Add support for EV, OV Wildcard, and DV Wildcard multi-name certificate products - #18
Open
bhillkeyfactor wants to merge 19 commits into
Open
bhillkeyfactor wants to merge 19 commits into
bhillkeyfactor wants to merge 19 commits into
Conversation
…te products CSC TrustedSecure EV, Multiple Names (7), CSC TrustedSecure OV Wildcard, Multiple Names (8), and CSC TrustedSecure DV Wildcard, Multiple Names (9) per CSC's certificate type table. Type 7 requires both EvCertificateDetails and SubjectAlternativeNames since it is EV plus multi-name; 8 and 9 only need SubjectAlternativeNames.
Introduce a step-oriented FlowLogger for tracing Enroll, Revoke, and Synchronize pipelines end to end, and add logging throughout RequestManager (previously had none) and CscGlobalClient (missing error/warning branches, wrong logger category on CscGlobalClient).
…s unset Only look up the optional additional-SAN-emails field when the domain control validation method is EMAIL, and use TryGetValue instead of the indexer so a missing/blank value no longer throws.
…no 'dnsname' key UC certificate enrollments with zero SANs supplied threw KeyNotFoundException from the sans["dnsname"] indexer. Use TryGetValue and treat a missing key as no SANs instead of throwing.
Registration/Renewal/Reissue/Revoke calls only handled CSC Global's 400 error-body case; any other failure status (e.g. 404) fell through to deserializing an empty/unexpected body, leaving Result and RegistrationError both null and causing a downstream NullReferenceException in RequestManager instead of a clear error.
Add null and bounds guards throughout the enrollment, revoke, and sync paths: CSC Global responses (Result/RegistrationError/Status may be null even on a 200), optional ProductParameters lookups that were using the strict indexer, CARequestID substring truncation, and config/dictionary lookups in Initialize and the CscGlobalClient constructor. Replaces silent NREs with clear, logged failures.
…/Keyfactor/cscglobal-caplugin into feature/ev-ov-dv-multiname-certs
Previously the CSC Global list request filtered to status=in=(ACTIVE,REVOKED) and SyncCertificates only forwarded GENERATED/REVOKED records, so any pending or failed request was never reported back to Command on any sync cycle. Command eventually treats a request it hasn't seen in recent syncs as outdated and tries to prune it, which can trigger an internal Command cleanup bug for requests with no staged private key. Now every request CSC Global returns is forwarded to Command each sync, with certificate content attached only when actually issued or revoked.
…ed/revoked" This reverts commit fa1b23e.
…ng sync CSC Global renamed its product line at some point; its sync/list API now returns current names (e.g. "CSC TrustedSecure DV") while this plugin's ProductIDs/GetCertificateType still use the legacy names it shipped with (e.g. "CSC TrustedSecure Domain Validated SSL"). Syncing a cert back set ProductID directly from CSC's current name, which never matched Command's Certificate Profile/Template mappings (keyed on the legacy names) for 7 of the 10 product types. Add a reverse lookup so synced certificates resolve to the same ProductID used during enrollment.
Drop the legacy product-name compatibility layer (GetCertificateType's duplicate/old-name cases, the CscCertificateTypeToProductId sync mapping) and use CSC's certificate type names directly everywhere: CSC TrustedSecure OV/OV Wildcard/OV Multiple Names/EV/DV/DV Wildcard/DV Multiple Names plus the three new EV/OV Wildcard/DV Wildcard Multiple Names products. There is no template mapping persisted in the gateway database, so no migration is needed, but existing Command Certificate Templates must have their Template Short Name updated to the new names.
TemplateSync defaulted to off and was never turned on, so template sync never ran. There is no reason to keep it opt-in, so always resolve synced certificates back to their CSC certificate type/template and drop the gateway registration setting.
…/Keyfactor/cscglobal-caplugin into feature/ev-ov-dv-multiname-certs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan