diff --git a/backend/internal/httpapi/server.go b/backend/internal/httpapi/server.go
index 4dfc242..198eb8a 100644
--- a/backend/internal/httpapi/server.go
+++ b/backend/internal/httpapi/server.go
@@ -730,11 +730,26 @@ func (s *Server) deleteDomain(c *gin.Context) {
 	c.Status(http.StatusNoContent)
 }
 
+func (s *Server) authorizeSynchronousCertificateIssue(c *gin.Context) bool {
+	if !s.authorizeVisibleDomainPermissions(c, domain.PermissionCertificateManage, domain.PermissionDeploymentExecute) {
+		return false
+	}
+	resource, err := s.projectResources.GetVisibleDomain(c.Request.Context(), c.GetString(authenticatedActorKey), c.Param("id"))
+	if err != nil {
+		s.writeProjectResourceError(c, err)
+		return false
+	}
+	return s.authorizeDNSCredentialUse(c, resource.ResourceScope.Normalize().ProjectID)
+}
+
 func (s *Server) issueDomain(c *gin.Context) {
 	if s.tasks != nil {
 		s.issueDomainAsTask(c)
 		return
 	}
+	if !s.authorizeSynchronousCertificateIssue(c) {
+		return
+	}
 	if s.issueCertificate == nil {
 		s.writeError(c, http.StatusNotImplemented, "证书申请接口尚未配置", errors.New("证书申请工作流未配置"))
 		return