From 9c62a8bee20c8565bf2f8b0a6a35e5f7261557bb Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:48:51 +0100
Subject: [PATCH 1/8] Add managed Fastly certificate provider

---
 README.md                                     |  11 +
 src/Cdn/Certificates/Provider/Fastly.php      | 285 ++++++++++++++++++
 src/Cdn/Certificates/Provider/FastlyTls.php   |  47 +--
 .../Cdn/Certificates/Provider/FastlyTest.php  | 117 +++++++
 .../Certificates/Provider/FastlyTlsTest.php   |  17 +-
 5 files changed, 455 insertions(+), 22 deletions(-)
 create mode 100644 src/Cdn/Certificates/Provider/Fastly.php
 create mode 100644 tests/Cdn/Certificates/Provider/FastlyTest.php

diff --git a/README.md b/README.md
index 2e37411..9ec9860 100644
--- a/README.md
+++ b/README.md
@@ -170,6 +170,17 @@ $renewRequired = $certificates->isRenewRequired('cdn.example.com', null);
 
 `issueCertificate()` returns a renew date when Fastly already has an issued or renewing certificate. For asynchronous states like `pending` or `processing`, it returns `null`.
 
+When Fastly domain management owns the domain lifecycle, use the managed provider instead. It creates versionless domains on the configured service and removes both the domain and TLS subscription on deletion. Classic domains are removed by cloning and activating their service version first.
+
+```php
+use Utopia\Cdn\Certificates\Provider\Fastly;
+
+$fastlyCertificates = new Fastly(
+    apiToken: 'YOUR_API_TOKEN',
+    serviceId: 'YOUR_SERVICE_ID',
+);
+```
+
 ### Cloudflare certificates
 
