I have a general question. With ACME and Let's Encrypt, I can request both DSA and RSA certs from the same ACME server URL, and the CA that signs looks to be the same. With Infisical, when I try to reproduce the same architecture (CA + intermediate in DSA) and request a RSA cert, I get

acme: error: 400 :: urn:ietf:params:acme:error:badCSR :: Invalid CSR: Requested signature algorithm RSA-SHA256 is not compatible with CA key algorithm EC_prime256v1. CA can only sign with ECDSA-based signature algorithms.

The only solution I have found so far is to have two intermediates and two profiles. The issue with this approach. I need to distribute two ACME URLs, and the user needs to choose accordingly. Try to avoid making a mistake. But if I have an RSA intermediate below a DSA CA, why doesn't Infisical allow signing a leaf RSA cert from a DSA intermediate ?

You're right that this is possible in principle, and the way Let's Encrypt handles it is a good reference. In Infisical, the current design binds a certificate profile to exactly one CA, which means one ACME URL can only serve one key type. So the two-profile/two-URL setup you landed on is actually the correct approach given this constraint, not just a workaround. Is this a big blocker for you, or is the two-profile setup workable for your use case?

no not a blocker as there is a workaround but i think it is an important improvement to bring to the product in the future