
+		encryptionKey: encryptionKey,
+		logger:        logger,
 	}
 }
 
+// GetRegistry returns the dynamic issuer registry.
+func (s *IssuerService) GetRegistry() *IssuerRegistry {
+	return s.registry
+}
+
 // List returns a paginated list of issuers.
 func (s *IssuerService) List(ctx context.Context, page, perPage int) ([]*domain.Issuer, int64, error) {
 	if page < 1 {
@@ -61,49 +80,112 @@ func (s *IssuerService) Get(ctx context.Context, id string) (*domain.Issuer, err
 	return issuer, nil
 }
 
-// Create validates and stores a new issuer.
-func (s *IssuerService) Create(ctx context.Context, issuer *domain.Issuer, actor string) error {
-	if issuer.Name == "" {
+// validIssuerTypes is the set of allowed issuer types for validation.
+var validIssuerTypes = map[domain.IssuerType]bool{
+	domain.IssuerTypeACME:      true,
+	domain.IssuerTypeGenericCA: true,
+	domain.IssuerTypeStepCA:    true,
+	domain.IssuerTypeOpenSSL:   true,
+	domain.IssuerTypeVault:     true,
+	domain.IssuerTypeDigiCert:  true,
+	domain.IssuerTypeSectigo:   true,
+	domain.IssuerTypeGoogleCAS: true,
+}
+
+// isValidIssuerType checks if a type string is a known issuer type.
+func isValidIssuerType(t domain.IssuerType) bool {
+	return validIssuerTypes[t]
+}
+
+// Create validates and stores a new issuer, encrypting sensitive config.
+func (s *IssuerService) Create(ctx context.Context, iss *domain.Issuer, actor string) error {
+	if iss.Name == "" {
 		return fmt.Errorf("issuer name is required")
 	}
+	if !isValidIssuerType(iss.Type) {
+		return fmt.Errorf("unsupported issuer type: %s", iss.Type)
+	}
 
-	if issuer.ID == "" {
-		issuer.ID = generateID("issuer")
+	if iss.ID == "" {
+		iss.ID = generateID("issuer")
 	}
 	now := time.Now()
-	if issuer.CreatedAt.IsZero() {
-		issuer.CreatedAt = now
+	if iss.CreatedAt.IsZero() {
+		iss.CreatedAt = now
 	}
-	if issuer.UpdatedAt.IsZero() {
-		issuer.UpdatedAt = now
+	if iss.UpdatedAt.IsZero() {
+		iss.UpdatedAt = now
 	}
-	if err := s.issuerRepo.Create(ctx, issuer); err != nil {
+	if iss.TestStatus == "" {
+		iss.TestStatus = "untested"
+	}
+	if iss.Source == "" {
+		iss.Source = "database"
+	}
+
+	// Encrypt the full config and store redacted version in config column
+	if len(iss.Config) > 0 {
+		encrypted, _, err := crypto.EncryptIfKeySet([]byte(iss.Config), s.encryptionKey)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt config: %w", err)
+		}
+		iss.EncryptedConfig = encrypted
+		iss.Config = redactConfigJSON(iss.Config)
+	}
+
+	if err := s.issuerRepo.Create(ctx, iss); err != nil {
 		return fmt.Errorf("failed to create issuer: %w", err)
 	}
 
+	// Add to dynamic registry
+	if iss.Enabled {
+		s.rebuildRegistryQuiet(ctx)
+	}
+
 	if s.auditService != nil {
-		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "create_issuer", "issuer", issuer.ID, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "create_issuer", "issuer", iss.ID, nil); auditErr != nil {
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
 	return nil
 }
 
-// Update modifies an existing issuer.
-func (s *IssuerService) Update(ctx context.Context, id string, issuer *domain.Issuer, actor string) error {
-	if issuer.Name == "" {
+// Update modifies an existing issuer. Handles "********" preservation for sensitive fields.
+func (s *IssuerService) Update(ctx context.Context, id string, iss *domain.Issuer, actor string) error {
+	if iss.Name == "" {
 		return fmt.Errorf("issuer name is required")
 	}
 
-	issuer.ID = id
-	if err := s.issuerRepo.Update(ctx, issuer); err != nil {
+	iss.ID = id
+	iss.UpdatedAt = time.Now()
+
+	// If config contains "********" values, merge with existing decrypted config
+	if len(iss.Config) > 0 {
+		mergedConfig, err := s.mergeRedactedConfig(ctx, id, iss.Config)
+		if err != nil {
+			return fmt.Errorf("failed to merge config: %w", err)
+		}
+
+		// Encrypt the merged config
+		encrypted, _, encErr := crypto.EncryptIfKeySet(mergedConfig, s.encryptionKey)
+		if encErr != nil {
+			return fmt.Errorf("failed to encrypt config: %w", encErr)
+		}
+		iss.EncryptedConfig = encrypted
+		iss.Config = redactConfigJSON(json.RawMessage(mergedConfig))
+	}
+
+	if err := s.issuerRepo.Update(ctx, iss); err != nil {
 		return fmt.Errorf("failed to update issuer %s: %w", id, err)
 	}
 
+	// Rebuild registry after update
+	s.rebuildRegistryQuiet(ctx)
+
 	if s.auditService != nil {
 		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "update_issuer", "issuer", id, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
@@ -116,27 +198,48 @@ func (s *IssuerService) Delete(ctx context.Context, id string, actor string) err
 		return fmt.Errorf("failed to delete issuer %s: %w", id, err)
 	}
 
+	// Remove from registry
+	if s.registry != nil {
+		s.registry.Remove(id)
+	}
+
 	if s.auditService != nil {
 		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "delete_issuer", "issuer", id, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
 	return nil
 }
 
-// TestConnectionWithContext verifies the issuer connection with context.
+// TestConnectionWithContext tests the connection to an issuer by instantiating a throwaway
+// connector and calling ValidateConfig. Records the result in the database.
 func (s *IssuerService) TestConnectionWithContext(ctx context.Context, id string) error {
-	issuer, err := s.issuerRepo.Get(ctx, id)
+	iss, err := s.issuerRepo.Get(ctx, id)
 	if err != nil {
 		return fmt.Errorf("issuer not found: %w", err)
 	}
 
-	// TODO: Implement actual connection test based on issuer type
-	if issuer == nil {
-		return fmt.Errorf("issuer not found")
+	// Get the decrypted config
+	configJSON, err := s.getDecryptedConfig(iss)
+	if err != nil {
+		s.updateTestStatus(ctx, iss, "failed")
+		return fmt.Errorf("failed to decrypt config: %w", err)
 	}
 
+	// Instantiate a throwaway connector and validate
+	connector, err := issuerfactory.NewFromConfig(string(iss.Type), configJSON, s.logger)
+	if err != nil {
+		s.updateTestStatus(ctx, iss, "failed")
+		return fmt.Errorf("failed to create connector: %w", err)
+	}
+
+	if err := connector.ValidateConfig(ctx, configJSON); err != nil {
+		s.updateTestStatus(ctx, iss, "failed")
+		return fmt.Errorf("connection test failed: %w", err)
+	}
+
+	s.updateTestStatus(ctx, iss, "success")
 	return nil
 }
 
@@ -145,6 +248,241 @@ func (s *IssuerService) TestConnection(id string) error {
 	return s.TestConnectionWithContext(context.Background(), id)
 }
 
+// BuildRegistry loads all enabled issuers from the database and rebuilds the dynamic registry.
+// Called at server startup. Partial failures (individual issuers failing to load) are logged
+// as warnings but don't prevent the server from starting.
+func (s *IssuerService) BuildRegistry(ctx context.Context) error {
+	issuers, err := s.issuerRepo.List(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to load issuers from database: %w", err)
+	}
+
+	if err := s.registry.Rebuild(issuers, s.encryptionKey); err != nil {
+		// Log the error but don't fail — some issuers loaded successfully.
+		s.logger.Warn("issuer registry rebuilt with errors", "error", err)
+	}
+
+	s.logger.Info("issuer registry built from database", "total_issuers", len(issuers), "registry_size", s.registry.Len())
+	return nil
+}
+
+// SeedFromEnvVars creates issuer records from environment variables if the database is empty.
+// Uses ON CONFLICT DO NOTHING so GUI-created configs are never overwritten.
+func (s *IssuerService) SeedFromEnvVars(ctx context.Context, cfg *config.Config) {
+	// Check if any issuers already exist
+	existing, err := s.issuerRepo.List(ctx)
+	if err != nil {
+		s.logger.Error("failed to check existing issuers for env var seeding", "error", err)
+		return
+	}
+
+	if len(existing) > 0 {
+		s.logger.Info("issuers already exist in database, skipping env var seeding", "count", len(existing))
+		return
+	}
+
+	s.logger.Info("no issuers in database, seeding from environment variables")
+
+	seeds := s.buildEnvVarSeeds(cfg)
+	seeded := 0
+	for _, seed := range seeds {
+		// Encrypt the config if key is set
+		if len(seed.Config) > 0 {
+			encrypted, _, encErr := crypto.EncryptIfKeySet([]byte(seed.Config), s.encryptionKey)
+			if encErr != nil {
+				s.logger.Error("failed to encrypt seed config", "id", seed.ID, "error", encErr)
+				continue
+			}
+			seed.EncryptedConfig = encrypted
+			seed.Config = redactConfigJSON(seed.Config)
+		}
+
+		if err := s.issuerRepo.Create(ctx, seed); err != nil {
+			s.logger.Warn("failed to seed issuer from env var", "id", seed.ID, "error", err)
+			continue
+		}
+		seeded++
+		s.logger.Info("seeded issuer from env vars", "id", seed.ID, "type", seed.Type)
+	}
+
+	s.logger.Info("env var seeding complete", "seeded", seeded, "total_seeds", len(seeds))
+}
+
+// buildEnvVarSeeds constructs issuer domain objects from the config's env var values.
+func (s *IssuerService) buildEnvVarSeeds(cfg *config.Config) []*domain.Issuer {
+	now := time.Now()
+	var seeds []*domain.Issuer
+
+	// Local CA (always seeded)
+	seeds = append(seeds, &domain.Issuer{
+		ID:        "iss-local",
+		Name:      "Local CA",
+		Type:      domain.IssuerTypeGenericCA,
+		Config:    mustJSON(map[string]interface{}{"ca_cert_path": cfg.CA.CertPath, "ca_key_path": cfg.CA.KeyPath}),
+		Enabled:   true,
+		Source:    "env",
+		CreatedAt: now,
+		UpdatedAt: now,
+	})
+
+	// ACME (always seeded — even with empty directory URL, for demo mode)
+	seeds = append(seeds, &domain.Issuer{
+		ID:   "iss-acme-staging",
+		Name: "ACME Staging",
+		Type: domain.IssuerTypeACME,
+		Config: mustJSON(map[string]interface{}{
+			"directory_url":  cfg.ACME.DirectoryURL,
+			"email":          cfg.ACME.Email,
+			"challenge_type": cfg.ACME.ChallengeType,
+			"insecure":       cfg.ACME.Insecure,
+			"ari_enabled":    cfg.ACME.ARIEnabled,
+		}),
+		Enabled:   true,
+		Source:    "env",
+		CreatedAt: now,
+		UpdatedAt: now,
+	})
+
+	// ACME prod (same config, different ID for backward compat)
+	seeds = append(seeds, &domain.Issuer{
+		ID:   "iss-acme-prod",
+		Name: "ACME Production",
+		Type: domain.IssuerTypeACME,
+		Config: mustJSON(map[string]interface{}{
+			"directory_url":  cfg.ACME.DirectoryURL,
+			"email":          cfg.ACME.Email,
+			"challenge_type": cfg.ACME.ChallengeType,
+			"insecure":       cfg.ACME.Insecure,
+			"ari_enabled":    cfg.ACME.ARIEnabled,
+		}),
+		Enabled:   true,
+		Source:    "env",
+		CreatedAt: now,
+		UpdatedAt: now,
+	})
+
+	// Conditional: step-ca — only seed if CERTCTL_STEPCA_URL is set
+	if stepcaURL := getEnvForSeed("CERTCTL_STEPCA_URL"); stepcaURL != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-stepca",
+			Name: "step-ca",
+			Type: domain.IssuerTypeStepCA,
+			Config: mustJSON(map[string]interface{}{
+				"ca_url":               stepcaURL,
+				"root_cert_path":       getEnvForSeed("CERTCTL_STEPCA_ROOT_CERT"),
+				"provisioner_name":     getEnvForSeed("CERTCTL_STEPCA_PROVISIONER"),
+				"provisioner_key_path": getEnvForSeed("CERTCTL_STEPCA_KEY_PATH"),
+				"provisioner_password": getEnvForSeed("CERTCTL_STEPCA_PASSWORD"),
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	// Conditional: OpenSSL — only seed if sign script is set
+	if signScript := getEnvForSeed("CERTCTL_OPENSSL_SIGN_SCRIPT"); signScript != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-openssl",
+			Name: "OpenSSL/Custom CA",
+			Type: domain.IssuerTypeOpenSSL,
+			Config: mustJSON(map[string]interface{}{
+				"sign_script":   signScript,
+				"revoke_script": getEnvForSeed("CERTCTL_OPENSSL_REVOKE_SCRIPT"),
+				"crl_script":    getEnvForSeed("CERTCTL_OPENSSL_CRL_SCRIPT"),
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	// Conditional: Vault PKI
+	if cfg.Vault.Addr != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-vault",
+			Name: "Vault PKI",
+			Type: domain.IssuerTypeVault,
+			Config: mustJSON(map[string]interface{}{
+				"addr":  cfg.Vault.Addr,
+				"token": cfg.Vault.Token,
+				"mount": cfg.Vault.Mount,
+				"role":  cfg.Vault.Role,
+				"ttl":   cfg.Vault.TTL,
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	// Conditional: DigiCert
+	if cfg.DigiCert.APIKey != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-digicert",
+			Name: "DigiCert CertCentral",
+			Type: domain.IssuerTypeDigiCert,
+			Config: mustJSON(map[string]interface{}{
+				"api_key":      cfg.DigiCert.APIKey,
+				"org_id":       cfg.DigiCert.OrgID,
+				"product_type": cfg.DigiCert.ProductType,
+				"base_url":     cfg.DigiCert.BaseURL,
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	// Conditional: Sectigo
+	if cfg.Sectigo.CustomerURI != "" && cfg.Sectigo.Login != "" && cfg.Sectigo.Password != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-sectigo",
+			Name: "Sectigo SCM",
+			Type: domain.IssuerTypeSectigo,
+			Config: mustJSON(map[string]interface{}{
+				"customer_uri": cfg.Sectigo.CustomerURI,
+				"login":        cfg.Sectigo.Login,
+				"password":     cfg.Sectigo.Password,
+				"org_id":       cfg.Sectigo.OrgID,
+				"cert_type":    cfg.Sectigo.CertType,
+				"term":         cfg.Sectigo.Term,
+				"base_url":     cfg.Sectigo.BaseURL,
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	// Conditional: Google CAS
+	if cfg.GoogleCAS.Project != "" && cfg.GoogleCAS.Credentials != "" {
+		seeds = append(seeds, &domain.Issuer{
+			ID:   "iss-googlecas",
+			Name: "Google CAS",
+			Type: domain.IssuerTypeGoogleCAS,
+			Config: mustJSON(map[string]interface{}{
+				"project":     cfg.GoogleCAS.Project,
+				"location":    cfg.GoogleCAS.Location,
+				"ca_pool":     cfg.GoogleCAS.CAPool,
+				"credentials": cfg.GoogleCAS.Credentials,
+				"ttl":         cfg.GoogleCAS.TTL,
+			}),
+			Enabled:   true,
+			Source:    "env",
+			CreatedAt: now,
+			UpdatedAt: now,
+		})
+	}
+
+	return seeds
+}
+
 // ListIssuers returns paginated issuers (handler interface method).
 func (s *IssuerService) ListIssuers(page, perPage int) ([]domain.Issuer, int64, error) {
 	if page < 1 {
@@ -176,33 +514,201 @@ func (s *IssuerService) GetIssuer(id string) (*domain.Issuer, error) {
 }
 
 // CreateIssuer creates a new issuer (handler interface method).
-func (s *IssuerService) CreateIssuer(issuer domain.Issuer) (*domain.Issuer, error) {
-	if issuer.ID == "" {
-		issuer.ID = generateID("issuer")
+func (s *IssuerService) CreateIssuer(iss domain.Issuer) (*domain.Issuer, error) {
+	if !isValidIssuerType(iss.Type) {
+		return nil, fmt.Errorf("unsupported issuer type: %s", iss.Type)
+	}
+	if iss.ID == "" {
+		iss.ID = generateID("issuer")
 	}
 	now := time.Now()
-	if issuer.CreatedAt.IsZero() {
-		issuer.CreatedAt = now
+	if iss.CreatedAt.IsZero() {
+		iss.CreatedAt = now
 	}
-	if issuer.UpdatedAt.IsZero() {
-		issuer.UpdatedAt = now
+	if iss.UpdatedAt.IsZero() {
+		iss.UpdatedAt = now
 	}
-	if err := s.issuerRepo.Create(context.Background(), &issuer); err != nil {
+	if iss.TestStatus == "" {
+		iss.TestStatus = "untested"
+	}
+	if iss.Source == "" {
+		iss.Source = "database"
+	}
+
+	// Encrypt config
+	if len(iss.Config) > 0 {
+		encrypted, _, err := crypto.EncryptIfKeySet([]byte(iss.Config), s.encryptionKey)
+		if err != nil {
+			return nil, fmt.Errorf("failed to encrypt config: %w", err)
+		}
+		iss.EncryptedConfig = encrypted
+		iss.Config = redactConfigJSON(iss.Config)
+	}
+
+	if err := s.issuerRepo.Create(context.Background(), &iss); err != nil {
 		return nil, fmt.Errorf("failed to create issuer: %w", err)
 	}
-	return &issuer, nil
+
+	// Rebuild registry
+	if iss.Enabled {
+		s.rebuildRegistryQuiet(context.Background())
+	}
+
+	return &iss, nil
 }
 
 // UpdateIssuer modifies an issuer (handler interface method).
-func (s *IssuerService) UpdateIssuer(id string, issuer domain.Issuer) (*domain.Issuer, error) {
-	issuer.ID = id
-	if err := s.issuerRepo.Update(context.Background(), &issuer); err != nil {
+func (s *IssuerService) UpdateIssuer(id string, iss domain.Issuer) (*domain.Issuer, error) {
+	iss.ID = id
+	iss.UpdatedAt = time.Now()
+
+	// Merge redacted fields with existing config
+	if len(iss.Config) > 0 {
+		mergedConfig, err := s.mergeRedactedConfig(context.Background(), id, iss.Config)
+		if err != nil {
+			return nil, fmt.Errorf("failed to merge config: %w", err)
+		}
+
+		encrypted, _, encErr := crypto.EncryptIfKeySet(mergedConfig, s.encryptionKey)
+		if encErr != nil {
+			return nil, fmt.Errorf("failed to encrypt config: %w", encErr)
+		}
+		iss.EncryptedConfig = encrypted
+		iss.Config = redactConfigJSON(json.RawMessage(mergedConfig))
+	}
+
+	if err := s.issuerRepo.Update(context.Background(), &iss); err != nil {
 		return nil, fmt.Errorf("failed to update issuer: %w", err)
 	}
-	return &issuer, nil
+
+	s.rebuildRegistryQuiet(context.Background())
+
+	return &iss, nil
 }
 
 // DeleteIssuer removes an issuer (handler interface method).
 func (s *IssuerService) DeleteIssuer(id string) error {
-	return s.issuerRepo.Delete(context.Background(), id)
+	if err := s.issuerRepo.Delete(context.Background(), id); err != nil {
+		return err
+	}
+	if s.registry != nil {
+		s.registry.Remove(id)
+	}
+	return nil
+}
+
+// --- Internal helpers ---
+
+// rebuildRegistryQuiet rebuilds the registry, logging errors instead of returning them.
+func (s *IssuerService) rebuildRegistryQuiet(ctx context.Context) {
+	if s.registry == nil {
+		return
+	}
+	if err := s.BuildRegistry(ctx); err != nil {
+		s.logger.Error("failed to rebuild issuer registry after change", "error", err)
+	}
+}
+
+// getDecryptedConfig returns the decrypted config JSON for an issuer.
+func (s *IssuerService) getDecryptedConfig(iss *domain.Issuer) (json.RawMessage, error) {
+	if len(iss.EncryptedConfig) > 0 {
+		decrypted, err := crypto.DecryptIfKeySet(iss.EncryptedConfig, s.encryptionKey)
+		if err != nil {
+			return nil, err
+		}
+		return json.RawMessage(decrypted), nil
+	}
+	if len(iss.Config) > 0 {
+		return iss.Config, nil
+	}
+	return json.RawMessage("{}"), nil
+}
+
+// mergeRedactedConfig merges incoming config (which may have "********" values)
+// with the existing decrypted config so sensitive fields are preserved.
+func (s *IssuerService) mergeRedactedConfig(ctx context.Context, id string, incoming json.RawMessage) ([]byte, error) {
+	// Parse incoming config
+	var incomingMap map[string]interface{}
+	if err := json.Unmarshal(incoming, &incomingMap); err != nil {
+		s.logger.Warn("mergeRedactedConfig: incoming config is not a JSON object, using as-is", "issuer", id, "error", err)
+		return incoming, nil
+	}
+
+	// Check if any values are "********"
+	hasRedacted := false
+	for _, v := range incomingMap {
+		if str, ok := v.(string); ok && str == "********" {
+			hasRedacted = true
+			break
+		}
+	}
+
+	if !hasRedacted {
+		return incoming, nil // No redacted values, use incoming as-is
+	}
+
+	// Load existing config to get real values
+	existing, err := s.issuerRepo.Get(ctx, id)
+	if err != nil {
+		s.logger.Warn("mergeRedactedConfig: could not load existing issuer, redacted values will be lost", "issuer", id, "error", err)
+		return incoming, nil
+	}
+
+	existingConfig, err := s.getDecryptedConfig(existing)
+	if err != nil {
+		s.logger.Warn("mergeRedactedConfig: could not decrypt existing config, redacted values will be lost", "issuer", id, "error", err)
+		return incoming, nil
+	}
+
+	var existingMap map[string]interface{}
+	if err := json.Unmarshal(existingConfig, &existingMap); err != nil {
+		s.logger.Warn("mergeRedactedConfig: existing config is not a JSON object, redacted values will be lost", "issuer", id, "error", err)
+		return incoming, nil
+	}
+
+	// Merge: for each "********" value in incoming, use existing value
+	for k, v := range incomingMap {
+		if str, ok := v.(string); ok && str == "********" {
+			if existingVal, exists := existingMap[k]; exists {
+				incomingMap[k] = existingVal
+			}
+		}
+	}
+
+	return json.Marshal(incomingMap)
+}
+
+// updateTestStatus updates the test_status and last_tested_at fields in the database
+// and records an audit event.
+func (s *IssuerService) updateTestStatus(ctx context.Context, iss *domain.Issuer, status string) {
+	now := time.Now()
+	iss.TestStatus = status
+	iss.LastTestedAt = &now
+	iss.UpdatedAt = now
+	if err := s.issuerRepo.Update(ctx, iss); err != nil {
+		s.logger.Error("failed to update test status", "issuer", iss.ID, "status", status, "error", err)
+	}
+
+	// Record audit event for connection test
+	if s.auditService != nil {
+		action := "issuer_test_connection_" + status
+		details := map[string]interface{}{"issuer_type": string(iss.Type), "result": status}
+		if auditErr := s.auditService.RecordEvent(ctx, "system", domain.ActorTypeSystem, action, "issuer", iss.ID, details); auditErr != nil {
+			s.logger.Error("failed to record test connection audit event", "error", auditErr)
+		}
+	}
+}
+
+// getEnvForSeed reads an environment variable for seed data construction.
+func getEnvForSeed(key string) string {
+	return os.Getenv(key)
+}
+
+// mustJSON marshals a value to json.RawMessage, panicking on error (for seed data only).
+func mustJSON(v interface{}) json.RawMessage {
+	b, err := json.Marshal(v)
+	if err != nil {
+		panic(fmt.Sprintf("mustJSON: %v", err))
+	}
+	return json.RawMessage(b)
 }

internal/service/issuer_registry.go

@@ -0,0 +1,139 @@
+package service
+
+import (
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"sync"
+
+	"github.com/shankar0123/certctl/internal/connector/issuerfactory"
+	"github.com/shankar0123/certctl/internal/crypto"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+// IssuerRegistry is a thread-safe registry of issuer connectors.
+// It replaces the static map[string]IssuerConnector that was built at startup.
+// Consumers call Get() to look up a connector by issuer ID.
+type IssuerRegistry struct {
+	mu      sync.RWMutex
+	issuers map[string]IssuerConnector
+	logger  *slog.Logger
+}
+
+// NewIssuerRegistry creates a new empty issuer registry.
+func NewIssuerRegistry(logger *slog.Logger) *IssuerRegistry {
+	return &IssuerRegistry{
+		issuers: make(map[string]IssuerConnector),
+		logger:  logger,
+	}
+}
+
+// Get returns the issuer connector for the given ID and whether it exists.
+func (r *IssuerRegistry) Get(id string) (IssuerConnector, bool) {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	conn, ok := r.issuers[id]
+	return conn, ok
+}
+
+// Set adds or replaces an issuer connector in the registry.
+func (r *IssuerRegistry) Set(id string, conn IssuerConnector) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.issuers[id] = conn
+}
+
+// Remove removes an issuer connector from the registry.
+func (r *IssuerRegistry) Remove(id string) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	delete(r.issuers, id)
+}
+
+// List returns a copy of all registered issuers.
+func (r *IssuerRegistry) List() map[string]IssuerConnector {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	result := make(map[string]IssuerConnector, len(r.issuers))
+	for k, v := range r.issuers {
+		result[k] = v
+	}
+	return result
+}
+
+// Len returns the number of registered issuers.
+func (r *IssuerRegistry) Len() int {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return len(r.issuers)
+}
+
+// Rebuild reconstructs the registry from a list of issuer configs.
+// For each enabled issuer, it decrypts the config (if encryption key is set),
+// instantiates a connector via the factory, wraps it in an adapter, and
+// atomically swaps the entire map.
+func (r *IssuerRegistry) Rebuild(configs []*domain.Issuer, encryptionKey []byte) error {
+	newIssuers := make(map[string]IssuerConnector)
+	var errors []string
+
+	for _, cfg := range configs {
+		if !cfg.Enabled {
+			r.logger.Debug("skipping disabled issuer", "id", cfg.ID, "type", cfg.Type)
+			continue
+		}
+
+		// Determine the config JSON to use for connector instantiation.
+		// Prefer encrypted_config (decrypted) if available; fall back to config.
+		var configJSON json.RawMessage
+		if len(cfg.EncryptedConfig) > 0 {
+			decrypted, err := crypto.DecryptIfKeySet(cfg.EncryptedConfig, encryptionKey)
+			if err != nil {
+				errors = append(errors, fmt.Sprintf("issuer %s: decrypt failed: %v", cfg.ID, err))
+				continue
+			}
+			configJSON = json.RawMessage(decrypted)
+		} else if len(cfg.Config) > 0 {
+			configJSON = cfg.Config
+		} else {
+			configJSON = json.RawMessage("{}")
+		}
+
+		connector, err := issuerfactory.NewFromConfig(string(cfg.Type), configJSON, r.logger)
+		if err != nil {
+			errors = append(errors, fmt.Sprintf("issuer %s: factory error: %v", cfg.ID, err))
+			continue
+		}
+
+		newIssuers[cfg.ID] = NewIssuerConnectorAdapter(connector)
+		r.logger.Info("issuer loaded into registry", "id", cfg.ID, "type", cfg.Type)
+	}
+
+	// Atomic swap
+	r.mu.Lock()
+	old := r.issuers
+	r.issuers = newIssuers
+	r.mu.Unlock()
+
+	// Log changes
+	for id := range newIssuers {
+		if _, existed := old[id]; !existed {
+			r.logger.Info("issuer added to registry", "id", id)
+		}
+	}
+	for id := range old {
+		if _, exists := newIssuers[id]; !exists {
+			r.logger.Info("issuer removed from registry", "id", id)
+		}
+	}
+
+	r.logger.Info("issuer registry rebuilt", "loaded", len(newIssuers), "failed", len(errors))
+
+	if len(errors) > 0 {
+		for _, e := range errors {
+			r.logger.Warn("issuer load failure", "detail", e)
+		}
+		return fmt.Errorf("%d issuer(s) failed to load: %s", len(errors), errors[0])
+	}
+
+	return nil
+}

internal/service/issuer_registry_test.go

@@ -0,0 +1,286 @@
+package service
+
+import (
+	"encoding/json"
+	"log/slog"
+	"os"
+	"sync"
+	"testing"
+
+	"github.com/shankar0123/certctl/internal/crypto"
+	"github.com/shankar0123/certctl/internal/domain"
+)
+
+func registryTestLogger() *slog.Logger {
+	return slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+}
+
+func TestIssuerRegistry_GetSet(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	mock := &mockIssuerConnector{}
+	reg.Set("iss-test", mock)
+
+	conn, ok := reg.Get("iss-test")
+	if !ok {
+		t.Fatal("expected to find iss-test in registry")
+	}
+	if conn == nil {
+		t.Fatal("expected non-nil connector")
+	}
+}
+
+func TestIssuerRegistry_GetNotFound(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	_, ok := reg.Get("nonexistent")
+	if ok {
+		t.Fatal("expected not to find nonexistent issuer")
+	}
+}
+
+func TestIssuerRegistry_Remove(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	reg.Set("iss-test", &mockIssuerConnector{})
+	reg.Remove("iss-test")
+
+	_, ok := reg.Get("iss-test")
+	if ok {
+		t.Fatal("expected issuer to be removed")
+	}
+}
+
+func TestIssuerRegistry_List(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	reg.Set("iss-a", &mockIssuerConnector{})
+	reg.Set("iss-b", &mockIssuerConnector{})
+
+	list := reg.List()
+	if len(list) != 2 {
+		t.Fatalf("expected 2 issuers, got %d", len(list))
+	}
+
+	// Verify List returns a copy (modifying it doesn't affect registry)
+	delete(list, "iss-a")
+	if reg.Len() != 2 {
+		t.Fatal("deleting from List() copy should not affect registry")
+	}
+}
+
+func TestIssuerRegistry_Len(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+	if reg.Len() != 0 {
+		t.Fatalf("expected empty registry, got %d", reg.Len())
+	}
+
+	reg.Set("iss-a", &mockIssuerConnector{})
+	if reg.Len() != 1 {
+		t.Fatalf("expected 1 issuer, got %d", reg.Len())
+	}
+}
+
+func TestIssuerRegistry_Rebuild_Enabled(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	configs := []*domain.Issuer{
+		{
+			ID:      "iss-local",
+			Name:    "Local CA",
+			Type:    "local",
+			Config:  json.RawMessage(`{}`),
+			Enabled: true,
+		},
+		{
+			ID:      "iss-disabled",
+			Name:    "Disabled",
+			Type:    "local",
+			Config:  json.RawMessage(`{}`),
+			Enabled: false,
+		},
+	}
+
+	err := reg.Rebuild(configs, nil)
+	if err != nil {
+		t.Fatalf("Rebuild failed: %v", err)
+	}
+
+	if reg.Len() != 1 {
+		t.Fatalf("expected 1 enabled issuer, got %d", reg.Len())
+	}
+
+	_, ok := reg.Get("iss-local")
+	if !ok {
+		t.Fatal("expected iss-local in registry")
+	}
+
+	_, ok = reg.Get("iss-disabled")
+	if ok {
+		t.Fatal("disabled issuer should not be in registry")
+	}
+}
+
+func TestIssuerRegistry_Rebuild_WithEncryption(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	key := crypto.DeriveKey("test-key")
+	configJSON := []byte(`{"ca_common_name":"Encrypted CA"}`)
+	encrypted, err := crypto.Encrypt(configJSON, key)
+	if err != nil {
+		t.Fatalf("encrypt failed: %v", err)
+	}
+
+	configs := []*domain.Issuer{
+		{
+			ID:              "iss-encrypted",
+			Name:            "Encrypted Local CA",
+			Type:            "local",
+			EncryptedConfig: encrypted,
+			Enabled:         true,
+		},
+	}
+
+	err = reg.Rebuild(configs, key)
+	if err != nil {
+		t.Fatalf("Rebuild with encryption failed: %v", err)
+	}
+
+	_, ok := reg.Get("iss-encrypted")
+	if !ok {
+		t.Fatal("expected iss-encrypted in registry")
+	}
+}
+
+func TestIssuerRegistry_Rebuild_NilKeyFallback(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	configs := []*domain.Issuer{
+		{
+			ID:      "iss-plain",
+			Name:    "Plain Config",
+			Type:    "local",
+			Config:  json.RawMessage(`{}`),
+			Enabled: true,
+		},
+	}
+
+	// nil key should work — falls back to config column
+	err := reg.Rebuild(configs, nil)
+	if err != nil {
+		t.Fatalf("Rebuild with nil key failed: %v", err)
+	}
+
+	_, ok := reg.Get("iss-plain")
+	if !ok {
+		t.Fatal("expected iss-plain in registry")
+	}
+}
+
+func TestIssuerRegistry_Rebuild_InvalidConfig(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	configs := []*domain.Issuer{
+		{
+			ID:      "iss-bad",
+			Name:    "Bad Config",
+			Type:    "UnknownType",
+			Config:  json.RawMessage(`{}`),
+			Enabled: true,
+		},
+		{
+			ID:      "iss-good",
+			Name:    "Good Config",
+			Type:    "local",
+			Config:  json.RawMessage(`{}`),
+			Enabled: true,
+		},
+	}
+
+	// Should return an error indicating partial failure, but still load valid issuers
+	err := reg.Rebuild(configs, nil)
+	if err == nil {
+		t.Fatal("Rebuild should return error when some issuers fail to load")
+	}
+
+	// Despite the error, valid issuers should be loaded
+	if reg.Len() != 1 {
+		t.Fatalf("expected 1 valid issuer, got %d", reg.Len())
+	}
+
+	_, ok := reg.Get("iss-good")
+	if !ok {
+		t.Fatal("expected iss-good in registry")
+	}
+}
+
+func TestIssuerRegistry_Rebuild_ReplacesExisting(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	// Set up initial state
+	reg.Set("iss-old", &mockIssuerConnector{})
+
+	configs := []*domain.Issuer{
+		{
+			ID:      "iss-new",
+			Name:    "New Issuer",
+			Type:    "local",
+			Config:  json.RawMessage(`{}`),
+			Enabled: true,
+		},
+	}
+
+	err := reg.Rebuild(configs, nil)
+	if err != nil {
+		t.Fatalf("Rebuild failed: %v", err)
+	}
+
+	_, ok := reg.Get("iss-old")
+	if ok {
+		t.Fatal("old issuer should have been replaced")
+	}
+
+	_, ok = reg.Get("iss-new")
+	if !ok {
+		t.Fatal("new issuer should be present")
+	}
+}
+
+func TestIssuerRegistry_ConcurrentAccess(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	var wg sync.WaitGroup
+	for i := 0; i < 100; i++ {
+		wg.Add(3)
+		id := "iss-concurrent"
+		go func() {
+			defer wg.Done()
+			reg.Set(id, &mockIssuerConnector{})
+		}()
+		go func() {
+			defer wg.Done()
+			reg.Get(id)
+		}()
+		go func() {
+			defer wg.Done()
+			reg.List()
+		}()
+	}
+	wg.Wait()
+	// No race detector panics = success
+}
+
+func TestIssuerRegistry_Rebuild_Empty(t *testing.T) {
+	reg := NewIssuerRegistry(registryTestLogger())
+
+	reg.Set("iss-existing", &mockIssuerConnector{})
+
+	err := reg.Rebuild([]*domain.Issuer{}, nil)
+	if err != nil {
+		t.Fatalf("Rebuild with empty configs failed: %v", err)
+	}
+
+	if reg.Len() != 0 {
+		t.Fatalf("expected empty registry after rebuild with no configs, got %d", reg.Len())
+	}
+}

internal/service/issuer_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -49,7 +50,7 @@ func TestIssuerService_List(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	issuers, total, err := service.List(ctx, 1, 2)
 
@@ -85,7 +86,8 @@ func TestIssuerService_List_DefaultPagination(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	// Call with invalid page and perPage
 	issuers, total, err := service.List(ctx, 0, 0)
@@ -113,7 +115,7 @@ func TestIssuerService_List_RepositoryError(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	_, _, err := service.List(ctx, 1, 50)
 
@@ -134,7 +136,8 @@ func TestIssuerService_List_EmptyResult(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	issuers, total, err := service.List(ctx, 1, 50)
 
@@ -170,7 +173,7 @@ func TestIssuerService_Get(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	retrieved, err := service.Get(ctx, "iss-acme-prod")
 
@@ -195,7 +198,8 @@ func TestIssuerService_Get_NotFound(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	_, err := service.Get(ctx, "nonexistent-issuer")
 
@@ -212,7 +216,8 @@ func TestIssuerService_Create(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	config := map[string]interface{}{"endpoint": "https://acme.example.com/v2/new-account"}
 	configJSON, _ := json.Marshal(config)
@@ -274,7 +279,8 @@ func TestIssuerService_Create_EmptyName(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	issuer := &domain.Issuer{
 		Name:    "",
@@ -308,7 +314,7 @@ func TestIssuerService_Create_RepositoryError(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	issuer := &domain.Issuer{
 		Name:    "Test Issuer",
@@ -335,7 +341,8 @@ func TestIssuerService_Update(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	config := map[string]interface{}{"endpoint": "https://acme.example.com"}
 	configJSON, _ := json.Marshal(config)
@@ -379,7 +386,8 @@ func TestIssuerService_Update_EmptyName(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	issuer := &domain.Issuer{
 		Name:    "",
@@ -406,7 +414,8 @@ func TestIssuerService_Delete(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	err := service.Delete(ctx, "iss-to-delete", "user-frank")
 
@@ -438,7 +447,7 @@ func TestIssuerService_Delete_RepositoryError(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	err := service.Delete(ctx, "iss-bad-id", "user-grace")
 
@@ -455,24 +464,27 @@ func TestIssuerService_Delete_RepositoryError(t *testing.T) {
 func TestIssuerService_TestConnection_Success(t *testing.T) {
 	ctx := context.Background()
 
-	issuer := &domain.Issuer{
+	// Use GenericCA (Local CA) type because it has no required config fields,
+	// so ValidateConfig succeeds with empty config.
+	iss := &domain.Issuer{
 		ID:        "iss-test-conn",
 		Name:      "Test Connection",
-		Type:      domain.IssuerTypeACME,
+		Type:      domain.IssuerTypeGenericCA,
+		Config:    json.RawMessage(`{"validity_days":365}`),
 		Enabled:   true,
 		CreatedAt: time.Now(),
 		UpdatedAt: time.Now(),
 	}
 
 	repo := newMockIssuerRepository()
-	repo.AddIssuer(issuer)
+	repo.AddIssuer(iss)
 
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	svc := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
-	err := service.TestConnectionWithContext(ctx, "iss-test-conn")
+	err := svc.TestConnectionWithContext(ctx, "iss-test-conn")
 
 	if err != nil {
 		t.Fatalf("TestConnectionWithContext failed: %v", err)
@@ -487,7 +499,8 @@ func TestIssuerService_TestConnection_NotFound(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	err := service.TestConnectionWithContext(ctx, "nonexistent-issuer")
 
@@ -527,7 +540,7 @@ func TestIssuerService_ListIssuers_HandlerInterface(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	service := NewIssuerService(repo, auditService, NewIssuerRegistry(slog.Default()), nil, slog.Default())
 
 	issuers, total, err := service.ListIssuers(1, 50)
 
@@ -554,7 +567,8 @@ func TestIssuerService_CreateIssuer_HandlerInterface(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	config := map[string]interface{}{"url": "https://example.com"}
 	configJSON, _ := json.Marshal(config)
@@ -591,7 +605,8 @@ func TestIssuerService_DeleteIssuer_HandlerInterface(t *testing.T) {
 	auditRepo := newMockAuditRepository()
 	auditService := NewAuditService(auditRepo)
 
-	service := NewIssuerService(repo, auditService)
+	registry := NewIssuerRegistry(slog.Default())
+	service := NewIssuerService(repo, auditService, registry, nil, slog.Default())
 
 	err := service.DeleteIssuer("iss-handler-delete")
 

internal/service/job_test.go

@@ -28,7 +28,8 @@ func newTestJobService(jobRepo *mockJobRepo) *JobService {
 	targetRepo := &mockTargetRepo{Targets: make(map[string]*domain.DeploymentTarget)}
 	agentRepo := &mockAgentRepo{Agents: make(map[string]*domain.Agent)}
 
-	renewalService := NewRenewalService(certRepo, jobRepo, renewalPolicyRepo, nil, auditService, notifService, make(map[string]IssuerConnector), "server")
+	issuerRegistry := NewIssuerRegistry(logger)
+	renewalService := NewRenewalService(certRepo, jobRepo, renewalPolicyRepo, nil, auditService, notifService, issuerRegistry, "server")
 	deploymentService := NewDeploymentService(jobRepo, targetRepo, agentRepo, certRepo, auditService, notifService)
 
 	return NewJobService(jobRepo, renewalService, deploymentService, logger)

internal/service/renewal.go

@@ -29,7 +29,7 @@ type RenewalService struct {
 	targetRepo        repository.TargetRepository
 	auditService      *AuditService
 	notificationSvc   *NotificationService
-	issuerRegistry    map[string]IssuerConnector
+	issuerRegistry    *IssuerRegistry
 	keygenMode        string // "agent" (default) or "server" (demo only)
 }
 
@@ -101,7 +101,7 @@ func NewRenewalService(
 	profileRepo repository.CertificateProfileRepository,
 	auditService *AuditService,
 	notificationSvc *NotificationService,
-	issuerRegistry map[string]IssuerConnector,
+	issuerRegistry *IssuerRegistry,
 	keygenMode string,
 ) *RenewalService {
 	if keygenMode == "" {
@@ -169,7 +169,7 @@ func (s *RenewalService) CheckExpiringCertificates(ctx context.Context) error {
 		s.sendThresholdAlerts(ctx, cert, int(daysUntil), thresholds)
 
 		// Only create renewal job if an issuer connector is registered for this cert's issuer
-		connector, hasIssuer := s.issuerRegistry[cert.IssuerID]
+		connector, hasIssuer := s.issuerRegistry.Get(cert.IssuerID)
 		if !hasIssuer {
 			continue
 		}
@@ -347,7 +347,7 @@ func (s *RenewalService) ProcessRenewalJob(ctx context.Context, job *domain.Job)
 		return fmt.Errorf("certificate has no issuer assigned")
 	}
 
-	_, ok := s.issuerRegistry[issuerID]
+	_, ok := s.issuerRegistry.Get(issuerID)
 	if !ok {
 		s.failJob(ctx, job, fmt.Sprintf("issuer connector not found for %s", issuerID))
 		return fmt.Errorf("issuer connector not found for %s", issuerID)
@@ -390,7 +390,7 @@ func (s *RenewalService) processRenewalAgentKeygen(ctx context.Context, job *dom
 // private key in the cert version so agents can retrieve it for deployment.
 // WARNING: Private keys touch the control plane. Use only for development/demo.
 func (s *RenewalService) processRenewalServerKeygen(ctx context.Context, job *domain.Job, cert *domain.ManagedCertificate) error {
-	connector := s.issuerRegistry[cert.IssuerID]
+	connector, _ := s.issuerRegistry.Get(cert.IssuerID)
 
 	// Generate server-side RSA key + CSR
 	privKey, err := rsa.GenerateKey(rand.Reader, 2048)
@@ -524,7 +524,7 @@ func (s *RenewalService) processRenewalServerKeygen(ctx context.Context, job *do
 // It signs the CSR via the issuer connector, stores the cert version (without private key),
 // completes the renewal job, and creates deployment jobs.
 func (s *RenewalService) CompleteAgentCSRRenewal(ctx context.Context, job *domain.Job, cert *domain.ManagedCertificate, csrPEM string) error {
-	connector, ok := s.issuerRegistry[cert.IssuerID]
+	connector, ok := s.issuerRegistry.Get(cert.IssuerID)
 	if !ok {
 		s.failJob(ctx, job, fmt.Sprintf("issuer connector not found for %s", cert.IssuerID))
 		return fmt.Errorf("issuer connector not found for %s", cert.IssuerID)

internal/service/renewal_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"strings"
 	"testing"
 	"time"
@@ -26,9 +27,8 @@ func TestCheckExpiringCertificates_SendsThresholdAlerts(t *testing.T) {
 		"Email": notifier,
 	})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -108,9 +108,8 @@ func TestCheckExpiringCertificates_DeduplicatesAlerts(t *testing.T) {
 		"Email": notifier,
 	})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -188,9 +187,8 @@ func TestCheckExpiringCertificates_SkipsRenewalInProgress(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -253,9 +251,8 @@ func TestCheckExpiringCertificates_UpdatesStatusToExpiring(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -315,9 +312,8 @@ func TestCheckExpiringCertificates_UpdatesStatusToExpired(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -377,9 +373,8 @@ func TestCheckExpiringCertificates_CreatesRenewalJob(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -445,7 +440,7 @@ func TestCheckExpiringCertificates_SkipsWithoutIssuer(t *testing.T) {
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
 	// Empty issuer registry
-	issuerRegistry := map[string]IssuerConnector{}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -505,9 +500,8 @@ func TestCheckExpiringCertificates_SkipsDuplicateJobs(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -589,9 +583,8 @@ func TestProcessRenewalJob(t *testing.T) {
 	})
 
 	issuerConnector := &mockIssuerConnector{}
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": issuerConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", issuerConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -685,9 +678,8 @@ func TestProcessRenewalJob_IssuerFailure(t *testing.T) {
 		Err: fmt.Errorf("issuer service unavailable"),
 	}
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": issuerConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", issuerConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -767,9 +759,8 @@ func TestRetryFailedJobs(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -832,9 +823,8 @@ func TestProcessRenewalJob_NoCertificate(t *testing.T) {
 	auditSvc := NewAuditService(auditRepo)
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -885,9 +875,8 @@ func TestCheckExpiringCertificates_ARI_ShouldRenewNow(t *testing.T) {
 			SuggestedWindowEnd:   time.Now().Add(48 * time.Hour),
 		},
 	}
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-acme": ariConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-acme", ariConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -958,9 +947,8 @@ func TestCheckExpiringCertificates_ARI_NotYet(t *testing.T) {
 			SuggestedWindowEnd:   time.Now().Add(96 * time.Hour),
 		},
 	}
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-acme": ariConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-acme", ariConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -1021,9 +1009,8 @@ func TestCheckExpiringCertificates_ARI_NilResult_FallsThrough(t *testing.T) {
 	notifSvc := NewNotificationService(notifRepo, map[string]Notifier{})
 
 	// ARI returns nil (issuer doesn't support ARI) — default mock behavior
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-local": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-local", &mockIssuerConnector{})
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 
@@ -1090,9 +1077,8 @@ func TestCheckExpiringCertificates_ARI_Error_FallsThrough(t *testing.T) {
 	ariConnector := &mockIssuerConnector{
 		getRenewalInfoErr: fmt.Errorf("ARI endpoint unreachable"),
 	}
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-acme": ariConnector,
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-acme", ariConnector)
 
 	svc := NewRenewalService(certRepo, jobRepo, policyRepo, nil, auditSvc, notifSvc, issuerRegistry, "server")
 

internal/service/revocation_svc.go

@@ -17,7 +17,7 @@ type RevocationSvc struct {
 	revocationRepo   repository.RevocationRepository
 	auditService     *AuditService
 	notificationSvc  *NotificationService
-	issuerRegistry   map[string]IssuerConnector
+	issuerRegistry   *IssuerRegistry
 }
 
 // NewRevocationSvc creates a new revocation service.
@@ -39,7 +39,7 @@ func (s *RevocationSvc) SetNotificationService(svc *NotificationService) {
 }
 