 Cloudflare certificates use Cloudflare for SaaS custom hostnames, which must be enabled for the zone and plan.
diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
new file mode 100644
index 0000000..43c7232
--- /dev/null
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -0,0 +1,285 @@
+<?php
+
+namespace Utopia\Cdn\Certificates\Provider;
+
+use Psr\Http\Client\ClientExceptionInterface;
+use Psr\Http\Client\ClientInterface;
+use Utopia\Client;
+use Utopia\Client\Adapter\Curl\Client as CurlAdapter;
+use Utopia\Cdn\Certificates\Provider;
+use Utopia\Cdn\Domain;
+use Utopia\Psr7\Header;
+use Utopia\Psr7\Request\Factory as RequestFactory;
+
+/**
+ * Manages Fastly domains together with their TLS subscriptions.
+ *
+ * Fastly's domain-management API owns versionless domains. Domains on a classic
+ * service version have to be removed by cloning and activating that version
+ * before their TLS subscription can be deleted.
+ */
+class Fastly implements Provider
+{
+    private ClientInterface $client;
+
+    private FastlyTls $tls;
+
+    public function __construct(
+        private string $apiToken,
+        private string $serviceId,
+        string $certificateAuthority = 'certainly',
+        ?ClientInterface $client = null,
+        private string $apiBase = 'https://api.fastly.com',
+        private int $deploymentPollAttempts = 10,
+        private int $deploymentPollIntervalMilliseconds = 5000,
+    ) {
+        if ($this->deploymentPollAttempts < 1) {
+            throw new \InvalidArgumentException('Deployment poll attempts must be at least one.');
+        }
+
+        if ($this->deploymentPollIntervalMilliseconds < 0) {
+            throw new \InvalidArgumentException('Deployment poll interval cannot be negative.');
+        }
+
+        $this->client = $client ?? new Client(new CurlAdapter());
+        $this->tls = new FastlyTls(
+            apiToken: $this->apiToken,
+            tlsConfigurationId: '',
+            certificateAuthority: $certificateAuthority,
+            client: $this->client,
+            apiBase: $this->apiBase,
+        );
+    }
+
+    public function issueCertificate(string $certName, string $domain, ?string $domainType): ?string
+    {
+        $domain = Domain::validate($domain);
+        $domainInfo = $this->findDomain($domain);
+
+        if ($domainInfo !== null) {
+            $existingServiceId = $domainInfo['service_id'] ?? null;
+
+            if (!\is_string($existingServiceId) || $existingServiceId === '') {
+                // A classic domain cannot be moved without activating a new
+                // service version, so leave its existing certificate untouched.
+                return null;
+            }
+
+            if ($existingServiceId !== $this->serviceId) {
+                $this->deleteVersionlessDomain($domainInfo);
+                $domainInfo = null;
+            }
+        }
+
+        if ($domainInfo === null) {
+            $result = $this->request('POST', '/domain-management/v1/domains', [
+                'fqdn' => $domain,
+                'service_id' => $this->serviceId,
+            ]);
+            $this->assertSuccess('add Fastly domain', $result, [201]);
+        }
+
+        return $this->tls->issueCertificate($certName, $domain, $domainType);
+    }
+
+    public function isInstantGeneration(string $domain, ?string $domainType): bool
+    {
+        return false;
+    }
+
+    public function getCertificateStatus(string $domain, ?string $domainType): string
+    {
+        return $this->tls->getCertificateStatus(Domain::validate($domain), $domainType);
+    }
+
+    public function isRenewRequired(string $domain, ?string $domainType): bool
+    {
+        return $this->tls->isRenewRequired(Domain::validate($domain), $domainType);
+    }
+
+    public function deleteCertificate(string $domain, ?string $domainType = null): void
+    {
+        $domain = Domain::validate($domain);
+        $domainInfo = $this->findDomain($domain);
+
+        if ($domainInfo === null) {
+            $this->tls->deleteCertificate($domain, $domainType);
+            return;
+        }
+
+        $serviceId = $domainInfo['service_id'] ?? null;
+        if (!\is_string($serviceId) || $serviceId === '') {
+            $this->deleteClassicDomain($domain, $domainType);
+            return;
+        }
+
+        $this->deleteVersionlessDomain($domainInfo, $domainType);
+    }
+
+    /** @return array<string, mixed>|null */
+    private function findDomain(string $domain): ?array
+    {
+        $query = \http_build_query(['fqdn' => $domain, 'limit' => 100]);
+        $result = $this->request('GET', '/domain-management/v1/domains?' . $query);
+        $this->assertSuccess('fetch Fastly domains', $result);
+
+        if (!\is_array($result['response'])) {
+            throw new \RuntimeException('Fastly domains response was not valid JSON.');
+        }
+
+        $domains = $result['response']['data'] ?? null;
+        if (!\is_array($domains)) {
+            throw new \RuntimeException('Fastly domains response was missing its data list.');
+        }
+
+        foreach ($domains as $candidate) {
+            if (\is_array($candidate) && ($candidate['fqdn'] ?? null) === $domain) {
+                return $candidate;
+            }
+        }
+
+        return null;
+    }
+
+    /** @param array<string, mixed> $domainInfo */
+    private function deleteVersionlessDomain(array $domainInfo, ?string $domainType = null): void
+    {
+        $domainId = $domainInfo['id'] ?? null;
+        $domain = $domainInfo['fqdn'] ?? null;
+
+        if (!\is_string($domainId) || $domainId === '' || !\is_string($domain) || $domain === '') {
+            throw new \RuntimeException('Fastly domain response was missing its ID or FQDN.');
+        }
+
+        $this->tls->deleteCertificate($domain, $domainType);
+
+        $result = $this->request('DELETE', '/domain-management/v1/domains/' . \rawurlencode($domainId));
+        $this->assertSuccess('delete Fastly domain', $result, [204]);
+    }
+
+    private function deleteClassicDomain(string $domain, ?string $domainType): void
+    {
+        $result = $this->request('GET', '/service/' . \rawurlencode($this->serviceId) . '/details');
+        $this->assertSuccess('fetch Fastly service details', $result);
+
+        if (!\is_array($result['response'])) {
+            throw new \RuntimeException('Fastly service details response was not valid JSON.');
+        }
+
+        $activeVersion = $result['response']['active_version'] ?? null;
+        if (!\is_array($activeVersion)) {
+            throw new \RuntimeException('Fastly service details response was missing its active version.');
+        }
+
+        $domains = $activeVersion['domains'] ?? [];
+        $containsDomain = \is_array($domains) && \array_any(
+            $domains,
+            static fn (mixed $candidate): bool => \is_array($candidate) && ($candidate['name'] ?? null) === $domain,
+        );
+
+        if (!$containsDomain) {
+            $this->tls->deleteCertificate($domain, $domainType);
+            return;
+        }
+
+        $currentVersion = $activeVersion['number'] ?? null;
+        if (!\is_int($currentVersion)) {
+            throw new \RuntimeException('Fastly active service version was missing its number.');
+        }
+
+        $servicePath = '/service/' . \rawurlencode($this->serviceId) . '/version/';
+        $result = $this->request('PUT', $servicePath . $currentVersion . '/clone');
+        $this->assertSuccess('clone Fastly service version', $result);
+
+        if (!\is_array($result['response']) || !\is_int($result['response']['number'] ?? null)) {
+            throw new \RuntimeException('Fastly cloned service version was missing its number.');
+        }
+        $newVersion = $result['response']['number'];
+
+        $result = $this->request('DELETE', $servicePath . $newVersion . '/domain/' . \rawurlencode($domain));
+        $this->assertSuccess('remove classic Fastly domain', $result, [200, 409]);
+
+        $result = $this->request('PUT', $servicePath . $newVersion . '/activate');
+        $this->assertSuccess('activate Fastly service version', $result);
+
+        $this->waitForDeployment($newVersion);
+        $this->tls->deleteCertificate($domain, $domainType);
+    }
+
+    private function waitForDeployment(int $version): void
+    {
+        $path = '/service/' . \rawurlencode($this->serviceId) . '/version/' . $version;
+
+        for ($attempt = 1; $attempt <= $this->deploymentPollAttempts; $attempt++) {
+            $result = $this->request('GET', $path);
+            $this->assertSuccess('fetch Fastly service version', $result);
+
+            if (\is_array($result['response']) && ($result['response']['active'] ?? false) === true) {
+                return;
+            }
+
+            if ($attempt < $this->deploymentPollAttempts && $this->deploymentPollIntervalMilliseconds > 0) {
+                \usleep($this->deploymentPollIntervalMilliseconds * 1000);
+            }
+        }
+
+        throw new \RuntimeException('Fastly service version was not deployed after ' . $this->deploymentPollAttempts . ' attempts.');
+    }
+
+    /**
+     * @param array<string, mixed>|null $body
+     * @return array{statusCode:int,response:array<string, mixed>|string|null,error:string|null}
+     */
+    private function request(string $method, string $path, ?array $body = null): array
+    {
+        $factory = new RequestFactory();
+        $request = $body === null
+            ? $factory->createRequest($method, $this->apiBase . $path)
+            : $factory->json($method, $this->apiBase . $path, $body);
+        $request = $request
+            ->withHeader(Header::USER_AGENT, 'Utopia CDN Fastly Certificates Provider')
+            ->withHeader('Fastly-Key', $this->apiToken)
+            ->withHeader(Header::ACCEPT, 'application/json');
+
+        try {
+            $response = $this->client->sendRequest($request);
+        } catch (ClientExceptionInterface $error) {
+            return ['statusCode' => 0, 'response' => null, 'error' => $error->getMessage()];
+        }
+
+        $contents = (string) $response->getBody();
+
+        try {
+            $decoded = \json_decode($contents, true, flags: JSON_THROW_ON_ERROR);
+        } catch (\JsonException) {
+            $decoded = $contents;
+        }
+
+        return ['statusCode' => $response->getStatusCode(), 'response' => $decoded, 'error' => null];
+    }
+
+    /**
+     * @param array{statusCode:int,response:array<string, mixed>|string|null,error:string|null} $result
+     * @param array<int, int>|null $expectedStatuses
+     */
+    private function assertSuccess(string $operation, array $result, ?array $expectedStatuses = null): void
+    {
+        $success = $expectedStatuses === null
+            ? $result['statusCode'] >= 200 && $result['statusCode'] < 300
+            : \in_array($result['statusCode'], $expectedStatuses, true);
+
+        if ($success) {
+            return;
+        }
+
+        $message = $result['error'];
+        if (\is_array($result['response'])) {
+            $message ??= $result['response']['errors'][0]['detail']
+                ?? $result['response']['errors'][0]['title']
+                ?? $result['response']['msg']
+                ?? null;
+        }
+
+        throw new \RuntimeException('Failed to ' . $operation . ' with status ' . $result['statusCode'] . ': ' . ($message ?? 'Unknown Fastly error'));
+    }
+}
diff --git a/src/Cdn/Certificates/Provider/FastlyTls.php b/src/Cdn/Certificates/Provider/FastlyTls.php
index e901c7b..c3a3f3c 100644
--- a/src/Cdn/Certificates/Provider/FastlyTls.php
+++ b/src/Cdn/Certificates/Provider/FastlyTls.php
@@ -75,7 +75,7 @@ public function deleteCertificate(string $domain, ?string $domainType = null): v
 
         $result = $this->request(
             'DELETE',
-            '/tls/subscriptions/' . $subscription['resource']['id']
+            '/tls/subscriptions/' . $subscription['resource']['id'] . '?force=true'
         );
 
         if ($result['statusCode'] < 200 || $result['statusCode'] >= 300) {
@@ -131,32 +131,37 @@ private function findSubscription(string $domain): ?array
      */
     private function createSubscription(string $domain): array
     {
+        $relationships = [
+            'tls_domains' => [
+                'data' => [[
+                    'type' => 'tls_domain',
+                    'id' => $domain,
+                ]],
+            ],
+        ];
+
+        if ($this->tlsConfigurationId !== '') {
+            $relationships['common_name'] = [
+                'data' => [
+                    'type' => 'tls_domain',
+                    'id' => $domain,
+                ],
+            ];
+            $relationships['tls_configuration'] = [
+                'data' => [
+                    'type' => 'tls_configuration',
+                    'id' => $this->tlsConfigurationId,
+                ],
+            ];
+        }
+
         $result = $this->request('POST', '/tls/subscriptions', [
             'data' => [
                 'type' => 'tls_subscription',
                 'attributes' => [
                     'certificate_authority' => $this->certificateAuthority,
                 ],
-                'relationships' => [
-                    'common_name' => [
-                        'data' => [
-                            'type' => 'tls_domain',
-                            'id' => $domain,
-                        ],
-                    ],
-                    'tls_configuration' => [
-                        'data' => [
-                            'type' => 'tls_configuration',
-                            'id' => $this->tlsConfigurationId,
-                        ],
-                    ],
-                    'tls_domains' => [
-                        'data' => [[
-                            'type' => 'tls_domain',
-                            'id' => $domain,
-                        ]],
-                    ],
-                ],
+                'relationships' => $relationships,
             ],
         ]);
 
