diff --git a/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj b/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj index bd3ec73..29d58ed 100644 --- a/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj +++ b/CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj @@ -16,14 +16,16 @@ - + + + diff --git a/CERTInext.IntegrationTests/CloudflareDomainValidator.cs b/CERTInext.IntegrationTests/CloudflareDomainValidator.cs index 89c01eb..db56616 100644 --- a/CERTInext.IntegrationTests/CloudflareDomainValidator.cs +++ b/CERTInext.IntegrationTests/CloudflareDomainValidator.cs @@ -23,7 +23,7 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests /// Credentials are read from the : /// CERTINEXT_CF_API_TOKEN and CERTINEXT_CF_ZONE_ID. /// - internal sealed class CloudflareDomainValidator : IDomainValidator + internal sealed class CloudflareDomainValidator : IDomainValidator, IDisposable { private const string CfApiBase = "https://api.cloudflare.com/client/v4"; @@ -113,11 +113,13 @@ public async Task CleanupValidation(string key, Cancella public Task ValidateConfiguration(Dictionary configuration) => Task.CompletedTask; public Dictionary GetDomainValidatorAnnotations() => new(); public string GetValidationType() => "dns-01"; + + public void Dispose() => _http.Dispose(); } - internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory + internal sealed class CloudflareDomainValidatorFactory : IDomainValidatorFactory, IDisposable { - private readonly IDomainValidator _validator; + private readonly CloudflareDomainValidator _validator; public CloudflareDomainValidatorFactory(string apiToken, string zoneId) { @@ -125,5 +127,7 @@ public CloudflareDomainValidatorFactory(string apiToken, string zoneId) } public IDomainValidator ResolveDomainValidator(string domain, string validationType) => _validator; + + public void Dispose() => _validator.Dispose(); } } diff --git a/CERTInext.IntegrationTests/DcvLifecycleTests.cs b/CERTInext.IntegrationTests/DcvLifecycleTests.cs index 24ba0f1..5f2d57e 100644 --- a/CERTInext.IntegrationTests/DcvLifecycleTests.cs +++ b/CERTInext.IntegrationTests/DcvLifecycleTests.cs @@ -40,10 +40,11 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests /// CERTINEXT_DCV_DOMAIN=<subdomain to use, e.g. dcv-test.example.com> /// /// - public class DcvLifecycleTests : IClassFixture + public class DcvLifecycleTests : IClassFixture, IDisposable { private readonly IntegrationTestFixture _fixture; private readonly ITestOutputHelper _output; + private readonly List _toDispose = new List(); public DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output) { @@ -51,6 +52,13 @@ public DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper outpu _output = output; } + public void Dispose() + { + foreach (var d in _toDispose) + d.Dispose(); + _toDispose.Clear(); + } + // --------------------------------------------------------------------------- // Helpers // --------------------------------------------------------------------------- @@ -69,11 +77,17 @@ private static string GenerateCsrPem(string commonName) + "\n-----END CERTIFICATE REQUEST-----"; } - private IDomainValidatorFactory BuildDnsFactory() => - _fixture.IsCloudflareConfigured - ? (IDomainValidatorFactory)new CloudflareDomainValidatorFactory( - _fixture.CloudflareApiToken, _fixture.CloudflareZoneId) - : new StubDomainValidatorFactory(); + private IDomainValidatorFactory BuildDnsFactory() + { + if (_fixture.IsCloudflareConfigured) + { + var factory = new CloudflareDomainValidatorFactory( + _fixture.CloudflareApiToken, _fixture.CloudflareZoneId); + _toDispose.Add(factory); + return factory; + } + return new StubDomainValidatorFactory(); + } /// /// Runs plugin.Synchronize and returns every record that came out of the @@ -88,6 +102,7 @@ private static async Task> RunSyncAsync(CERTInextCA var syncTask = Task.Run(async () => { await plugin.Synchronize(buffer, lastSync: null, fullSync: true, cancelToken: System.Threading.CancellationToken.None); + // Synchronize calls CompleteAdding() in its finally block; guard against double-call. if (!buffer.IsAddingCompleted) buffer.CompleteAdding(); }); @@ -655,7 +670,6 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks() List synced = null; System.Diagnostics.Stopwatch syncPhaseSw = System.Diagnostics.Stopwatch.StartNew(); int passesUsed = 0; - int finalNotIssued = -1; for (int pass = 1; pass <= maxSyncPasses; pass++) { @@ -664,13 +678,27 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks() synced = await RunSyncAsync(plugin); passSw.Stop(); + // Classify enrolled orders by their current status so that FAILED orders + // are not silently counted as still-pending, which would burn the full + // pass budget before producing a misleading "expected 0" assertion. int generated = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.GENERATED); - int pending = enrolledIds.Count - generated; - finalNotIssued = pending; + int failed = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED); + int pending = enrolledIds.Count - generated - failed; _output.WriteLine( $"--- Sync pass #{pass}: returned {synced.Count} records, {generated}/{enrolledIds.Count} GENERATED, " + - $"{pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---"); + $"{failed} FAILED, {pending} still pending, elapsed={passSw.Elapsed:mm\\:ss} ---"); + + if (failed > 0) + { + var failedIds = synced + .Where(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED) + .Select(r => r.CARequestID) + .Take(5); + Assert.Fail( + $"Pass #{pass}: {failed} order(s) reached FAILED status and will never issue: " + + string.Join(", ", failedIds)); + } if (pending == 0) break; @@ -696,10 +724,14 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks() $"{string.Join(", ", missing.Take(5))}{(missing.Count > 5 ? ", ..." : "")}"); // Final assertion — every enrolled order must be GENERATED after the polling window. - var lookup = synced.ToDictionary(r => r.CARequestID, r => r); + // Filter null CARequestIDs before building the lookup (guards against any CA response + // that omits the ID, which would otherwise throw ArgumentNullException in ToDictionary). + var lookup = synced + .Where(r => r.CARequestID != null) + .ToDictionary(r => r.CARequestID, r => r); var notIssued = enrolledIds + .Where(id => lookup.TryGetValue(id, out var rec) && rec.Status != (int)EndEntityStatus.GENERATED) .Select(id => lookup[id]) - .Where(r => r.Status != (int)EndEntityStatus.GENERATED) .ToList(); if (notIssued.Count > 0) @@ -711,7 +743,7 @@ public async Task BulkDvEnrollment_AllOrdersIssue_AndPaginationWorks() notIssued.Should().BeEmpty( $"every enrolled DV order should auto-issue on the new sandbox after {maxSyncPasses} sync passes; " + - $"{notIssued.Count} did not (last pass: {finalNotIssued} pending)."); + $"{notIssued.Count} did not."); _output.WriteLine($"--- SUCCESS: {count}/{count} DV orders enrolled, synced, and issued in {passesUsed} sync pass(es). " + $"Enroll={sw.Elapsed:mm\\:ss} SyncPhase={syncPhaseSw.Elapsed:mm\\:ss} Total={(sw.Elapsed + syncPhaseSw.Elapsed):mm\\:ss} ---"); diff --git a/CERTInext.IntegrationTests/IntegrationTestFixture.cs b/CERTInext.IntegrationTests/IntegrationTestFixture.cs index 8e4f637..0a414f9 100644 --- a/CERTInext.IntegrationTests/IntegrationTestFixture.cs +++ b/CERTInext.IntegrationTests/IntegrationTestFixture.cs @@ -20,6 +20,23 @@ namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests /// public sealed class IntegrationTestFixture : IDisposable { + // --------------------------------------------------------------------------- + // Opt-in guard + // --------------------------------------------------------------------------- + + /// + /// Env-var keys that must be set explicitly in the shell and must NOT be + /// auto-promoted from the env file. These gate destructive or mutating tests + /// so a developer cannot accidentally arm them by leaving flags in ~/.env_certinext. + /// + private static readonly System.Collections.Generic.HashSet _optInOnlyFlags = + new System.Collections.Generic.HashSet(StringComparer.OrdinalIgnoreCase) + { + "CERTINEXT_COMPLETE_PENDING", + "CERTINEXT_RUN_BULK_TEST", + "CERTINEXT_V2_RUN_BULK_TEST", + }; + // --------------------------------------------------------------------------- // Credential properties // --------------------------------------------------------------------------- @@ -85,8 +102,12 @@ public IntegrationTestFixture() // Promote env-file values into the process environment so that any code // calling System.Environment.GetEnvironmentVariable() picks them up. + // Opt-in destructive-test flags are deliberately excluded: they must be + // set explicitly in the shell so a developer who leaves them in the file + // does not accidentally arm bulk/mutating tests on every bare `dotnet test`. foreach (var kv in env) - if (System.Environment.GetEnvironmentVariable(kv.Key) == null) + if (System.Environment.GetEnvironmentVariable(kv.Key) == null + && !_optInOnlyFlags.Contains(kv.Key)) System.Environment.SetEnvironmentVariable(kv.Key, kv.Value); ApiUrl = GetEnvValue(env, "CERTINEXT_API_URL"); diff --git a/CERTInext.IntegrationTests/RecordingDomainValidator.cs b/CERTInext.IntegrationTests/RecordingDomainValidator.cs new file mode 100644 index 0000000..be46395 --- /dev/null +++ b/CERTInext.IntegrationTests/RecordingDomainValidator.cs @@ -0,0 +1,94 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Linq; +using System.Threading; +using System.Threading.Tasks; +using Keyfactor.AnyGateway.Extensions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// spy that wraps a real (Cloudflare or stub) validator + /// and records every StageValidation/CleanupValidation call, including the + /// FQDN and staged value, so DCV-on tests can assert whether the plugin actually staged + /// a TXT record rather than just asserting that Enroll did not throw (gap G5, issues/0020). + /// + internal sealed class RecordingDomainValidator : IDomainValidator + { + private readonly IDomainValidator _inner; + private readonly ConcurrentQueue<(string Fqdn, string Value)> _staged = new(); + private readonly ConcurrentQueue _cleanedUp = new(); + + public RecordingDomainValidator(IDomainValidator inner) + { + _inner = inner; + } + + public IReadOnlyList<(string Fqdn, string Value)> StagedCalls => _staged.ToList(); + public IReadOnlyList CleanedUpFqdns => _cleanedUp.ToList(); + + public void Initialize(IDomainValidatorConfigProvider configProvider) => _inner.Initialize(configProvider); + + public async Task StageValidation(string key, string value, CancellationToken cancellationToken) + { + _staged.Enqueue((key, value)); + return await _inner.StageValidation(key, value, cancellationToken); + } + + public async Task CleanupValidation(string key, CancellationToken cancellationToken) + { + _cleanedUp.Enqueue(key); + return await _inner.CleanupValidation(key, cancellationToken); + } + + public Task ValidateConfiguration(Dictionary configuration) => _inner.ValidateConfiguration(configuration); + public Dictionary GetDomainValidatorAnnotations() => _inner.GetDomainValidatorAnnotations(); + public string GetValidationType() => _inner.GetValidationType(); + } + + /// + /// that wraps another factory and hands out + /// spies so tests can inspect what the plugin + /// actually did with the DNS provider, keyed by (domain, validationType). Does not own + /// disposal of the wrapped factory — callers that build a disposable inner factory + /// (e.g. CloudflareDomainValidatorFactory) remain responsible for disposing it. + /// + internal sealed class RecordingDomainValidatorFactory : IDomainValidatorFactory + { + private readonly IDomainValidatorFactory _inner; + private readonly ConcurrentDictionary _wrapped = new(); + + public RecordingDomainValidatorFactory(IDomainValidatorFactory inner) + { + _inner = inner; + } + + public IDomainValidator ResolveDomainValidator(string domain, string validationType) + { + string cacheKey = $"{domain}|{validationType}"; + return _wrapped.GetOrAdd(cacheKey, _ => new RecordingDomainValidator(_inner.ResolveDomainValidator(domain, validationType))); + } + + /// All StageValidation calls recorded across every domain resolved so far. + public IReadOnlyList<(string Fqdn, string Value)> StagedCalls => + _wrapped.Values.SelectMany(v => v.StagedCalls).ToList(); + + /// All CleanupValidation calls recorded across every domain resolved so far. + public IReadOnlyList CleanedUpFqdns => + _wrapped.Values.SelectMany(v => v.CleanedUpFqdns).ToList(); + } +} diff --git a/CERTInext.IntegrationTests/SanSubmissionProbeTests.cs b/CERTInext.IntegrationTests/SanSubmissionProbeTests.cs new file mode 100644 index 0000000..23681d1 --- /dev/null +++ b/CERTInext.IntegrationTests/SanSubmissionProbeTests.cs @@ -0,0 +1,391 @@ +// Copyright 2026 Keyfactor +// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. +// At http://www.apache.org/licenses/LICENSE-2.0 +// +// Probe: establish empirically how CERTInext treats the SAN/domain fields on +// GenerateOrderSSL. Written because the plugin's original behaviour encoded three +// assumptions that were never measured: +// +// A. certificateInformation.additionalDomains is the field that puts extra names on +// the certificate (so a UCC order that omits it yields a CN-only certificate). +// B. additionalDomains accepts DNS names only, so a non-DNS SAN is rejected by the CA. +// C. Repeating the primary domainName inside additionalDomains is harmful (duplicate +// domain / consumes the UCC allowance), so it should be de-duplicated. +// +// None of these had a test. This probe answers them against the live API by placing one +// order per variant and reading back the domain set CERTInext actually registered, via +// TrackOrder's domainVerification block (keys are the domains on the order). That is +// ground truth for "which names did the CA put on this order" without waiting for DCV +// and issuance to complete. +// +// --------------------------------------------------------------------------------------- +// MEASURED RESULTS — SANDBOX ONLY: sandbox-us, account 4951571271, product 844 (OV SSL UCC), +// 2026-08-12. (Product 840 / DV UCC is not enabled on that account: "Invalid Product Code".) +// +// These are sandbox observations. Re-run against production before treating B or C as +// settled there — point ~/.env_certinext at the production account and set +// CERTINEXT_SAN_PROBE_PRODUCTS to a UCC code that account can actually order (product +// numbering is per-account; the codes in Constants.Products are defaults, not guarantees). +// Finding A and the CSR-SAN result below are separately corroborated by production: the +// customer report that prompted this work was a production UCC order whose CSR carried the +// SANs and whose issued certificate held only the CN. +// +// A. CONFIRMED. additionalDomains is what puts extra names on the order. Submitting +// CN + extra1. registered BOTH domains. +// +// B. DISPROVEN. Non-DNS values are NOT rejected. An email address, an IPv4 literal and +// an https:// URI were each accepted at placement AND registered as order domains +// ("san-probe@example.com", "192.0.2.10", "https://san-probe.example.com/x" all came +// back as domainVerification keys). So the CA does not validate the field's contents +// at order time; such an order is created and then cannot pass DCV, rather than +// failing cleanly up front. +// +// C. PARTLY DISPROVEN. Repeating the primary domainName inside additionalDomains is +// accepted and CERTInext collapses it itself — the order came back with the CN +// registered once. De-duplicating on our side is therefore belt-and-braces, not a +// correctness requirement. +// +// Root cause of the customer-reported "UCC SANs not populating": CERTInext IGNORES the +// subjectAltName extension in the CSR. A CSR carrying CN + extra2., submitted with +// additionalDomains omitted, registered ONLY the CN. SANs must be sent in +// additionalDomains or they do not reach the certificate, no matter what the CSR says. +// --------------------------------------------------------------------------------------- +// +// Opt-in: this places real orders against whatever account ~/.env_certinext points at. +// +// set -a; . ~/.env_certinext; set +a +// export CERTINEXT_SAN_PROBE=1 +// dotnet test CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj -c Release \ +// --filter "FullyQualifiedName~SanSubmissionProbeTests" \ +// --logger "console;verbosity=detailed" > /tmp/sanprobe.log 2>&1 +// +// (xUnit buffers ITestOutputHelper output until the test ends — read the report at the tail.) + +using System; +using System.Collections.Generic; +using System.Linq; +using System.Threading.Tasks; +using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Org.BouncyCastle.Asn1; +using Org.BouncyCastle.Asn1.Pkcs; +using Org.BouncyCastle.Asn1.X509; +using Org.BouncyCastle.Crypto; +using Org.BouncyCastle.Crypto.Generators; +using Org.BouncyCastle.Pkcs; +using Org.BouncyCastle.Security; +using Xunit; +using Xunit.Abstractions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + public class SanSubmissionProbeTests : IClassFixture + { + private const string OptInFlag = "CERTINEXT_SAN_PROBE"; + + /// + /// Comma-separated product codes to probe. Defaults to the Multi-Domain (UCC) codes, + /// because additional domains are only meaningful on a UCC product — a single-domain + /// product (e.g. 842 = OV SSL) registers the CN and nothing else no matter what + /// additionalDomains contains, which makes it useless as a probe target. + /// + private const string ProductCodesFlag = "CERTINEXT_SAN_PROBE_PRODUCTS"; + private const string DefaultProductCodes = "840,844"; + + private readonly IntegrationTestFixture _fixture; + private readonly ITestOutputHelper _out; + + public SanSubmissionProbeTests(IntegrationTestFixture fixture, ITestOutputHelper output) + { + _fixture = fixture; + _out = output; + } + + // ------------------------------------------------------------------------- + // CSR generation (BouncyCastle — project crypto policy) + // ------------------------------------------------------------------------- + + /// + /// Generates a PKCS#10 CSR for , optionally carrying a + /// subjectAltName extension (via the PKCS#9 extensionRequest attribute) holding + /// . The SAN-bearing form is what lets this probe ask + /// whether CERTInext reads SANs out of the CSR at all. + /// + private static string GenerateCsrPem(string cn, params string[] dnsSans) + { + var keyGen = new RsaKeyPairGenerator(); + keyGen.Init(new KeyGenerationParameters(new SecureRandom(), 2048)); + AsymmetricCipherKeyPair kp = keyGen.GenerateKeyPair(); + + Asn1Set attributes = null; + if (dnsSans != null && dnsSans.Length > 0) + { + var names = new GeneralNames( + dnsSans.Select(d => new GeneralName(GeneralName.DnsName, d)).ToArray()); + + var extGen = new X509ExtensionsGenerator(); + extGen.AddExtension(X509Extensions.SubjectAlternativeName, critical: false, extValue: names); + + attributes = new DerSet(new AttributePkcs( + PkcsObjectIdentifiers.Pkcs9AtExtensionRequest, + new DerSet(extGen.Generate()))); + } + + var csr = new Pkcs10CertificationRequest( + "SHA256withRSA", new X509Name($"CN={cn}"), kp.Public, attributes, kp.Private); + + return "-----BEGIN CERTIFICATE REQUEST-----\n" + + Convert.ToBase64String(csr.GetEncoded(), Base64FormattingOptions.InsertLineBreaks) + + "\n-----END CERTIFICATE REQUEST-----"; + } + + // ------------------------------------------------------------------------- + // One probe variant + // ------------------------------------------------------------------------- + + private sealed class ProbeOutcome + { + public string ProductCode; + public string Label; + public bool Accepted; + public string OrderNumber; + public string Detail; + /// Domains CERTInext registered on the order, per TrackOrder. + public List RegisteredDomains = new List(); + /// Names we asked CERTInext to put on the order, for comparison. + public List RequestedDomains = new List(); + + /// + /// True when the rejection was "Invalid Product Code" — the product simply is not + /// enabled on this account, which is not a data point about SAN handling. + /// + public bool ProductUnavailable; + } + + /// + /// Places one order and reads back the domain set CERTInext registered for it. + /// drives certificateInformation.additionalDomains; + /// drives the SAN extension inside the CSR. They are + /// varied independently on purpose — that separation is the whole point of the probe. + /// + private async Task ProbeAsync( + string productCode, + string label, + Func> sansFactory, + string[] csrSans) + { + var outcome = new ProbeOutcome { ProductCode = productCode, Label = label }; + + var client = new CERTInextClient(_fixture.Config); + string cn = $"sanprobe-{DateTime.UtcNow:yyyyMMddHHmmssfff}.