 // SetIssuerRegistry sets the issuer registry for issuer-level revocation.
-func (s *RevocationSvc) SetIssuerRegistry(registry map[string]IssuerConnector) {
+func (s *RevocationSvc) SetIssuerRegistry(registry *IssuerRegistry) {
 	s.issuerRegistry = registry
 }
 
@@ -110,7 +110,7 @@ func (s *RevocationSvc) RevokeCertificateWithActor(ctx context.Context, certID s
 
 	// 5. Notify the issuer connector (best-effort)
 	if s.issuerRegistry != nil {
-		if issuerConn, ok := s.issuerRegistry[cert.IssuerID]; ok {
+		if issuerConn, ok := s.issuerRegistry.Get(cert.IssuerID); ok {
 			if err := issuerConn.RevokeCertificate(ctx, version.SerialNumber, reason); err != nil {
 				slog.Error("failed to notify issuer of revocation",
 					"error", err,

internal/service/revocation_svc_test.go

@@ -4,6 +4,7 @@ package service
 
 import (
 	"context"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -18,9 +19,9 @@ func newRevocationSvcTest() (*RevocationSvc, *mockCertRepo, *mockRevocationRepo,
 
 	auditService := NewAuditService(auditRepo)
 	revSvc := NewRevocationSvc(certRepo, revocationRepo, auditService)
-	revSvc.SetIssuerRegistry(map[string]IssuerConnector{
-		"iss-local": &mockIssuerConnector{},
-	})
+	registry := NewIssuerRegistry(slog.Default())
+	registry.Set("iss-local", &mockIssuerConnector{})
+	revSvc.SetIssuerRegistry(registry)
 
 	return revSvc, certRepo, revocationRepo, auditRepo
 }

internal/service/revocation_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"context"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -21,15 +22,13 @@ func newRevocationTestService() (*CertificateService, *mockCertRepo, *mockRevoca
 
 	// Create RevocationSvc
 	revSvc := NewRevocationSvc(certRepo, revocationRepo, auditService)
-	revSvc.SetIssuerRegistry(map[string]IssuerConnector{
-		"iss-local": &mockIssuerConnector{},
-	})
+	registry := NewIssuerRegistry(slog.Default())
+	registry.Set("iss-local", &mockIssuerConnector{})
+	revSvc.SetIssuerRegistry(registry)
 
 	// Create CAOperationsSvc
 	caSvc := NewCAOperationsSvc(revocationRepo, certRepo, profileRepo)
-	caSvc.SetIssuerRegistry(map[string]IssuerConnector{
-		"iss-local": &mockIssuerConnector{},
-	})
+	caSvc.SetIssuerRegistry(registry)
 
 	certService := NewCertificateService(certRepo, policyService, auditService)
 	certService.SetRevocationSvc(revSvc)
@@ -243,9 +242,9 @@ func TestRevokeCertificate_WithIssuerNotification(t *testing.T) {
 
 	// Wire up issuer registry on RevocationSvc with mock
 	mockIssuer := &mockIssuerConnector{}
-	svc.revSvc.SetIssuerRegistry(map[string]IssuerConnector{
-		"iss-local": mockIssuer,
-	})
+	registry := NewIssuerRegistry(slog.Default())
+	registry.Set("iss-local", mockIssuer)
+	svc.revSvc.SetIssuerRegistry(registry)
 
 	cert := &domain.ManagedCertificate{
 		ID:         "cert-7",

internal/service/shortlived_test.go

@@ -3,6 +3,7 @@ package service
 import (
 	"context"
 	"errors"
+	"log/slog"
 	"testing"
 	"time"
 
@@ -18,9 +19,8 @@ func setupShortLivedTestService(
 ) *RenewalService {
 	auditSvc := NewAuditService(auditRepo)
 
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(
 		certRepo,
@@ -137,9 +137,8 @@ func TestExpireShortLivedCertificates_ListError(t *testing.T) {
 
 	// Create the service manually to use our custom cert repo
 	auditSvc := NewAuditService(auditRepo)
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(
 		customCertRepo,
@@ -385,9 +384,8 @@ func TestExpireShortLivedCertificates_NoProfileRepository(t *testing.T) {
 	}
 
 	auditSvc := NewAuditService(auditRepo)
-	issuerRegistry := map[string]IssuerConnector{
-		"iss-test": &mockIssuerConnector{},
-	}
+	issuerRegistry := NewIssuerRegistry(slog.Default())
+	issuerRegistry.Set("iss-test", &mockIssuerConnector{})
 
 	svc := NewRenewalService(
 		certRepo,

internal/service/target.go

@@ -2,28 +2,58 @@ package service
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"time"
 
+	"github.com/shankar0123/certctl/internal/crypto"
 	"github.com/shankar0123/certctl/internal/domain"
 	"github.com/shankar0123/certctl/internal/repository"
 )
 
+// validTargetTypes is the set of allowed target types for validation.
+var validTargetTypes = map[domain.TargetType]bool{
+	domain.TargetTypeNGINX:   true,
+	domain.TargetTypeApache:  true,
+	domain.TargetTypeHAProxy: true,
+	domain.TargetTypeF5:      true,
+	domain.TargetTypeIIS:     true,
+	domain.TargetTypeTraefik: true,
+	domain.TargetTypeCaddy:   true,
+	domain.TargetTypeEnvoy:   true,
+	domain.TargetTypePostfix: true,
+	domain.TargetTypeDovecot: true,
+}
+
+// isValidTargetType checks if a type string is a known target type.
+func isValidTargetType(t domain.TargetType) bool {
+	return validTargetTypes[t]
+}
+
 // TargetService provides business logic for deployment target management.
 type TargetService struct {
-	targetRepo   repository.TargetRepository
-	auditService *AuditService
+	targetRepo    repository.TargetRepository
+	agentRepo     repository.AgentRepository
+	auditService  *AuditService
+	encryptionKey []byte
+	logger        *slog.Logger
 }
 
 // NewTargetService creates a new target service.
 func NewTargetService(
 	targetRepo repository.TargetRepository,
 	auditService *AuditService,
+	agentRepo repository.AgentRepository,
+	encryptionKey []byte,
+	logger *slog.Logger,
 ) *TargetService {
 	return &TargetService{
-		targetRepo:   targetRepo,
-		auditService: auditService,
+		targetRepo:    targetRepo,
+		agentRepo:     agentRepo,
+		auditService:  auditService,
+		encryptionKey: encryptionKey,
+		logger:        logger,
 	}
 }
 
@@ -61,11 +91,14 @@ func (s *TargetService) Get(ctx context.Context, id string) (*domain.DeploymentT
 	return target, nil
 }
 
-// Create validates and stores a new deployment target.
+// Create validates and stores a new deployment target, encrypting sensitive config.
 func (s *TargetService) Create(ctx context.Context, target *domain.DeploymentTarget, actor string) error {
 	if target.Name == "" {
 		return fmt.Errorf("target name is required")
 	}
+	if !isValidTargetType(target.Type) {
+		return fmt.Errorf("unsupported target type: %s", target.Type)
+	}
 
 	if target.ID == "" {
 		target.ID = generateID("target")
@@ -77,33 +110,68 @@ func (s *TargetService) Create(ctx context.Context, target *domain.DeploymentTar
 	if target.UpdatedAt.IsZero() {
 		target.UpdatedAt = now
 	}
+	if target.TestStatus == "" {
+		target.TestStatus = "untested"
+	}
+	if target.Source == "" {
+		target.Source = "database"
+	}
+
+	// Encrypt the full config and store redacted version in config column
+	if len(target.Config) > 0 {
+		encrypted, _, err := crypto.EncryptIfKeySet([]byte(target.Config), s.encryptionKey)
+		if err != nil {
+			return fmt.Errorf("failed to encrypt config: %w", err)
+		}
+		target.EncryptedConfig = encrypted
+		target.Config = redactConfigJSON(target.Config)
+	}
+
 	if err := s.targetRepo.Create(ctx, target); err != nil {
 		return fmt.Errorf("failed to create target: %w", err)
 	}
 
 	if s.auditService != nil {
 		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "create_target", "target", target.ID, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
 	return nil
 }
 
-// Update modifies an existing deployment target.
+// Update modifies an existing deployment target. Handles "********" preservation for sensitive fields.
 func (s *TargetService) Update(ctx context.Context, id string, target *domain.DeploymentTarget, actor string) error {
 	if target.Name == "" {
 		return fmt.Errorf("target name is required")
 	}
 
 	target.ID = id
+	target.UpdatedAt = time.Now()
+
+	// If config contains "********" values, merge with existing decrypted config
+	if len(target.Config) > 0 {
+		mergedConfig, err := s.mergeRedactedConfig(ctx, id, target.Config)
+		if err != nil {
+			return fmt.Errorf("failed to merge config: %w", err)
+		}
+
+		// Encrypt the merged config
+		encrypted, _, encErr := crypto.EncryptIfKeySet(mergedConfig, s.encryptionKey)
+		if encErr != nil {
+			return fmt.Errorf("failed to encrypt config: %w", encErr)
+		}
+		target.EncryptedConfig = encrypted
+		target.Config = redactConfigJSON(json.RawMessage(mergedConfig))
+	}
+
 	if err := s.targetRepo.Update(ctx, target); err != nil {
 		return fmt.Errorf("failed to update target %s: %w", id, err)
 	}
 
 	if s.auditService != nil {
 		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "update_target", "target", id, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
@@ -118,13 +186,50 @@ func (s *TargetService) Delete(ctx context.Context, id string, actor string) err
 
 	if s.auditService != nil {
 		if auditErr := s.auditService.RecordEvent(ctx, actor, domain.ActorTypeUser, "delete_target", "target", id, nil); auditErr != nil {
-			slog.Error("failed to record audit event", "error", auditErr)
+			s.logger.Error("failed to record audit event", "error", auditErr)
 		}
 	}
 
 	return nil
 }
 
+// TestConnection tests a target's connectivity by checking the assigned agent's heartbeat status.
+// Target connectors run on agents, not on the server, so we can't instantiate a connector here.
+// Instead, we verify the agent is online and reachable.
+func (s *TargetService) TestConnection(ctx context.Context, id string) error {
+	target, err := s.targetRepo.Get(ctx, id)
+	if err != nil {
+		return fmt.Errorf("target not found: %w", err)
+	}
+
+	if target.AgentID == "" {
+		s.updateTestStatus(ctx, target, "failed")
+		return fmt.Errorf("target has no assigned agent")
+	}
+
+	agent, err := s.agentRepo.Get(ctx, target.AgentID)
+	if err != nil {
+		s.updateTestStatus(ctx, target, "failed")
+		return fmt.Errorf("assigned agent not found: %w", err)
+	}
+
+	if agent.Status != domain.AgentStatusOnline {
+		s.updateTestStatus(ctx, target, "failed")
+		return fmt.Errorf("assigned agent %s is %s (expected Online)", agent.ID, agent.Status)
+	}
+
+	// Check heartbeat freshness (agent must have heartbeated within the last 5 minutes)
+	if agent.LastHeartbeatAt != nil {
+		if time.Since(*agent.LastHeartbeatAt) > 5*time.Minute {
+			s.updateTestStatus(ctx, target, "failed")
+			return fmt.Errorf("assigned agent %s last heartbeat was %s ago (stale)", agent.ID, time.Since(*agent.LastHeartbeatAt).Round(time.Second))
+		}
+	}
+
+	s.updateTestStatus(ctx, target, "success")
+	return nil
+}
+
 // ListTargets returns paginated targets (handler interface method).
 func (s *TargetService) ListTargets(page, perPage int) ([]domain.DeploymentTarget, int64, error) {
 	if page < 1 {
@@ -157,6 +262,9 @@ func (s *TargetService) GetTarget(id string) (*domain.DeploymentTarget, error) {
 
 // CreateTarget creates a new target (handler interface method).
 func (s *TargetService) CreateTarget(target domain.DeploymentTarget) (*domain.DeploymentTarget, error) {
+	if !isValidTargetType(target.Type) {
+		return nil, fmt.Errorf("unsupported target type: %s", target.Type)
+	}
 	if target.ID == "" {
 		target.ID = generateID("target")
 	}
@@ -167,6 +275,23 @@ func (s *TargetService) CreateTarget(target domain.DeploymentTarget) (*domain.De
 	if target.UpdatedAt.IsZero() {
 		target.UpdatedAt = now
 	}
+	if target.TestStatus == "" {
+		target.TestStatus = "untested"
+	}
+	if target.Source == "" {
+		target.Source = "database"
+	}
+
+	// Encrypt config
+	if len(target.Config) > 0 {
+		encrypted, _, err := crypto.EncryptIfKeySet([]byte(target.Config), s.encryptionKey)
+		if err != nil {
+			return nil, fmt.Errorf("failed to encrypt config: %w", err)
+		}
+		target.EncryptedConfig = encrypted
+		target.Config = redactConfigJSON(target.Config)
+	}
+
 	if err := s.targetRepo.Create(context.Background(), &target); err != nil {
 		return nil, fmt.Errorf("failed to create target: %w", err)
 	}
@@ -176,6 +301,23 @@ func (s *TargetService) CreateTarget(target domain.DeploymentTarget) (*domain.De
 // UpdateTarget modifies a target (handler interface method).
 func (s *TargetService) UpdateTarget(id string, target domain.DeploymentTarget) (*domain.DeploymentTarget, error) {
 	target.ID = id
+	target.UpdatedAt = time.Now()
+
+	// Merge redacted fields with existing config
+	if len(target.Config) > 0 {
+		mergedConfig, err := s.mergeRedactedConfig(context.Background(), id, target.Config)
+		if err != nil {
+			return nil, fmt.Errorf("failed to merge config: %w", err)
+		}
+
+		encrypted, _, encErr := crypto.EncryptIfKeySet(mergedConfig, s.encryptionKey)
+		if encErr != nil {
+			return nil, fmt.Errorf("failed to encrypt config: %w", encErr)
+		}
+		target.EncryptedConfig = encrypted
+		target.Config = redactConfigJSON(json.RawMessage(mergedConfig))
+	}
+
 	if err := s.targetRepo.Update(context.Background(), &target); err != nil {
 		return nil, fmt.Errorf("failed to update target: %w", err)
 	}
@@ -186,3 +328,100 @@ func (s *TargetService) UpdateTarget(id string, target domain.DeploymentTarget)
 func (s *TargetService) DeleteTarget(id string) error {
 	return s.targetRepo.Delete(context.Background(), id)
 }
+
+// TestTargetConnection tests target connectivity (handler interface method).
+func (s *TargetService) TestTargetConnection(id string) error {
+	return s.TestConnection(context.Background(), id)
+}
+
+// --- Internal helpers ---
+
+// getDecryptedConfig returns the decrypted config JSON for a target.
+func (s *TargetService) getDecryptedConfig(target *domain.DeploymentTarget) (json.RawMessage, error) {
+	if len(target.EncryptedConfig) > 0 {
+		decrypted, err := crypto.DecryptIfKeySet(target.EncryptedConfig, s.encryptionKey)
+		if err != nil {
+			return nil, err
+		}
+		return json.RawMessage(decrypted), nil
+	}
+	if len(target.Config) > 0 {
+		return target.Config, nil
+	}
+	return json.RawMessage("{}"), nil
+}
+
+// mergeRedactedConfig merges incoming config (which may have "********" values)
+// with the existing decrypted config so sensitive fields are preserved.
+func (s *TargetService) mergeRedactedConfig(ctx context.Context, id string, incoming json.RawMessage) ([]byte, error) {
+	// Parse incoming config
+	var incomingMap map[string]interface{}
+	if err := json.Unmarshal(incoming, &incomingMap); err != nil {
+		s.logger.Warn("mergeRedactedConfig: incoming config is not a JSON object, using as-is", "target", id, "error", err)
+		return incoming, nil
+	}
+
+	// Check if any values are "********"
+	hasRedacted := false
+	for _, v := range incomingMap {
+		if str, ok := v.(string); ok && str == "********" {
+			hasRedacted = true
+			break
+		}
+	}
+
+	if !hasRedacted {
+		return incoming, nil // No redacted values, use incoming as-is
+	}
+
+	// Load existing target to get real values
+	existing, err := s.targetRepo.Get(ctx, id)
+	if err != nil {
+		s.logger.Warn("mergeRedactedConfig: could not load existing target, redacted values will be lost", "target", id, "error", err)
+		return incoming, nil
+	}
+
+	existingConfig, err := s.getDecryptedConfig(existing)
+	if err != nil {
+		s.logger.Warn("mergeRedactedConfig: could not decrypt existing config, redacted values will be lost", "target", id, "error", err)
+		return incoming, nil
+	}
+
+	var existingMap map[string]interface{}
+	if err := json.Unmarshal(existingConfig, &existingMap); err != nil {
+		s.logger.Warn("mergeRedactedConfig: existing config is not a JSON object, redacted values will be lost", "target", id, "error", err)
+		return incoming, nil
+	}
+
+	// Merge: for each "********" value in incoming, use existing value
+	for k, v := range incomingMap {
+		if str, ok := v.(string); ok && str == "********" {
+			if existingVal, exists := existingMap[k]; exists {
+				incomingMap[k] = existingVal
+			}
+		}
+	}
+
+	return json.Marshal(incomingMap)
+}
+
+// updateTestStatus updates the test_status and last_tested_at fields in the database
+// and records an audit event.
+func (s *TargetService) updateTestStatus(ctx context.Context, target *domain.DeploymentTarget, status string) {
+	now := time.Now()
+	target.TestStatus = status
+	target.LastTestedAt = &now
+	target.UpdatedAt = now
+	if err := s.targetRepo.Update(ctx, target); err != nil {
+		s.logger.Error("failed to update test status", "target", target.ID, "status", status, "error", err)
+	}
+
+	// Record audit event for connection test
+	if s.auditService != nil {
+		action := "target_test_connection_" + status
+		details := map[string]interface{}{"target_type": string(target.Type), "result": status, "agent_id": target.AgentID}
+		if auditErr := s.auditService.RecordEvent(ctx, "system", domain.ActorTypeSystem, action, "target", target.ID, details); auditErr != nil {
+			s.logger.Error("failed to record test connection audit event", "error", auditErr)
+		}
+	}
+}

internal/service/target_test.go

@@ -3,21 +3,26 @@ package service
 import (
 	"context"
 	"encoding/json"
+	"log/slog"
+	"os"
 	"testing"
+	"time"
 