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
new file mode 100644
index 0000000..1f25b99
--- /dev/null
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -0,0 +1,117 @@
+<?php
+
+namespace Utopia\Tests\Cdn\Certificates\Provider;
+
+use PHPUnit\Framework\TestCase;
+use Utopia\Cdn\Certificates\Provider\Fastly;
+use Utopia\Psr7\Response;
+use Utopia\Psr7\Stream;
+use Utopia\Tests\Cdn\TestClient;
+
+class FastlyTest extends TestCase
+{
+    public function testIssueCreatesDomainAndTlsSubscription(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[]}'),
+            $this->json('{}', 201),
+            $this->json('{"data":[]}'),
+            $this->json('{"data":{"id":"sub_1","attributes":{"state":"pending"}}}', 201),
+        ]);
+
+        $provider = new Fastly('token', 'service_1', client: $client);
+        $this->assertNull($provider->issueCertificate('cert', 'example.com', null));
+
+        $this->assertSame('POST', $client->calls[1]['method']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains', $client->calls[1]['url']);
+        $this->assertSame(['fqdn' => 'example.com', 'service_id' => 'service_1'], $client->calls[1]['body']);
+        $this->assertSame('POST', $client->calls[3]['method']);
+        $this->assertSame('example.com', $client->calls[3]['body']['data']['relationships']['tls_domains']['data'][0]['id']);
+    }
+
+    public function testIssueReassignsVersionlessDomainFromAnotherService(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            new Response(204),
+            new Response(204),
+            $this->json('{}', 201),
+            $this->json('{"data":[]}'),
+            $this->json('{"data":{"id":"sub_2","attributes":{"state":"pending"}}}', 201),
+        ]);
+
+        (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
+
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[2]['url']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[3]['url']);
+        $this->assertSame('new_service', $client->calls[4]['body']['service_id']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions', $client->calls[6]['url']);
+    }
+
+    public function testDeleteRemovesVersionlessSubscriptionAndDomain(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"service_1"}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            new Response(204),
+            new Response(204),
+        ]);
+
+        (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+
+        $this->assertSame('DELETE', $client->calls[2]['method']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[2]['url']);
+        $this->assertSame('DELETE', $client->calls[3]['method']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[3]['url']);
+    }
+
+    public function testDeleteActivatesClassicServiceWithoutDomainBeforeRemovingTls(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com"}]}'),
+            $this->json('{"active_version":{"number":3,"domains":[{"name":"example.com"}]}}'),
+            $this->json('{"number":4}'),
+            $this->json('{}'),
+            $this->json('{}'),
+            $this->json('{"active":false}'),
+            $this->json('{"active":true}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            new Response(204),
+        ]);
+
+        $provider = new Fastly(
+            'token',
+            'service_1',
+            client: $client,
+            deploymentPollAttempts: 2,
+            deploymentPollIntervalMilliseconds: 0,
+        );
+        $provider->deleteCertificate('example.com');
+
+        $this->assertSame('PUT', $client->calls[2]['method']);
+        $this->assertSame('https://api.fastly.com/service/service_1/version/3/clone', $client->calls[2]['url']);
+        $this->assertSame('https://api.fastly.com/service/service_1/version/4/domain/example.com', $client->calls[3]['url']);
+        $this->assertSame('https://api.fastly.com/service/service_1/version/4/activate', $client->calls[4]['url']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[8]['url']);
+    }
+
+    public function testDeleteStillRemovesOrphanedTlsSubscription(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            new Response(204),
+        ]);
+
+        (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+
+        $this->assertCount(3, $client->calls);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[2]['url']);
+    }
+
+    private function json(string $body, int $status = 200): Response
+    {
+        return new Response($status, body: new Stream($body));
+    }
+}
diff --git a/tests/Cdn/Certificates/Provider/FastlyTlsTest.php b/tests/Cdn/Certificates/Provider/FastlyTlsTest.php
index f6e41c8..904c3b9 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTlsTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTlsTest.php
@@ -29,6 +29,21 @@ public function testIssueCertificateCreatesSubscriptionWhenMissing(): void
         $this->assertSame('tls-config-id', $client->calls[1]['body']['data']['relationships']['tls_configuration']['data']['id']);
     }
 
+    public function testIssueCertificateCanUseFastlyDomainManagementWithoutAConfiguration(): void
+    {
+        $client = new TestClient([
+            new Response(200, body: new Stream('{"data":[]}')),
+            new Response(201, body: new Stream('{"data":{"id":"sub_123","attributes":{"state":"pending"}}}')),
+        ]);
+
+        (new FastlyTls('token', '', 'certainly', $client))->issueCertificate('cert', 'example.com', null);
+
+        $relationships = $client->calls[1]['body']['data']['relationships'];
+        $this->assertSame('example.com', $relationships['tls_domains']['data'][0]['id']);
+        $this->assertArrayNotHasKey('common_name', $relationships);
+        $this->assertArrayNotHasKey('tls_configuration', $relationships);
+    }
+
     public function testGetCertificateStatusMapsFastlyState(): void
     {
         $client = new TestClient([
@@ -54,7 +69,7 @@ public function testDeleteCertificateRemovesSubscription(): void
 
         $this->assertCount(2, $client->calls);
         $this->assertSame('DELETE', $client->calls[1]['method']);
-        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_123', $client->calls[1]['url']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_123?force=true', $client->calls[1]['url']);
     }
 
     public function testIssueCertificateReturnsRenewDateFromIncludedCertificate(): void

From f820bbe14436aca8a7b04d28881a39a032257849 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:55:53 +0100
Subject: [PATCH 2/8] Keep TLS until Fastly domain removal succeeds

---
 src/Cdn/Certificates/Provider/Fastly.php      |  6 +--
 .../Cdn/Certificates/Provider/FastlyTest.php  | 53 ++++++++++++++++---
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 43c7232..1d28283 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -151,10 +151,10 @@ private function deleteVersionlessDomain(array $domainInfo, ?string $domainType
             throw new \RuntimeException('Fastly domain response was missing its ID or FQDN.');
         }
 
-        $this->tls->deleteCertificate($domain, $domainType);
-
         $result = $this->request('DELETE', '/domain-management/v1/domains/' . \rawurlencode($domainId));
         $this->assertSuccess('delete Fastly domain', $result, [204]);
+
+        $this->tls->deleteCertificate($domain, $domainType);
     }
 
     private function deleteClassicDomain(string $domain, ?string $domainType): void
@@ -197,7 +197,7 @@ private function deleteClassicDomain(string $domain, ?string $domainType): void
         $newVersion = $result['response']['number'];
 
         $result = $this->request('DELETE', $servicePath . $newVersion . '/domain/' . \rawurlencode($domain));
-        $this->assertSuccess('remove classic Fastly domain', $result, [200, 409]);
+        $this->assertSuccess('remove classic Fastly domain', $result, [200]);
 