{SafeLabel(label)}.example.com"; + + var sans = sansFactory?.Invoke(cn); + outcome.RequestedDomains = sans == null + ? new List() + : sans.Select(s => $"{s.Type}:{s.Value}").ToList(); + + var req = new EnrollCertificateRequest + { + Csr = GenerateCsrPem(cn, csrSans == null ? null : csrSans.Select(s => Format(s, cn)).ToArray()), + Subject = $"CN={cn}", + Sans = sans, + ProfileId = productCode, + RequesterName = _fixture.RequestorName, + RequesterEmail = _fixture.RequestorEmail + }; + + try + { + var resp = await client.EnrollCertificateAsync(req); + outcome.Accepted = true; + outcome.OrderNumber = resp?.Id; + outcome.Detail = $"OrderNumber={resp?.Id} Status={resp?.Status}"; + } + catch (Exception ex) + { + outcome.Accepted = false; + outcome.Detail = ex.Message; + outcome.ProductUnavailable = + ex.Message.IndexOf("Invalid Product Code", StringComparison.OrdinalIgnoreCase) >= 0; + return outcome; + } + + // Read back which domains the CA actually put on the order. + try + { + var track = await client.TrackOrderAsync(outcome.OrderNumber); + var entries = track.OrderDetails?.DomainVerification?.GetDomainEntries(); + if (entries != null) + outcome.RegisteredDomains = entries.Keys.OrderBy(k => k, StringComparer.OrdinalIgnoreCase).ToList(); + } + catch (Exception ex) + { + outcome.Detail += $" | TrackOrder failed: {ex.Message}"; + } + + return outcome; + } + + /// Substitutes the generated CN into a variant's placeholder template. + private static string Format(string template, string cn) => template.Replace("{cn}", cn); + + private static string SafeLabel(string label) => + new string(label.ToLowerInvariant().Select(c => char.IsLetterOrDigit(c) ? c : '-').ToArray()) + .Trim('-'); + + // ------------------------------------------------------------------------- + // The probe + // ------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe_SanSubmissionBehaviour() + { + IntegrationSkip.IfNotConfigured(_fixture); + Skip.IfNot( + Environment.GetEnvironmentVariable(OptInFlag) == "1", + $"Set {OptInFlag}=1 to run this probe — it places real orders on the configured account."); + + var variants = new List<(string Label, Func> Sans, string[] CsrSans)> + { + // 1. Assumption A, positive control: additionalDomains carries an extra DNS + // name. If the extra name comes back registered, additionalDomains works. + ("dns-extra-via-additionalDomains", + cn => new List + { + new SanEntry { Type = "dns", Value = cn }, + new SanEntry { Type = "dns", Value = $"extra1.{cn}" } + }, + new[] { "{cn}", "extra1.{cn}" }), + + // 2. Assumption A, the actual bug: CSR carries both names, additionalDomains + // is omitted entirely. This is what v1.0.1 sent for every UCC enrollment. + // If only the CN comes back registered, the CA does NOT read CSR SANs and + // the diagnosis is confirmed. + ("csr-sans-only-no-additionalDomains", + _ => null, + new[] { "{cn}", "extra2.{cn}" }), + + // 3. Assumption C: primary domainName repeated inside additionalDomains. + // Does the CA reject it, or silently collapse it? + ("cn-duplicated-in-additionalDomains", + cn => new List + { + new SanEntry { Type = "dns", Value = cn }, + new SanEntry { Type = "dns", Value = cn } + }, + new[] { "{cn}" }), + + // 4-6. Assumption B: non-DNS values in additionalDomains. Rejected, ignored, + // or accepted? Each is submitted alongside a valid DNS name so a rejection + // is attributable to the non-DNS value rather than an empty domain set. + ("nondns-email-in-additionalDomains", + cn => new List + { + new SanEntry { Type = "dns", Value = cn }, + new SanEntry { Type = "email", Value = "san-probe@example.com" } + }, + new[] { "{cn}" }), + + ("nondns-ip-in-additionalDomains", + cn => new List + { + new SanEntry { Type = "dns", Value = cn }, + new SanEntry { Type = "ip", Value = "192.0.2.10" } + }, + new[] { "{cn}" }), + + ("nondns-uri-in-additionalDomains", + cn => new List + { + new SanEntry { Type = "dns", Value = cn }, + new SanEntry { Type = "uri", Value = "https://san-probe.example.com/x" } + }, + new[] { "{cn}" }), + }; + + string[] productCodes = + (Environment.GetEnvironmentVariable(ProductCodesFlag) ?? DefaultProductCodes) + .Split(',', StringSplitOptions.RemoveEmptyEntries) + .Select(p => p.Trim()) + .Where(p => p.Length > 0) + .ToArray(); + + var results = new List(); + foreach (string productCode in productCodes) + { + bool unavailable = false; + foreach (var (label, sans, csrSans) in variants) + { + var outcome = await ProbeAsync(productCode, label, sans, csrSans); + results.Add(outcome); + + // Don't burn five more orders proving the same product code is not + // enabled on this account. + if (outcome.ProductUnavailable) + { + unavailable = true; + break; + } + + // Throttle: the sandbox rate-limits order bursts (~16 orders / 10 s). + await Task.Delay(1500); + } + + if (unavailable) + _out.WriteLine($"(product {productCode} is not enabled on this account — skipped)"); + } + + _out.WriteLine("=== CERTInext SAN submission probe ==="); + _out.WriteLine($"ProductCodes probed : {string.Join(", ", productCodes)}"); + _out.WriteLine($"(fixture default : {_fixture.ProductCode})"); + _out.WriteLine(""); + + foreach (var group in results.GroupBy(r => r.ProductCode)) + { + _out.WriteLine($"--- ProductCode {group.Key} ---"); + foreach (var r in group) + { + _out.WriteLine($"[{(r.Accepted ? "ACCEPTED" : "REJECTED")}] {r.Label}"); + _out.WriteLine($" requested (additionalDomains): {(r.RequestedDomains.Count > 0 ? string.Join(", ", r.RequestedDomains) : "(field omitted)")}"); + _out.WriteLine($" detail : {r.Detail}"); + _out.WriteLine($" registeredDomains (TrackOrder): {(r.RegisteredDomains.Count > 0 ? string.Join(", ", r.RegisteredDomains) : "(none reported)")}"); + _out.WriteLine(""); + } + } + + _out.WriteLine("=== How to read this ==="); + _out.WriteLine("registeredDomains is TrackOrder's domainVerification key set — the domains"); + _out.WriteLine("CERTInext put on the order. Compare it against 'requested':"); + _out.WriteLine("(1) vs (2): if (1) registers the extra name and (2) does not, then"); + _out.WriteLine(" additionalDomains is required and CSR SANs alone are ignored."); + _out.WriteLine("(3) : whether repeating the CN is rejected or collapsed."); + _out.WriteLine("(4)-(6) : whether non-DNS values are rejected, ignored, or accepted"); + _out.WriteLine(" AT PLACEMENT TIME. An order accepted here can still be"); + _out.WriteLine(" rejected later during validation/approval."); + + // The probe reports; it does not assert a specific CA behaviour, because its purpose + // is to discover what that behaviour is. What must hold is that at least one UCC + // product was actually exercised — otherwise the run proved nothing and should not + // read as a pass. + var usable = results + .Where(r => !r.ProductUnavailable) + .GroupBy(r => r.ProductCode) + .ToList(); + + Skip.If( + usable.Count == 0, + "None of the probed product codes are enabled on this account " + + $"({string.Join(", ", productCodes)}). Set {ProductCodesFlag} to a Multi-Domain (UCC) " + + "code this account can order."); + + foreach (var group in usable) + { + var control = group.First(r => r.Label == "dns-extra-via-additionalDomains"); + Assert.True( + control.Accepted, + $"Positive control failed on product {group.Key} — could not place even a " + + $"plain DNS UCC order: {control.Detail}"); + } + } + } +} diff --git a/CERTInext.IntegrationTests/V2ApiTests.cs b/CERTInext.IntegrationTests/V2ApiTests.cs new file mode 100644 index 0000000..f4a0e3a --- /dev/null +++ b/CERTInext.IntegrationTests/V2ApiTests.cs @@ -0,0 +1,723 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Threading; +using System.Threading.Tasks; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Keyfactor.PKI.Enums.EJBCA; +using Xunit; +using Xunit.Abstractions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// Integration test stubs for the V2 REST API code path. + /// + /// All tests are gated behind the CERTINEXT_USE_V2_API=1 environment variable + /// and skip gracefully when it is not set, so they are safe to run in CI environments + /// that do not have V2 credentials configured. + /// + /// To run against a live V2 environment: + /// + /// set -a; . ~/.env_certinext; set +a + /// export CERTINEXT_USE_V2_API=1 + /// dotnet test CERTInext.IntegrationTests/ --filter "FullyQualifiedName~V2ApiTests" + /// + /// Note: the shell must source ONLY ~/.env_certinext (never ~/.env_certinext_v2 — + /// see issue 0017); this class loads ~/.env_certinext_v2 itself from disk at + /// test-construction time. + /// + /// Required variables in ~/.env_certinext_v2 (or real env vars): + /// + /// CERTINEXT_API_URL — V2 base URL (e.g. https://sandbox-us-api.certinext.io) + /// CERTINEXT_CLIENT_ID — OAuth2 client ID + /// CERTINEXT_CLIENT_SECRET — OAuth2 client secret + /// CERTINEXT_PRODUCT_CODE — product code for lifecycle test (e.g. 842) + /// CERTINEXT_DCV_DOMAIN — domain for lifecycle test (e.g. dcv-test.example.com) + /// + /// V1 variables (CERTINEXT_API_URL, CERTINEXT_ACCESS_KEY, etc.) must remain + /// configured because Synchronize continues to use the V1 GetOrderReport endpoint. + /// + public class V2ApiTests : IClassFixture + { + private readonly IntegrationTestFixture _fixture; + private readonly ITestOutputHelper _output; + private readonly string _v2ApiUrl; + private readonly string _v2ClientId; + private readonly string _v2ClientSecret; + private readonly string _v2ProductCode; + private readonly string _v2Domain; + private readonly bool _v2Enabled; + private readonly string _cfApiToken; + private readonly string _cfZoneId; + private readonly bool _dcvEnabled; + private readonly string _issuedOrderId; + + public V2ApiTests(IntegrationTestFixture fixture, ITestOutputHelper output) + { + _fixture = fixture; + _output = output; + + // Load ~/.env_certinext_v2 if present. V2 file values take priority + // over process env because IntegrationTestFixture may have already + // promoted the V1 CERTINEXT_API_URL (with /emSignHub-API suffix) into + // process env, and the V2 base URL is different. + string v2Path = Path.Combine( + Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), + ".env_certinext_v2"); + var (env, fileKeys) = LoadEnvFile(v2Path); + + // Force-promote V2-file-defined keys into process env so they override + // any V1 values the fixture already set. + foreach (string key in fileKeys) + if (env.TryGetValue(key, out string fv)) + Environment.SetEnvironmentVariable(key, fv); + + // Promote remaining keys that aren't already in process env + foreach (var kv in env) + if (Environment.GetEnvironmentVariable(kv.Key) == null) + Environment.SetEnvironmentVariable(kv.Key, kv.Value); + + _v2ApiUrl = GetEnv(env, "CERTINEXT_API_URL"); + _v2ClientId = GetEnv(env, "CERTINEXT_CLIENT_ID"); + _v2ClientSecret = GetEnv(env, "CERTINEXT_CLIENT_SECRET"); + _v2ProductCode = GetEnv(env, "CERTINEXT_PRODUCT_CODE", "842"); + _v2Domain = GetEnv(env, "CERTINEXT_DCV_DOMAIN", "test.example.com"); + _cfApiToken = GetEnv(env, "CERTINEXT_CF_API_TOKEN"); + _cfZoneId = GetEnv(env, "CERTINEXT_CF_ZONE_ID"); + _issuedOrderId = GetEnv(env, "CERTINEXT_V2_ISSUED_ORDER_ID"); + + _v2Enabled = !string.IsNullOrWhiteSpace(GetEnv(env, "CERTINEXT_USE_V2_API")) + && !string.IsNullOrWhiteSpace(_v2ApiUrl) + && !string.IsNullOrWhiteSpace(_v2ClientId) + && !string.IsNullOrWhiteSpace(_v2ClientSecret); + + _dcvEnabled = _v2Enabled + && !string.IsNullOrWhiteSpace(_cfApiToken) + && !string.IsNullOrWhiteSpace(_cfZoneId); + } + + // --------------------------------------------------------------------------- + // V2 Connectivity + // --------------------------------------------------------------------------- + + /// + /// Calls GET /api/certinext/v2/auth/me and verifies a non-empty accountNumber + /// is returned. Skips when CERTINEXT_USE_V2_API is not set. + /// + [SkippableFact] + public async Task Connectivity_V2_Ping() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + var me = await client.GetAuthMeV2Async(); + + me.Should().NotBeNull(); + me.AccountNumber.Should().NotBeNullOrEmpty("auth/me must return accountNumber for a valid OAuth2 client"); + me.AuthType.Should().Be("oauth2"); + } + + // --------------------------------------------------------------------------- + // V2 Lifecycle: place order → track → revoke + // --------------------------------------------------------------------------- + + /// + /// Places a V2 SSL order, asserts that the CARequestID starts with "ord_", + /// then revokes the order. + /// Skips when CERTINEXT_USE_V2_API is not set. + /// + [SkippableFact] + public async Task Lifecycle_V2_EnrollTrackRevoke() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + + // Place order + var orderReq = BuildStandardOrderRequest(); + var createResp = await client.PlaceOrderV2Async( + Constants.ApiV2.FamilySsl, _v2ProductCode, orderReq); + + createResp.Should().NotBeNull(); + createResp.OrderId.Should().NotBeNullOrEmpty( + "V2 place-order must return a non-empty orderId (sandbox may return numeric IDs rather than 'ord_' prefix)"); + + // Track the order + var (_, trackResp) = await ResolveOrderFamilyAsync(client, createResp.OrderId); + trackResp.OrderId.Should().Be(createResp.OrderId); + trackResp.Status.Should().NotBeNullOrEmpty( + "V2 TrackOrder must return a status for the placed order"); + // Best-effort structural check: this sandbox's TrackOrder response has been + // observed to omit "_links" entirely (see issues/0016), so we log rather than + // hard-fail — the regression we actually guard against is OrderId/Status shape. + if (trackResp.Links?.Self?.Href is string href && !string.IsNullOrWhiteSpace(href)) + _output.WriteLine($"TrackOrder links.self.href: {href}"); + else + _output.WriteLine("TrackOrder response did not include a links.self.href (sandbox may omit _links)."); + + // Note: revoke requires the order to reach 'issued' state first. + // The sandbox processes orders asynchronously, so we only assert enroll + track here. + // A full revoke smoke test requires waiting for issuance (run separately with DCV configured). + } + + // --------------------------------------------------------------------------- + // Synchronize still uses V1 when UseV2Api=true + // --------------------------------------------------------------------------- + + /// + /// Verifies that Synchronize calls the V1 GetOrderReport (not V2 /reports/orders) + /// even when UseV2Api=true. + /// Skips when V1 credentials are absent. + /// + [SkippableFact] + public async Task Sync_UsesV1_WhenV2Enabled() + { + Skip.If(!_fixture.IsConfigured || !_v2Enabled, + "V1 credentials or V2 opt-in (CERTINEXT_USE_V2_API) not configured — skipping."); + + // Build a V2-enabled config that still has V1 creds for sync + var config = new CERTInextConfig + { + // V1 creds (required for sync) + ApiUrl = _fixture.Config.ApiUrl, + AuthMode = "AccessKey", + ApiKey = _fixture.Config.ApiKey, + AccountNumber = _fixture.Config.AccountNumber, + // V2 creds (only used for enroll/revoke) + UseV2Api = true, + ApiUrlV2 = _v2Enabled ? _v2ApiUrl : "https://placeholder.certinext.io", + ClientId = _v2Enabled ? _v2ClientId : "placeholder-client", + ClientSecret = _v2Enabled ? _v2ClientSecret : "placeholder-secret", + RequestorName = _fixture.Config.RequestorName, + RequestorEmail = _fixture.Config.RequestorEmail, + PageSize = 10 // small page — we just want to confirm sync runs via V1 + }; + + using var client = new CERTInextClient(config); + var plugin = new CERTInextCAPlugin(client, config); + + var buffer = new BlockingCollection(1000); + using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30)); + + Exception caughtEx = null; + try + { + await plugin.Synchronize(buffer, DateTime.UtcNow.AddDays(-1), false, cts.Token); + } + catch (Exception ex) + { + caughtEx = ex; + } + if (!buffer.IsAddingCompleted) + buffer.CompleteAdding(); + + var records = new List(); + foreach (var record in buffer.GetConsumingEnumerable()) + records.Add(record); + + // Sync must call V1 GetOrderReport, not V2 endpoints. + // A V2-routing bug would throw KeyNotFoundException with "not found in any V2 product family". + // A V1 API error (wrong creds / URL mismatch) is acceptable here — it proves the V1 path ran. + if (caughtEx != null) + { + caughtEx.Message.Should().NotContain("V2 product family", + "sync must use V1 GetOrderReport, not V2 product-family routing"); + } + else + { + // Success path must actually prove something: the delta sync window is a day, + // so a healthy V1 account is expected to return at least one record. An empty, + // silent success here would be exactly as uninformative as the old "only check + // the exception message" assertion (see gap G6). + records.Should().NotBeEmpty( + "Synchronize must return records via V1 GetOrderReport when it succeeds with UseV2Api=true " + + "(an empty result here proves nothing about which code path actually ran)"); + _output.WriteLine($"Sync_UsesV1_WhenV2Enabled: {records.Count} record(s) returned via V1."); + } + } + + // --------------------------------------------------------------------------- + // V2 Product catalogue + // --------------------------------------------------------------------------- + + /// + /// Calls GET /api/certinext/v2/catalog/products and asserts a non-empty list + /// is returned. Skips when CERTINEXT_USE_V2_API is not set. + /// + [SkippableFact] + public async Task GetProductDetails_V2_ReturnsProducts() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + List products = await client.GetProductDetailsV2Async(); + + products.Should().NotBeNull("V2 catalog/products must return a non-null list"); + products.Should().NotBeEmpty("V2 catalog/products must return at least one product"); + + // Best-effort structural check: this sandbox's catalog/products entries have been + // observed to carry null ProductCode/ProductName/ProductType (see issues/0016), so + // we log rather than hard-fail — the regression we actually guard against is an + // empty/null list, asserted above. + int withCode = products.Count(p => !string.IsNullOrWhiteSpace(p.ProductCode)); + _output.WriteLine($"{withCode}/{products.Count} catalog products carry a non-empty ProductCode."); + } + + // --------------------------------------------------------------------------- + // GetSingleRecord via V2 (ResolveAndTrackOrderV2Async) + // --------------------------------------------------------------------------- + + /// + /// Places a fresh DV SSL order then calls ResolveAndTrackOrderV2Async on the + /// returned orderId. Asserts that the order can be found and has a non-empty + /// status. The order will typically be pending-csr or pending-dcv; that is fine. + /// Skips when CERTINEXT_USE_V2_API is not set. + /// + [SkippableFact] + public async Task GetSingleRecord_V2_ReturnsOrderDetails() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + + var orderReq = BuildStandardOrderRequest(); + var createResp = await client.PlaceOrderV2Async( + Constants.ApiV2.FamilySsl, _v2ProductCode, orderReq); + + createResp.Should().NotBeNull(); + string orderId = createResp.OrderId; + orderId.Should().NotBeNullOrEmpty("PlaceOrderV2Async must return a non-empty orderId"); + + var status = await client.ResolveAndTrackOrderV2Async(orderId); + + status.Should().NotBeNull("ResolveAndTrackOrderV2Async must return a non-null status"); + status.OrderId.Should().Be(orderId, "tracked order ID must match the placed order"); + status.Status.Should().NotBeNullOrEmpty("TrackOrder must return a non-empty status string"); + } + + // --------------------------------------------------------------------------- + // Revoke a known-issued V2 order + // --------------------------------------------------------------------------- + + /// + /// Revokes a previously issued V2 order. Prefers CERTINEXT_V2_ISSUED_ORDER_ID; + /// otherwise self-enrolls a fresh order via + /// and polls (bounded) for issuance (V2_TEST_GAP_PLAN.md Phase 1.4b) — so the test + /// no longer depends on another test's run order (issues/0017, gap G7) to have a + /// usable order ID. + /// + [SkippableFact] + public async Task Revoke_V2_IssuedOrder() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + var (orderId, family) = await EnsureIssuedOrderIdAsync(client); + + // Revoke — sandbox may report 'issued' via track but reject revocation + // with 422 ("Certificate Request still being processed") while the order + // is still being processed internally (issues/0019). + var revokeReq = new V2RevokeRequest + { + Reason = "superseded", + Note = "V2 integration test cleanup" + }; + + try + { + await client.RevokeOrderV2Async(family, orderId, revokeReq); + } + catch (InvalidOperationException ex) when (ex.Message.Contains("still being processed")) + { + // Retry once after a short delay before giving up — any other exception + // (or a second failure) must fail the test rather than be swallowed here. + _output.WriteLine($"Revoke rejected as still-processing; retrying once after 15s: {ex.Message}"); + await Task.Delay(TimeSpan.FromSeconds(15)); + try + { + await client.RevokeOrderV2Async(family, orderId, revokeReq); + } + catch (InvalidOperationException ex2) when (ex2.Message.Contains("still being processed")) + { + Skip.If(true, + $"Order {orderId} tracked as 'issued' but CA rejected revocation twice (sandbox timing): {ex2.Message}"); + return; // unreachable; satisfies compiler + } + } + + // Re-track — must be revoked + var trackAfter = await client.ResolveAndTrackOrderV2Async(orderId); + trackAfter.Status.Should().Be( + Constants.ApiV2.StatusRevoked, + $"order {orderId} must be 'revoked' after revocation"); + } + + // --------------------------------------------------------------------------- + // DCV flow (publishes real Cloudflare TXT record) — requires SUPPORTS_DCV build + // --------------------------------------------------------------------------- + +#if SUPPORTS_DCV + /// + /// Places a DV SSL order, publishes the DCV TXT token via real Cloudflare DNS, + /// calls VerifyDcvV2Async, and polls until the order leaves pending-dcv. + /// Requires CERTINEXT_CF_API_TOKEN and CERTINEXT_CF_ZONE_ID in addition to + /// CERTINEXT_USE_V2_API. Skips if either is absent. + /// + /// CERTInext's domain DCV is account-scoped and reusable (BR 3.2.2.5): once + /// CERTINEXT_DCV_DOMAIN is verified once, it stays verified for the + /// validTill reuse window, and GetDcv/VerifyDcv return EMS-1080 + /// ("Domain is already verified") instead of issuing a fresh challenge — see + /// issues/0020. That is treated here as the reuse-path outcome, not a failure: + /// the publish/verify steps are skipped and the order is polled directly for + /// leaving pending-dcv. + /// + [SkippableFact] + public async Task DcvFlow_V2_PublishesAndVerifies() + { + Skip.If(!