 	"github.com/shankar0123/certctl/internal/domain"
 )
 
 // newTestTargetService creates a TargetService with mock repositories for testing.
-func newTestTargetService() (*TargetService, *mockTargetRepo, *mockAuditRepo) {
+func newTestTargetService() (*TargetService, *mockTargetRepo, *mockAuditRepo, *mockAgentRepo) {
 	targetRepo := &mockTargetRepo{Targets: make(map[string]*domain.DeploymentTarget)}
 	auditRepo := newMockAuditRepository()
 	auditSvc := NewAuditService(auditRepo)
-	return NewTargetService(targetRepo, auditSvc), targetRepo, auditRepo
+	agentRepo := &mockAgentRepo{Agents: make(map[string]*domain.Agent), HeartbeatUpdates: make(map[string]time.Time)}
+	logger := slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelError}))
+	return NewTargetService(targetRepo, auditSvc, agentRepo, nil, logger), targetRepo, auditRepo, agentRepo
 }
 
 func TestTargetService_List_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Add 3 targets
@@ -44,7 +49,7 @@ func TestTargetService_List_Success(t *testing.T) {
 }
 
 func TestTargetService_List_DefaultPagination(t *testing.T) {
-	svc, _, _ := newTestTargetService()
+	svc, _, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Call with invalid pagination (page=0, perPage=0)
@@ -60,7 +65,7 @@ func TestTargetService_List_DefaultPagination(t *testing.T) {
 }
 
 func TestTargetService_List_EmptyPage(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Add 3 targets
@@ -87,7 +92,7 @@ func TestTargetService_List_EmptyPage(t *testing.T) {
 }
 
 func TestTargetService_List_RepoError(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Set repo to return error
@@ -104,7 +109,7 @@ func TestTargetService_List_RepoError(t *testing.T) {
 }
 
 func TestTargetService_Get_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	target := &domain.DeploymentTarget{ID: "t-1", Name: "Target 1", Type: domain.TargetTypeNGINX}
@@ -121,7 +126,7 @@ func TestTargetService_Get_Success(t *testing.T) {
 }
 
 func TestTargetService_Get_NotFound(t *testing.T) {
-	svc, _, _ := newTestTargetService()
+	svc, _, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	result, err := svc.Get(ctx, "nonexistent")
@@ -135,7 +140,7 @@ func TestTargetService_Get_NotFound(t *testing.T) {
 }
 
 func TestTargetService_Create_Success(t *testing.T) {
-	svc, targetRepo, auditRepo := newTestTargetService()
+	svc, targetRepo, auditRepo, _ := newTestTargetService()
 	ctx := context.Background()
 
 	target := &domain.DeploymentTarget{
@@ -168,6 +173,14 @@ func TestTargetService_Create_Success(t *testing.T) {
 		t.Errorf("expected timestamps to be set, CreatedAt=%v, UpdatedAt=%v", target.CreatedAt, target.UpdatedAt)
 	}
 
+	// Verify test status and source defaults
+	if target.TestStatus != "untested" {
+		t.Errorf("expected test_status 'untested', got %s", target.TestStatus)
+	}
+	if target.Source != "database" {
+		t.Errorf("expected source 'database', got %s", target.Source)
+	}
+
 	// Verify audit event
 	if len(auditRepo.Events) == 0 {
 		t.Fatalf("expected audit event, got none")
@@ -184,7 +197,7 @@ func TestTargetService_Create_Success(t *testing.T) {
 }
 
 func TestTargetService_Create_MissingName(t *testing.T) {
-	svc, _, _ := newTestTargetService()
+	svc, _, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	target := &domain.DeploymentTarget{
@@ -197,8 +210,23 @@ func TestTargetService_Create_MissingName(t *testing.T) {
 	}
 }
 
+func TestTargetService_Create_InvalidType(t *testing.T) {
+	svc, _, _, _ := newTestTargetService()
+	ctx := context.Background()
+
+	target := &domain.DeploymentTarget{
+		Name: "Bad Target",
+		Type: domain.TargetType("InvalidType"),
+	}
+
+	err := svc.Create(ctx, target, "test-actor")
+	if err == nil {
+		t.Fatalf("expected error for invalid type, got nil")
+	}
+}
+
 func TestTargetService_Create_RepoError(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	targetRepo.CreateErr = errNotFound
@@ -215,7 +243,7 @@ func TestTargetService_Create_RepoError(t *testing.T) {
 }
 
 func TestTargetService_Update_Success(t *testing.T) {
-	svc, targetRepo, auditRepo := newTestTargetService()
+	svc, targetRepo, auditRepo, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Create initial target
@@ -251,7 +279,7 @@ func TestTargetService_Update_Success(t *testing.T) {
 }
 
 func TestTargetService_Update_MissingName(t *testing.T) {
-	svc, _, _ := newTestTargetService()
+	svc, _, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	target := &domain.DeploymentTarget{
@@ -265,7 +293,7 @@ func TestTargetService_Update_MissingName(t *testing.T) {
 }
 
 func TestTargetService_Delete_Success(t *testing.T) {
-	svc, targetRepo, auditRepo := newTestTargetService()
+	svc, targetRepo, auditRepo, _ := newTestTargetService()
 	ctx := context.Background()
 
 	// Create initial target
@@ -295,7 +323,7 @@ func TestTargetService_Delete_Success(t *testing.T) {
 }
 
 func TestTargetService_Delete_RepoError(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 	ctx := context.Background()
 
 	targetRepo.DeleteErr = errNotFound
@@ -307,7 +335,7 @@ func TestTargetService_Delete_RepoError(t *testing.T) {
 }
 
 func TestTargetService_ListTargets_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 
 	// Add targets
 	target1 := &domain.DeploymentTarget{ID: "t-1", Name: "Target 1", Type: domain.TargetTypeNGINX}
@@ -331,7 +359,7 @@ func TestTargetService_ListTargets_Success(t *testing.T) {
 }
 
 func TestTargetService_GetTarget_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 
 	target := &domain.DeploymentTarget{ID: "t-1", Name: "Target 1", Type: domain.TargetTypeNGINX}
 	targetRepo.AddTarget(target)
@@ -347,7 +375,7 @@ func TestTargetService_GetTarget_Success(t *testing.T) {
 }
 
 func TestTargetService_CreateTarget_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 
 	target := domain.DeploymentTarget{
 		Name: "New Target",
@@ -369,8 +397,22 @@ func TestTargetService_CreateTarget_Success(t *testing.T) {
 	}
 }
 
+func TestTargetService_CreateTarget_InvalidType(t *testing.T) {
+	svc, _, _, _ := newTestTargetService()
+
+	target := domain.DeploymentTarget{
+		Name: "Bad Target",
+		Type: domain.TargetType("Unknown"),
+	}
+
+	_, err := svc.CreateTarget(target)
+	if err == nil {
+		t.Fatalf("expected error for invalid type, got nil")
+	}
+}
+
 func TestTargetService_UpdateTarget_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 
 	// Create initial target
 	target := &domain.DeploymentTarget{ID: "t-1", Name: "Old Name", Type: domain.TargetTypeNGINX}
@@ -393,7 +435,7 @@ func TestTargetService_UpdateTarget_Success(t *testing.T) {
 }
 
 func TestTargetService_DeleteTarget_Success(t *testing.T) {
-	svc, targetRepo, _ := newTestTargetService()
+	svc, targetRepo, _, _ := newTestTargetService()
 
 	// Create initial target
 	target := &domain.DeploymentTarget{ID: "t-1", Name: "Target To Delete", Type: domain.TargetTypeNGINX}
@@ -410,3 +452,130 @@ func TestTargetService_DeleteTarget_Success(t *testing.T) {
 		t.Errorf("target should be deleted from repo")
 	}
 }
+
+func TestTargetService_TestConnection_AgentOnline(t *testing.T) {
+	svc, targetRepo, _, agentRepo := newTestTargetService()
+	ctx := context.Background()
+
+	// Set up agent
+	heartbeat := time.Now()
+	agent := &domain.Agent{
+		ID:              "agent-1",
+		Name:            "Test Agent",
+		Status:          domain.AgentStatusOnline,
+		LastHeartbeatAt: &heartbeat,
+	}
+	agentRepo.Create(ctx, agent)
+
+	// Set up target assigned to agent
+	target := &domain.DeploymentTarget{
+		ID:      "t-1",
+		Name:    "Test Target",
+		Type:    domain.TargetTypeNGINX,
+		AgentID: "agent-1",
+	}
+	targetRepo.AddTarget(target)
+
+	// Test connection should succeed
+	err := svc.TestConnection(ctx, "t-1")
+	if err != nil {
+		t.Fatalf("expected success, got error: %v", err)
+	}
+
+	// Verify test status was updated
+	stored := targetRepo.Targets["t-1"]
+	if stored.TestStatus != "success" {
+		t.Errorf("expected test_status 'success', got %s", stored.TestStatus)
+	}
+	if stored.LastTestedAt == nil {
+		t.Error("expected last_tested_at to be set")
+	}
+}
+
+func TestTargetService_TestConnection_AgentOffline(t *testing.T) {
+	svc, targetRepo, _, agentRepo := newTestTargetService()
+	ctx := context.Background()
+
+	// Set up offline agent
+	agent := &domain.Agent{
+		ID:     "agent-1",
+		Name:   "Offline Agent",
+		Status: domain.AgentStatusOffline,
+	}
+	agentRepo.Create(ctx, agent)
+
+	// Set up target
+	target := &domain.DeploymentTarget{
+		ID:      "t-1",
+		Name:    "Test Target",
+		Type:    domain.TargetTypeNGINX,
+		AgentID: "agent-1",
+	}
+	targetRepo.AddTarget(target)
+
+	err := svc.TestConnection(ctx, "t-1")
+	if err == nil {
+		t.Fatal("expected error for offline agent, got nil")
+	}
+
+	stored := targetRepo.Targets["t-1"]
+	if stored.TestStatus != "failed" {
+		t.Errorf("expected test_status 'failed', got %s", stored.TestStatus)
+	}
+}
+
+func TestTargetService_TestConnection_NoAgent(t *testing.T) {
+	svc, targetRepo, _, _ := newTestTargetService()
+	ctx := context.Background()
+
+	target := &domain.DeploymentTarget{
+		ID:      "t-1",
+		Name:    "Test Target",
+		Type:    domain.TargetTypeNGINX,
+		AgentID: "",
+	}
+	targetRepo.AddTarget(target)
+
+	err := svc.TestConnection(ctx, "t-1")
+	if err == nil {
+		t.Fatal("expected error for missing agent, got nil")
+	}
+}
+
+func TestTargetService_TestConnection_TargetNotFound(t *testing.T) {
+	svc, _, _, _ := newTestTargetService()
+	ctx := context.Background()
+
+	err := svc.TestConnection(ctx, "nonexistent")
+	if err == nil {
+		t.Fatal("expected error for nonexistent target, got nil")
+	}
+}
+
+func TestTargetService_TestConnection_StaleHeartbeat(t *testing.T) {
+	svc, targetRepo, _, agentRepo := newTestTargetService()
+	ctx := context.Background()
+
+	// Set up agent with stale heartbeat (10 minutes ago)
+	staleTime := time.Now().Add(-10 * time.Minute)
+	agent := &domain.Agent{
+		ID:              "agent-1",
+		Name:            "Stale Agent",
+		Status:          domain.AgentStatusOnline,
+		LastHeartbeatAt: &staleTime,
+	}
+	agentRepo.Create(ctx, agent)
+
+	target := &domain.DeploymentTarget{
+		ID:      "t-1",
+		Name:    "Test Target",
+		Type:    domain.TargetTypeNGINX,
+		AgentID: "agent-1",
+	}
+	targetRepo.AddTarget(target)
+
+	err := svc.TestConnection(ctx, "t-1")
+	if err == nil {
+		t.Fatal("expected error for stale heartbeat, got nil")
+	}
+}

internal/service/testutil_test.go

@@ -637,6 +637,19 @@ func (m *mockTargetRepo) Create(ctx context.Context, target *domain.DeploymentTa
 	return nil
 }
 
+func (m *mockTargetRepo) CreateIfNotExists(ctx context.Context, target *domain.DeploymentTarget) (bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.CreateErr != nil {
+		return false, m.CreateErr
+	}
+	if _, exists := m.Targets[target.ID]; exists {
+		return false, nil
+	}
+	m.Targets[target.ID] = target
+	return true, nil
+}
+
 func (m *mockTargetRepo) Update(ctx context.Context, target *domain.DeploymentTarget) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
@@ -856,6 +869,17 @@ func (m *mockIssuerRepository) Update(ctx context.Context, issuer *domain.Issuer
 	return nil
 }
 
