[BUG]Termix ID CA issues SSH certificates without principals

Title

Termix ID CA issues SSH certificates without principals

Platform

Website - Firefox

Server Installation Method

Docker

Version

2.7.1

CLI Installation Method

None

CLI Version

No response

Troubleshooting

• I have examined logs and tried to find the issue
• I have reviewed opened and closed issues
• I have tried restarting the application
• I have checked open issues and ensured this is not a duplicate

The Problem

The Termix ID built-in CA generates OpenSSH user certificates without any principals.
When a certificate is generated using the Certificate button in the Termix ID UI, the resulting certificate contains:
Principals: (none)
This makes the certificate unusable with the TrustedUserCAKeys configuration recommended by Termix.

How to Reproduce

1. Enable the CA in Termix ID.
2. Install the Termix CA public key on the SSH server.
3. Configure OpenSSH:

TrustedUserCAKeys /etc/ssh/termca-ca.pub

4. Add an Ed25519 user public key to Termix ID.
5. Click Certificate for that key.
6. Inspect the generated certificate: ssh-keygen -L -f termix-termca-3-cert.pub
   The result contains:

Key ID: "termix:@termca:3"
Principals: (none)

Additional Context

The backend already supports principals.
The certificate endpoint in backend/database/routes/termix-id.js accepts:

{
  "validityDays": 90,
  "principals": ["root"]
}

and processes them with:

const principals = Array.isArray(req.body?.principals)
    ? req.body.principals
        .filter((p) => typeof p === "string" && p.trim())
        .map((p) => p.trim())
        .slice(0, 32)
    : [];

The principals are then correctly passed to signUserCertificate().
However, the Termix ID UI sends an empty payload when the Certificate button is clicked.
As a result:
principals = []
and the generated certificate has no principals.

Verification
Issuing the same certificate manually through the existing API with:

{
  "principals": ["root"]
}

produces a valid certificate:

Type: ssh-ed25519-cert-v01@openssh.com user certificate
Key ID: "termix:@termca:3"
Principals:
root

The certificate then works correctly with OpenSSH using:
TrustedUserCAKeys /etc/ssh/termca-ca.pub

and the client can authenticate using the private key together with the issued certificate.

Expected behavior

When generating a certificate, the Termix ID UI should allow the user to specify one or more SSH principals and send them to:
POST /termix-id/keys/:id/certificate
For example:

{
  "principals": ["root"]
}

Alternatively, Termix could provide a configurable default principal.

Actual behavior
The UI sends an empty request payload, causing the backend to generate a certificate with:

Principals: (none)

Suggested fix

Add a Principals field to the certificate generation UI and pass its value to the already existing principals property of the certificate API.
Since the backend and certificate signing implementation already support principals, this appears to require primarily a frontend change.

Start with the Termix ID UI code behind the Certificate button, then compare its request with the existing POST /termix-id/keys/:id/certificate endpoint in backend/database/routes/termix-id.js. Add a principals input or default and verify that the generated request includes it and that the resulting certificate lists the chosen principal.