_dcvEnabled, + "DCV test requires CERTINEXT_USE_V2_API + CERTINEXT_CF_API_TOKEN + CERTINEXT_CF_ZONE_ID — skipping."); + + using var client = BuildV2Client(); + var dns = new CloudflareDomainValidator(_cfApiToken, _cfZoneId); + string txtKey = null; + string orderId = null; + + var (domainVerifiedBeforeEnroll, rawStatus) = await V2DomainStatusHelper.GetDcvStatusAsync(client, _v2Domain); + _output.WriteLine($"Pre-enroll domain status for '{_v2Domain}': dcvStatus={rawStatus ?? ""}"); + + try + { + // 1. Place a DV SSL order — it lands in pending-dcv + var orderReq = BuildStandardOrderRequest(); + var createResp = await client.PlaceOrderV2Async( + Constants.ApiV2.FamilySsl, _v2ProductCode, orderReq); + orderId = createResp.OrderId; + orderId.Should().NotBeNullOrEmpty(); + + // 2. Get DCV challenge + V2DcvChallengeResponse dcvResp; + try + { + dcvResp = await client.GetDcvV2Async(orderId, Constants.ApiV2.FamilySsl); + } + catch (Exception ex) when (ex.Message.Contains("EMS-1080")) + { + // Reuse path: the domain is already verified account-wide, so there is no + // fresh challenge to publish. Prove the order still reaches a non-pending-dcv + // state without ever staging a TXT record. + _output.WriteLine($"GetDcv returned EMS-1080 (domain already verified) — reuse path: {ex.Message}"); + _output.WriteLine($"(pre-enroll domain probe {(domainVerifiedBeforeEnroll ? "agreed: VERIFIED" : "did NOT show VERIFIED — status may have changed between the probe and this order")}.)"); + + V2OrderStatusResponse reuseStatus = null; + var reuseDeadline = DateTime.UtcNow.AddSeconds(30); + while (DateTime.UtcNow < reuseDeadline) + { + reuseStatus = await client.ResolveAndTrackOrderV2Async(orderId); + _output.WriteLine($"Poll (reuse path): orderId={orderId} status={reuseStatus.Status}"); + if (reuseStatus.Status != Constants.ApiV2.StatusPendingDcv) + break; + await Task.Delay(TimeSpan.FromSeconds(5)); + } + + reuseStatus.Should().NotBeNull(); + reuseStatus!.Status.Should().NotBe( + Constants.ApiV2.StatusPendingDcv, + $"order {orderId} must leave pending-dcv on a reused/already-verified domain (EMS-1080) " + + "without a fresh TXT challenge. If this fails, see issues/0020."); + return; + } + dcvResp.Should().NotBeNull(); + dcvResp.FileNameContent.Should().NotBeNullOrEmpty( + "GetDcvV2Async must return a TXT token in FileNameContent"); + + string domainName = string.IsNullOrWhiteSpace(dcvResp.DomainName) + ? _v2Domain + : dcvResp.DomainName; + + // 3. Publish TXT record + txtKey = $"_emudhra-challenge.{domainName}"; + _output.WriteLine($"Publishing TXT {txtKey} = {dcvResp.FileNameContent}"); + var staged = await dns.StageValidation(txtKey, dcvResp.FileNameContent, CancellationToken.None); + staged.Success.Should().BeTrue($"Cloudflare TXT record creation must succeed: {staged.ErrorMessage}"); + + // Brief propagation pause + await Task.Delay(TimeSpan.FromSeconds(5)); + + // 4. Ask CERTInext to verify + var verifyResp = await client.VerifyDcvV2Async(orderId, _v2Domain, Constants.ApiV2.FamilySsl); + verifyResp.Should().NotBeNull(); + verifyResp.OverallStatus.Should().Be("VERIFIED", + "VerifyDcvV2Async must return OverallStatus=VERIFIED after DNS record is published"); + + // 5. Poll until order leaves pending-dcv (up to 60s) + V2OrderStatusResponse finalStatus = null; + var deadline = DateTime.UtcNow.AddSeconds(60); + while (DateTime.UtcNow < deadline) + { + finalStatus = await client.ResolveAndTrackOrderV2Async(orderId); + _output.WriteLine($"Poll: orderId={orderId} status={finalStatus.Status}"); + if (finalStatus.Status != Constants.ApiV2.StatusPendingDcv) + break; + await Task.Delay(TimeSpan.FromSeconds(5)); + } + + finalStatus.Should().NotBeNull(); + finalStatus!.Status.Should().NotBe( + Constants.ApiV2.StatusPendingDcv, + "order must leave pending-dcv after successful DCV verification"); + } + finally + { + if (txtKey != null) + { + _output.WriteLine($"Cleaning up TXT record: {txtKey}"); + await dns.CleanupValidation(txtKey, CancellationToken.None); + } + } + } +#endif + + // --------------------------------------------------------------------------- + // Chain PEM assembly + // --------------------------------------------------------------------------- + + /// + /// Downloads the certificate for a known-issued V2 order and logs whether + /// ChainPem is populated. The test passes in either case — it is a + /// best-effort diagnostic to confirm chain assembly works in production. + /// Prefers CERTINEXT_V2_ISSUED_ORDER_ID; otherwise self-enrolls a fresh order + /// via (V2_TEST_GAP_PLAN.md Phase 1.4b). + /// + [SkippableFact] + public async Task ChainPem_V2_IsAssembled() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + using var client = BuildV2Client(); + var (orderId, family) = await EnsureIssuedOrderIdAsync(client); + + V2CertificateDownloadResponse downloadResp; + try + { + downloadResp = await client.DownloadCertificateV2Async(family, orderId); + } + catch (Exception ex) when (ex.Message.Contains("422") || ex.Message.Contains("Invalid request status")) + { + Skip.If(true, + $"Order {orderId} tracked as 'issued' but CA rejected download (sandbox timing): {ex.Message}"); + return; // unreachable; satisfies compiler + } + + downloadResp.Should().NotBeNull("DownloadCertificateV2Async must return a non-null response"); + downloadResp.CertificatePem.Should().NotBeNull( + "CertificatePem must be present for an issued order"); + downloadResp.CertificatePem.Should().StartWith( + "-----BEGIN CERTIFICATE-----", + "leaf certificate must be PEM-encoded"); + + bool chainPresent = downloadResp.ChainPem != null && downloadResp.ChainPem.Count > 0; + _output.WriteLine(chainPresent + ? $"ChainPem: {downloadResp.ChainPem!.Count} intermediate(s) returned." + : "ChainPem: null or empty — sandbox may not return chain."); + + if (chainPresent) + { + foreach (string chainCert in downloadResp.ChainPem!) + { + chainCert.Should().StartWith( + "-----BEGIN CERTIFICATE-----", + "each chain entry must be a PEM-encoded certificate"); + } + } + } + + // --------------------------------------------------------------------------- + // Private helpers + // --------------------------------------------------------------------------- + + private V2CreateSslOrderRequest BuildStandardOrderRequest() => + new V2CreateSslOrderRequest + { + ProductVariant = "dv", + EmailNotifications = "all", + Requestor = new V2Requestor + { + Name = _fixture.Config?.RequestorName ?? "Keyfactor Test", + Email = _fixture.Config?.RequestorEmail ?? "test@example.com", + Phone = "0000000000", + Designation = "IT Administrator" + }, + Certificate = new V2CertificateParams + { + Domain = _v2Domain, + AutoSecureWww = false + }, + Subscription = new V2SubscriptionParams + { + ValidityYears = 1, + AutoRenew = false, + RenewBeforeDays = 30 + }, + Agreement = new V2AgreementParams + { + SignerName = _fixture.Config?.RequestorName ?? "Keyfactor Test", + SignerIp = "127.0.0.1", + SignerPlace = "Gateway Lab", + Accepted = true + }, + Remarks = "Keyfactor V2 integration test — safe to revoke immediately." + }; + + private CERTInextClient BuildV2Client() + { + return new CERTInextClient(new CERTInextConfig + { + // V1 fields (still needed for Synchronize) + ApiUrl = _fixture.IsConfigured ? _fixture.Config.ApiUrl : "https://v1-placeholder.certinext.io", + AuthMode = "AccessKey", + ApiKey = _fixture.IsConfigured ? _fixture.Config.ApiKey : "placeholder", + AccountNumber = _fixture.IsConfigured ? _fixture.Config.AccountNumber : "0", + // V2 fields + UseV2Api = true, + ApiUrlV2 = _v2ApiUrl, + ClientId = _v2ClientId, + ClientSecret = _v2ClientSecret, + RequestorName = _fixture.IsConfigured ? _fixture.Config.RequestorName : "Test", + RequestorEmail = _fixture.IsConfigured ? _fixture.Config.RequestorEmail : "test@example.com", + SignerIp = "127.0.0.1", + SignerPlace = "Gateway Lab", + PageSize = 100 + }); + } + + /// + /// Returns an issued V2 order (and the family it lives in) to exercise. Prefers + /// CERTINEXT_V2_ISSUED_ORDER_ID if set; otherwise places a fresh order on + /// and polls (bounded) until it reaches issued, so + /// tests using this helper are self-contained and don't depend on env state or + /// another test's run order (V2_TEST_GAP_PLAN.md Phase 1.4b). Skip.Ifs when + /// no env ID is set and the freshly-placed order never reaches issued within + /// the poll budget — sandboxes may require DCV to auto-issue. + /// + private async Task<(string orderId, string family)> EnsureIssuedOrderIdAsync(CERTInextClient client) + { + if (!string.IsNullOrWhiteSpace(_issuedOrderId)) + { + var (family, status) = await ResolveOrderFamilyAsync(client, _issuedOrderId); + Skip.If(status.Status != Constants.ApiV2.StatusIssued, + $"Order '{_issuedOrderId}' is in '{status.Status}' state, not 'issued' — skipping."); + return (_issuedOrderId, family); + } + + var orderReq = BuildStandardOrderRequest(); + var createResp = await client.PlaceOrderV2Async(Constants.ApiV2.FamilySsl, _v2ProductCode, orderReq); + createResp.Should().NotBeNull(); + string orderId = createResp.OrderId; + orderId.Should().NotBeNullOrEmpty("PlaceOrderV2Async must return a non-empty orderId"); + _output.WriteLine( + $"EnsureIssuedOrderIdAsync: no CERTINEXT_V2_ISSUED_ORDER_ID set — placed fresh order {orderId}."); + + V2OrderStatusResponse trackResp = null; + var deadline = DateTime.UtcNow.AddSeconds(90); + while (DateTime.UtcNow < deadline) + { + trackResp = await client.TrackOrderV2Async(Constants.ApiV2.FamilySsl, orderId); + _output.WriteLine($"EnsureIssuedOrderIdAsync poll: orderId={orderId} status={trackResp.Status}"); + if (trackResp.Status == Constants.ApiV2.StatusIssued) + break; + await Task.Delay(TimeSpan.FromSeconds(15)); + } + + Skip.If(trackResp?.Status != Constants.ApiV2.StatusIssued, + $"Freshly-placed order '{orderId}' did not reach 'issued' within the poll budget " + + $"(status={trackResp?.Status}) — sandbox may require DCV to auto-issue. Set " + + "CERTINEXT_V2_ISSUED_ORDER_ID to a known-issued order to bypass placement."); + + return (orderId, Constants.ApiV2.FamilySsl); + } + + private static async Task<(string family, V2OrderStatusResponse status)> ResolveOrderFamilyAsync( + CERTInextClient client, string orderId) + { + foreach (var family in new[] { Constants.ApiV2.FamilySsl, Constants.ApiV2.FamilyPrivatePki, Constants.ApiV2.FamilySignature }) + { + try + { + var s = await client.TrackOrderV2Async(family, orderId); + return (family, s); + } + catch (KeyNotFoundException) + { + // try next + } + } + throw new KeyNotFoundException($"Order '{orderId}' not found in any V2 product family."); + } + + /// + /// Loads a KEY=VALUE env file and merges with process env vars. + /// V2 file values take priority over process env because the fixture + /// may have already promoted V1 values (e.g. CERTINEXT_API_URL with + /// /emSignHub-API suffix) into process env, and the V2 base URL differs. + /// Returns the merged dict and the set of keys defined in the file. + /// + private static (Dictionary env, HashSet fileKeys) LoadEnvFile(string path) + { + var fileKeys = new HashSet(StringComparer.OrdinalIgnoreCase); + var result = new Dictionary(StringComparer.OrdinalIgnoreCase); + + // Seed with process env vars first + foreach (System.Collections.DictionaryEntry de in Environment.GetEnvironmentVariables()) + { + string k = de.Key?.ToString(); + string v = de.Value?.ToString(); + if (!string.IsNullOrEmpty(k)) result[k] = v ?? string.Empty; + } + + // V2 env-file values override process env for any key they define. + // This is the correct priority: the V2 file is a targeted overlay. + if (File.Exists(path)) + { + foreach (string rawLine in File.ReadAllLines(path)) + { + string line = rawLine.Trim(); + if (string.IsNullOrEmpty(line) || line.StartsWith("#")) continue; + + int idx = line.IndexOf('='); + if (idx <= 0) continue; + + string key = line.Substring(0, idx).Trim(); + string val = line.Substring(idx + 1).Trim().Trim('"').Trim('\''); + result[key] = val; + fileKeys.Add(key); + } + } + + return (result, fileKeys); + } + + private static string GetEnv(Dictionary env, string key, string defaultValue = "") + => env.TryGetValue(key, out string v) && !string.IsNullOrWhiteSpace(v) ? v : defaultValue; + } +} diff --git a/CERTInext.IntegrationTests/V2DcvLifecycleTests.cs b/CERTInext.IntegrationTests/V2DcvLifecycleTests.cs new file mode 100644 index 0000000..7ff1833 --- /dev/null +++ b/CERTInext.IntegrationTests/V2DcvLifecycleTests.cs @@ -0,0 +1,623 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +#if SUPPORTS_DCV +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Linq; +using System.Threading; +using System.Threading.Tasks; +using Org.BouncyCastle.Asn1.X509; +using Org.BouncyCastle.Crypto; +using Org.BouncyCastle.Crypto.Generators; +using Org.BouncyCastle.Crypto.Parameters; +using Org.BouncyCastle.Pkcs; +using Org.BouncyCastle.Security; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Keyfactor.PKI.Enums.EJBCA; +using Xunit; +using Xunit.Abstractions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// Plugin-level DCV integration tests for the V2 (OAuth2) API path (gaps 5-8, 14-15). + /// Mirrors 's structure for V1: uses a real + /// when Cloudflare credentials are + /// configured, otherwise a . + /// + /// Requires the SUPPORTS_DCV build (-p:DcvSupport=true) because it uses + /// the v3.3-only constructor. Excluded from the + /// no-DCV build via the test project's <Compile Remove> item group. + /// + public class V2DcvLifecycleTests : IClassFixture, IDisposable + { + private readonly IntegrationTestFixture _fixture; + private readonly ITestOutputHelper _output; + private readonly List _toDispose = new List(); + + private readonly string _v2ApiUrl; + private readonly string _v2ClientId; + private readonly string _v2ClientSecret; + private readonly string _v2ProductCode; + private readonly string _v2Domain; + private readonly bool _v2Enabled; + private readonly string _cfApiToken; + private readonly string _cfZoneId; + private readonly bool _dcvEnabled; + + public V2DcvLifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output) + { + _fixture = fixture; + _output = output; + + var env = V2EnvHelper.LoadAndPromote(); + + _v2ApiUrl = V2EnvHelper.GetEnv(env, "CERTINEXT_API_URL"); + _v2ClientId = V2EnvHelper.GetEnv(env, "CERTINEXT_CLIENT_ID"); + _v2ClientSecret = V2EnvHelper.GetEnv(env, "CERTINEXT_CLIENT_SECRET"); + _v2ProductCode = V2EnvHelper.GetEnv(env, "CERTINEXT_PRODUCT_CODE", "842"); + _v2Domain = V2EnvHelper.GetEnv(env, "CERTINEXT_DCV_DOMAIN", "test.example.com"); + _cfApiToken = V2EnvHelper.GetEnv(env, "CERTINEXT_CF_API_TOKEN"); + _cfZoneId = V2EnvHelper.GetEnv(env, "CERTINEXT_CF_ZONE_ID"); + + _v2Enabled = !string.IsNullOrWhiteSpace(V2EnvHelper.GetEnv(env, "CERTINEXT_USE_V2_API")) + && !string.IsNullOrWhiteSpace(_v2ApiUrl) + && !string.IsNullOrWhiteSpace(_v2ClientId) + && !string.IsNullOrWhiteSpace(_v2ClientSecret); + + _dcvEnabled = _v2Enabled + && !string.IsNullOrWhiteSpace(_cfApiToken) + && !string.IsNullOrWhiteSpace(_cfZoneId); + } + + public void Dispose() + { + foreach (var d in _toDispose) + d.Dispose(); + _toDispose.Clear(); + } + + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + private static string GenerateCsrPem(string commonName) + { + var keyGen = new RsaKeyPairGenerator(); + keyGen.Init(new KeyGenerationParameters(new SecureRandom(), 2048)); + var keyPair = keyGen.GenerateKeyPair(); + + var subject = new X509Name($"CN={commonName}"); + var csr = new Pkcs10CertificationRequest("SHA256withRSA", subject, keyPair.Public, null, keyPair.Private); + + return "-----BEGIN CERTIFICATE REQUEST-----\n" + + Convert.ToBase64String(csr.GetEncoded(), Base64FormattingOptions.InsertLineBreaks) + + "\n-----END CERTIFICATE REQUEST-----"; + } + + private static async Task> RunSyncAsync( + CERTInextCAPlugin plugin, DateTime? lastSync = null, bool fullSync = true) + { + var buffer = new BlockingCollection(boundedCapacity: 10_000); + var collected = new List(); + + var syncTask = Task.Run(async () => + { + await plugin.Synchronize(buffer, lastSync: lastSync, fullSync: fullSync, cancelToken: CancellationToken.None); + if (!buffer.IsAddingCompleted) + buffer.CompleteAdding(); + }); + + foreach (var record in buffer.GetConsumingEnumerable()) + collected.Add(record); + + await syncTask; + return collected; + } + + private IDomainValidatorFactory BuildV2DnsFactory() + { + if (_dcvEnabled) + { + var factory = new CloudflareDomainValidatorFactory(_cfApiToken, _cfZoneId); + _toDispose.Add(factory); + return factory; + } + return new StubDomainValidatorFactory(); + } + + private CERTInextConfig BuildV2Config(bool dcvEnabled = true, int propagationDelaySeconds = 5, int? pageSize = null) + { + return new CERTInextConfig + { + // V1 fields — required so Synchronize (always V1) keeps working. + ApiUrl = _fixture.IsConfigured ? _fixture.Config.ApiUrl : "https://v1-placeholder.certinext.io", + AuthMode = "AccessKey", + ApiKey = _fixture.IsConfigured ? _fixture.Config.ApiKey : "placeholder", + AccountNumber = _fixture.IsConfigured ? _fixture.Config.AccountNumber : "0", + GroupNumber = _fixture.IsConfigured ? _fixture.Config.GroupNumber : string.Empty, + OrganizationNumber = _fixture.IsConfigured ? _fixture.Config.OrganizationNumber : string.Empty, + DefaultProductCode = _fixture.IsConfigured ? _fixture.Config.DefaultProductCode : _v2ProductCode, + + // V2 fields + UseV2Api = true, + ApiUrlV2 = _v2ApiUrl, + ClientId = _v2ClientId, + ClientSecret = _v2ClientSecret, + + RequestorName = _fixture.IsConfigured ? _fixture.Config.RequestorName : "Keyfactor Test", + RequestorEmail = _fixture.IsConfigured ? _fixture.Config.RequestorEmail : "test@example.com", + RequestorIsdCode = "1", + RequestorMobileNumber = "0000000000", + SignerPlace = "Gateway Lab", + SignerIp = "127.0.0.1", + + PageSize = pageSize ?? 