+func (m *mockIssuerRepository) CreateIfNotExists(ctx context.Context, issuer *domain.Issuer) (bool, error) {
+	if m.CreateErr != nil {
+		return false, m.CreateErr
+	}
+	if _, exists := m.issuers[issuer.ID]; exists {
+		return false, nil
+	}
+	m.issuers[issuer.ID] = issuer
+	return true, nil
+}
+
 func (m *mockIssuerRepository) Delete(ctx context.Context, id string) error {
 	if m.DeleteErr != nil {
 		return m.DeleteErr

migrations/000009_issuer_config.down.sql

@@ -0,0 +1,5 @@
+-- Rollback migration 000009: Remove dynamic issuer configuration columns
+ALTER TABLE issuers DROP COLUMN IF EXISTS encrypted_config;
+ALTER TABLE issuers DROP COLUMN IF EXISTS last_tested_at;
+ALTER TABLE issuers DROP COLUMN IF EXISTS test_status;
+ALTER TABLE issuers DROP COLUMN IF EXISTS source;

migrations/000009_issuer_config.up.sql

@@ -0,0 +1,16 @@
+-- Migration 000009: Add dynamic issuer configuration columns
+-- Supports M34: Dynamic Issuer Configuration (GUI)
+
+-- encrypted_config stores AES-GCM encrypted config blob containing all fields including secrets.
+-- The existing `config` JSONB column is retained for backward compatibility and holds a redacted copy.
+ALTER TABLE issuers ADD COLUMN IF NOT EXISTS encrypted_config BYTEA;
+
+-- last_tested_at tracks when the issuer connection was last successfully tested.
+ALTER TABLE issuers ADD COLUMN IF NOT EXISTS last_tested_at TIMESTAMPTZ;
+
+-- test_status tracks the latest connection test result.
+ALTER TABLE issuers ADD COLUMN IF NOT EXISTS test_status TEXT NOT NULL DEFAULT 'untested';
+
+-- source tracks where the issuer configuration originated from.
+-- 'database' = created via GUI, 'env' = seeded from environment variables.
+ALTER TABLE issuers ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'database';

migrations/000010_target_config.down.sql

@@ -0,0 +1,5 @@
+-- Rollback migration 000010: Remove dynamic target configuration columns
+ALTER TABLE deployment_targets DROP COLUMN IF EXISTS encrypted_config;
+ALTER TABLE deployment_targets DROP COLUMN IF EXISTS last_tested_at;
+ALTER TABLE deployment_targets DROP COLUMN IF EXISTS test_status;
+ALTER TABLE deployment_targets DROP COLUMN IF EXISTS source;

migrations/000010_target_config.up.sql

@@ -0,0 +1,16 @@
+-- Migration 000010: Add dynamic target configuration columns
+-- Supports M35: Dynamic Target Configuration (GUI)
+
+-- encrypted_config stores AES-GCM encrypted config blob containing all fields including secrets.
+-- The existing `config` JSONB column is retained for backward compatibility and holds a redacted copy.
+ALTER TABLE deployment_targets ADD COLUMN IF NOT EXISTS encrypted_config BYTEA;
+
+-- last_tested_at tracks when the target connection was last tested (agent heartbeat check).
+ALTER TABLE deployment_targets ADD COLUMN IF NOT EXISTS last_tested_at TIMESTAMPTZ;
+
+-- test_status tracks the latest connection test result.
+ALTER TABLE deployment_targets ADD COLUMN IF NOT EXISTS test_status TEXT NOT NULL DEFAULT 'untested';
+
+-- source tracks where the target configuration originated from.
+-- 'database' = created via GUI, 'env' = seeded from environment variables.
+ALTER TABLE deployment_targets ADD COLUMN IF NOT EXISTS source TEXT NOT NULL DEFAULT 'database';

web/src/api/client.test.ts

@@ -36,6 +36,7 @@ import {
   getTargets,
   createTarget,
   deleteTarget,
+  testTargetConnection,
   getProfiles,
   getProfile,
   createProfile,
@@ -425,6 +426,14 @@ describe('API Client', () => {
       expect(url).toBe('/api/v1/targets/t-nginx');
       expect(init.method).toBe('DELETE');
     });
+
+    it('testTargetConnection sends POST', async () => {
+      mockFetch.mockReturnValueOnce(mockJsonResponse({ status: 'success', message: 'Agent is online' }));
+      await testTargetConnection('t-nginx');
+      const [url, init] = mockFetch.mock.calls[0];
+      expect(url).toBe('/api/v1/targets/t-nginx/test');
+      expect(init.method).toBe('POST');
+    });
   });
 
   // ─── Approval ──────────────────────────────────────

web/src/api/client.ts

@@ -232,6 +232,9 @@ export const updateTarget = (id: string, data: Partial<Target>) =>
 export const deleteTarget = (id: string) =>
   fetchJSON<{ message: string }>(`${BASE}/targets/${id}`, { method: 'DELETE' });
 
+export const testTargetConnection = (id: string) =>
+  fetchJSON<{ status: string; message: string }>(`${BASE}/targets/${id}/test`, { method: 'POST' });
+
 // Profiles
 export const getProfiles = (params: Record<string, string> = {}) => {
   const qs = new URLSearchParams({ page: '1', per_page: '50', ...params }).toString();

web/src/api/types.ts

@@ -142,6 +142,12 @@ export interface Issuer {
   status: string;
   /** Backend returns enabled boolean; status is derived from this */
   enabled: boolean;
+  /** Timestamp of last connection test */
+  last_tested_at?: string;
+  /** Result of last connection test: "untested", "success", or "failed" */
+  test_status?: string;
+  /** Config source: "database" (GUI-created) or "env" (env var seeded) */
+  source?: string;
   created_at: string;
   updated_at?: string;
 }
@@ -150,10 +156,12 @@ export interface Target {
   id: string;
   name: string;
   type: string;
-  hostname: string;
   agent_id: string;
   config: Record<string, unknown>;
-  status: string;
+  enabled: boolean;
+  last_tested_at?: string;
+  test_status?: string;
+  source?: string;
   created_at: string;
   updated_at?: string;
 }

web/src/pages/CertificateDetailPage.tsx

@@ -660,7 +660,7 @@ export default function CertificateDetailPage() {
             >
               <option value="">Choose a target...</option>
               {targets?.data?.map(t => (
-                <option key={t.id} value={t.id}>{t.name} ({t.type} — {t.hostname})</option>
+                <option key={t.id} value={t.id}>{t.name} ({t.type})</option>
               ))}
             </select>
             <div className="flex justify-end gap-3">

web/src/pages/DashboardPage.tsx

@@ -8,11 +8,12 @@ import {
 import {
   getCertificates, getAgents, getJobs, getNotifications, getHealth,
   getDashboardSummary, getCertificatesByStatus, getExpirationTimeline,
-  getJobTrends, getIssuanceRate, previewDigest, sendDigest,
+  getJobTrends, getIssuanceRate, previewDigest, sendDigest, getIssuers,
 } from '../api/client';
 import PageHeader from '../components/PageHeader';
 import StatusBadge from '../components/StatusBadge';
 import { daysUntil, expiryColor, formatDate } from '../api/utils';
+import OnboardingWizard from './OnboardingWizard';
 
 // Convert PascalCase status like "RenewalInProgress" to "Renewal In Progress"
 const formatStatus = (s: string) => s.replace(/([a-z])([A-Z])/g, '$1 $2');
@@ -162,8 +163,17 @@ function DigestCard() {
 export default function DashboardPage() {
   const navigate = useNavigate();
 
+  // Onboarding wizard state: once shown, stays shown until explicitly dismissed.
+  // Uses a ref to "latch" the first-run detection so query refetches don't yank the wizard away.
+  const [onboardingDismissed, setOnboardingDismissed] = useState(() => {
+    try { return localStorage.getItem('certctl:onboarding-dismissed') === 'true'; } catch { return false; }
+  });
+  const [showWizard, setShowWizard] = useState(false);
+
+  // All hooks must be called unconditionally (React rules of hooks — no hooks after early returns)
   const { data: health } = useQuery({ queryKey: ['health'], queryFn: getHealth, refetchInterval: 30000 });
   const { data: summary } = useQuery({ queryKey: ['dashboard-summary'], queryFn: getDashboardSummary, refetchInterval: 30000 });
+  const { data: issuersData } = useQuery({ queryKey: ['issuers'], queryFn: () => getIssuers() });
   const { data: statusCounts } = useQuery({ queryKey: ['certs-by-status'], queryFn: getCertificatesByStatus, refetchInterval: 30000 });
   const { data: expirationTimeline } = useQuery({ queryKey: ['expiration-timeline'], queryFn: () => getExpirationTimeline(90), refetchInterval: 60000 });
   const { data: jobTrends } = useQuery({ queryKey: ['job-trends'], queryFn: () => getJobTrends(30), refetchInterval: 30000 });
@@ -171,6 +181,30 @@ export default function DashboardPage() {
   const { data: certs } = useQuery({ queryKey: ['certificates', {}], queryFn: () => getCertificates(), refetchInterval: 30000 });
   const { data: jobs } = useQuery({ queryKey: ['jobs', {}], queryFn: () => getJobs(), refetchInterval: 10000 });
 
+  // Detect first-run ONCE: no user-configured issuers AND no certificates.
+  // Auto-seeded env var issuers (source="env") don't count — they exist on every fresh boot.
+  // Once showWizard latches true, it stays true until the user dismisses.
+  const userConfiguredIssuers = (issuersData?.data ?? []).filter((i: { source?: string }) => i.source !== 'env');
+  const isFirstRun = !onboardingDismissed &&
+    summary !== undefined && issuersData !== undefined &&
+    summary.total_certificates === 0 &&
+    userConfiguredIssuers.length === 0;
+
+  if (isFirstRun && !showWizard) {
+    // Can't call setState during render — use a microtask
+    setTimeout(() => setShowWizard(true), 0);
+  }
+
+  if (showWizard && !onboardingDismissed) {
+    return (
+      <OnboardingWizard onDismiss={() => {
+        try { localStorage.setItem('certctl:onboarding-dismissed', 'true'); } catch { /* noop */ }
+        setOnboardingDismissed(true);
+        setShowWizard(false);
+      }} />
+    );
+  }
+
   const totalCerts = summary?.total_certificates || 0;
   const expiringSoon = summary?.expiring_certificates || 0;
   const expired = summary?.expired_certificates || 0;

web/src/pages/IssuerDetailPage.tsx

@@ -45,6 +45,7 @@ export default function IssuerDetailPage() {
 
   const testMutation = useMutation({
     mutationFn: () => testIssuerConnection(id!),
+    onSuccess: () => refetch(),
   });
 
   if (error) {
@@ -128,6 +129,22 @@ export default function IssuerDetailPage() {
             <InfoRow label="Name" value={issuer.name} />
             <InfoRow label="Type" value={typeLabels[issuer.type] || issuer.type} />
             <InfoRow label="Status" value={<StatusBadge status={issuerStatus(issuer)} />} />
+            <InfoRow label="Source" value={
+              <span className={`text-xs px-2 py-0.5 rounded-full ${
+                issuer.source === 'env' ? 'bg-amber-100 text-amber-700' : 'bg-blue-100 text-blue-700'
+              }`}>
+                {issuer.source === 'env' ? 'Environment Variable' : 'GUI Configured'}
+              </span>
+            } />
+            <InfoRow label="Connection Test" value={
+              issuer.test_status === 'success' ? (
+                <span className="text-xs text-emerald-600 font-medium">Passed {issuer.last_tested_at ? formatDateTime(issuer.last_tested_at) : ''}</span>
+              ) : issuer.test_status === 'failed' ? (
+                <span className="text-xs text-red-600 font-medium">Failed {issuer.last_tested_at ? formatDateTime(issuer.last_tested_at) : ''}</span>
+              ) : (
+                <span className="text-xs text-ink-faint">Not tested</span>
+              )
+            } />
             <InfoRow label="Created" value={formatDateTime(issuer.created_at)} />
           </div>
 