         $result = $this->request('PUT', $servicePath . $newVersion . '/activate');
         $this->assertSuccess('activate Fastly service version', $result);
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 1f25b99..766fef1 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -33,8 +33,8 @@ public function testIssueReassignsVersionlessDomainFromAnotherService(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
-            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             new Response(204),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             new Response(204),
             $this->json('{}', 201),
             $this->json('{"data":[]}'),
@@ -43,8 +43,8 @@ public function testIssueReassignsVersionlessDomainFromAnotherService(): void
 
         (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
 
-        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[2]['url']);
-        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[3]['url']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[3]['url']);
         $this->assertSame('new_service', $client->calls[4]['body']['service_id']);
         $this->assertSame('https://api.fastly.com/tls/subscriptions', $client->calls[6]['url']);
     }
@@ -53,17 +53,35 @@ public function testDeleteRemovesVersionlessSubscriptionAndDomain(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"service_1"}]}'),
-            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             new Response(204),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             new Response(204),
         ]);
 
         (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
 
-        $this->assertSame('DELETE', $client->calls[2]['method']);
-        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[2]['url']);
+        $this->assertSame('DELETE', $client->calls[1]['method']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
         $this->assertSame('DELETE', $client->calls[3]['method']);
-        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[3]['url']);
+        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[3]['url']);
+    }
+
+    public function testFailedVersionlessDomainDeletionLeavesTlsSubscriptionUntouched(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"service_1"}]}'),
+            $this->json('{"msg":"domain is still active"}', 409),
+        ]);
+
+        try {
+            (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+            $this->fail('Expected domain deletion to fail.');
+        } catch (\RuntimeException $error) {
+            $this->assertStringContainsString('delete Fastly domain', $error->getMessage());
+        }
+
+        $this->assertCount(2, $client->calls);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
     }
 
     public function testDeleteActivatesClassicServiceWithoutDomainBeforeRemovingTls(): void
@@ -96,6 +114,27 @@ public function testDeleteActivatesClassicServiceWithoutDomainBeforeRemovingTls(
         $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[8]['url']);
     }
 
+    public function testClassicDomainConflictStopsBeforeActivationAndTlsDeletion(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com"}]}'),
+            $this->json('{"active_version":{"number":3,"domains":[{"name":"example.com"}]}}'),
+            $this->json('{"number":4}'),
+            $this->json('{"msg":"version is locked"}', 409),
+        ]);
+
+        try {
+            (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+            $this->fail('Expected classic domain deletion to fail.');
+        } catch (\RuntimeException $error) {
+            $this->assertStringContainsString('remove classic Fastly domain', $error->getMessage());
+        }
+
+        $this->assertCount(4, $client->calls);
+        $this->assertSame('DELETE', $client->calls[3]['method']);
+        $this->assertSame('https://api.fastly.com/service/service_1/version/4/domain/example.com', $client->calls[3]['url']);
+    }
+
     public function testDeleteStillRemovesOrphanedTlsSubscription(): void
     {
         $client = new TestClient([

From 5e20a533c96ed5462c40bd55b5577f743500be3d Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 12:59:18 +0100
Subject: [PATCH 3/8] Preserve TLS for classic domains on other services

---
 src/Cdn/Certificates/Provider/Fastly.php       |  4 +++-
 tests/Cdn/Certificates/Provider/FastlyTest.php | 13 +++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 1d28283..152fa6e 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -178,7 +178,9 @@ private function deleteClassicDomain(string $domain, ?string $domainType): void
         );
 
         if (!$containsDomain) {
-            $this->tls->deleteCertificate($domain, $domainType);
+            // Classic domain records do not identify their service. An
+            // account-wide FQDN match that is absent from this service may
+            // belong to another service, whose TLS must remain untouched.
             return;
         }
 
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 766fef1..2409cb3 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -135,6 +135,19 @@ public function testClassicDomainConflictStopsBeforeActivationAndTlsDeletion():
         $this->assertSame('https://api.fastly.com/service/service_1/version/4/domain/example.com', $client->calls[3]['url']);
     }
 
+    public function testClassicDomainOwnedByAnotherServiceLeavesTlsUntouched(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com"}]}'),
+            $this->json('{"active_version":{"number":3,"domains":[{"name":"other.example.com"}]}}'),
+        ]);
+
+        (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+
+        $this->assertCount(2, $client->calls);
+        $this->assertSame('https://api.fastly.com/service/service_1/details', $client->calls[1]['url']);
+    }
+
     public function testDeleteStillRemovesOrphanedTlsSubscription(): void
     {
         $client = new TestClient([

From 7be1c84f15e890e17bce492bf14df3ec8c4260f1 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:02:03 +0100
Subject: [PATCH 4/8] Limit versionless deletion to the configured service

---
 src/Cdn/Certificates/Provider/Fastly.php       |  4 ++++
 tests/Cdn/Certificates/Provider/FastlyTest.php | 12 ++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 152fa6e..3580e9b 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -113,6 +113,10 @@ public function deleteCertificate(string $domain, ?string $domainType = null): v
             return;
         }
 
+        if ($serviceId !== $this->serviceId) {
+            return;
+        }
+
         $this->deleteVersionlessDomain($domainInfo, $domainType);
     }
 
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 2409cb3..49b0ba3 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -84,6 +84,18 @@ public function testFailedVersionlessDomainDeletionLeavesTlsSubscriptionUntouche
         $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
     }
 
+    public function testVersionlessDomainOwnedByAnotherServiceIsNotDeleted(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"other_service"}]}'),
+        ]);
+
+        (new Fastly('token', 'service_1', client: $client))->deleteCertificate('example.com');
+
+        $this->assertCount(1, $client->calls);
+        $this->assertStringContainsString('/domain-management/v1/domains?', $client->calls[0]['url']);
+    }
+
     public function testDeleteActivatesClassicServiceWithoutDomainBeforeRemovingTls(): void
     {
         $client = new TestClient([