100, + + DcvEnabled = dcvEnabled, + DcvPropagationDelaySeconds = propagationDelaySeconds, + DcvTimeoutMinutes = 3 + }; + } + + /// + /// Builds a plugin wired for the V2 API with a real DNS factory injected via the + /// v3.3-only three-arg test constructor, so EnrollV2Async / + /// GetSingleRecordV2Async can drive DCV inline. + /// + private CERTInextCAPlugin BuildV2DcvPlugin(bool dcvEnabled = true, int propagationDelaySeconds = 5, int? pageSize = null) + { + var config = BuildV2Config(dcvEnabled, propagationDelaySeconds, pageSize); + var client = new CERTInextClient(config); + return new CERTInextCAPlugin(client, BuildV2DnsFactory(), config); + } + + private EnrollmentProductInfo BuildV2ProductInfo() => + new EnrollmentProductInfo + { + ProductID = _v2ProductCode, + ProductParameters = new Dictionary + { + [Constants.EnrollmentParam.ProductCode] = _v2ProductCode, + [Constants.EnrollmentParam.ProfileId] = _v2ProductCode, + } + }; + + /// + /// Parses an issued certificate PEM and asserts its public key matches the requested + /// algorithm/size. Copy of the equivalent helper in . + /// + private static void AssertIssuedCertMatchesAlgorithm(string certPem, KeyAlgorithmSpec spec, string tag) + { + var b64 = certPem + .Replace("-----BEGIN CERTIFICATE-----", string.Empty) + .Replace("-----END CERTIFICATE-----", string.Empty) + .Replace("\r", string.Empty).Replace("\n", string.Empty).Trim(); + + var cert = new Org.BouncyCastle.X509.X509CertificateParser().ReadCertificate(Convert.FromBase64String(b64)); + cert.Should().NotBeNull($"{tag}: issued cert PEM must parse"); + + var pub = cert.GetPublicKey(); + switch (spec.Kind) + { + case KeyKind.Rsa: + pub.Should().BeOfType(); + ((RsaKeyParameters)pub).Modulus.BitLength.Should().Be(spec.Strength, + $"{tag}: issued RSA cert must have a {spec.Strength}-bit modulus"); + break; + case KeyKind.Ecdsa: + pub.Should().BeOfType(); + ((ECPublicKeyParameters)pub).Parameters.Curve.FieldSize.Should().Be(spec.Strength, + $"{tag}: issued EC cert must use a {spec.Strength}-bit curve"); + break; + case KeyKind.Ed25519: + pub.Should().BeOfType(); + break; + case KeyKind.Ed448: + pub.Should().BeOfType(); + break; + } + } + + // --------------------------------------------------------------------------- + // Gap 5 — Enroll with DCV on, V2 path, does not throw + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task DcvEnroll_V2_CompletesWithoutThrowing() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var config = BuildV2Config(dcvEnabled: true); + using var probeClient = new CERTInextClient(config); + var (domainVerified, rawStatus) = await V2DomainStatusHelper.GetDcvStatusAsync(probeClient, _v2Domain); + _output.WriteLine($"Pre-enroll domain status for '{_v2Domain}': dcvStatus={rawStatus ?? ""}"); + + var recordingFactory = new RecordingDomainValidatorFactory(BuildV2DnsFactory()); + var plugin = new CERTInextCAPlugin(new CERTInextClient(config), recordingFactory, config); + + var result = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Should().NotBeNull("Enroll must return a result even when DCV verification does not complete inline"); + _output.WriteLine($"CARequestID: {result.CARequestID}"); + _output.WriteLine($"Status: {result.Status}"); + _output.WriteLine($"Message: {result.StatusMessage}"); + + var staged = recordingFactory.StagedCalls; + var cleaned = recordingFactory.CleanedUpFqdns; + _output.WriteLine($"DNS provider calls: staged={staged.Count}, cleaned={cleaned.Count}"); + + if (domainVerified) + { + // Reuse path (issues/0020): the domain is already verified account-wide, so no + // fresh TXT record should ever be staged for it. + staged.Should().BeEmpty( + $"domain '{_v2Domain}' was already VERIFIED before enrollment (reuse path) — no TXT record " + + "should be staged. If this fails, see issues/0020 (the plugin currently treats the CA's " + + "EMS-1080 'already verified' response as a failure and defers, rather than as satisfied)."); + new[] { (int)EndEntityStatus.EXTERNALVALIDATION, (int)EndEntityStatus.GENERATED } + .Should().Contain(result.Status, + $"a reused, already-verified domain must let the order proceed to pending or issued; " + + $"got {result.Status}. Message: {result.StatusMessage}"); + } + else + { + // Publish path: a fresh challenge must actually get staged and cleaned up. + staged.Should().NotBeEmpty( + $"domain '{_v2Domain}' was not yet VERIFIED (dcvStatus={rawStatus ?? ""}) — Enroll " + + "must stage a TXT record to exercise the publish path."); + cleaned.Should().NotBeEmpty( + "a staged DCV TXT record must be cleaned up after the publish-path attempt."); + } + } + + // --------------------------------------------------------------------------- + // Gap 6 — Enroll with DCV off, V2 path, does not invoke the DNS provider + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task EnrollWithoutDcv_V2_DoesNotInvokeDnsProvider() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var config = BuildV2Config(dcvEnabled: false); + var recordingFactory = new RecordingDomainValidatorFactory(BuildV2DnsFactory()); + var plugin = new CERTInextCAPlugin(new CERTInextClient(config), recordingFactory, config); + + var result = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Should().NotBeNull(); + result.CARequestID.Should().NotBeNullOrWhiteSpace( + "the CA must accept the order even with DCV off — DCV-off must not block enrollment"); + + recordingFactory.StagedCalls.Should().BeEmpty( + "with DcvEnabled=false the plugin must never stage a DCV TXT record — this test's name promised " + + "that, but nothing previously checked it"); + recordingFactory.CleanedUpFqdns.Should().BeEmpty( + "with DcvEnabled=false the plugin must never attempt DCV cleanup either"); + } + + // --------------------------------------------------------------------------- + // Gap 7 — GetSingleRecord drives DCV for an existing pending V2 order + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task GetSingleRecord_V2_DrivesDcvForPendingOrder() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + string orderId = Environment.GetEnvironmentVariable("CERTINEXT_V2_PENDING_ORDER_ID"); + Skip.If(string.IsNullOrWhiteSpace(orderId), + "Set CERTINEXT_V2_PENDING_ORDER_ID to a real pending-dcv V2 order to run this test."); + Skip.If(!_dcvEnabled, + "CERTINEXT_CF_API_TOKEN and CERTINEXT_CF_ZONE_ID must be set so the plugin can publish a real TXT record."); + + var plugin = BuildV2DcvPlugin(dcvEnabled: true); + var record = await plugin.GetSingleRecord(orderId); + + record.Should().NotBeNull(); + _output.WriteLine($"CARequestID: {record.CARequestID}"); + _output.WriteLine($"Status: {record.Status}"); + + new[] { (int)EndEntityStatus.GENERATED, (int)EndEntityStatus.EXTERNALVALIDATION } + .Should().Contain(record.Status, + "deferred-DCV retry should leave the V2 order in a valid pending or issued state"); + } + + // --------------------------------------------------------------------------- + // Gap 8 — End-to-end DCV-on enrollment, issued cert appears in sync + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task EnrollWithDcvOn_V2_OrderIssuedEndToEnd_AndAppearsInSync() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + Skip.If(!_dcvEnabled, + "CERTINEXT_CF_API_TOKEN + CERTINEXT_CF_ZONE_ID required — DCV-on test must publish real TXT records."); + + var config = BuildV2Config(dcvEnabled: true); + using var probeClient = new CERTInextClient(config); + var (domainVerified, rawStatus) = await V2DomainStatusHelper.GetDcvStatusAsync(probeClient, _v2Domain); + _output.WriteLine($"Pre-enroll domain status for '{_v2Domain}': dcvStatus={rawStatus ?? ""}"); + + var recordingFactory = new RecordingDomainValidatorFactory(BuildV2DnsFactory()); + var plugin = new CERTInextCAPlugin(new CERTInextClient(config), recordingFactory, config); + + var enrollResult = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + enrollResult.Should().NotBeNull(); + enrollResult.CARequestID.Should().NotBeNullOrWhiteSpace(); + _output.WriteLine($"Enroll CARequestID={enrollResult.CARequestID}, Status={enrollResult.Status}"); + + new[] { (int)EndEntityStatus.EXTERNALVALIDATION, (int)EndEntityStatus.GENERATED } + .Should().Contain(enrollResult.Status, + $"DCV-on V2 Enroll must return pending or issued; got {enrollResult.Status}"); + + var staged = recordingFactory.StagedCalls; + var cleaned = recordingFactory.CleanedUpFqdns; + _output.WriteLine($"DNS provider calls: staged={staged.Count}, cleaned={cleaned.Count}"); + + if (domainVerified) + { + // Reuse path (issues/0020): no fresh TXT record should be staged for an + // already-verified domain. + staged.Should().BeEmpty( + $"domain '{_v2Domain}' was already VERIFIED before enrollment (reuse path) — no TXT record " + + "should be staged. See issues/0020."); + } + else + { + staged.Should().NotBeEmpty( + $"domain '{_v2Domain}' was not yet VERIFIED (dcvStatus={rawStatus ?? ""}) — Enroll " + + "must stage a TXT record to exercise the publish path."); + cleaned.Should().NotBeEmpty( + "a staged DCV TXT record must be cleaned up after the publish-path attempt."); + } + + // Delta sync — this sandbox account has 1000+ historical orders. + var synced = await RunSyncAsync(plugin, lastSync: DateTime.UtcNow.AddDays(-1), fullSync: false); + var record = synced.FirstOrDefault(r => r.CARequestID == enrollResult.CARequestID); + record.Should().NotBeNull( + $"the enrolled V2 order ({enrollResult.CARequestID}) must appear in plugin.Synchronize results"); + + _output.WriteLine($"Synced record status: {record!.Status}"); + + if (record.Status == (int)EndEntityStatus.GENERATED) + { + record.Certificate.Should().NotBeNullOrWhiteSpace( + "Synchronize must populate the cert body for an issued V2 order (mirrors issue 0001 for V1)"); + } + } + + // --------------------------------------------------------------------------- + // Gap 14 — Key-algorithm issuance matrix, V2 path (opt-in) + // --------------------------------------------------------------------------- + + [SkippableTheory] + [MemberData(nameof(KeyAlgorithms.AsMemberData), MemberType = typeof(KeyAlgorithms))] + public async Task EnrollWithDcvOn_V2_IssuesPerKeyAlgorithm(string tag) + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + Skip.If(Environment.GetEnvironmentVariable("CERTINEXT_V2_ALGO_MATRIX") != "1", + "Opt-in: set CERTINEXT_V2_ALGO_MATRIX=1 to issue one real V2 cert per key algorithm."); + Skip.If(!_dcvEnabled, + "CERTINEXT_CF_API_TOKEN + CERTINEXT_CF_ZONE_ID required — DCV issuance must publish real TXT records."); + + var spec = KeyAlgorithms.For(tag); + string suffix = Guid.NewGuid().ToString("N").Substring(0, 8); + string cn = $"algo-{KeyAlgorithms.Slug(tag)}-{suffix}.{_v2Domain}"; + string csr = KeyAlgorithms.GenerateCsrPem(cn, spec); + + var plugin = BuildV2DcvPlugin(dcvEnabled: true); + + EnrollmentResult enrollResult; + try + { + enrollResult = await plugin.Enroll( + csr: csr, + subject: $"CN={cn}", + san: new Dictionary { ["dns"] = new[] { cn } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + } + catch (Exception ex) + { + string reason = KeyAlgorithms.ClassifyRejection(ex.Message); + _output.WriteLine($"[SKIP] {tag}: {reason} — {ex.Message}"); + Skip.If(true, $"CERTInext did not issue a {tag} V2 cert: {reason}. CA message: {ex.Message}"); + return; // unreachable + } + + enrollResult.Should().NotBeNull(); + enrollResult.CARequestID.Should().NotBeNullOrWhiteSpace($"{tag}: CA must return a CARequestID when it accepts the order"); + _output.WriteLine($"[{tag}] enrolled cn={cn} id={enrollResult.CARequestID} status={enrollResult.Status}"); + + const int maxPolls = 6; + const int delaySeconds = 15; + AnyCAPluginCertificate record = null; + for (int poll = 1; poll <= maxPolls; poll++) + { + record = await plugin.GetSingleRecord(enrollResult.CARequestID); + int status = record?.Status ?? -1; + _output.WriteLine($"[{tag}] poll #{poll}: status={status} certLen={record?.Certificate?.Length ?? 0}"); + + if (status == (int)EndEntityStatus.GENERATED && !string.IsNullOrWhiteSpace(record?.Certificate)) + break; + if (status == (int)EndEntityStatus.FAILED) + { + Skip.If(true, $"CERTInext FAILED the {tag} V2 order — algorithm not issuable on this account/profile."); + return; // unreachable + } + if (poll < maxPolls) + await Task.Delay(TimeSpan.FromSeconds(delaySeconds)); + } + + record.Should().NotBeNull($"{tag}: enrolled order {enrollResult.CARequestID} must be retrievable"); + if (record!.Status != (int)EndEntityStatus.GENERATED) + { + Skip.If(true, $"CERTInext accepted the {tag} V2 order but it did not reach GENERATED within the polling window " + + $"(Status={record.Status})."); + return; // unreachable + } + + record.Certificate.Should().NotBeNullOrWhiteSpace($"{tag}: issued V2 cert must carry a PEM body"); + AssertIssuedCertMatchesAlgorithm(record.Certificate, spec, tag); + _output.WriteLine($"--- {tag}: V2 DCV-on issuance OK — order {enrollResult.CARequestID} GENERATED. ---"); + } + + // --------------------------------------------------------------------------- + // Gap 15 — Bulk V2 enrollment + pagination smoke test (opt-in) + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task BulkV2Enrollment_AllOrdersIssue_AndPaginationWorks() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + Skip.If(Environment.GetEnvironmentVariable("CERTINEXT_V2_RUN_BULK_TEST") != "1", + "Opt-in: set CERTINEXT_V2_RUN_BULK_TEST=1 to run the V2 volume/pagination test."); + Skip.If(!_dcvEnabled, + "CERTINEXT_CF_API_TOKEN + CERTINEXT_CF_ZONE_ID required — bulk test must publish real TXT records."); + + int count = int.TryParse(Environment.GetEnvironmentVariable("CERTINEXT_V2_BULK_TEST_COUNT"), out int c) ? c : 101; + int parallel = int.TryParse(Environment.GetEnvironmentVariable("CERTINEXT_V2_BULK_TEST_PARALLEL"), out int p) ? p : 5; + + // PageSize=100 ensures the 101st order forces a second page during Synchronize. + var plugin = BuildV2DcvPlugin(dcvEnabled: true, propagationDelaySeconds: 5, pageSize: 100); + + var enrolled = new ConcurrentBag<(int idx, string cn, EnrollmentResult result)>(); + var failures = new ConcurrentBag<(int idx, string error)>(); + var sw = System.Diagnostics.Stopwatch.StartNew(); + + using (var sem = new SemaphoreSlim(parallel, parallel)) + { + var tasks = Enumerable.Range(0, count).Select(async i => + { + await sem.WaitAsync(); + try + { + string suffix = Guid.NewGuid().ToString("N").Substring(0, 8); + string cn = $"v2bulk-{suffix}.{_v2Domain}"; + string csr = GenerateCsrPem(cn); + + var result = await plugin.Enroll( + csr: csr, + subject: $"CN={cn}", + san: new Dictionary { ["dns"] = new[] { cn } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + enrolled.Add((i, cn, result)); + _output.WriteLine($"[{i:000}] OK cn={cn} id={result.CARequestID} status={result.Status}"); + } + catch (Exception ex) + { + failures.Add((i, ex.Message)); + _output.WriteLine($"[{i:000}] FAIL {ex.GetType().Name}: {ex.Message}"); + } + finally + { + sem.Release(); + } + }); + await Task.WhenAll(tasks); + } + + sw.Stop(); + _output.WriteLine($"--- Enroll phase: enrolled={enrolled.Count}, failed={failures.Count}, elapsed={sw.Elapsed:mm\\:ss} ---"); + + failures.Should().BeEmpty($"every V2 Enroll() call must succeed; got {failures.Count} hard failures."); + enrolled.Count.Should().Be(count, $"expected {count} successful V2 Enroll() calls"); + + var enrolledIds = enrolled + .Where(e => !string.IsNullOrEmpty(e.result.CARequestID)) + .Select(e => e.result.CARequestID) + .ToHashSet(); + enrolledIds.Count.Should().Be(count, "every V2 enrollment must return a CARequestID"); + + const int maxSyncPasses = 8; + const int delayBetweenPassesSeconds = 30; + + List synced = null; + int passesUsed = 0; + + for (int pass = 1; pass <= maxSyncPasses; pass++) + { + passesUsed = pass; + synced = await RunSyncAsync(plugin, lastSync: DateTime.UtcNow.AddDays(-1), fullSync: false); + + int generated = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.GENERATED); + int failed = synced.Count(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED); + int pending = enrolledIds.Count - generated - failed; + + _output.WriteLine($"--- Sync pass #{pass}: {generated}/{enrolledIds.Count} GENERATED, {failed} FAILED, {pending} pending ---"); + + if (failed > 0) + { + var failedIds = synced + .Where(r => enrolledIds.Contains(r.CARequestID) && r.Status == (int)EndEntityStatus.FAILED) + .Select(r => r.CARequestID) + .Take(5); + Assert.Fail($"Pass #{pass}: {failed} V2 order(s) reached FAILED status: {string.Join(", ", failedIds)}"); + } + + if (pending == 0) + break; + + if (pass < maxSyncPasses) + await Task.Delay(TimeSpan.FromSeconds(delayBetweenPassesSeconds)); + } + + var syncedIds = synced!.Select(r => r.CARequestID).ToHashSet(); + var missing = enrolledIds.Where(id => !syncedIds.Contains(id)).ToList(); + missing.Should().BeEmpty( + $"{missing.Count} enrolled V2 orders did not appear in sync results: {string.Join(", ", missing.Take(5))}"); + + var lookup = synced!.Where(r => r.CARequestID != null).ToDictionary(r => r.CARequestID, r => r); + var notIssued = enrolledIds + .Where(id => lookup.TryGetValue(id, out var rec) && rec.Status != (int)EndEntityStatus.GENERATED) + .Select(id => lookup[id]) + .ToList(); + + notIssued.Should().BeEmpty( + $"every enrolled V2 order should auto-issue after {maxSyncPasses} sync passes; {notIssued.Count} did not."); + + _output.WriteLine($"--- SUCCESS: {count}/{count} V2 orders enrolled and issued in {passesUsed} sync pass(es). ---"); + } + } +} +#endif diff --git a/CERTInext.IntegrationTests/V2DomainStatusHelper.cs b/CERTInext.IntegrationTests/V2DomainStatusHelper.cs new file mode 100644 index 0000000..92909b7 --- /dev/null +++ b/CERTInext.IntegrationTests/V2DomainStatusHelper.cs @@ -0,0 +1,58 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Text.Json; +using System.Threading.Tasks; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// Read-only helper for querying GET /api/certinext/v2/domains?search=&exactMatch=true + /// via the existing escape hatch, so DCV-on V2 + /// tests can tell the reuse path (domain already VERIFIED, see issues/0020) apart from + /// the publish path before asserting what the DNS provider spy should have recorded. + /// + internal static class V2DomainStatusHelper + { + /// + /// Returns whether currently has dcvStatus=VERIFIED, plus + /// the raw dcvStatus string (null if the domain has no row at all, e.g. never + /// submitted on any order yet). + /// + public static async Task<(bool IsVerified, string RawStatus)> GetDcvStatusAsync( + CERTInextClient client, string domain) + { + string query = $"/api/certinext/v2/domains?search={Uri.EscapeDataString(domain)}&exactMatch=true"; + var (statusCode, _, content) = await client.ProbeV2GetAsync(query); + + // A failed lookup must not masquerade as "not verified" — that would steer the caller + // into asserting the publish path for the wrong reason. + if (statusCode != 200 || string.IsNullOrWhiteSpace(content)) + throw new InvalidOperationException( + $"GET /domains lookup for '{domain}' failed: HTTP {statusCode}; cannot tell reuse path from publish path."); + + using var doc = JsonDocument.Parse(content); + if (!doc.RootElement.TryGetProperty("content", out var arr) + || arr.ValueKind != JsonValueKind.Array + || arr.GetArrayLength() == 0) + return (false, null); + + var row = arr[0]; + string dcvStatus = row.TryGetProperty("dcvStatus", out var v) ? v.GetString() : null; + return (string.Equals(dcvStatus, "VERIFIED", StringComparison.OrdinalIgnoreCase), dcvStatus); + } + } +} diff --git a/CERTInext.IntegrationTests/V2LifecycleTests.cs b/CERTInext.IntegrationTests/V2LifecycleTests.cs new file mode 100644 index 0000000..c3948bb --- /dev/null +++ b/CERTInext.IntegrationTests/V2LifecycleTests.cs @@ -0,0 +1,632 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Threading; +using System.Threading.Tasks; +using Org.BouncyCastle.Asn1.X509; +using Org.BouncyCastle.Crypto; +using Org.BouncyCastle.Crypto.Generators; +using Org.BouncyCastle.Pkcs; +using Org.BouncyCastle.Security; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Keyfactor.PKI.Enums.EJBCA; +using Xunit; +using Xunit.Abstractions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// Plugin-level integration tests for the V2 (OAuth2) API path — Tiers 1–3 (no DCV + /// build required). Unlike , which exercises + /// methods directly, these tests drive the full + /// IAnyCAPlugin surface (Enroll, Revoke, GetSingleRecord, + /// Synchronize) the way Keyfactor Command actually calls the plugin. + /// + /// All tests are gated behind CERTINEXT_USE_V2_API=1 plus valid V2 OAuth2 + /// credentials and skip gracefully otherwise. See for the + /// full list of required environment variables. + /// + public class V2LifecycleTests : IClassFixture + { + private readonly IntegrationTestFixture _fixture; + private readonly ITestOutputHelper _output; + + private readonly string _v2ApiUrl; + private readonly string _v2ClientId; + private readonly string _v2ClientSecret; + private readonly string _v2ProductCode; + private readonly string _v2Domain; + private readonly bool _v2Enabled; + + public V2LifecycleTests(IntegrationTestFixture fixture, ITestOutputHelper output) + { + _fixture = fixture; + _output = output; + + var env = V2EnvHelper.LoadAndPromote(); + + _v2ApiUrl = V2EnvHelper.GetEnv(env, "CERTINEXT_API_URL"); + _v2ClientId = V2EnvHelper.GetEnv(env, "CERTINEXT_CLIENT_ID"); + _v2ClientSecret = V2EnvHelper.GetEnv(env, "CERTINEXT_CLIENT_SECRET"); + _v2ProductCode = V2EnvHelper.GetEnv(env, "CERTINEXT_PRODUCT_CODE", "842"); + _v2Domain = V2EnvHelper.GetEnv(env, "CERTINEXT_DCV_DOMAIN", "test.example.com"); + + _v2Enabled = !string.IsNullOrWhiteSpace(V2EnvHelper.GetEnv(env, "CERTINEXT_USE_V2_API")) + && !string.IsNullOrWhiteSpace(_v2ApiUrl) + && !string.IsNullOrWhiteSpace(_v2ClientId) + && !string.IsNullOrWhiteSpace(_v2ClientSecret); + } + + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + /// + /// Builds a wired for the V2 API. V1 fields are + /// populated from the fixture's config because Synchronize always uses + /// the V1 GetOrderReport endpoint regardless of UseV2Api. + /// + private CERTInextConfig BuildV2Config(bool dcvEnabled = false, int? pageSize = null) + { + return new CERTInextConfig + { + // V1 fields — required so Synchronize (always V1) keeps working. + ApiUrl = _fixture.IsConfigured ? _fixture.Config.ApiUrl : "https://v1-placeholder.certinext.io", + AuthMode = "AccessKey", + ApiKey = _fixture.IsConfigured ? _fixture.Config.ApiKey : "placeholder", + AccountNumber = _fixture.IsConfigured ? _fixture.Config.AccountNumber : "0", + GroupNumber = _fixture.IsConfigured ? _fixture.Config.GroupNumber : string.Empty, + OrganizationNumber = _fixture.IsConfigured ? _fixture.Config.OrganizationNumber : string.Empty, + DefaultProductCode = _fixture.IsConfigured ? _fixture.Config.DefaultProductCode : _v2ProductCode, + + // V2 fields + UseV2Api = true, + ApiUrlV2 = _v2ApiUrl, + ClientId = _v2ClientId, + ClientSecret = _v2ClientSecret, + + RequestorName = _fixture.IsConfigured ? _fixture.Config.RequestorName : "Keyfactor Test", + RequestorEmail = _fixture.IsConfigured ? _fixture.Config.RequestorEmail : "test@example.com", + RequestorIsdCode = "1", + RequestorMobileNumber = "0000000000", + SignerPlace = "Gateway Lab", + SignerIp = "127.0.0.1", + + PageSize = pageSize ?? 100, + + DcvEnabled = dcvEnabled, + DcvPropagationDelaySeconds = 5, + DcvTimeoutMinutes = 3 + }; + } + + /// + /// Constructs a plugin instance wired to a real + /// built from (or a fresh + /// if none is supplied). Uses the two-arg test constructor so no + /// Initialize call is required. + /// + private CERTInextCAPlugin BuildV2Plugin(CERTInextConfig config = null) + { + config ??