web/src/pages/OnboardingWizard.tsx

@@ -0,0 +1,692 @@
+import { useState } from 'react';
+import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
+import { useNavigate, Link } from 'react-router-dom';
+import {
+  getIssuers, getAgents, getProfiles,
+  createIssuer, testIssuerConnection,
+  createCertificate, triggerRenewal,
+  getApiKey,
+} from '../api/client';
+import { issuerTypes, type IssuerTypeConfig } from '../config/issuerTypes';
+import ConfigForm from '../components/issuer/ConfigForm';
+import type { Issuer, Agent } from '../api/types';
+
+// ─── Types ───────────────────────────────────────────
+
+type WizardStep = 'issuer' | 'agent' | 'certificate' | 'complete';
+
+const STEPS: { key: WizardStep; label: string }[] = [
+  { key: 'issuer', label: 'Connect a CA' },
+  { key: 'agent', label: 'Deploy Agent' },
+  { key: 'certificate', label: 'Add Certificate' },
+  { key: 'complete', label: 'Done' },
+];
+
+// ─── Helpers ─────────────────────────────────────────
+
+function CodeBlock({ code, label }: { code: string; label?: string }) {
+  const [copied, setCopied] = useState(false);
+  return (
+    <div className="relative">
+      {label && <div className="text-xs text-ink-muted mb-1 font-medium">{label}</div>}
+      <pre className="bg-gray-900 text-gray-100 rounded p-4 text-sm font-mono overflow-x-auto whitespace-pre-wrap">
+        {code}
+      </pre>
+      <button
+        onClick={() => { navigator.clipboard.writeText(code); setCopied(true); setTimeout(() => setCopied(false), 2000); }}
+        className="absolute top-2 right-2 px-2 py-1 bg-gray-700 hover:bg-gray-600 text-gray-300 text-xs rounded transition-colors"
+      >
+        {copied ? 'Copied!' : 'Copy'}
+      </button>
+    </div>
+  );
+}
+
+function StepIndicator({ steps, current }: { steps: typeof STEPS; current: WizardStep }) {
+  const currentIdx = steps.findIndex(s => s.key === current);
+  return (
+    <div className="flex items-center justify-center gap-2 mb-8">
+      {steps.map((s, i) => {
+        const isCompleted = i < currentIdx;
+        const isCurrent = s.key === current;
+        return (
+          <div key={s.key} className="flex items-center gap-2">
+            <div className={`w-8 h-8 rounded-full flex items-center justify-center text-xs font-bold transition-colors ${
+              isCompleted ? 'bg-emerald-500 text-white' :
+              isCurrent ? 'bg-accent text-white' :
+              'bg-surface-border text-ink-muted'
+            }`}>
+              {isCompleted ? (
+                <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={3}>
+                  <path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" />
+                </svg>
+              ) : i + 1}
+            </div>
+            <span className={`text-xs font-medium hidden sm:inline ${isCurrent ? 'text-ink' : 'text-ink-muted'}`}>
+              {s.label}
+            </span>
+            {i < steps.length - 1 && (
+              <div className={`w-8 h-0.5 ${i < currentIdx ? 'bg-emerald-500' : 'bg-surface-border'}`} />
+            )}
+          </div>
+        );
+      })}
+    </div>
+  );
+}
+
+function WizardFooter({ onSkip, onNext, nextLabel, nextDisabled, showSkip = true }: {
+  onSkip?: () => void;
+  onNext?: () => void;
+  nextLabel?: string;
+  nextDisabled?: boolean;
+  showSkip?: boolean;
+}) {
+  return (
+    <div className="flex justify-between items-center pt-6 border-t border-surface-border mt-6">
+      <div>
+        {showSkip && onSkip && (
+          <button onClick={onSkip} className="text-sm text-ink-muted hover:text-ink transition-colors">
+            Skip this step
+          </button>
+        )}
+      </div>
+      {onNext && (
+        <button
+          onClick={onNext}
+          disabled={nextDisabled}
+          className="btn btn-primary disabled:opacity-50"
+        >
+          {nextLabel || 'Continue'}
+        </button>
+      )}
+    </div>
+  );
+}
+
+// ─── Step 1: Connect a CA ────────────────────────────
+
+function IssuerStep({ onNext, onSkip, onIssuerCreated }: {
+  onNext: () => void;
+  onSkip: () => void;
+  onIssuerCreated: (issuer: Issuer) => void;
+}) {
+  const queryClient = useQueryClient();
+  const [selectedType, setSelectedType] = useState<string | null>(null);
+  const [configValues, setConfigValues] = useState<Record<string, unknown>>({});
+  const [issuerName, setIssuerName] = useState('');
+  const [error, setError] = useState('');
+  const [testResult, setTestResult] = useState<{ ok: boolean; msg: string } | null>(null);
+  const [createdIssuer, setCreatedIssuer] = useState<Issuer | null>(null);
+
+  const typeConfig = selectedType ? issuerTypes.find(t => t.id === selectedType) : null;
+
+  const createMutation = useMutation({
+    mutationFn: () => createIssuer({
+      name: issuerName || `${typeConfig?.name || selectedType} Issuer`,
+      type: selectedType!,
+      config: configValues as Record<string, unknown>,
+    }),
+    onSuccess: (issuer) => {
+      setCreatedIssuer(issuer);
+      onIssuerCreated(issuer);
+      queryClient.invalidateQueries({ queryKey: ['issuers'] });
+      setError('');
+    },
+    onError: (err: Error) => setError(err.message),
+  });
+
+  const testMutation = useMutation({
+    mutationFn: () => testIssuerConnection(createdIssuer!.id),
+    onSuccess: () => setTestResult({ ok: true, msg: 'Connection successful' }),
+    onError: (err: Error) => setTestResult({ ok: false, msg: err.message }),
+  });
+
+  // After issuer is created successfully
+  if (createdIssuer) {
+    return (
+      <div>
+        <h2 className="text-lg font-semibold text-ink mb-2">CA Connected</h2>
+        <div className="bg-emerald-50 border border-emerald-200 rounded p-4 mb-4">
+          <div className="flex items-center gap-2">
+            <svg className="w-5 h-5 text-emerald-600" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+            </svg>
+            <span className="text-sm font-medium text-emerald-700">
+              {createdIssuer.name} ({typeConfig?.name}) created successfully
+            </span>
+          </div>
+        </div>
+
+        {!testResult && (
+          <button
+            onClick={() => testMutation.mutate()}
+            disabled={testMutation.isPending}
+            className="btn btn-secondary text-sm mb-4"
+          >
+            {testMutation.isPending ? 'Testing...' : 'Test Connection'}
+          </button>
+        )}
+
+        {testResult?.ok && (
+          <div className="bg-emerald-50 border border-emerald-200 rounded p-3 mb-4 text-sm text-emerald-700">
+            Connection test passed.
+          </div>
+        )}
+        {testResult && !testResult.ok && (
+          <div className="bg-red-50 border border-red-200 rounded p-3 mb-4 text-sm text-red-700">
+            Connection test failed: {testResult.msg}
+          </div>
+        )}
+
+        <WizardFooter onNext={onNext} nextLabel="Next: Deploy Agent" showSkip={false} />
+      </div>
+    );
+  }
+
+  // Type selection
+  if (!selectedType) {
+    return (
+      <div>
+        <h2 className="text-lg font-semibold text-ink mb-1">Connect a Certificate Authority</h2>
+        <p className="text-sm text-ink-muted mb-6">
+          Choose a CA to issue and manage certificates. You can add more later from the Issuers page.
+        </p>
+        <div className="grid grid-cols-2 gap-4">
+          {issuerTypes.filter(t => !t.comingSoon).map((type: IssuerTypeConfig) => (
+            <button
+              key={type.id}
+              onClick={() => setSelectedType(type.id)}
+              className="p-4 border border-surface-border rounded-lg hover:border-brand-500 hover:bg-surface-muted transition-all text-left"
+            >
+              <div className="flex items-center gap-2">
+                <span className="text-lg">{type.icon}</span>
+                <span className="font-medium text-ink">{type.name}</span>
+              </div>
+              <div className="text-xs text-ink-muted mt-1">{type.description}</div>
+            </button>
+          ))}
+        </div>
+        <WizardFooter onSkip={onSkip} />
+      </div>
+    );
+  }
+
+  // Config form for selected type
+  const requiredFields = typeConfig?.configFields.filter(f => f.required) || [];
+  const allRequiredFilled = requiredFields.every(f => configValues[f.key]);
+
+  return (
+    <div>
+      <div className="flex items-center gap-2 mb-1">
+        <button onClick={() => { setSelectedType(null); setConfigValues({}); setError(''); }}
+          className="text-ink-muted hover:text-ink transition-colors">
+          <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+            <path strokeLinecap="round" strokeLinejoin="round" d="M15 19l-7-7 7-7" />
+          </svg>
+        </button>
+        <h2 className="text-lg font-semibold text-ink">
+          Configure {typeConfig?.name}
+        </h2>
+      </div>
+      <p className="text-sm text-ink-muted mb-6">{typeConfig?.description}</p>
+
+      <div className="mb-5">
+        <label className="block text-sm font-medium text-ink mb-2">Display Name</label>
+        <input
+          type="text"
+          value={issuerName}
+          onChange={e => setIssuerName(e.target.value)}
+          placeholder={`${typeConfig?.name || ''} Issuer`}
+          className="w-full px-3 py-2 bg-surface border border-surface-border rounded text-ink placeholder-ink-faint focus:outline-none focus:border-brand-500 transition-colors"
+        />
+      </div>
+
+      <ConfigForm
+        fields={typeConfig?.configFields || []}
+        values={configValues}
+        onChange={(key, val) => setConfigValues(prev => ({ ...prev, [key]: val }))}
+      />
+
+      {error && (
+        <div className="mt-4 p-3 bg-red-50 border border-red-200 rounded text-sm text-red-700">{error}</div>
+      )}
+
+      <WizardFooter
+        onSkip={onSkip}
+        onNext={() => createMutation.mutate()}
+        nextLabel={createMutation.isPending ? 'Creating...' : 'Create Issuer'}
+        nextDisabled={!allRequiredFilled || createMutation.isPending}
+      />
+    </div>
+  );
+}
+
+// ─── Step 2: Deploy an Agent ─────────────────────────
+
+function AgentStep({ onNext, onSkip }: { onNext: () => void; onSkip: () => void }) {
+  const [activeTab, setActiveTab] = useState<'linux' | 'macos' | 'docker'>('linux');
+
+  const apiKey = getApiKey() || '<your-api-key>';
+  const serverUrl = typeof window !== 'undefined' ? `${window.location.protocol}//${window.location.hostname}:8443` : 'http://localhost:8443';
+
+  // Poll for agents every 5s
+  const { data: agents } = useQuery({
+    queryKey: ['agents'],
+    queryFn: () => getAgents(),
+    refetchInterval: 5000,
+  });
+
+  const agentList = agents?.data || [];
+  const hasAgents = agentList.length > 0;
+
+  const tabs = [
+    { key: 'linux' as const, label: 'Linux' },
+    { key: 'macos' as const, label: 'macOS' },
+    { key: 'docker' as const, label: 'Docker' },
+  ];
+
+  const commands: Record<string, { code: string; label: string }> = {
+    linux: {
+      label: 'Install via shell script (systemd service)',
+      code: `curl -sSL https://raw.githubusercontent.com/shankar0123/certctl/master/install-agent.sh | bash
+
+# Then configure:
+sudo systemctl edit certctl-agent
+# Add:
+# [Service]
+# Environment="CERTCTL_SERVER_URL=${serverUrl}"
+# Environment="CERTCTL_API_KEY=${apiKey}"
+
+sudo systemctl restart certctl-agent`,
+    },
+    macos: {
+      label: 'Install via shell script (launchd service)',
+      code: `curl -sSL https://raw.githubusercontent.com/shankar0123/certctl/master/install-agent.sh | bash
+
+# Then configure:
+# Edit /Library/LaunchDaemons/com.certctl.agent.plist
+# Set CERTCTL_SERVER_URL to ${serverUrl}
+# Set CERTCTL_API_KEY to ${apiKey}
+
+sudo launchctl unload /Library/LaunchDaemons/com.certctl.agent.plist
+sudo launchctl load /Library/LaunchDaemons/com.certctl.agent.plist`,
+    },
+    docker: {
+      label: 'Run as Docker container',
+      code: `docker run -d --name certctl-agent \\
+  -e CERTCTL_SERVER_URL=${serverUrl} \\
+  -e CERTCTL_API_KEY=${apiKey} \\
+  ghcr.io/shankar0123/certctl-agent:latest`,
+    },
+  };
+
+  return (
+    <div>
+      <h2 className="text-lg font-semibold text-ink mb-1">Deploy a certctl Agent</h2>
+      <p className="text-sm text-ink-muted mb-6">
+        Agents run on your infrastructure to manage certificates, generate keys, and deploy to targets.
+        Install one now or skip to do it later.
+      </p>
+
+      {/* OS Tabs */}
+      <div className="flex gap-1 mb-4 bg-surface-border/30 rounded-lg p-1 w-fit">
+        {tabs.map(t => (
+          <button
+            key={t.key}
+            onClick={() => setActiveTab(t.key)}
+            className={`px-4 py-1.5 text-sm rounded-md transition-colors ${
+              activeTab === t.key
+                ? 'bg-surface text-ink font-medium shadow-sm'
+                : 'text-ink-muted hover:text-ink'
+            }`}
+          >
+            {t.label}
+          </button>
+        ))}
+      </div>
+
+      <CodeBlock code={commands[activeTab].code} label={commands[activeTab].label} />
+
+      {/* Agent detection */}
+      <div className="mt-6 p-4 border border-surface-border rounded-lg">
+        <div className="flex items-center gap-3">
+          {hasAgents ? (
+            <>
+              <div className="w-3 h-3 rounded-full bg-emerald-500" />
+              <div>
+                <div className="text-sm font-medium text-emerald-700">
+                  {agentList.length} agent{agentList.length !== 1 ? 's' : ''} detected
+                </div>
+                <div className="text-xs text-ink-muted mt-0.5">
+                  {agentList.slice(0, 3).map(a => a.name || a.id).join(', ')}
+                  {agentList.length > 3 && ` and ${agentList.length - 3} more`}
+                </div>
+              </div>
+            </>
+          ) : (
+            <>
+              <div className="w-3 h-3 rounded-full bg-amber-400 animate-pulse" />
+              <div className="text-sm text-ink-muted">
+                Waiting for an agent to connect... <span className="text-xs">(polling every 5s)</span>
+              </div>
+            </>
+          )}
+        </div>
+      </div>
+
+      <WizardFooter
+        onSkip={onSkip}
+        onNext={onNext}
+        nextLabel={hasAgents ? 'Next: Add Certificate' : 'Next: Add Certificate'}
+      />
+    </div>
+  );
+}
+
+// ─── Step 3: Add a Certificate ───────────────────────
+
+function CertificateStep({ onNext, onSkip, createdIssuerId }: {
+  onNext: (certName?: string) => void;
+  onSkip: () => void;
+  createdIssuerId: string | null;
+}) {
+  const queryClient = useQueryClient();
+  const [commonName, setCommonName] = useState('');
+  const [sans, setSans] = useState('');
+  const [issuerId, setIssuerId] = useState(createdIssuerId || '');
+  const [profileId, setProfileId] = useState('');
+  const [error, setError] = useState('');
+  const [created, setCreated] = useState(false);
+
+  const { data: issuers } = useQuery({ queryKey: ['issuers'], queryFn: () => getIssuers() });
+  const { data: profiles } = useQuery({ queryKey: ['profiles'], queryFn: () => getProfiles() });
+  const { data: agents } = useQuery({ queryKey: ['agents'], queryFn: () => getAgents() });
+
+  const hasAgents = (agents?.data?.length ?? 0) > 0;
+
+  const createMutation = useMutation({
+    mutationFn: async () => {
+      const sanList = sans.split(',').map(s => s.trim()).filter(Boolean);
+      const cert = await createCertificate({
+        common_name: commonName,
+        sans: sanList,
+        issuer_id: issuerId,
+        certificate_profile_id: profileId || undefined,
+        environment: 'production',
+      });
+      // Trigger issuance
+      await triggerRenewal(cert.id);
+      return cert;
+    },
+    onSuccess: (cert) => {
+      setCreated(true);
+      queryClient.invalidateQueries({ queryKey: ['certificates'] });
+      queryClient.invalidateQueries({ queryKey: ['dashboard-summary'] });
+      setTimeout(() => onNext(cert.common_name), 1500);
+    },
+    onError: (err: Error) => setError(err.message),
+  });
+
+  if (created) {
+    return (
+      <div>
+        <h2 className="text-lg font-semibold text-ink mb-2">Certificate Requested</h2>
+        <div className="bg-emerald-50 border border-emerald-200 rounded p-4">
+          <div className="flex items-center gap-2">
+            <svg className="w-5 h-5 text-emerald-600" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+              <path strokeLinecap="round" strokeLinejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+            </svg>
+            <span className="text-sm font-medium text-emerald-700">
+              Certificate for {commonName} has been requested. Moving to summary...
+            </span>
+          </div>
+        </div>
+      </div>
+    );
+  }
+
+  return (
+    <div>
+      <h2 className="text-lg font-semibold text-ink mb-1">Add a Certificate</h2>
+      <p className="text-sm text-ink-muted mb-6">
+        Issue your first certificate, or skip this step and explore the dashboard.
+      </p>
+
+      <div className="space-y-5">
+        <div>
+          <label className="block text-sm font-medium text-ink mb-2">
+            Common Name <span className="text-red-600">*</span>
+          </label>
+          <input
+            type="text"
+            value={commonName}
+            onChange={e => setCommonName(e.target.value)}
+            placeholder="example.com"
+            className="w-full px-3 py-2 bg-surface border border-surface-border rounded text-ink placeholder-ink-faint focus:outline-none focus:border-brand-500 transition-colors"
+          />
+        </div>
+
+        <div>
+          <label className="block text-sm font-medium text-ink mb-2">
+            Subject Alternative Names <span className="text-xs text-ink-muted font-normal">(comma-separated)</span>
+          </label>
+          <input
+            type="text"
+            value={sans}
+            onChange={e => setSans(e.target.value)}
+            placeholder="www.example.com, api.example.com"
+            className="w-full px-3 py-2 bg-surface border border-surface-border rounded text-ink placeholder-ink-faint focus:outline-none focus:border-brand-500 transition-colors"
+          />
+        </div>
+
+        <div className="grid grid-cols-2 gap-4">
+          <div>
+            <label className="block text-sm font-medium text-ink mb-2">
+              Issuer <span className="text-red-600">*</span>
+            </label>
+            <select
+              value={issuerId}
+              onChange={e => setIssuerId(e.target.value)}
+              className="w-full px-3 py-2 bg-surface border border-surface-border rounded text-ink focus:outline-none focus:border-brand-500 transition-colors"
+            >
+              <option value="">Select issuer...</option>
+              {issuers?.data?.map(iss => (
+                <option key={iss.id} value={iss.id}>{iss.name} ({iss.type})</option>
+              ))}
+            </select>
+          </div>
+
+          <div>
+            <label className="block text-sm font-medium text-ink mb-2">
+              Profile <span className="text-xs text-ink-muted font-normal">(optional)</span>
+            </label>
+            <select
+              value={profileId}
+              onChange={e => setProfileId(e.target.value)}
+              className="w-full px-3 py-2 bg-surface border border-surface-border rounded text-ink focus:outline-none focus:border-brand-500 transition-colors"
+            >
+              <option value="">Default</option>
+              {profiles?.data?.map(p => (
+                <option key={p.id} value={p.id}>{p.name}</option>
+              ))}
+            </select>
+          </div>
+        </div>
+      </div>
+
+      {/* Discovery hint */}
+      {hasAgents && (
+        <div className="mt-6 p-4 bg-blue-50 border border-blue-200 rounded text-sm text-blue-700">
+          <span className="font-medium">Already have certificates on disk?</span>{' '}
+          Visit the <Link to="/discovery" className="underline hover:text-blue-900">Discovery page</Link> to
+          import and manage existing certificates found by your agents.
+        </div>
+      )}
+      {!hasAgents && (
+        <div className="mt-6 p-4 bg-gray-50 border border-gray-200 rounded text-sm text-ink-muted">
+          <span className="font-medium">Tip:</span> Deploy an agent with{' '}
+          <code className="bg-gray-200 px-1 rounded text-xs">CERTCTL_DISCOVERY_DIRS=/etc/ssl/certs</code>{' '}
+          to automatically discover existing certificates on your infrastructure.
+        </div>
+      )}
+
+      {error && (
+        <div className="mt-4 p-3 bg-red-50 border border-red-200 rounded text-sm text-red-700">{error}</div>
+      )}
+
+      <WizardFooter
+        onSkip={onSkip}
+        onNext={() => createMutation.mutate()}
+        nextLabel={createMutation.isPending ? 'Creating...' : 'Issue Certificate'}
+        nextDisabled={!commonName || !issuerId || createMutation.isPending}
+      />
+    </div>
+  );
+}
+
+// ─── Step 4: Complete ────────────────────────────────
+
+function CompleteStep({ onFinish, issuerName, certName }: {
+  onFinish: () => void;
+  issuerName: string | null;
+  certName: string | null;
+}) {
+  const { data: issuers } = useQuery({ queryKey: ['issuers'], queryFn: () => getIssuers() });
+  const { data: agents } = useQuery({ queryKey: ['agents'], queryFn: () => getAgents() });
+
+  const issuerCount = issuers?.data?.length ?? 0;
+  const agentCount = agents?.data?.length ?? 0;
+
+  return (
+    <div className="text-center py-8">
+      <div className="w-16 h-16 mx-auto mb-6 bg-emerald-100 rounded-full flex items-center justify-center">
+        <svg className="w-8 h-8 text-emerald-600" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+          <path strokeLinecap="round" strokeLinejoin="round" d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
+        </svg>
+      </div>
+
+      <h2 className="text-xl font-semibold text-ink mb-2">You're all set!</h2>
+      <p className="text-sm text-ink-muted mb-8 max-w-md mx-auto">
+        certctl is ready to manage your certificate lifecycle. Here's what's configured:
+      </p>
+
+      {/* Summary */}
+      <div className="max-w-sm mx-auto mb-8 space-y-3 text-left">
+        <div className="flex items-center gap-3 p-3 bg-surface border border-surface-border rounded">
+          <div className={`w-6 h-6 rounded-full flex items-center justify-center text-xs ${issuerCount > 0 ? 'bg-emerald-100 text-emerald-600' : 'bg-gray-100 text-gray-400'}`}>
+            {issuerCount > 0 ? (
+              <svg className="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={3}><path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" /></svg>
+            ) : '—'}
+          </div>
+          <div className="text-sm">
+            <span className="font-medium text-ink">
+              {issuerCount > 0 ? `${issuerCount} issuer${issuerCount !== 1 ? 's' : ''} configured` : 'No issuers configured'}
+            </span>
+            {issuerName && <span className="text-ink-muted ml-1">({issuerName})</span>}
+          </div>
+        </div>
+
+        <div className="flex items-center gap-3 p-3 bg-surface border border-surface-border rounded">
+          <div className={`w-6 h-6 rounded-full flex items-center justify-center text-xs ${agentCount > 0 ? 'bg-emerald-100 text-emerald-600' : 'bg-gray-100 text-gray-400'}`}>
+            {agentCount > 0 ? (
+              <svg className="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={3}><path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" /></svg>
+            ) : '—'}
+          </div>
+          <span className="text-sm font-medium text-ink">
+            {agentCount > 0 ? `${agentCount} agent${agentCount !== 1 ? 's' : ''} connected` : 'No agents deployed yet'}
+          </span>
+        </div>
+
+        <div className="flex items-center gap-3 p-3 bg-surface border border-surface-border rounded">
+          <div className={`w-6 h-6 rounded-full flex items-center justify-center text-xs ${certName ? 'bg-emerald-100 text-emerald-600' : 'bg-gray-100 text-gray-400'}`}>
+            {certName ? (
+              <svg className="w-3.5 h-3.5" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={3}><path strokeLinecap="round" strokeLinejoin="round" d="M5 13l4 4L19 7" /></svg>
+            ) : '—'}
+          </div>
+          <span className="text-sm font-medium text-ink">
+            {certName ? `Certificate requested: ${certName}` : 'No certificates added yet'}
+          </span>
+        </div>
+      </div>
+
+      <button onClick={onFinish} className="btn btn-primary text-sm px-8 mb-6">
+        Go to Dashboard
+      </button>
+
+      <div className="flex justify-center gap-6 text-xs">
+        <a href="https://github.com/shankar0123/certctl/blob/master/docs/quickstart.md" target="_blank" rel="noopener noreferrer" className="text-accent hover:text-accent-bright">Quickstart Guide</a>
+        <a href="https://github.com/shankar0123/certctl/blob/master/docs/architecture.md" target="_blank" rel="noopener noreferrer" className="text-accent hover:text-accent-bright">Architecture</a>
+        <a href="https://github.com/shankar0123/certctl/blob/master/docs/connectors.md" target="_blank" rel="noopener noreferrer" className="text-accent hover:text-accent-bright">Connectors</a>
+      </div>
+    </div>
+  );
+}
+
+// ─── Main Wizard ─────────────────────────────────────
+
+export default function OnboardingWizard({ onDismiss }: { onDismiss: () => void }) {
+  const [step, setStep] = useState<WizardStep>('issuer');
+  const [createdIssuerId, setCreatedIssuerId] = useState<string | null>(null);
+  const [issuerName, setIssuerName] = useState<string | null>(null);
+  const [certName, setCertName] = useState<string | null>(null);
+  const navigate = useNavigate();
+
+  const goTo = (s: WizardStep) => setStep(s);
+
+  return (
+    <>
+      <div className="flex items-center justify-between px-6 pt-5 pb-0">
+        <div>
+          <h1 className="text-xl font-bold text-ink">Welcome to certctl</h1>
+          <p className="text-sm text-ink-muted mt-0.5">Let's set up your certificate lifecycle management</p>
+        </div>
+        <button
+          onClick={onDismiss}
+          className="text-xs text-ink-muted hover:text-ink transition-colors"
+        >
+          Skip setup
+        </button>
+      </div>
+
+      <div className="flex-1 overflow-y-auto px-6 py-6">
+        <div className="max-w-2xl mx-auto">
+          <StepIndicator steps={STEPS} current={step} />
+
+          <div className="bg-surface border border-surface-border rounded-lg p-6 shadow-sm">
+            {step === 'issuer' && (
+              <IssuerStep
+                onNext={() => goTo('agent')}
+                onSkip={() => goTo('agent')}
+                onIssuerCreated={(iss) => { setCreatedIssuerId(iss.id); setIssuerName(iss.name); }}
+              />
+            )}
+
+            {step === 'agent' && (
+              <AgentStep
+                onNext={() => goTo('certificate')}
+                onSkip={() => goTo('certificate')}
+              />
+            )}
+
+            {step === 'certificate' && (
+              <CertificateStep
+                onNext={(name) => { if (name) setCertName(name); goTo('complete'); }}
+                onSkip={() => goTo('complete')}
+                createdIssuerId={createdIssuerId}
+              />
+            )}
+
+            {step === 'complete' && (
+              <CompleteStep
+                onFinish={() => { onDismiss(); navigate('/'); }}
+                issuerName={issuerName}
+                certName={certName}
+              />
+            )}
+          </div>
+        </div>
+      </div>
+    </>
+  );
+}

web/src/pages/TargetDetailPage.tsx

@@ -1,7 +1,7 @@
 import { useState } from 'react';
 import { useParams, Link } from 'react-router-dom';
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { getTarget, getJobs, updateTarget } from '../api/client';
+import { getTarget, getJobs, updateTarget, testTargetConnection } from '../api/client';
 import PageHeader from '../components/PageHeader';
 import StatusBadge from '../components/StatusBadge';
 import DataTable from '../components/DataTable';
@@ -18,6 +18,9 @@ const typeLabels: Record<string, string> = {
   caddy: 'Caddy',
   f5_bigip: 'F5 BIG-IP',
   iis: 'IIS',
+  envoy: 'Envoy',
+  postfix: 'Postfix',
+  dovecot: 'Dovecot',
 };
 
 function InfoRow({ label, value }: { label: string; value: React.ReactNode }) {
@@ -29,21 +32,59 @@ function InfoRow({ label, value }: { label: string; value: React.ReactNode }) {
   );
 }
 
+function TestStatusIndicator({ status, testedAt }: { status?: string; testedAt?: string }) {
+  if (!status || status === 'untested') {
+    return <span className="text-xs text-ink-faint">Not tested</span>;
+  }
+  const styles: Record<string, string> = {
+    success: 'bg-emerald-100 text-emerald-700',
+    failed: 'bg-red-100 text-red-700',
+  };
+  const labels: Record<string, string> = {
+    success: 'Connected',
+    failed: 'Failed',
+  };
+  return (
+    <span className="inline-flex items-center gap-1.5">
+      <span className={`text-xs px-2 py-0.5 rounded-full font-medium ${styles[status] || 'bg-gray-100 text-gray-600'}`}>
+        {labels[status] || status}
+      </span>
+      {testedAt && <span className="text-xs text-ink-faint">{formatDateTime(testedAt)}</span>}
+    </span>
+  );
+}
+
+function SourceBadge({ source }: { source?: string }) {
+  if (!source || source === 'database') {
+    return <span className="text-xs px-2 py-0.5 rounded-full bg-blue-100 text-blue-700 font-medium">GUI</span>;
+  }
+  if (source === 'env') {
+    return <span className="text-xs px-2 py-0.5 rounded-full bg-amber-100 text-amber-700 font-medium">Env Var</span>;
+  }
+  return <span className="text-xs text-ink-faint">{source}</span>;
+}
+
 export default function TargetDetailPage() {
   const { id } = useParams<{ id: string }>();
   const queryClient = useQueryClient();
   const [isEditing, setIsEditing] = useState(false);
   const [editName, setEditName] = useState('');
-  const [editHostname, setEditHostname] = useState('');
 
   const updateMutation = useMutation({
-    mutationFn: (data: Partial<{ name: string; hostname: string }>) => updateTarget(id!, data),
+    mutationFn: (data: Partial<{ name: string }>) => updateTarget(id!, data),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ['target', id] });
       setIsEditing(false);
     },
   });
 
+  const testMutation = useMutation({
+    mutationFn: () => testTargetConnection(id!),
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: ['target', id] });
+    },
+  });
+
   const { data: target, isLoading, error, refetch } = useQuery({
     queryKey: ['target', id],
     queryFn: () => getTarget(id!),
@@ -126,19 +167,39 @@ export default function TargetDetailPage() {
         title={target.name}
         subtitle={typeLabels[target.type] || target.type}
         action={
-          <button
-            onClick={() => {
-              setEditName(target.name);
-              setEditHostname(target.hostname || '');
-              setIsEditing(true);
-            }}
-            className="px-3 py-1.5 border border-surface-border rounded text-ink text-xs hover:bg-surface-hover transition-colors font-medium"
-          >
-            Edit
-          </button>
+          <div className="flex gap-2">
+            <button
+              onClick={() => testMutation.mutate()}
+              disabled={testMutation.isPending}
+              className="px-3 py-1.5 border border-surface-border rounded text-ink text-xs hover:bg-surface-hover transition-colors font-medium disabled:opacity-50"
+            >
+              {testMutation.isPending ? 'Testing...' : 'Test Connection'}
+            </button>
+            <button
+              onClick={() => {
+                setEditName(target.name);
+                setIsEditing(true);
+              }}
+              className="px-3 py-1.5 border border-surface-border rounded text-ink text-xs hover:bg-surface-hover transition-colors font-medium"
+            >
+              Edit
+            </button>
+          </div>
         }
       />
 
+      {/* Test connection result banner */}
+      {testMutation.isSuccess && (
+        <div className="mx-6 mt-2 p-3 bg-emerald-50 border border-emerald-200 rounded text-sm text-emerald-700">
+          Agent connection test passed — agent is online and responsive.
+        </div>
+      )}
+      {testMutation.isError && (
+        <div className="mx-6 mt-2 p-3 bg-red-50 border border-red-200 rounded text-sm text-red-700">
+          Connection test failed: {(testMutation.error as Error).message}
+        </div>
+      )}
+
       <div className="flex-1 overflow-y-auto px-6 py-4 space-y-6">
         <div className="grid grid-cols-1 lg:grid-cols-2 gap-6">
           {/* Target info */}
@@ -147,8 +208,9 @@ export default function TargetDetailPage() {
             <InfoRow label="ID" value={<span className="font-mono text-xs">{target.id}</span>} />
             <InfoRow label="Name" value={target.name} />
             <InfoRow label="Type" value={typeLabels[target.type] || target.type} />
-            <InfoRow label="Hostname" value={target.hostname || '—'} />
-            <InfoRow label="Status" value={<StatusBadge status={target.status} />} />
+            <InfoRow label="Enabled" value={<StatusBadge status={target.enabled ? 'Enabled' : 'Disabled'} />} />
+            <InfoRow label="Source" value={<SourceBadge source={target.source} />} />
+            <InfoRow label="Test Status" value={<TestStatusIndicator status={target.test_status} testedAt={target.last_tested_at} />} />
             {target.agent_id && (
               <InfoRow label="Agent" value={
                 <Link to={`/agents/${target.agent_id}`} className="text-xs text-accent hover:text-accent-bright font-mono">
@@ -157,6 +219,7 @@ export default function TargetDetailPage() {
               } />
             )}
             <InfoRow label="Created" value={formatDateTime(target.created_at)} />
+            {target.updated_at && <InfoRow label="Updated" value={formatDateTime(target.updated_at)} />}
           </div>
 
           {/* Config */}
@@ -205,15 +268,11 @@ export default function TargetDetailPage() {
                 {(updateMutation.error as Error).message}
               </div>
             )}
-            <form onSubmit={e => { e.preventDefault(); updateMutation.mutate({ name: editName, hostname: editHostname }); }} className="space-y-4">
+            <form onSubmit={e => { e.preventDefault(); updateMutation.mutate({ name: editName }); }} className="space-y-4">
               <div>
                 <label className="block text-sm font-medium text-ink mb-1">Name</label>
                 <input value={editName} onChange={e => setEditName(e.target.value)} className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400" />
               </div>
-              <div>
-                <label className="block text-sm font-medium text-ink mb-1">Hostname</label>
-                <input value={editHostname} onChange={e => setEditHostname(e.target.value)} className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400" />
-              </div>
               <div className="flex gap-2 pt-2">
                 <button type="submit" disabled={updateMutation.isPending} className="flex-1 btn btn-primary disabled:opacity-50">
                   {updateMutation.isPending ? 'Saving...' : 'Save'}

web/src/pages/TargetsPage.tsx

@@ -118,7 +118,6 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
   const [step, setStep] = useState<'type' | 'config' | 'review'>('type');
   const [targetType, setTargetType] = useState('');
   const [name, setName] = useState('');
-  const [hostname, setHostname] = useState('');
   const [agentId, setAgentId] = useState('');
   const [config, setConfig] = useState<Record<string, string>>({});
   const [error, setError] = useState('');
@@ -127,7 +126,6 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
     mutationFn: () => createTarget({
       name,
       type: targetType,
-      hostname,
       agent_id: agentId,
       config: Object.fromEntries(Object.entries(config).filter(([, v]) => v)),
     }),
@@ -205,19 +203,11 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
                   className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
                   placeholder="web-server-1" />
               </div>
-              <div className="grid grid-cols-2 gap-3">
-                <div>
-                  <label className="text-xs text-ink-muted block mb-1">Hostname</label>
-                  <input value={hostname} onChange={e => setHostname(e.target.value)}
-                    className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
-                    placeholder="web1.example.com" />
-                </div>
-                <div>
-                  <label className="text-xs text-ink-muted block mb-1">Agent ID</label>
-                  <input value={agentId} onChange={e => setAgentId(e.target.value)}
-                    className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
-                    placeholder="agent-web1" />
-                </div>
+              <div>
+                <label className="text-xs text-ink-muted block mb-1">Agent ID</label>
+                <input value={agentId} onChange={e => setAgentId(e.target.value)}
+                  className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
+                  placeholder="agent-web1" />
               </div>
               {fields.map(f => (
                 <div key={f.key}>
@@ -252,12 +242,6 @@ function CreateTargetWizard({ onClose, onSuccess }: { onClose: () => void; onSuc
                 <span className="text-ink-muted">Type</span>
                 <span className="text-ink">{typeLabels[targetType] || targetType}</span>
               </div>
-              {hostname && (
-                <div className="flex justify-between">
-                  <span className="text-ink-muted">Hostname</span>
-                  <span className="text-ink font-mono text-xs">{hostname}</span>
-                </div>
-              )}
               {agentId && (
                 <div className="flex justify-between">
                   <span className="text-ink-muted">Agent</span>
@@ -322,20 +306,23 @@ export default function TargetsPage() {
         <span className="badge badge-neutral">{typeLabels[t.type] || t.type}</span>
       ),
     },
-    {
-      key: 'hostname',
-      label: 'Hostname',
-      render: (t) => <span className="text-ink font-mono text-xs">{t.hostname || '\u2014'}</span>,
-    },
     {
       key: 'agent',
       label: 'Agent',
       render: (t) => <span className="text-xs text-ink-muted font-mono">{t.agent_id || '\u2014'}</span>,
     },
     {
-      key: 'status',
+      key: 'enabled',
       label: 'Status',
-      render: (t) => <StatusBadge status={t.status} />,
+      render: (t) => <StatusBadge status={t.enabled ? 'Enabled' : 'Disabled'} />,
+    },
+    {
+      key: 'test_status',
+      label: 'Connection',
+      render: (t) => {
+        if (!t.test_status || t.test_status === 'untested') return <span className="text-xs text-ink-faint">—</span>;
+        return <StatusBadge status={t.test_status === 'success' ? 'Connected' : 'Failed'} />;
+      },
     },
     {
       key: 'created',