From 0e23cbc94b1a1e65319106b9c58c7f6833892ae7 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:05:06 +0100
Subject: [PATCH 5/8] Reassign Fastly domains atomically

---
 src/Cdn/Certificates/Provider/Fastly.php      | 13 ++++++--
 .../Cdn/Certificates/Provider/FastlyTest.php  | 31 ++++++++++++++-----
 2 files changed, 34 insertions(+), 10 deletions(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 3580e9b..2194b62 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -66,8 +66,17 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
             }
 
             if ($existingServiceId !== $this->serviceId) {
-                $this->deleteVersionlessDomain($domainInfo);
-                $domainInfo = null;
+                $domainId = $domainInfo['id'] ?? null;
+                if (!\is_string($domainId) || $domainId === '') {
+                    throw new \RuntimeException('Fastly domain response was missing its ID.');
+                }
+
+                $result = $this->request(
+                    'PATCH',
+                    '/domain-management/v1/domains/' . \rawurlencode($domainId),
+                    ['service_id' => $this->serviceId],
+                );
+                $this->assertSuccess('reassign Fastly domain', $result);
             }
         }
 
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 49b0ba3..e3ce42d 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -33,20 +33,35 @@ public function testIssueReassignsVersionlessDomainFromAnotherService(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
-            new Response(204),
+            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
             $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
-            new Response(204),
-            $this->json('{}', 201),
-            $this->json('{"data":[]}'),
-            $this->json('{"data":{"id":"sub_2","attributes":{"state":"pending"}}}', 201),
         ]);
 
         (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
 
+        $this->assertCount(3, $client->calls);
+        $this->assertSame('PATCH', $client->calls[1]['method']);
         $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
-        $this->assertSame('https://api.fastly.com/tls/subscriptions/sub_1?force=true', $client->calls[3]['url']);
-        $this->assertSame('new_service', $client->calls[4]['body']['service_id']);
-        $this->assertSame('https://api.fastly.com/tls/subscriptions', $client->calls[6]['url']);
+        $this->assertSame(['service_id' => 'new_service'], $client->calls[1]['body']);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[2]['url']);
+    }
+
+    public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"msg":"service unavailable"}', 503),
+        ]);
+
+        try {
+            (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
+            $this->fail('Expected domain reassignment to fail.');
+        } catch (\RuntimeException $error) {
+            $this->assertStringContainsString('reassign Fastly domain', $error->getMessage());
+        }
+
+        $this->assertCount(2, $client->calls);
+        $this->assertSame('PATCH', $client->calls[1]['method']);
     }
 
     public function testDeleteRemovesVersionlessSubscriptionAndDomain(): void

From de57a577af66da056dd449028d570a7a37afb9b8 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:09:13 +0100
Subject: [PATCH 6/8] Roll back Fastly reassignment on TLS failure

---
 src/Cdn/Certificates/Provider/Fastly.php      | 31 +++++++++++++-
 .../Cdn/Certificates/Provider/FastlyTest.php  | 42 +++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 2194b62..4835ad1 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -55,6 +55,7 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
     {
         $domain = Domain::validate($domain);
         $domainInfo = $this->findDomain($domain);
+        $reassignment = null;
 
         if ($domainInfo !== null) {
             $existingServiceId = $domainInfo['service_id'] ?? null;
@@ -77,6 +78,10 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
                     ['service_id' => $this->serviceId],
                 );
                 $this->assertSuccess('reassign Fastly domain', $result);
+                $reassignment = [
+                    'domainId' => $domainId,
+                    'previousServiceId' => $existingServiceId,
+                ];
             }
         }
 
@@ -88,7 +93,31 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
             $this->assertSuccess('add Fastly domain', $result, [201]);
         }
 
-        return $this->tls->issueCertificate($certName, $domain, $domainType);
+        try {
+            return $this->tls->issueCertificate($certName, $domain, $domainType);
+        } catch (\Throwable $tlsError) {
+            if ($reassignment === null) {
+                throw $tlsError;
+            }
+
+            $result = $this->request(
+                'PATCH',
+                '/domain-management/v1/domains/' . \rawurlencode($reassignment['domainId']),
+                ['service_id' => $reassignment['previousServiceId']],
+            );
+
+            try {
+                $this->assertSuccess('roll back Fastly domain reassignment', $result);
+            } catch (\Throwable $rollbackError) {
+                throw new \RuntimeException(
+                    'Fastly TLS issuance failed after domain reassignment and rollback also failed: '
+                    . $tlsError->getMessage() . '; ' . $rollbackError->getMessage(),
+                    previous: $tlsError,
+                );
+            }
+
+            throw $tlsError;
+        }
     }
 
     public function isInstantGeneration(string $domain, ?string $domainType): bool
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index e3ce42d..2a3bb60 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -64,6 +64,48 @@ public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched():
         $this->assertSame('PATCH', $client->calls[1]['method']);
     }
 
+    public function testTlsFailureRollsVersionlessDomainBackToOriginalService(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
+            $this->json('{"msg":"TLS unavailable"}', 503),
+            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}'),
+        ]);
+
+        try {
+            (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
+            $this->fail('Expected TLS issuance to fail.');
+        } catch (\RuntimeException $error) {
+            $this->assertStringContainsString('fetch Fastly TLS subscriptions', $error->getMessage());
+        }
+
+        $this->assertCount(4, $client->calls);
+        $this->assertSame(['service_id' => 'new_service'], $client->calls[1]['body']);
+        $this->assertSame(['service_id' => 'old_service'], $client->calls[3]['body']);
+    }
+
+    public function testTlsAndRollbackFailureReportsBothErrors(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
+            $this->json('{"msg":"TLS unavailable"}', 503),
+            $this->json('{"msg":"rollback unavailable"}', 503),
+        ]);
+
+        try {
+            (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
+            $this->fail('Expected TLS issuance and rollback to fail.');
+        } catch (\RuntimeException $error) {
+            $this->assertStringContainsString('TLS unavailable', $error->getMessage());
+            $this->assertStringContainsString('rollback unavailable', $error->getMessage());
+        }
+
+        $this->assertCount(4, $client->calls);
+        $this->assertSame(['service_id' => 'old_service'], $client->calls[3]['body']);
+    }
+
     public function testDeleteRemovesVersionlessSubscriptionAndDomain(): void
     {
         $client = new TestClient([

From 3ab7a2dd2a7ac0498e36069d092a4ad44259c663 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:12:34 +0100
Subject: [PATCH 7/8] Complete TLS before Fastly domain transfer

---
 src/Cdn/Certificates/Provider/Fastly.php      | 37 +++------------
 .../Cdn/Certificates/Provider/FastlyTest.php  | 46 +++++--------------
 2 files changed, 19 insertions(+), 64 deletions(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 4835ad1..5e7238f 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -55,7 +55,6 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
     {
         $domain = Domain::validate($domain);
         $domainInfo = $this->findDomain($domain);
-        $reassignment = null;
 
         if ($domainInfo !== null) {
             $existingServiceId = $domainInfo['service_id'] ?? null;
@@ -72,16 +71,18 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
                     throw new \RuntimeException('Fastly domain response was missing its ID.');
                 }
 
+                // Finish the certificate lifecycle while ownership is still
+                // unchanged. A TLS failure must not move a live hostname.
+                $renewDate = $this->tls->issueCertificate($certName, $domain, $domainType);
+
                 $result = $this->request(
                     'PATCH',
                     '/domain-management/v1/domains/' . \rawurlencode($domainId),
                     ['service_id' => $this->serviceId],
                 );
                 $this->assertSuccess('reassign Fastly domain', $result);
-                $reassignment = [
-                    'domainId' => $domainId,
-                    'previousServiceId' => $existingServiceId,
-                ];
+
+                return $renewDate;
             }
         }
 
@@ -93,31 +94,7 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
             $this->assertSuccess('add Fastly domain', $result, [201]);
         }
 
-        try {
-            return $this->tls->issueCertificate($certName, $domain, $domainType);
-        } catch (\Throwable $tlsError) {
-            if ($reassignment === null) {
-                throw $tlsError;
-            }
-
-            $result = $this->request(
-                'PATCH',
-                '/domain-management/v1/domains/' . \rawurlencode($reassignment['domainId']),
-                ['service_id' => $reassignment['previousServiceId']],
-            );
-
-            try {
-                $this->assertSuccess('roll back Fastly domain reassignment', $result);
-            } catch (\Throwable $rollbackError) {
-                throw new \RuntimeException(
-                    'Fastly TLS issuance failed after domain reassignment and rollback also failed: '
-                    . $tlsError->getMessage() . '; ' . $rollbackError->getMessage(),
-                    previous: $tlsError,
-                );
-            }
-
-            throw $tlsError;
-        }
+        return $this->tls->issueCertificate($certName, $domain, $domainType);
     }
 
     public function isInstantGeneration(string $domain, ?string $domainType): bool
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 2a3bb60..7b4dff5 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -33,23 +33,24 @@ public function testIssueReassignsVersionlessDomainFromAnotherService(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
-            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
             $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
         ]);
 
         (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
 
         $this->assertCount(3, $client->calls);
-        $this->assertSame('PATCH', $client->calls[1]['method']);
-        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[1]['url']);
-        $this->assertSame(['service_id' => 'new_service'], $client->calls[1]['body']);
-        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[2]['url']);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[1]['url']);
+        $this->assertSame('PATCH', $client->calls[2]['method']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[2]['url']);
+        $this->assertSame(['service_id' => 'new_service'], $client->calls[2]['body']);
     }
 
     public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             $this->json('{"msg":"service unavailable"}', 503),
         ]);
 
@@ -60,17 +61,16 @@ public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched():
             $this->assertStringContainsString('reassign Fastly domain', $error->getMessage());
         }
 
-        $this->assertCount(2, $client->calls);
-        $this->assertSame('PATCH', $client->calls[1]['method']);
+        $this->assertCount(3, $client->calls);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[1]['url']);
+        $this->assertSame('PATCH', $client->calls[2]['method']);
     }
 
-    public function testTlsFailureRollsVersionlessDomainBackToOriginalService(): void
+    public function testTlsFailureStopsBeforeVersionlessDomainReassignment(): void
     {
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
-            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
             $this->json('{"msg":"TLS unavailable"}', 503),
-            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}'),
         ]);
 
         try {
@@ -80,30 +80,8 @@ public function testTlsFailureRollsVersionlessDomainBackToOriginalService(): voi
             $this->assertStringContainsString('fetch Fastly TLS subscriptions', $error->getMessage());
         }
 
-        $this->assertCount(4, $client->calls);
-        $this->assertSame(['service_id' => 'new_service'], $client->calls[1]['body']);
-        $this->assertSame(['service_id' => 'old_service'], $client->calls[3]['body']);
-    }
-
-    public function testTlsAndRollbackFailureReportsBothErrors(): void
-    {
-        $client = new TestClient([
-            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
-            $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
-            $this->json('{"msg":"TLS unavailable"}', 503),
-            $this->json('{"msg":"rollback unavailable"}', 503),
-        ]);
-
-        try {
-            (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
-            $this->fail('Expected TLS issuance and rollback to fail.');
-        } catch (\RuntimeException $error) {
-            $this->assertStringContainsString('TLS unavailable', $error->getMessage());
-            $this->assertStringContainsString('rollback unavailable', $error->getMessage());
-        }
-
-        $this->assertCount(4, $client->calls);
-        $this->assertSame(['service_id' => 'old_service'], $client->calls[3]['body']);
+        $this->assertCount(2, $client->calls);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[1]['url']);
     }
 
     public function testDeleteRemovesVersionlessSubscriptionAndDomain(): void

From 30aea5a54b2d48c4bfa1a1a5e3b762604ba2fd76 Mon Sep 17 00:00:00 2001
From: loks0n <22452787+loks0n@users.noreply.github.com>
Date: Fri, 28 Aug 2026 13:15:57 +0100
Subject: [PATCH 8/8] Wait for usable TLS before domain transfer

---
 src/Cdn/Certificates/Provider/Fastly.php      |  6 ++++
 .../Cdn/Certificates/Provider/FastlyTest.php  | 31 +++++++++++++++----
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/src/Cdn/Certificates/Provider/Fastly.php b/src/Cdn/Certificates/Provider/Fastly.php
index 5e7238f..c55e6f5 100644
--- a/src/Cdn/Certificates/Provider/Fastly.php
+++ b/src/Cdn/Certificates/Provider/Fastly.php
@@ -7,6 +7,7 @@
 use Utopia\Client;
 use Utopia\Client\Adapter\Curl\Client as CurlAdapter;
 use Utopia\Cdn\Certificates\Provider;
+use Utopia\Cdn\Certificates\Status;
 use Utopia\Cdn\Domain;
 use Utopia\Psr7\Header;
 use Utopia\Psr7\Request\Factory as RequestFactory;
@@ -74,6 +75,11 @@ public function issueCertificate(string $certName, string $domain, ?string $doma
                 // Finish the certificate lifecycle while ownership is still
                 // unchanged. A TLS failure must not move a live hostname.
                 $renewDate = $this->tls->issueCertificate($certName, $domain, $domainType);
+                $status = $this->tls->getCertificateStatus($domain, $domainType);
+
+                if (!\in_array($status, [Status::ISSUED, Status::RENEWING], true)) {
+                    return $renewDate;
+                }
 
                 $result = $this->request(
                     'PATCH',
diff --git a/tests/Cdn/Certificates/Provider/FastlyTest.php b/tests/Cdn/Certificates/Provider/FastlyTest.php
index 7b4dff5..edc7d6f 100644
--- a/tests/Cdn/Certificates/Provider/FastlyTest.php
+++ b/tests/Cdn/Certificates/Provider/FastlyTest.php
@@ -34,16 +34,33 @@ public function testIssueReassignsVersionlessDomainFromAnotherService(): void
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
             $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             $this->json('{"id":"domain_1","fqdn":"example.com","service_id":"new_service"}'),
         ]);
 
         (new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null);
 
-        $this->assertCount(3, $client->calls);
+        $this->assertCount(4, $client->calls);
         $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[1]['url']);
-        $this->assertSame('PATCH', $client->calls[2]['method']);
-        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[2]['url']);
-        $this->assertSame(['service_id' => 'new_service'], $client->calls[2]['body']);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[2]['url']);
+        $this->assertSame('PATCH', $client->calls[3]['method']);
+        $this->assertSame('https://api.fastly.com/domain-management/v1/domains/domain_1', $client->calls[3]['url']);
+        $this->assertSame(['service_id' => 'new_service'], $client->calls[3]['body']);
+    }
+
+    public function testPendingTlsDoesNotReassignVersionlessDomain(): void
+    {
+        $client = new TestClient([
+            $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"pending"}}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"pending"}}]}'),
+        ]);
+
+        $this->assertNull((new Fastly('token', 'new_service', client: $client))->issueCertificate('cert', 'example.com', null));
+
+        $this->assertCount(3, $client->calls);
+        $this->assertSame('GET', $client->calls[2]['method']);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[2]['url']);
     }
 
     public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched(): void
@@ -51,6 +68,7 @@ public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched():
         $client = new TestClient([
             $this->json('{"data":[{"id":"domain_1","fqdn":"example.com","service_id":"old_service"}]}'),
             $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
+            $this->json('{"data":[{"id":"sub_1","attributes":{"state":"issued"}}]}'),
             $this->json('{"msg":"service unavailable"}', 503),
         ]);
 
@@ -61,9 +79,10 @@ public function testFailedVersionlessReassignmentLeavesDomainAndTlsUntouched():
             $this->assertStringContainsString('reassign Fastly domain', $error->getMessage());
         }
 
-        $this->assertCount(3, $client->calls);
+        $this->assertCount(4, $client->calls);
         $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[1]['url']);
-        $this->assertSame('PATCH', $client->calls[2]['method']);
+        $this->assertStringStartsWith('https://api.fastly.com/tls/subscriptions?', $client->calls[2]['url']);
+        $this->assertSame('PATCH', $client->calls[3]['method']);
     }
 
     public function testTlsFailureStopsBeforeVersionlessDomainReassignment(): void