= BuildV2Config(); + var client = new CERTInextClient(config); + return new CERTInextCAPlugin(client, config); + } + + /// + /// Generates a fresh RSA-2048 PKCS#10 CSR for the given common name using + /// BouncyCastle only. + /// + private static string GenerateCsrPem(string commonName) + { + var keyGen = new RsaKeyPairGenerator(); + keyGen.Init(new KeyGenerationParameters(new SecureRandom(), 2048)); + var keyPair = keyGen.GenerateKeyPair(); + + var subject = new X509Name($"CN={commonName}"); + var csr = new Pkcs10CertificationRequest("SHA256withRSA", subject, keyPair.Public, null, keyPair.Private); + + return "-----BEGIN CERTIFICATE REQUEST-----\n" + + Convert.ToBase64String(csr.GetEncoded(), Base64FormattingOptions.InsertLineBreaks) + + "\n-----END CERTIFICATE REQUEST-----"; + } + + /// + /// Runs a full synchronization via the plugin and returns all collected records. + /// + private static async Task> RunSyncAsync( + CERTInextCAPlugin plugin, DateTime? lastSync = null, bool fullSync = true) + { + var buffer = new BlockingCollection(boundedCapacity: 10_000); + var collected = new List(); + + var syncTask = Task.Run(async () => + { + await plugin.Synchronize( + buffer, + lastSync: lastSync, + fullSync: fullSync, + cancelToken: CancellationToken.None); + + if (!buffer.IsAddingCompleted) + buffer.CompleteAdding(); + }); + + foreach (var record in buffer.GetConsumingEnumerable()) + collected.Add(record); + + await syncTask; + return collected; + } + + /// + /// Polls until the order reaches + /// GENERATED or FAILED, or the poll budget is exhausted. + /// + private static async Task WaitForIssuanceAsync( + CERTInextCAPlugin plugin, string caRequestId, int maxPolls = 6, int delaySeconds = 15) + { + AnyCAPluginCertificate record = null; + for (int poll = 1; poll <= maxPolls; poll++) + { + record = await plugin.GetSingleRecord(caRequestId); + if (record?.Status == (int)EndEntityStatus.GENERATED + || record?.Status == (int)EndEntityStatus.FAILED) + break; + if (poll < maxPolls) + await Task.Delay(TimeSpan.FromSeconds(delaySeconds)); + } + return record; + } + + private EnrollmentProductInfo BuildV2ProductInfo() => + new EnrollmentProductInfo + { + ProductID = _v2ProductCode, + ProductParameters = new Dictionary + { + [Constants.EnrollmentParam.ProductCode] = _v2ProductCode, + [Constants.EnrollmentParam.ProfileId] = _v2ProductCode, + } + }; + + /// + /// Resolves the order ID to exercise for tests that need a pre-existing V2 order. + /// Reads only CERTINEXT_V2_ORDER_ID — deliberately does not fall back to an + /// order ID produced by another test in this class, so results do not depend on + /// test run order (see issues/0017, gap G7). + /// + private static string ResolveOrderId() + => Environment.GetEnvironmentVariable("CERTINEXT_V2_ORDER_ID"); + + /// + /// Returns an issued (GENERATED) V2 order to exercise, plus the plugin instance + /// that owns it. Prefers CERTINEXT_V2_ORDER_ID if set; otherwise enrolls a + /// fresh order in this test and polls (bounded) for issuance, so tests using this + /// helper are self-contained and don't depend on env state or another test's run + /// order (V2_TEST_GAP_PLAN.md Phase 1.4b). Skip.Ifs (via ) + /// when no env ID is set and the freshly-enrolled order never reaches GENERATED + /// within the poll budget — sandboxes may require DCV to auto-issue. + /// + private async Task<(string orderId, CERTInextCAPlugin plugin)> EnsureIssuedOrderIdAsync() + { + var plugin = BuildV2Plugin(); + string envOrderId = ResolveOrderId(); + if (!string.IsNullOrWhiteSpace(envOrderId)) + return (envOrderId, plugin); + + var enrollResult = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + enrollResult.Should().NotBeNull(); + enrollResult.CARequestID.Should().NotBeNullOrWhiteSpace(); + _output.WriteLine( + $"EnsureIssuedOrderIdAsync: no CERTINEXT_V2_ORDER_ID set — enrolled fresh order {enrollResult.CARequestID}."); + + var record = await WaitForIssuanceAsync(plugin, enrollResult.CARequestID); + Skip.If(record?.Status != (int)EndEntityStatus.GENERATED, + $"Freshly-enrolled order '{enrollResult.CARequestID}' did not reach GENERATED within the poll " + + $"budget (status={record?.Status}) — sandbox may require DCV to auto-issue. Set " + + "CERTINEXT_V2_ORDER_ID to a known-issued order to bypass enrollment."); + + return (enrollResult.CARequestID, plugin); + } + + // --------------------------------------------------------------------------- + // Gap 1 — Enroll() via the plugin, V2 path + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Enroll_V2_ReturnsCARequestID() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var plugin = BuildV2Plugin(); + + var result = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Should().NotBeNull(); + result.CARequestID.Should().NotBeNullOrWhiteSpace( + "V2 Enroll must return a non-empty CARequestID — it is the stable foreign key for all future operations"); + result.Status.Should().NotBe((int)EndEntityStatus.FAILED, + $"V2 Enroll must not FAILED at submission time; message: {result.StatusMessage}"); + + _output.WriteLine($"CARequestID: {result.CARequestID}"); + _output.WriteLine($"Status: {result.Status}"); + _output.WriteLine($"Message: {result.StatusMessage}"); + } + + // --------------------------------------------------------------------------- + // Gap 2 — Revoke() via the plugin, V2 path + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Revoke_V2_IssuedOrder_ReturnsRevoked() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var (orderId, plugin) = await EnsureIssuedOrderIdAsync(); + + var current = await plugin.GetSingleRecord(orderId); + Skip.If(current?.Status != (int)EndEntityStatus.GENERATED, + $"Order '{orderId}' is in status {current?.Status} (not GENERATED) — revocation requires an issued certificate; skipping."); + + int revokeResult; + try + { + revokeResult = await plugin.Revoke(orderId, hexSerialNumber: string.Empty, revocationReason: 1 /* keyCompromise */); + } + catch (InvalidOperationException ex) when (ex.Message.Contains("still being processed")) + { + // Documented sandbox-timing quirk: the CA reports 'issued' via GetSingleRecord + // while still internally finalizing the order, and rejects revoke with 422 + // ("Certificate Request still being processed") in that window (issues/0019). + // Retry once after a short delay before giving up — any other exception (or a + // second failure) must fail the test rather than be swallowed here. + _output.WriteLine($"Revoke rejected as still-processing; retrying once after 15s: {ex.Message}"); + await Task.Delay(TimeSpan.FromSeconds(15)); + try + { + revokeResult = await plugin.Revoke(orderId, hexSerialNumber: string.Empty, revocationReason: 1); + } + catch (InvalidOperationException ex2) when (ex2.Message.Contains("still being processed")) + { + Skip.If(true, + $"Order '{orderId}' tracked as GENERATED but CA rejected revocation twice (sandbox timing): {ex2.Message}"); + return; // unreachable + } + } + + revokeResult.Should().Be((int)EndEntityStatus.REVOKED, + "V2 Revoke must return the REVOKED status code on success"); + } + + // --------------------------------------------------------------------------- + // Gap 3 — GetSingleRecord() via the plugin, V2 path + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task GetSingleRecord_V2_Plugin_ReturnsDetails() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + string orderId = ResolveOrderId(); + Skip.If(string.IsNullOrWhiteSpace(orderId), + "No V2 order ID available — set CERTINEXT_V2_ORDER_ID to a real V2 order to run this test."); + + var plugin = BuildV2Plugin(); + var record = await plugin.GetSingleRecord(orderId); + + record.Should().NotBeNull("plugin.GetSingleRecord must return a record for a known V2 order"); + record.CARequestID.Should().Be(orderId); + _output.WriteLine($"CARequestID: {record.CARequestID}"); + _output.WriteLine($"Status: {record.Status}"); + _output.WriteLine($"ProductID: {record.ProductID}"); + } + + // --------------------------------------------------------------------------- + // Gap 4 — Enroll -> Synchronize -> Revoke, full V2 lifecycle via the plugin + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Enroll_Synchronize_Revoke_V2_FullLifecycle() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var config = BuildV2Config(); + var plugin = BuildV2Plugin(config); + + // --- Enroll --- + var enrollResult = await plugin.Enroll( + csr: GenerateCsrPem(_v2Domain), + subject: $"CN={_v2Domain}", + san: new Dictionary { ["dns"] = new[] { _v2Domain } }, + productInfo: BuildV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + enrollResult.Should().NotBeNull(); + enrollResult.CARequestID.Should().NotBeNullOrWhiteSpace(); + enrollResult.Status.Should().NotBe((int)EndEntityStatus.FAILED, + $"V2 Enroll must not FAILED at submission time; message: {enrollResult.StatusMessage}"); + + _output.WriteLine($"Enrolled V2 order {enrollResult.CARequestID}, status={enrollResult.Status}"); + + // --- Synchronize (always V1, even though UseV2Api=true) --- + // Delta sync (fullSync=false, lastSync=recent) rather than a full historical + // pull — this sandbox account has accumulated 1000+ orders from prior test + // runs, and a full sync of the entire history is unnecessarily slow here; the + // order we just enrolled is recent, so a delta sync is sufficient to prove it + // surfaces via Synchronize. + var synced = await RunSyncAsync(BuildV2Plugin(config), lastSync: DateTime.UtcNow.AddDays(-1), fullSync: false); + synced.Should().Contain( + r => r.CARequestID == enrollResult.CARequestID, + $"the newly enrolled V2 order '{enrollResult.CARequestID}' must appear in a delta sync " + + "(Synchronize always uses V1 GetOrderReport regardless of UseV2Api)"); + + var syncedRecord = synced.First(r => r.CARequestID == enrollResult.CARequestID); + _output.WriteLine($"Synced record status: {syncedRecord.Status}"); + + // --- Revoke — only if the sandbox has already auto-issued --- + if (syncedRecord.Status != (int)EndEntityStatus.GENERATED) + { + Skip.If(true, + $"Order '{enrollResult.CARequestID}' is in status {syncedRecord.Status} (not GENERATED) — " + + "sandbox may not auto-issue a V2 order without DCV; skipping revoke step."); + } + + int revokeResult; + try + { + revokeResult = await plugin.Revoke(enrollResult.CARequestID, hexSerialNumber: string.Empty, revocationReason: 1); + } + catch (InvalidOperationException ex) when (ex.Message.Contains("still being processed")) + { + // Documented sandbox-timing quirk: the sandbox has been observed to report an + // order as 'issued' via TrackOrder/GetSingleRecord while still internally + // finalizing it, and reject a revoke attempted in that window with 422 + // "Certificate Request still being processed" (see issues/0019). Retry once + // after a short delay before giving up — any other exception (e.g. the + // camelCase-reason HTTP 400 that 0019 describes) must fail the test rather + // than be swallowed here. + _output.WriteLine($"Revoke rejected as still-processing; retrying once after 15s: {ex.Message}"); + await Task.Delay(TimeSpan.FromSeconds(15)); + try + { + revokeResult = await plugin.Revoke(enrollResult.CARequestID, hexSerialNumber: string.Empty, revocationReason: 1); + } + catch (InvalidOperationException ex2) when (ex2.Message.Contains("still being processed")) + { + Skip.If(true, + $"Order '{enrollResult.CARequestID}' tracked as GENERATED but CA rejected revocation " + + $"twice (sandbox timing): {ex2.Message}"); + return; // unreachable + } + } + + revokeResult.Should().Be((int)EndEntityStatus.REVOKED, + "Revoke must return the REVOKED status code on success"); + } + + // --------------------------------------------------------------------------- + // Gap 9 — GetSingleRecord() cert-body regression, V2 path + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task GetSingleRecord_V2_IssuedOrder_HasParseableCertBody() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + + var (orderId, plugin) = await EnsureIssuedOrderIdAsync(); + var record = await WaitForIssuanceAsync(plugin, orderId, maxPolls: 1); + + Skip.If(record?.Status != (int)EndEntityStatus.GENERATED, + $"Order '{orderId}' is not GENERATED (status={record?.Status}) — skipping cert-body check."); + + record!.Certificate.Should().NotBeNullOrWhiteSpace( + "GetSingleRecord must populate the PEM body for a GENERATED V2 order"); + record.Certificate.Should().StartWith("-----BEGIN CERTIFICATE-----"); + + // record.Certificate may be the leaf cert alone, or the leaf followed by one or + // more chain PEM blocks (AssembleV2CertChain concatenates them) — extract only the + // FIRST block. Naively stripping every BEGIN/END marker and decoding the + // concatenation as one base64 blob breaks as soon as a chain is present, because + // each block's own '=' padding then lands mid-string, which is illegal base64. + var firstBlock = System.Text.RegularExpressions.Regex.Match( + record.Certificate, + @"-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----", + System.Text.RegularExpressions.RegexOptions.Singleline); + firstBlock.Success.Should().BeTrue("the certificate body must contain at least one PEM block"); + + var b64 = firstBlock.Groups[1].Value + .Replace("\r", string.Empty).Replace("\n", string.Empty).Trim(); + + Action parse = () => new Org.BouncyCastle.X509.X509CertificateParser().ReadCertificate(Convert.FromBase64String(b64)); + parse.Should().NotThrow("the issued V2 certificate's leaf PEM block must be parseable"); + } + + // --------------------------------------------------------------------------- + // Gap 10 — GetSingleRecord() across all synced orders, V2-configured plugin + // --------------------------------------------------------------------------- + + /// + /// Runs a full sync (always V1) with a V2-configured (UseV2Api=true) plugin, + /// then calls GetSingleRecord for a sample of the resulting CARequestIDs. + /// Since V1-created order IDs are not resolvable via the V2 family probe, + /// is an accepted, + /// documented outcome here (see issues/0016) — this test guards against any + /// *other* unhandled exception type escaping GetSingleRecord. + /// + [SkippableFact] + public async Task GetSingleRecord_V2_AllSyncedOrders_DoNotThrow() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + Skip.If(!_fixture.IsConfigured, "V1 credentials not configured — Synchronize requires them."); + + // Delta sync — this sandbox account has 1000+ historical orders; a recent + // window is enough to sample GetSingleRecord behavior without paging the + // entire multi-month history on every test run. + var plugin = BuildV2Plugin(); + var synced = await RunSyncAsync(plugin, lastSync: DateTime.UtcNow.AddDays(-7), fullSync: false); + synced.Should().NotBeNull(); + synced.Should().NotBeEmpty( + "the delta sync window must return at least one record from this sandbox account to sample " + + "GetSingleRecord against — an empty sync makes the rest of this test vacuous (see gap G6)"); + + var sample = synced.Take(10).ToList(); + _output.WriteLine($"Sampling {sample.Count} of {synced.Count} synced records for GetSingleRecord (V2-configured plugin)."); + + int ok = 0, keyNotFound = 0; + foreach (var rec in sample) + { + try + { + await plugin.GetSingleRecord(rec.CARequestID); + ok++; + } + catch (KeyNotFoundException) + { + // Expected: V1-created order IDs are not resolvable via the V2 family + // probe when the plugin is UseV2Api=true. See issues/0016. + keyNotFound++; + } + } + + _output.WriteLine($"GetSingleRecord results: {ok} succeeded, {keyNotFound} KeyNotFoundException (expected for V1 orders under V2 config)."); + (ok + keyNotFound).Should().Be(sample.Count, + "every sampled GetSingleRecord call must either succeed or throw the documented KeyNotFoundException " + + "(issues/0016) — any other exception type must escape this loop and fail the test (see gap G6)"); + } + + // --------------------------------------------------------------------------- + // Gap 11 — Synchronize() still uses V1 when UseV2Api=true, and returns records + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Sync_V2_StillUsesV1_ReturnsRecords() + { + Skip.If(!_v2Enabled, "CERTINEXT_USE_V2_API not set or V2 credentials not configured — skipping."); + Skip.If(!_fixture.IsConfigured, "V1 credentials not configured — Synchronize requires them."); + + // Delta sync — this sandbox account has 1000+ historical orders; a recent + // window proves Synchronize returns records without paging the entire + // multi-month history on every test run. + var plugin = BuildV2Plugin(); + var synced = await RunSyncAsync(plugin, lastSync: DateTime.UtcNow.AddDays(-7), fullSync: false); + + synced.Should().NotBeNull(); + synced.Should().NotBeEmpty( + "Synchronize must return the account's recent V1 order inventory even when UseV2Api=true " + + "(Synchronize always uses V1 GetOrderReport)"); + + _output.WriteLine($"Synchronize returned {synced.Count} record(s) with UseV2Api=true."); + } + } + + /// + /// Shared helper for loading ~/.env_certinext_v2 and promoting its values into + /// process environment, overriding V1 values the fixture may have already set. Used + /// by both and V2DcvLifecycleTests so the two + /// files don't duplicate env-loading logic. + /// + internal static class V2EnvHelper + { + /// + /// Loads ~/.env_certinext_v2, force-promotes its keys into process + /// environment (overriding any V1 values already set by ), + /// and returns the merged environment dictionary. + /// + public static Dictionary LoadAndPromote() + { + string v2Path = Path.Combine( + Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), + ".env_certinext_v2"); + + var (env, fileKeys) = LoadEnvFile(v2Path); + + // Force-promote V2-file-defined keys into process env so they override + // any V1 values the fixture already set. + foreach (string key in fileKeys) + if (env.TryGetValue(key, out string fv)) + Environment.SetEnvironmentVariable(key, fv); + + // Promote remaining keys that aren't already in process env + foreach (var kv in env) + if (Environment.GetEnvironmentVariable(kv.Key) == null) + Environment.SetEnvironmentVariable(kv.Key, kv.Value); + + return env; + } + + /// + /// Loads a KEY=VALUE env file and merges with process env vars. File values take + /// priority over process env because the fixture may have already promoted V1 + /// values (e.g. CERTINEXT_API_URL with /emSignHub-API suffix) into process env, + /// and the V2 base URL differs. Returns the merged dict and the set of keys + /// defined in the file. + /// + public static (Dictionary env, HashSet fileKeys) LoadEnvFile(string path) + { + var fileKeys = new HashSet(StringComparer.OrdinalIgnoreCase); + var result = new Dictionary(StringComparer.OrdinalIgnoreCase); + + foreach (System.Collections.DictionaryEntry de in Environment.GetEnvironmentVariables()) + { + string k = de.Key?.ToString(); + string v = de.Value?.ToString(); + if (!string.IsNullOrEmpty(k)) result[k] = v ?? string.Empty; + } + + if (File.Exists(path)) + { + foreach (string rawLine in File.ReadAllLines(path)) + { + string line = rawLine.Trim(); + if (string.IsNullOrEmpty(line) || line.StartsWith("#")) continue; + + int idx = line.IndexOf('='); + if (idx <= 0) continue; + + string key = line.Substring(0, idx).Trim(); + string val = line.Substring(idx + 1).Trim().Trim('"').Trim('\''); + result[key] = val; + fileKeys.Add(key); + } + } + + return (result, fileKeys); + } + + public static string GetEnv(Dictionary env, string key, string defaultValue = "") + => env.TryGetValue(key, out string v) && !string.IsNullOrWhiteSpace(v) ? v : defaultValue; + } +} diff --git a/CERTInext.IntegrationTests/V2ReportProbeTests.cs b/CERTInext.IntegrationTests/V2ReportProbeTests.cs new file mode 100644 index 0000000..1632e53 --- /dev/null +++ b/CERTInext.IntegrationTests/V2ReportProbeTests.cs @@ -0,0 +1,568 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Generic; +using System.IO; +using System.Linq; +using System.Text.Json; +using System.Threading.Tasks; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Xunit; +using Xunit.Abstractions; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.IntegrationTests +{ + /// + /// Read-only discovery probes against the V2 /reports/orders and + /// /domains endpoints. + /// + /// This is a fact-finding GATE ahead of switching V2-mode Synchronize from the V1 + /// GetOrderReport endpoint to V2 reports. It does not place, revoke, or modify any + /// order or domain. All findings are printed via and + /// must be read from the test's tail output (xUnit buffers it until the test ends). + /// + /// Gated by CERTINEXT_V2_REPORT_PROBE=1 (in addition to the usual + /// CERTINEXT_USE_V2_API=1 + V2 credentials) so it never runs by accident in CI. + /// + /// To run: + /// + /// cd <repo> + /// set -a; . ~/.env_certinext; set +a + /// export CERTINEXT_USE_V2_API=1 CERTINEXT_V2_REPORT_PROBE=1 + /// dotnet test CERTInext.IntegrationTests/CERTInext.IntegrationTests.csproj -c Release \ + /// --filter "FullyQualifiedName~V2ReportProbe" \ + /// --logger "console;verbosity=detailed" > /tmp/v2_probe.log 2>&1 + /// + /// Note: the shell must source ONLY ~/.env_certinext (never ~/.env_certinext_v2 — see + /// issue 0017); this class loads ~/.env_certinext_v2 itself, same pattern as V2ApiTests. + /// + public class V2ReportProbeTests : IClassFixture + { + private readonly IntegrationTestFixture _fixture; + private readonly ITestOutputHelper _output; + private readonly string _v2ApiUrl; + private readonly string _v2ClientId; + private readonly string _v2ClientSecret; + private readonly string _v2Domain; + private readonly string _issuedOrderId; + private readonly bool _v2Enabled; + private readonly bool _probeEnabled; + + public V2ReportProbeTests(IntegrationTestFixture fixture, ITestOutputHelper output) + { + _fixture = fixture; + _output = output; + + // Load ~/.env_certinext_v2 if present, same priority rules as V2ApiTests: + // V2-file-defined keys override whatever the fixture already promoted into + // process env (the V1 CERTINEXT_API_URL differs from the V2 base URL). + string v2Path = Path.Combine( + Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), + ".env_certinext_v2"); + var (env, fileKeys) = LoadEnvFile(v2Path); + + foreach (string key in fileKeys) + if (env.TryGetValue(key, out string fv)) + Environment.SetEnvironmentVariable(key, fv); + + foreach (var kv in env) + if (Environment.GetEnvironmentVariable(kv.Key) == null) + Environment.SetEnvironmentVariable(kv.Key, kv.Value); + + _v2ApiUrl = GetEnv(env, "CERTINEXT_API_URL"); + _v2ClientId = GetEnv(env, "CERTINEXT_CLIENT_ID"); + _v2ClientSecret = GetEnv(env, "CERTINEXT_CLIENT_SECRET"); + _v2Domain = GetEnv(env, "CERTINEXT_DCV_DOMAIN", "test.example.com"); + _issuedOrderId = GetEnv(env, "CERTINEXT_V2_ISSUED_ORDER_ID"); + + _v2Enabled = !string.IsNullOrWhiteSpace(GetEnv(env, "CERTINEXT_USE_V2_API")) + && !string.IsNullOrWhiteSpace(_v2ApiUrl) + && !string.IsNullOrWhiteSpace(_v2ClientId) + && !string.IsNullOrWhiteSpace(_v2ClientSecret); + + _probeEnabled = _v2Enabled && !string.IsNullOrWhiteSpace(GetEnv(env, "CERTINEXT_V2_REPORT_PROBE")); + } + + // --------------------------------------------------------------------------- + // Probe 1 + 5: report shape, envelope pagination fields, product/serial/status vocab + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe1_OrdersReport_ShapeAndFieldVocabulary() + { + Skip.IfNot(_probeEnabled, "CERTINEXT_V2_REPORT_PROBE not set (or V2 not enabled) — skipping report probe."); + + using var client = BuildV2Client(); + + _output.WriteLine("=== Probe 1: GET /reports/orders?page=1&size=50 ==="); + var (status, contentType, content) = await client.ProbeV2GetAsync( + "/api/certinext/v2/reports/orders?page=1&size=50"); + + _output.WriteLine($"HTTP {status} (Content-Type: {contentType})"); + + if (status != 200) + { + _output.WriteLine($"FINDING: /reports/orders is NOT live (200). Raw body: {Redact(content)}"); + return; + } + + _output.WriteLine("FINDING: /reports/orders returned 200 — endpoint IS live (contradicts the " + + "plugin's current 501 assumption in CERTInextCAPlugin.cs ~862-868)."); + + using var doc = JsonDocument.Parse(content); + var root = doc.RootElement; + + var envelopeKeys = root.EnumerateObject().Select(p => p.Name).ToList(); + _output.WriteLine($"Envelope top-level keys: [{string.Join(", ", envelopeKeys)}]"); + + foreach (string field in new[] { "page", "size", "totalElements", "totalPages" }) + { + if (root.TryGetProperty(field, out var v)) + _output.WriteLine($" envelope.{field} = {v} (kind={v.ValueKind})"); + else + _output.WriteLine($" envelope.{field} = "); + } + + if (!root.TryGetProperty("content", out var contentArr) || contentArr.ValueKind != JsonValueKind.Array) + { + _output.WriteLine("FINDING: no 'content' array in the envelope — cannot inspect rows."); + return; + } + + int rowCount = contentArr.GetArrayLength(); + _output.WriteLine($"content[] length on this page: {rowCount}"); + + var rows = contentArr.EnumerateArray().Take(3).ToList(); + var distinctStatusValues = new SortedSet(); + var sampleRowRaw = string.Empty; + + for (int i = 0; i < rows.Count; i++) + { + var row = rows[i]; + var rowKeys = row.EnumerateObject().Select(p => $"{p.Name}:{p.Value.ValueKind}").ToList(); + _output.WriteLine($"row[{i}] fields (name:type): [{string.Join(", ", rowKeys)}]"); + if (i == 0) + sampleRowRaw = Redact(row.GetRawText()); + + foreach (var statusField in new[] { "orderStatus", "state", "certificateStatus" }) + if (row.TryGetProperty(statusField, out var sv) && sv.ValueKind == JsonValueKind.String) + distinctStatusValues.Add($"{statusField}={sv.GetString()}"); + } + + _output.WriteLine($"Sample row 0 (redacted): {sampleRowRaw}"); + + // Spec field table vs example body discrepancy (docs/reference/specs/CERTInext API + // v2.postman_collection (1).json, item "Orders Report"): field table documents + // orderStatus/domainName/certificateSerialNumber; the example body instead shows + // state/identifier/account/group/product. Report which is actually live. + bool hasTableFields = rows.Any(r => r.TryGetProperty("orderStatus", out _) || + r.TryGetProperty("domainName", out _) || + r.TryGetProperty("certificateSerialNumber", out _)); + bool hasExampleFields = rows.Any(r => r.TryGetProperty("state", out _) || + r.TryGetProperty("identifier", out _)); + + _output.WriteLine($"FINDING: spec field-table shape present = {hasTableFields}; " + + $"spec example-body shape present = {hasExampleFields}."); + + // Probe 5: does the row carry productCode / serial / cert body link? + bool hasProductCode = rows.Any(r => r.TryGetProperty("productCode", out _) || r.TryGetProperty("product", out _)); + bool hasSerial = rows.Any(r => r.TryGetProperty("certificateSerialNumber", out _)); + bool hasCertLink = rows.Any(r => r.EnumerateObject().Any(p => p.Name.Contains("certificate", StringComparison.OrdinalIgnoreCase) + && p.Name.Contains("link", StringComparison.OrdinalIgnoreCase))); + _output.WriteLine($"FINDING: row carries product/productCode = {hasProductCode}; " + + $"certificateSerialNumber = {hasSerial}; a *Link field naming a cert body = {hasCertLink}."); + + // Probe 5 (continued): collect distinct status vocabulary across up to 3 pages. + var allStatusValues = new SortedSet(distinctStatusValues); + for (int page = 2; page <= 3; page++) + { + var (pStatus, _, pContent) = await client.ProbeV2GetAsync( + $"/api/certinext/v2/reports/orders?page={page}&size=50"); + if (pStatus != 200 || string.IsNullOrWhiteSpace(pContent)) break; + using var pDoc = JsonDocument.Parse(pContent); + if (!pDoc.RootElement.TryGetProperty("content", out var pArr) || pArr.GetArrayLength() == 0) break; + foreach (var row in pArr.EnumerateArray()) + foreach (var statusField in new[] { "orderStatus", "state", "certificateStatus" }) + if (row.TryGetProperty(statusField, out var sv) && sv.ValueKind == JsonValueKind.String) + allStatusValues.Add($"{statusField}={sv.GetString()}"); + } + _output.WriteLine($"FINDING: distinct status values observed (pages 1-3): [{string.Join(", ", allStatusValues)}]"); + } + + // --------------------------------------------------------------------------- + // Probe 2: pagination semantics + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe2_OrdersReport_Pagination() + { + Skip.IfNot(_probeEnabled, "CERTINEXT_V2_REPORT_PROBE not set (or V2 not enabled) — skipping pagination probe."); + + using var client = BuildV2Client(); + _output.WriteLine("=== Probe 2: pagination semantics ==="); + + foreach (var (label, query) in new[] + { + ("size=100", "/api/certinext/v2/reports/orders?page=1&size=100"), + ("size=101 (over max)", "/api/certinext/v2/reports/orders?page=1&size=101"), + ("page=0", "/api/certinext/v2/reports/orders?page=0&size=10"), + ("page=1 (baseline)", "/api/certinext/v2/reports/orders?page=1&size=10"), + }) + { + var (status, _, content) = await client.ProbeV2GetAsync(query); + string sizeEcho = "n/a", pageEcho = "n/a"; + if (status == 200 && !string.IsNullOrWhiteSpace(content)) + { + using var doc = JsonDocument.Parse(content); + if (doc.RootElement.TryGetProperty("size", out var sv)) sizeEcho = sv.ToString(); + if (doc.RootElement.TryGetProperty("page", out var pv)) pageEcho = pv.ToString(); + } + _output.WriteLine($"FINDING: {label} -> HTTP {status}, echoed size={sizeEcho}, echoed page={pageEcho}, " + + $"bodySnippet={Redact(Truncate(content, 300))}"); + } + } + + // --------------------------------------------------------------------------- + // Probe 3: from/to filter param names + semantics (order date vs issue date) + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe3_OrdersReport_FromToFilters() + { + Skip.IfNot(_probeEnabled, "CERTINEXT_V2_REPORT_PROBE not set (or V2 not enabled) — skipping from/to probe."); + + using var v2Client = BuildV2Client(); + _output.WriteLine("=== Probe 3: from/to filters ==="); + + // Baseline: unfiltered totalElements. + var (baseStatus, _, baseContent) = await v2Client.ProbeV2GetAsync( + "/api/certinext/v2/reports/orders?page=1&size=1"); + long baseTotal = -1; + if (baseStatus == 200 && !string.IsNullOrWhiteSpace(baseContent)) + { + using var doc = JsonDocument.Parse(baseContent); + if (doc.RootElement.TryGetProperty("totalElements", out var te)) baseTotal = te.GetInt64(); + } + _output.WriteLine($"Baseline (no filter) totalElements = {baseTotal}"); + + // Wide bracket per spec format (YYYY-MM-DD) that should include everything. + var (wideStatus, _, wideContent) = await v2Client.ProbeV2GetAsync( + "/api/certinext/v2/reports/orders?page=1&size=1&from=2000-01-01&to=2099-12-31"); + long wideTotal = -1; + if (wideStatus == 200 && !string.IsNullOrWhiteSpace(wideContent)) + { + using var doc = JsonDocument.Parse(wideContent); + if (doc.RootElement.TryGetProperty("totalElements", out var te)) wideTotal = te.GetInt64(); + } + _output.WriteLine($"FINDING: from=2000-01-01&to=2099-12-31 -> HTTP {wideStatus}, totalElements = {wideTotal} " + + $"(vs baseline {baseTotal}; equal => from/to accepted with YYYY-MM-DD and don't drop rows)."); + + // Narrow bracket in the far past that should exclude everything, to confirm the + // params actually filter (rather than being silently ignored). + var (narrowStatus, _, narrowContent) = await v2Client.ProbeV2GetAsync( + "/api/certinext/v2/reports/orders?page=1&size=1&from=2000-01-01&to=2000-01-02"); + long narrowTotal = -1; + if (narrowStatus == 200 && !string.IsNullOrWhiteSpace(narrowContent)) + { + using var doc = JsonDocument.Parse(narrowContent); + if (doc.RootElement.TryGetProperty("totalElements", out var te)) narrowTotal = te.GetInt64(); + } + _output.WriteLine($"FINDING: from=2000-01-01&to=2000-01-02 -> HTTP {narrowStatus}, totalElements = {narrowTotal} " + + "(if 0, from/to do filter; if unchanged from baseline, they are likely no-ops)."); + + // Empirical order-date vs issue-date distinction: pick an issued order from the V1 + // report whose OrderDate we know, and bracket from/to tightly around that date. + // If the row still appears in a bracket that excludes its (later) issuance date, + // from/to are filtering on order date, not issue date. + if (!_fixture.IsConfigured) + { + _output.WriteLine("V1 fixture not configured — cannot pick a known-orderDate order to " + + "distinguish order-date vs issue-date filtering. Skipping that sub-probe."); + return; + } + + OrderReportSample sample = null; + await foreach (var entry in _fixture.Client.ListOrdersAsync(pageSize: 20)) + { + if (!string.IsNullOrWhiteSpace(entry.OrderNumber) && + !string.IsNullOrWhiteSpace(entry.OrderDate) && + DateTime.TryParse(entry.OrderDate, null, + System.Globalization.DateTimeStyles.AdjustToUniversal | System.Globalization.DateTimeStyles.AssumeUniversal, + out DateTime parsedOrderDate)) + { + sample = new OrderReportSample(entry.OrderNumber, parsedOrderDate); + break; + } + } + + if (sample == null) + { + _output.WriteLine("No V1 order with a parsed OrderDate found in the first page — cannot run the " + + "order-date-vs-issue-date sub-probe."); + return; + } + + string from = sample.OrderDate.ToString("yyyy-MM-dd"); + string to = sample.OrderDate.AddDays(1).ToString("yyyy-MM-dd"); + var (bracketStatus, _, bracketContent) = await v2Client.ProbeV2GetAsync( + $"/api/certinext/v2/reports/orders?page=1&size=50&from={from}&to={to}"); + bool foundInOrderDateBracket = bracketStatus == 200 && + ContainsOrderNumber(bracketContent, sample.OrderNumber); + _output.WriteLine($"FINDING: V1 order {Redact(sample.OrderNumber)} (V1 orderDate={sample.OrderDate:u}) " + + $"bracketed from={from}&to={to} in V2 report -> present = {foundInOrderDateBracket}. " + + "(V1 report has no separate issue-date field to bracket against, so a full " + + "order-date-vs-issue-date distinction could not be made empirically in this pass; " + + "see report notes.)"); + } + + // --------------------------------------------------------------------------- + // Probe 4: orderNumber identity between V1 and V2 + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe4_OrderNumberIdentity_V1VsV2() + { + Skip.IfNot(_probeEnabled, "CERTINEXT_V2_REPORT_PROBE not set (or V2 not enabled) — skipping identity probe."); + Skip.IfNot(_fixture.IsConfigured, "V1 fixture not configured — cannot compare V1 order numbers."); + + using var v2Client = BuildV2Client(); + _output.WriteLine("=== Probe 4: orderNumber identity (V1 <-> V2) ==="); + + // Collect a handful of V1 order numbers. + var v1OrderNumbers = new List(); + await foreach (var entry in _fixture.Client.ListOrdersAsync(pageSize: 20)) + { + if (!string.IsNullOrWhiteSpace(entry.OrderNumber)) + v1OrderNumbers.Add(entry.OrderNumber); + if (v1OrderNumbers.Count >= 5) break; + } + _output.WriteLine($"Collected {v1OrderNumbers.Count} V1 order numbers to compare."); + + // Pull the V2 report (first few pages, capped) to build a set of V2 orderNumbers. + var v2OrderNumbers = new HashSet(StringComparer.OrdinalIgnoreCase); + for (int page = 1; page <= 5; page++) + { + var (status, _, content) = await v2Client.ProbeV2GetAsync( + $"/api/certinext/v2/reports/orders?page={page}&size=100"); + if (status != 200 || string.IsNullOrWhiteSpace(content)) break; + using var doc = JsonDocument.Parse(content); + if (!doc.RootElement.TryGetProperty("content", out var arr) || arr.GetArrayLength() == 0) break; + foreach (var row in arr.EnumerateArray()) + if (row.TryGetProperty("orderNumber", out var on) && on.ValueKind == JsonValueKind.String) + v2OrderNumbers.Add(on.GetString()); + if (arr.GetArrayLength() < 100) break; // last page + } + _output.WriteLine($"Collected {v2OrderNumbers.Count} distinct orderNumbers across up to 5 V2 report pages."); + + int matched = v1OrderNumbers.Count(n => v2OrderNumbers.Contains(n)); + _output.WriteLine($"FINDING: N compared = {v1OrderNumbers.Count}, N matched by exact orderNumber = {matched}."); + + // Cross-check: do V1 order numbers resolve against the V2 TrackOrder endpoint at all + // (independent of the report), by probing all three V2 product families. + int trackResolved = 0; + foreach (var orderNumber in v1OrderNumbers) + { + bool resolved = false; + foreach (var family in new[] { "ssl-certificates", "private-pki-certificates", "signature-certificates" }) + { + var (status, _, _) = await v2Client.ProbeV2GetAsync($"/api/certinext/v2/{family}/{orderNumber}"); + if (status == 200) { resolved = true; break; } + } + if (resolved) trackResolved++; + } + _output.WriteLine($"FINDING: of {v1OrderNumbers.Count} V1 order numbers, {trackResolved} resolved via " + + "V2 GET /{family}/{orderId} (TrackOrder-equivalent) in any product family."); + + // If an order was placed via V2 (CERTINEXT_V2_ISSUED_ORDER_ID), check whether its ID + // appears in the V2 report and whether it matches the V1 orderNumber format. + if (!string.IsNullOrWhiteSpace(_issuedOrderId)) + { + bool v2OrderInReport = v2OrderNumbers.Contains(_issuedOrderId); + _output.WriteLine($"FINDING: CERTINEXT_V2_ISSUED_ORDER_ID ({Redact(_issuedOrderId)}) present in V2 report = " + + $"{v2OrderInReport}."); + } + else + { + _output.WriteLine("CERTINEXT_V2_ISSUED_ORDER_ID not set — cannot check a V2-placed order's ID " + + "against V1 orderNumber format."); + } + } + + // --------------------------------------------------------------------------- + // Probe 6: List Domains + // --------------------------------------------------------------------------- + + [SkippableFact] + public async Task Probe6_ListDomains_Shape() + { + Skip.IfNot(_probeEnabled, "CERTINEXT_V2_REPORT_PROBE not set (or V2 not enabled) — skipping domains probe."); + + using var client = BuildV2Client(); + _output.WriteLine("=== Probe 6: GET /domains?search=&exactMatch=true ==="); + + string query = $"/api/certinext/v2/domains?search={Uri.EscapeDataString(_v2Domain)}&exactMatch=true"; + var (status, contentType, content) = await client.ProbeV2GetAsync(query); + _output.WriteLine($"HTTP {status} (Content-Type: {contentType})"); + + if (status != 200 || string.IsNullOrWhiteSpace(content)) + { + _output.WriteLine($"FINDING: /domains did not return 200 with a body. Raw: {Redact(content)}"); + return; + } + + using var doc = JsonDocument.Parse(content); + var root = doc.RootElement; + var envelopeKeys = root.EnumerateObject().Select(p => p.Name).ToList(); + _output.WriteLine($"Envelope top-level keys: [{string.Join(", ", envelopeKeys)}]"); + + if (!root.TryGetProperty("content", out var arr) || arr.ValueKind != JsonValueKind.Array || arr.GetArrayLength() == 0) + { + _output.WriteLine($"FINDING: no matching domain row for search={Redact(_v2Domain)}, exactMatch=true."); + return; + } + + var row = arr[0]; + var rowKeys = row.EnumerateObject().Select(p => $"{p.Name}:{p.Value.ValueKind}").ToList(); + _output.WriteLine($"row[0] fields (name:type): [{string.Join(", ", rowKeys)}]"); + _output.WriteLine($"Sample domain row (redacted): {Redact(row.GetRawText())}"); + + foreach (string field in new[] { "domainId", "dcvStatus", "validTill", "domainName", "status" }) + { + if (row.TryGetProperty(field, out var v)) + _output.WriteLine($" domain.{field} = {Redact(v.ToString())}"); + else + _output.WriteLine($" domain.{field} = "); + } + } + + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + private sealed class OrderReportSample + { + public OrderReportSample(string orderNumber, DateTime orderDate) + { + OrderNumber = orderNumber; + OrderDate = orderDate; + } + + public string OrderNumber { get; } + public DateTime OrderDate { get; } + } + + private static bool ContainsOrderNumber(string reportJson, string orderNumber) + { + if (string.IsNullOrWhiteSpace(reportJson)) return false; + try + { + using var doc = JsonDocument.Parse(reportJson); + if (!doc.RootElement.TryGetProperty("content", out var arr) || arr.ValueKind != JsonValueKind.Array) + return false; + return arr.EnumerateArray().Any(row => + row.TryGetProperty("orderNumber", out var on) && + on.ValueKind == JsonValueKind.String && + string.Equals(on.GetString(), orderNumber, StringComparison.OrdinalIgnoreCase)); + } + catch (JsonException) + { + return false; + } + } + + private CERTInextClient BuildV2Client() + { + return new CERTInextClient(new CERTInextConfig + { + // V1 fields (still needed for construction; not exercised by these probes). + ApiUrl = _fixture.IsConfigured ? _fixture.Config.ApiUrl : "https://v1-placeholder.certinext.io", + AuthMode = "AccessKey", + ApiKey = _fixture.IsConfigured ? _fixture.Config.ApiKey : "placeholder", + AccountNumber = _fixture.IsConfigured ? _fixture.Config.AccountNumber : "0", + // V2 fields + UseV2Api = true, + ApiUrlV2 = _v2ApiUrl, + ClientId = _v2ClientId, + ClientSecret = _v2ClientSecret, + RequestorName = _fixture.IsConfigured ? _fixture.Config.RequestorName : "Test", + RequestorEmail = _fixture.IsConfigured ? _fixture.Config.RequestorEmail : "test@example.com", + SignerIp = "127.0.0.1", + SignerPlace = "Gateway Lab", + PageSize = 100 + }); + } + + /// + /// Redacts anything that looks like a token/secret/key value before it's written to + /// test output. This is a best-effort scrub of raw JSON bodies for a discovery probe — + /// never log access tokens, client secrets, or API keys. + /// + private static string Redact(string raw) + { + if (string.IsNullOrEmpty(raw)) return raw; + string redacted = raw; + foreach (string key in new[] { "accessToken", "access_token", "clientSecret", "client_secret", "apiKey", "api_key", "authKey", "token" }) + { + redacted = System.Text.RegularExpressions.Regex.Replace( + redacted, + $"\"{System.Text.RegularExpressions.Regex.Escape(key)}\"\\s*:\\s*\"[^\"]*\"", + $"\"{key}\":\"***REDACTED***\"", + System.Text.RegularExpressions.RegexOptions.IgnoreCase); + } + return redacted; + } + + private static string Truncate(string value, int maxLength) + { + if (string.IsNullOrEmpty(value) || value.Length <= maxLength) return value; + return value.Substring(0, maxLength) + "...(truncated)"; + } + + private static (Dictionary env, HashSet fileKeys) LoadEnvFile(string path) + { + var fileKeys = new HashSet(StringComparer.OrdinalIgnoreCase); + var result = new Dictionary(StringComparer.OrdinalIgnoreCase); + + foreach (System.Collections.DictionaryEntry de in Environment.GetEnvironmentVariables()) + { + string k = de.Key?.ToString(); + string v = de.Value?.ToString(); + if (!string.IsNullOrEmpty(k)) result[k] = v ?? string.Empty; + } + + if (File.Exists(path)) + { + foreach (string rawLine in File.ReadAllLines(path)) + { + string line = rawLine.Trim(); + if (string.IsNullOrEmpty(line) || line.StartsWith("#")) continue; + + int idx = line.IndexOf('='); + if (idx <= 0) continue; + + string key = line.Substring(0, idx).Trim(); + string val = line.Substring(idx + 1).Trim().Trim('"').Trim('\''); + result[key] = val; + fileKeys.Add(key); + } + } + + return (result, fileKeys); + } + + private static string GetEnv(Dictionary env, string key, string defaultValue = "") + => env.TryGetValue(key, out string v) && !string.IsNullOrWhiteSpace(v) ? v : defaultValue; + } +} diff --git a/CERTInext.Tests/CERTInext.Tests.csproj b/CERTInext.Tests/CERTInext.Tests.csproj index 84ce7a6..fcd3697 100644 --- a/CERTInext.Tests/CERTInext.Tests.csproj +++ b/CERTInext.Tests/CERTInext.Tests.csproj @@ -21,6 +21,7 @@ exist, so exclude these files unless SUPPORTS_DCV is defined. See issue 0003. --> + diff --git a/CERTInext.Tests/CERTInextCAPluginCoverageTests.cs b/CERTInext.Tests/CERTInextCAPluginCoverageTests.cs index f684f7d..1a9faa9 100644 --- a/CERTInext.Tests/CERTInextCAPluginCoverageTests.cs +++ b/CERTInext.Tests/CERTInextCAPluginCoverageTests.cs @@ -259,6 +259,60 @@ public async Task RenewOrReissue_CallsRenewApi_WhenCertWithinRenewalWindow() It.IsAny()), Times.Never); } + // --------------------------------------------------------------------------- + // A1d-2: renewal within window carries the template's product code onto the + // RenewCertificateRequest, not just the connector-level DefaultProductCode. + // Regression for issue #26 / local issues/0012. + // --------------------------------------------------------------------------- + + [Fact] + public async Task RenewOrReissue_CallsRenewApi_UsesTemplateProductCode() + { + var clientMock = NewMock(); + var readerMock = NewReaderMock(); + + // Expiry is 30 days in the future, renewal window is 90 days → within window + DateTime expiry = DateTime.UtcNow.AddDays(30); + + readerMock + .Setup(r => r.GetRequestIDBySerialNumber(It.IsAny())) + .ReturnsAsync(MockCertificateData.CertId1); + + readerMock + .Setup(r => r.GetExpirationDateByRequestId(MockCertificateData.CertId1)) + .Returns(expiry); + + clientMock + .Setup(c => c.RenewCertificateAsync( + MockCertificateData.CertId1, + It.Is(r => r.ProfileId == MockCertificateData.ProfileIdClient), + It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedEnrollResponse("cert-renewed-002")); + + var plugin = new CERTInextCAPlugin(clientMock.Object, readerMock.Object); + + // ProfileId is a non-default value distinct from the connector's DefaultProductCode. + var productInfo = MakeProductInfo(profileId: MockCertificateData.ProfileIdClient, extras: new Dictionary + { + ["PriorCertSN"] = "AABBCCDDEEFF", + ["RenewalWindowDays"] = "90" + }); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, + subject: "CN=test.example.com", + san: null, + productInfo: productInfo, + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.RenewOrReissue); + + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + clientMock.Verify(c => c.RenewCertificateAsync( + MockCertificateData.CertId1, + It.Is(r => r.ProfileId == MockCertificateData.ProfileIdClient), + It.IsAny()), Times.Once); + } + // --------------------------------------------------------------------------- // A1e: PriorCertSN present, cert already expired → new enroll // Semantics: useRenewalApi = expiry > now && expiry <= now + window. diff --git a/CERTInext.Tests/CERTInextCAPluginDcvTests.cs b/CERTInext.Tests/CERTInextCAPluginDcvTests.cs index 837ae8d..7350abc 100644 --- a/CERTInext.Tests/CERTInextCAPluginDcvTests.cs +++ b/CERTInext.Tests/CERTInextCAPluginDcvTests.cs @@ -35,7 +35,8 @@ private static CERTInextConfig DcvConfig( int propagationDelaySeconds = 1, int timeoutMinutes = 1, int dcvWaitForChallengeSeconds = 0, - int dcvWaitForIssuanceSeconds = 0) => + int dcvWaitForIssuanceSeconds = 0, + int pickupRetries = 0) => new CERTInextConfig { DcvEnabled = enabled, @@ -45,7 +46,12 @@ private static CERTInextConfig DcvConfig( // behaviour and run fast. Tests that exercise the new wait paths can opt // in with a positive value (see WaitsForChallenge_ToAppear / WaitsForIssuance). DcvWaitForChallengeSeconds = dcvWaitForChallengeSeconds, - DcvWaitForIssuanceSeconds = dcvWaitForIssuanceSeconds + DcvWaitForIssuanceSeconds = dcvWaitForIssuanceSeconds, + // Disable the synchronous pickup poll by default (same reasoning as the wait + // budgets above): the DCV path owns issuance for these tests, and a DCV-disabled + // or no-factory case that ends on a pending result must not pay the real pickup + // Task.Delay loop. The dedicated pickup tests live in CERTInextCAPluginTests. + PickupRetries = pickupRetries }; private static Mock NewMock() => @@ -437,17 +443,19 @@ public async Task Dcv_Skipped_WhenOrderStatusIdIsTerminal_EvenIfDcvValidated(str }); var validator = new FakeDomainValidator(); - // Issuance-wait budget > 0 so a wrong-path entry would manifest as a - // GetCertificate call we DON'T expect. + // Issuance-wait budget > 0 AND pickup ENABLED (pickupRetries > 0) so a wrong-path + // entry would manifest as a GetCertificate call we DON'T expect — this test must + // fail if either the DCV issuance-wait guard OR the synchronous-pickup gate + // (dcvIssuanceWaitRan) regresses and starts polling a cancelled/rejected order. var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator), - DcvConfig(dcvWaitForIssuanceSeconds: 10)); + DcvConfig(dcvWaitForIssuanceSeconds: 10, pickupRetries: 5)); await Enroll(plugin); mock.Verify(c => c.GetCertificateAsync(It.IsAny(), It.IsAny()), Times.Never, - "Enroll must not enter WaitForIssuanceAfterDcvAsync when the order is " + - "cancelled/rejected, even if DCV happens to be in a 'validated' state"); + "Enroll must not enter WaitForIssuanceAfterDcvAsync OR the synchronous pickup poll " + + "when the order is cancelled/rejected, even if DCV happens to be in a 'validated' state"); validator.StagedRecords.Should().BeEmpty( "DCV staging must not run for a cancelled/rejected order"); } @@ -519,7 +527,7 @@ public async Task SyncDcvRetry_DoesSingleShotTrackOrder_WhenChallengeNotReady() // --------------------------------------------------------------------------- [Fact] - public async Task Dcv_Throws_WhenNoProviderForDomain() + public async Task Dcv_SkipsAndDefers_WhenNoProviderForDomain() { var mock = NewMock(); mock.Setup(c => c.EnrollCertificateAsync(It.IsAny(), It.IsAny())) @@ -531,17 +539,19 @@ public async Task Dcv_Throws_WhenNoProviderForDomain() mock.Setup(c => c.GetDcvAsync(MockCertificateData.DcvOrderId, MockCertificateData.DcvDomain, Constants.Dcv.MethodDnsTxt, It.IsAny())) .ReturnsAsync(MockCertificateData.DcvTokenResponse()); - // Factory returns null → no DNS provider configured + // Factory returns null → no DNS provider configured. Regression: this used to throw and + // fail the whole order — including when the "unresolvable" domain was actually just a + // non-DNS Subject CN with no config-level way to prevent the throw (SubmitNonDnsSans only + // filters the SAN list, not the subject). Now it is logged loudly and deferred instead. var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator: null)); Func act = () => Enroll(plugin); - await act.Should().ThrowAsync() - .WithMessage("*No DNS provider plugin is configured*"); + await act.Should().NotThrowAsync(); } [Fact] - public async Task Dcv_Throws_WhenStageValidationFails() + public async Task Dcv_SkipsAndDefers_WhenStageValidationFails() { var mock = NewMock(); mock.Setup(c => c.EnrollCertificateAsync(It.IsAny(), It.IsAny())) @@ -558,10 +568,12 @@ public async Task Dcv_Throws_WhenStageValidationFails() Func act = () => Enroll(plugin); - await act.Should().ThrowAsync() - .WithMessage("*Failed to stage DNS validation*DNS zone not writable*"); + // Regression: a StageValidation failure used to throw and fail the whole order. Now it + // is logged loudly and the domain is skipped/deferred — this is the only pending domain, + // so nothing gets staged and the order defers to the next sync cycle. + await act.Should().NotThrowAsync(); - // No VerifyDcv call — failed before reaching that step + // No VerifyDcv call — nothing was staged to verify mock.Verify(c => c.VerifyDcvAsync(It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny()), Times.Never); } @@ -594,7 +606,7 @@ public async Task Dcv_CleanupAlwaysCalled_EvenWhenVerifyDcvThrows() } [Fact] - public async Task Dcv_Throws_WhenGetDcvReturnsNoToken() + public async Task Dcv_SkipsAndDefers_WhenGetDcvReturnsNoToken() { var mock = NewMock(); mock.Setup(c => c.EnrollCertificateAsync(It.IsAny(), It.IsAny())) @@ -611,8 +623,11 @@ public async Task Dcv_Throws_WhenGetDcvReturnsNoToken() Func act = () => Enroll(plugin); - await act.Should().ThrowAsync() - .WithMessage("*GetDcv returned no token*"); + // Regression: an empty token used to throw and fail the whole order. It is now logged + // loudly (LogError) and the domain is skipped — the order defers to the next sync cycle + // rather than failing Enroll with an order already placed at the CA. + await act.Should().NotThrowAsync(); + validator.StagedRecords.Should().BeEmpty("the only pending domain returned no token, so nothing should have been staged"); } // --------------------------------------------------------------------------- @@ -681,11 +696,16 @@ public async Task Dcv_Defers_When_GetDcv_ReturnsInvalidRequestMessage_WithoutEms } [Fact] - public async Task Dcv_Rethrows_When_GetDcv_FailsWithUnrelatedError() + public async Task Dcv_SkipsAndDefers_WhenGetDcvFailsWithUnrelatedError() { - // Tolerance is narrow: a genuine server error (5xx, transport, auth) must still - // bubble up so the gateway treats the enrollment as failed and the operator can - // diagnose. This guards against accidentally swallowing every GetDcv exception. + // Regression: this test used to assert the opposite — that a genuine server error (5xx, + // transport, auth) must bubble up and fail the whole enrollment. That is exactly the + // orphaned-order failure mode: GetDcv's live behavior for a non-DNS order-domain is + // unmeasured (see BuildSanList's sandbox-only caveat), so treating any unrecognized + // GetDcv error as fatal risks failing perfectly good co-tenant DNS domains on the same + // order over one domain's transient or CA-side issue, with the enrollment already + // placed at CERTInext and no catch anywhere above this call. The failure is still loud + // (LogError, with the underlying exception) — it just no longer fails the call. var mock = NewMock(); mock.Setup(c => c.EnrollCertificateAsync(It.IsAny(), It.IsAny())) .ReturnsAsync(new EnrollCertificateResponse { Id = MockCertificateData.DcvOrderId, Status = "pending_dcv" }); @@ -700,8 +720,8 @@ public async Task Dcv_Rethrows_When_GetDcv_FailsWithUnrelatedError() var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator)); Func act = () => Enroll(plugin); - await act.Should().ThrowAsync() - .WithMessage("*HTTP 500*"); + await act.Should().NotThrowAsync(); + validator.StagedRecords.Should().BeEmpty("the only pending domain's GetDcv call failed, so nothing should have been staged"); } // --------------------------------------------------------------------------- @@ -816,5 +836,507 @@ public async Task Dcv_WaitsForIssuance_AfterDcvVerifies() mock.Verify(c => c.GetCertificateAsync(MockCertificateData.DcvOrderId, It.IsAny()), Times.AtLeast(2), "plugin should have polled at least twice for issuance"); } + + // --------------------------------------------------------------------------- + // Undrainable pending domains must not strand the valid ones on the same order + // --------------------------------------------------------------------------- + + /// Builds a DomainVerificationDetail JsonElement for the given dcvStatus. + private static System.Text.Json.JsonElement DcvDetail(string dcvStatus) => + System.Text.Json.JsonSerializer.SerializeToElement(new DomainVerificationDetail + { + DcvMethod = Constants.Dcv.MethodDnsTxt, + DcvStatus = dcvStatus, + Status = "1" + }); + + /// + /// Builds a TrackOrder response whose domainVerification block lists several pending + /// domains, so tests can mix validatable and unvalidatable keys on one order. + /// + private static TrackOrderResponse DcvPendingTrackResponseMultiDomain( + string orderNumber, params string[] domains) + { + var detail = DcvDetail(Constants.Dcv.StatusPending); + var raw = new Dictionary(); + foreach (string d in domains) + raw[d] = detail; + + return new TrackOrderResponse + { + OrderDetails = new TrackOrderResponseDetails + { + OrderStatusId = "1", + CertificateStatusId = "1", + DomainVerification = new TrackOrderDomainVerification + { + Status = Constants.Dcv.StatusPending, + RawDomainEntries = raw + } + } + }; + } + + /// + /// Builds a TrackOrder response with one already-validated domain (dcvStatus=1) and one + /// still-pending, unresolvable domain (dcvStatus=0) — the shape CERTInext produces when it + /// has cached a prior DCV validation for the CN while a non-DNS SAN on the same order is + /// still outstanding. + /// + private static TrackOrderResponse DcvMixedStatusTrackResponse( + string validatedDomain, string pendingDomain) + { + var validated = DcvDetail(Constants.Dcv.StatusValidated); + var pending = DcvDetail(Constants.Dcv.StatusPending); + + return new TrackOrderResponse + { + OrderDetails = new TrackOrderResponseDetails + { + OrderStatusId = "1", + CertificateStatusId = "1", + DomainVerification = new TrackOrderDomainVerification + { + // Aggregate stays pending because one domain still is — this must not take + // the early "already validated" return at the top of the method. + Status = Constants.Dcv.StatusPending, + RawDomainEntries = new Dictionary + { + [validatedDomain] = validated, + [pendingDomain] = pending + } + } + } + }; + } + + /// + /// Regression for the false invariant behind the round-1 fix's own misconfiguration check: + /// "the CN is always a pending domain too" is untrue whenever CERTInext has cached a prior + /// DCV validation for it (a case this same file's cached-validation branch documents), so a + /// non-DNS SAN sharing the order with an already-validated CN must not throw — it must defer + /// to the next sync cycle exactly like the single-domain case does. + /// + [Fact] + public async Task Dcv_CachedCnPlusUnresolvableSan_DefersWithoutThrowing() + { + const string order = MockCertificateData.DcvOrderId; + const string cn = MockCertificateData.DcvDomain; + const string ip = "192.0.2.10"; + + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending" }); + + mock.Setup(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvMixedStatusTrackResponse(validatedDomain: cn, pendingDomain: ip)); + + // The IP clears the FQDN regex and reaches GetDcv, per the sandbox-measured shape. + mock.Setup(c => c.GetDcvAsync(order, ip, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse(MockCertificateData.DcvToken)); + + var validator = new FakeDomainValidator(); + // Resolves for the CN (a real, working DNS provider) but not for the IP literal — the + // scenario that must prove "a provider IS deployed" rather than "nothing is deployed". + var plugin = BuildPlugin( + mock.Object, + new FakeDomainValidatorFactory(validator, resolvableDomain: cn), + DcvConfig()); + + Func act = () => Enroll(plugin); + + await act.Should().NotThrowAsync( + "an unresolvable non-DNS SAN must defer the order to the next sync cycle, not fail " + + "the enrollment — the CN having cached DCV proves a provider is deployed and working, " + + "so this is not the 'nothing is deployed' misconfiguration case"); + + validator.StagedRecords.Should().BeEmpty( + "the only pending domain is unresolvable, so nothing should have been staged"); + } + + /// + /// A non-FQDN pending domain must be skipped, not thrown on. + /// + /// Regression: non-DNS SANs are now submitted to CERTInext, which registers them verbatim + /// as order domains, so an email/URI SAN turns up as a domainVerification key that fails the + /// FQDN check. That check used to throw for the whole order — escaping Enroll (which has no + /// catch) after the order was already placed, so the enrollment failed with an orphaned + /// order and no TXT record was staged for the *valid* domains beside it. Every sync retry + /// re-threw and TryRunDcvDuringSyncAsync swallowed it, so the order could never progress. + /// + [Fact] + public async Task Dcv_NonFqdnPendingDomain_IsSkipped_AndValidDomainStillStaged() + { + const string order = MockCertificateData.DcvOrderId; + const string good = MockCertificateData.DcvDomain; + const string bad = "admin@example.com"; // what an rfc822 SAN comes back as + + var mock = NewMock(); + + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + mock.SetupSequence(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, good, bad)) + .ReturnsAsync(MockCertificateData.DcvVerifiedTrackResponse(order, good)); + + // Only the valid domain should ever reach GetDcv/VerifyDcv. MockBehavior.Strict means + // an unexpected call for `bad` fails the test on its own. + mock.Setup(c => c.GetDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse(MockCertificateData.DcvToken)); + mock.Setup(c => c.VerifyDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.GetCertificateAsync(order, It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord(order)); + + var validator = new FakeDomainValidator(); + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator), + DcvConfig(dcvWaitForIssuanceSeconds: 10)); + + // Must not throw — that is the regression. + var result = await Enroll(plugin); + + string expectedHostname = string.Format(Constants.Dcv.DefaultTxtRecordTemplate, good); + validator.StagedRecords.Should().ContainSingle( + "the valid DNS domain must still be staged even though a co-tenant domain is unusable") + .Which.Should().Be((expectedHostname, MockCertificateData.DcvToken)); + + mock.Verify(c => c.GetDcvAsync(order, bad, It.IsAny(), It.IsAny()), + Times.Never, "a non-FQDN domain must never be sent to GetDcv"); + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + } + + /// + /// Regression: the FQDN validation regex used ^...$ , and in .NET's default (non-Multiline) + /// mode $ matches immediately before a single trailing '\n', not only at the true end of the + /// string. A domain value ending in '\n' therefore passed as "valid" and reached several log + /// sinks unsanitized further down this same method — a CWE-117 log-injection route into the + /// DCV audit trail, reachable via any order visible through Synchronize/GetSingleRecord (not + /// just ones this plugin's own Enroll call placed, since TrackOrder's domainVerification keys + /// for an externally-created order are never trimmed by this plugin). The regex now anchors + /// with \A/\z, which are absolute string-start/end regardless of trailing newlines. + /// + [Fact] + public async Task Dcv_DomainWithTrailingNewline_IsRejectedAsInvalid_AndValidDomainStillStaged() + { + const string order = MockCertificateData.DcvOrderId; + const string good = MockCertificateData.DcvDomain; + const string bad = "evil.example.com\n"; + + var mock = NewMock(); + + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + mock.SetupSequence(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, good, bad)) + .ReturnsAsync(MockCertificateData.DcvVerifiedTrackResponse(order, good)); + + // MockBehavior.Strict: an unexpected GetDcv call for `bad` fails the test on its own — + // if the regex fix regressed, this domain would reach GetDcv instead of being rejected + // by the FQDN check before the staging loop even starts. + mock.Setup(c => c.GetDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse(MockCertificateData.DcvToken)); + mock.Setup(c => c.VerifyDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.GetCertificateAsync(order, It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord(order)); + + var validator = new FakeDomainValidator(); + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator), + DcvConfig(dcvWaitForIssuanceSeconds: 10)); + + var result = await Enroll(plugin); + + string expectedHostname = string.Format(Constants.Dcv.DefaultTxtRecordTemplate, good); + validator.StagedRecords.Should().ContainSingle( + "the valid domain must still be staged even though a co-tenant domain carries a " + + "trailing newline") + .Which.Should().Be((expectedHostname, MockCertificateData.DcvToken)); + + mock.Verify(c => c.GetDcvAsync(order, bad, It.IsAny(), It.IsAny()), + Times.Never, "a domain with a trailing newline must never be sent to GetDcv"); + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + } + + /// + /// Regression: the generic per-domain catch blocks around GetDcvAsync and StageValidation + /// used to catch OperationCanceledException along with genuine GetDcv/DNS-provider failures, + /// logging and skipping the domain as an ordinary per-domain failure. A cancellation (the + /// shared DcvTimeoutMinutes-bound token expiring mid-loop) is not that — it must propagate to + /// the outer catch instead, which is the only place that logs it correctly and is the + /// intended timeout-handling path documented at the top of this method's DCV timeout setup. + /// + [Fact] + public async Task Dcv_CancellationDuringGetDcv_PropagatesRatherThanBeingSkippedAsPerDomainFailure() + { + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = MockCertificateData.DcvOrderId, Status = "pending_dcv" }); + + mock.Setup(c => c.TrackOrderAsync(MockCertificateData.DcvOrderId, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvPendingTrackResponse()); + + mock.Setup(c => c.GetDcvAsync(MockCertificateData.DcvOrderId, MockCertificateData.DcvDomain, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ThrowsAsync(new OperationCanceledException("DCV timeout budget exceeded")); + + var validator = new FakeDomainValidator(); + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator)); + + Func act = () => Enroll(plugin); + + // Must propagate as a cancellation, not be swallowed and reported as "GetDcv failed" in + // the skipped-domains summary while Enroll completes normally. + await act.Should().ThrowAsync(); + } + + /// + /// A pending domain that resolves no DNS provider (an IP-literal SAN passes the FQDN regex + /// but no zone can match it) must likewise be skipped rather than failing the whole order. + /// + [Fact] + public async Task Dcv_DomainWithNoResolvableValidator_IsSkipped_AndValidDomainStillStaged() + { + const string order = MockCertificateData.DcvOrderId; + const string good = MockCertificateData.DcvDomain; + const string ip = "192.0.2.10"; // what an iPAddress SAN comes back as + + var mock = NewMock(); + + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + mock.SetupSequence(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, good, ip)) + .ReturnsAsync(MockCertificateData.DcvVerifiedTrackResponse(order, good)); + + // The IP literal clears the FQDN filter, so GetDcv IS called for it; the dead end is + // that no validator resolves. Stub it so reaching that point is legitimate. + mock.Setup(c => c.GetDcvAsync(order, It.IsAny(), Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse(MockCertificateData.DcvToken)); + mock.Setup(c => c.VerifyDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.GetCertificateAsync(order, It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord(order)); + + var validator = new FakeDomainValidator(); + var plugin = BuildPlugin( + mock.Object, + new FakeDomainValidatorFactory(validator, resolvableDomain: good), + DcvConfig(dcvWaitForIssuanceSeconds: 10)); + + var result = await Enroll(plugin); + + string expectedHostname = string.Format(Constants.Dcv.DefaultTxtRecordTemplate, good); + validator.StagedRecords.Should().ContainSingle( + "only the domain with a resolvable provider should be staged, and it must still be staged") + .Which.Should().Be((expectedHostname, MockCertificateData.DcvToken)); + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + } + + /// + /// Regression: the compensating cleanup call after an early exit from staging (chiefly the + /// shared DcvTimeoutMinutes-bound token firing mid-loop, which is what this scenario + /// simulates via a domain whose GetDcv call raises OperationCanceledException) must not reuse + /// the same token the operation was cancelled by. A cooperative IDomainValidator that forwards + /// its token into its own HTTP calls (the reference CloudflareDomainValidator in this repo + /// does exactly that) would otherwise throw immediately on an already-cancelled token and + /// never even attempt the delete, silently leaving the TXT record published. + /// + /// CancellationToken.None would fix that but removes the cleanup call's timeout bound + /// entirely — a second, adversarially-found regression on top of the first — so the correct + /// fix is a fresh token with its OWN short timeout: not cancelled going in, but still bounded. + /// + [Fact] + public async Task Dcv_CleanupAfterCancellation_UsesAFreshBoundedToken_NotTheAmbientToken() + { + const string order = MockCertificateData.DcvOrderId; + const string good = "a.example.com"; + const string bad = "b.example.com"; + + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + mock.Setup(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, good, bad)); + + mock.Setup(c => c.GetDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse("token-a")); + // Domain 'good' is processed first (Dictionary enumeration order matches insertion order + // in practice for the small dictionaries this test builds); 'bad' then throws, driving the + // outer catch's cleanup of the already-staged 'good' entry. + mock.Setup(c => c.GetDcvAsync(order, bad, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ThrowsAsync(new OperationCanceledException("DCV timeout budget exceeded")); + + var validator = new FakeDomainValidator(); + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator)); + + Func act = () => Enroll(plugin); + await act.Should().ThrowAsync(); + + validator.StagedRecords.Should().ContainSingle( + "'good' must have staged before 'bad' threw, for this test to exercise cleanup at all"); + var cleanupToken = validator.CleanupTokens.Should().ContainSingle( + "the staged entry must go through the cancellation cleanup path exactly once").Subject; + + cleanupToken.IsCancellationRequested.Should().BeFalse( + "cleanup is a best-effort compensating action and must run with its own token, " + + "not the already-cancelled ambient one"); + cleanupToken.CanBeCanceled.Should().BeTrue( + "the cleanup call must still be bounded by its own timeout, not unbounded " + + "(CancellationToken.None) — a hanging DNS-provider call must not block forever"); + } + + /// + /// Regression: the routine, always-runs finally-block cleanup used to iterate staged domains + /// sequentially. Each cleanup call already has its own independent + /// CleanupValidationTimeoutSeconds bound, but running them one after another meant that + /// bound was per-call, not in aggregate — a UCC order with N staged domains could hold the + /// calling request open for up to N x the per-call ceiling if the DNS provider was merely + /// slow (not even hung) on every delete, which can exceed DcvTimeoutMinutes itself for a + /// realistic multi-SAN count. + /// + /// Proven directly via — the number + /// of CleanupValidation calls the validator observed in flight at once — rather than total + /// wall-clock time. 0023: a prior version of this test asserted elapsed time < 4000ms, which + /// failed deterministically (~4801ms) because the surrounding DCV flow carries ~4s of fixed + /// overhead unrelated to cleanup concurrency (DcvConfig's 1s propagation delay plus + /// WaitForDcvVerificationAsync's separate, hardcoded 3s poll interval, + /// Constants.Dcv.SyncPropagationDelaySeconds — not the 1s the old comment assumed), on top of + /// which the (already-concurrent) ~800ms cleanup pushed the total past the threshold. That was + /// a test-design defect present since the test was introduced, not a cleanup regression — the + /// finally block here already runs cleanup via Task.WhenAll. Measuring peak concurrency proves + /// the same thing the wall-clock check intended, without being coupled to unrelated fixed + /// delays elsewhere in the flow. + /// + [Fact] + public async Task Dcv_CleanupOfMultipleDomains_RunsConcurrently_NotSequentially() + { + const string order = MockCertificateData.DcvOrderId; + string[] domains = { "a.example.com", "b.example.com", "c.example.com" }; + var cleanupDelay = TimeSpan.FromMilliseconds(800); + + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + var verifiedDetail = DcvDetail(Constants.Dcv.StatusValidated); + var verifiedRaw = new Dictionary(); + foreach (string d in domains) verifiedRaw[d] = verifiedDetail; + + mock.SetupSequence(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, domains)) + .ReturnsAsync(new TrackOrderResponse + { + OrderDetails = new TrackOrderResponseDetails + { + OrderStatusId = "1", + CertificateStatusId = "1", + DomainVerification = new TrackOrderDomainVerification + { + Status = Constants.Dcv.StatusValidated, + RawDomainEntries = verifiedRaw + } + } + }); + + foreach (string d in domains) + { + mock.Setup(c => c.GetDcvAsync(order, d, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse($"token-{d}")); + mock.Setup(c => c.VerifyDcvAsync(order, d, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .Returns(Task.CompletedTask); + } + mock.Setup(c => c.GetCertificateAsync(order, It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord(order)); + + var validator = new FakeDomainValidator { CleanupDelay = cleanupDelay }; + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator), + DcvConfig(dcvWaitForIssuanceSeconds: 10)); + + await Enroll(plugin); + + validator.CleanedUpKeys.Should().HaveCount(3, "all three staged domains must be cleaned up"); + + // Direct proof of concurrency: all three CleanupValidation calls must have been in + // flight at the same instant. If cleanup ran sequentially, PeakConcurrentCleanups would + // be 1 regardless of how long the whole call took — this assertion doesn't depend on any + // wall-clock budget or on the fixed overhead elsewhere in the DCV flow (see 0023). + validator.PeakConcurrentCleanups.Should().Be(3, + "cleanup for independent domains must run concurrently, not sequentially — " + + "all three CleanupValidation calls should have been in flight at once"); + } + + /// + /// Regression: a StageValidation failure on one domain of a multi-domain order must not + /// leave the TXT records already published for the earlier domains orphaned. Before the + /// fix, the staging loop's throw sites were outside the try/finally that owns cleanup, so + /// this was reachable only by accident (pre-fix, a UCC order's SANs never reached CERTInext + /// at all, so an order rarely had more than one pending domain to stage). Submitting every + /// requested SAN makes multi-domain staging the normal case, so this must hold now. + /// + [Fact] + public async Task Dcv_StageFailureOnSecondDomain_DoesNotAbortTheGoodDomain() + { + const string order = MockCertificateData.DcvOrderId; + const string good = "a.example.com"; + const string bad = "b.example.com"; + + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(new EnrollCertificateResponse { Id = order, Status = "pending_dcv" }); + + // First TrackOrder call (inside PerformDcvIfNeededAsync) sees both domains pending; + // the second (WaitForDcvVerificationAsync's poll after staging/VerifyDcv) sees the one + // domain that actually got staged — 'good' — as verified. + mock.SetupSequence(c => c.TrackOrderAsync(order, It.IsAny())) + .ReturnsAsync(DcvPendingTrackResponseMultiDomain(order, good, bad)) + .ReturnsAsync(MockCertificateData.DcvVerifiedTrackResponse(order, good)); + + mock.Setup(c => c.GetDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse("token-a")); + mock.Setup(c => c.GetDcvAsync(order, bad, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .ReturnsAsync(MockCertificateData.DcvTokenResponse("token-b")); + + mock.Setup(c => c.VerifyDcvAsync(order, good, Constants.Dcv.MethodDnsTxt, It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.GetCertificateAsync(order, It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord(order)); + + var validator = new FakeDomainValidator + { + ShouldFail = key => key.Contains(bad, StringComparison.OrdinalIgnoreCase) + }; + var plugin = BuildPlugin(mock.Object, new FakeDomainValidatorFactory(validator), + DcvConfig(dcvWaitForIssuanceSeconds: 10)); + + Func act = () => Enroll(plugin); + + // Regression: a StageValidation failure on one domain of a multi-domain order must not + // abort the whole order any more — it did before this fix, which both failed the + // enrollment with an orphaned CERTInext order AND (before an earlier round's fix) + // orphaned the 'good' domain's already-published TXT record. Now the bad domain is + // skipped (logged loudly) and the good domain proceeds through the normal DCV lifecycle. + await act.Should().NotThrowAsync(); + + string goodHostname = string.Format(Constants.Dcv.DefaultTxtRecordTemplate, good); + string badHostname = string.Format(Constants.Dcv.DefaultTxtRecordTemplate, bad); + + validator.StagedRecords.Should().ContainSingle( + "only the domain that did not fail to stage should ever have been staged") + .Which.key.Should().Be(goodHostname); + validator.CleanedUpKeys.Should().Contain(goodHostname, + "the good domain completes its normal verify-then-cleanup lifecycle"); + validator.CleanedUpKeys.Should().NotContain(badHostname, + "the bad domain was never staged, so there is nothing to clean up for it"); + } } } diff --git a/CERTInext.Tests/CERTInextCAPluginTests.cs b/CERTInext.Tests/CERTInextCAPluginTests.cs index 3ec5df1..5154146 100644 --- a/CERTInext.Tests/CERTInextCAPluginTests.cs +++ b/CERTInext.Tests/CERTInextCAPluginTests.cs @@ -31,8 +31,20 @@ public class CERTInextCAPluginTests // Helpers // --------------------------------------------------------------------------- + // Pickup is disabled by default in the broad fixture (PickupRetries=0) — mirroring how + // DcvConfig defaults its wait budgets to 0 — so tests that don't care about the + // synchronous pickup don't pay its real Task.Delay-based poll. Tests that DO exercise + // pickup opt in via BuildPluginWithPickup. private static CERTInextCAPlugin BuildPlugin(ICERTInextClient client) => - new CERTInextCAPlugin(client); + new CERTInextCAPlugin(client, new CERTInextConfig { PickupRetries = 0 }); + + // Pickup-enabled fixture for the synchronous-pickup tests. PickupDelay is clamped to a + // 1s floor and the loop adds a fixed 5s initial delay, so these tests are intentionally + // a few seconds each. + private static CERTInextCAPlugin BuildPluginWithPickup( + ICERTInextClient client, int retries, int delaySeconds = 1) => + new CERTInextCAPlugin(client, + new CERTInextConfig { PickupRetries = retries, PickupDelayInSeconds = delaySeconds }); private static Mock NewMock() => new Mock(MockBehavior.Strict); @@ -345,6 +357,127 @@ public async Task Enroll_New_ReturnsPendingStatus_WhenCaReturnsPendingApproval() result.Status.Should().Be((int)EndEntityStatus.EXTERNALVALIDATION); } + [Fact] + public async Task Enroll_New_ReturnsPendingStatus_WhenCaReportsIssuedButBodyMissing() + { + // CERTInext can report an "issued"/auto-approved certificateStatusId before the + // certificate bytes actually exist — the immediate GetCertificate download fails + // and the legacy client returns Status="issued" with Certificate=null. Reporting + // GENERATED with no PEM crashes the gateway framework's PEM parser downstream, so + // the plugin must demote this to pending rather than trust the raw status string. + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), + It.IsAny())) + .ReturnsAsync(MockCertificateData.AutoApprovedNoBodyEnrollResponse()); + + var plugin = BuildPluginWithPickup(mock.Object, retries: 0); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, + subject: "CN=test.example.com", + san: null, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Status.Should().Be((int)EndEntityStatus.EXTERNALVALIDATION); + result.Certificate.Should().BeNullOrEmpty(); + } + + // --------------------------------------------------------------------------- + // Synchronous certificate pickup (Sectigo parity) + // --------------------------------------------------------------------------- + + [Fact] + public async Task Pickup_Disabled_WhenPickupRetriesZero_ReturnsPendingWithoutPolling() + { + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.PendingEnrollResponse()); + + var plugin = BuildPluginWithPickup(mock.Object, retries: 0); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, subject: "CN=test.example.com", san: null, + productInfo: MakeProductInfo(), requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Status.Should().Be((int)EndEntityStatus.EXTERNALVALIDATION); + mock.Verify(c => c.GetCertificateAsync(It.IsAny(), It.IsAny()), + Times.Never, "PickupRetries=0 must disable the synchronous pickup poll"); + } + + [Fact] + public async Task Pickup_ReturnsIssuedCert_WhenOrderIssuesDuringPoll() + { + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.PendingEnrollResponse()); + // The order finishes issuing by the time we poll: GetCertificate reports issued + PEM. + mock.Setup(c => c.GetCertificateAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.IssuedCertRecord()); + + var plugin = BuildPluginWithPickup(mock.Object, retries: 2); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, subject: "CN=test.example.com", san: null, + productInfo: MakeProductInfo(), requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + result.Certificate.Should().NotBeNullOrEmpty("a synchronously-picked-up cert must carry its PEM"); + mock.Verify(c => c.GetCertificateAsync(It.IsAny(), It.IsAny()), + Times.AtLeastOnce); + } + + [Fact] + public async Task Pickup_SurfacesTerminalStatus_WhenOrderRevokedDuringPoll() + { + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.PendingEnrollResponse()); + mock.Setup(c => c.GetCertificateAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.RevokedCertRecord()); + + var plugin = BuildPluginWithPickup(mock.Object, retries: 3); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, subject: "CN=test.example.com", san: null, + productInfo: MakeProductInfo(), requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Status.Should().Be((int)EndEntityStatus.REVOKED, + "a terminal status observed during pickup is surfaced immediately, not polled to exhaustion"); + } + + [Fact] + public async Task Pickup_ReturnsPending_WhenOrderNeverIssuesWithinBudget() + { + var mock = NewMock(); + mock.Setup(c => c.EnrollCertificateAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.PendingEnrollResponse()); + // Every poll still reports pending — the budget is exhausted and Enroll returns the + // pending result for a later sync to complete. + mock.Setup(c => c.GetCertificateAsync(It.IsAny(), It.IsAny())) + .ReturnsAsync(MockCertificateData.PendingCertRecord()); + + var plugin = BuildPluginWithPickup(mock.Object, retries: 1); + + var result = await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, subject: "CN=test.example.com", san: null, + productInfo: MakeProductInfo(), requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + result.Status.Should().Be((int)EndEntityStatus.EXTERNALVALIDATION); + mock.Verify(c => c.GetCertificateAsync(It.IsAny(), It.IsAny()), + Times.AtLeastOnce, "an enabled pickup must actually poll before giving up"); + } + [Fact] public async Task Enroll_New_Throws_WhenProfileIdNotSet() { diff --git a/CERTInext.Tests/CERTInextCAPluginV2DcvTests.cs b/CERTInext.Tests/CERTInextCAPluginV2DcvTests.cs new file mode 100644 index 0000000..fac4dfa --- /dev/null +++ b/CERTInext.Tests/CERTInextCAPluginV2DcvTests.cs @@ -0,0 +1,213 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Collections.Generic; +using System.Threading; +using System.Threading.Tasks; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Keyfactor.PKI.Enums.EJBCA; +using Moq; +using Xunit; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Tests +{ + /// + /// Regression tests for issues/0020: EMS-1080 ("Domain is already verified") from either + /// V2 DCV entry point (GetDcvV2Async or VerifyDcvV2Async) must be treated as + /// DCV already satisfied — skip TXT publish, proceed straight to tracking — not as a + /// failure deferred to the next sync cycle. Driven end-to-end through + /// (V2 path) so the assertions exercise the same + /// code path Command actually calls, using to observe + /// whether a TXT record was ever staged. + /// + public class CERTInextCAPluginV2DcvTests + { + private static Mock NewMock() => + new Mock(MockBehavior.Strict); + + private static CERTInextCAPlugin BuildV2DcvPlugin( + ICERTInextClient client, IDomainValidatorFactory factory) => + new CERTInextCAPlugin(client, factory, new CERTInextConfig + { + UseV2Api = true, + ApiUrlV2 = "https://v2.certinext.io", + ClientId = "my-client", + ClientSecret = "my-secret", + ApiUrl = "https://v1.certinext.io", + AccountNumber = "12345", + AuthMode = "AccessKey", + ApiKey = "v1-key", + RequestorName = "Test User", + RequestorEmail = "test@example.com", + SignerIp = "1.2.3.4", + SignerPlace = "New York", + PickupRetries = 0, + DcvEnabled = true, + DcvTimeoutMinutes = 1, + DcvPropagationDelaySeconds = 1 + }); + + private static EnrollmentProductInfo MakeV2ProductInfo() => + new EnrollmentProductInfo + { + ProductID = "DV SSL", + ProductParameters = new Dictionary(System.StringComparer.OrdinalIgnoreCase) + { + ["ProductCode"] = "842", + ["ProductFamily"] = "ssl", + ["ProductVariant"] = "dv", + ["DomainName"] = "example.com" + } + }; + + private static Task Enroll(CERTInextCAPlugin plugin) => + plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, + subject: "CN=example.com", + san: new Dictionary { ["dns"] = new[] { "example.com" } }, + productInfo: MakeV2ProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + private const string OrderId = "ord_ems1080_001"; + + private static V2CreateOrderResponse PlaceOrderResponse() => + new V2CreateOrderResponse { OrderId = OrderId, Status = "pending-dcv" }; + + private static V2OrderStatusResponse PendingDcvStatus() => + new V2OrderStatusResponse { OrderId = OrderId, Status = "pending-dcv", Domain = "example.com" }; + + private static V2OrderStatusResponse IssuedStatus() => + new V2OrderStatusResponse { OrderId = OrderId, Status = "issued", Domain = "example.com" }; + + private static V2CertificateDownloadResponse DownloadResponse() => + new V2CertificateDownloadResponse + { + OrderId = OrderId, + SerialNumber = "AA11BB22", + CertificatePem = MockCertificateData.FakePemCertificate + }; + + // --------------------------------------------------------------------------- + // Regression (issues/0020): GetDcv returns EMS-1080 + // --------------------------------------------------------------------------- + + [Fact] + public async Task PerformDcvV2_GetDcvReturnsEms1080_TreatedAsSatisfied_NoStagingAndProceedsToTracking() + { + var mock = NewMock(); + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(PlaceOrderResponse()); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), OrderId, It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + + // 1st call: post-CSR check (pending-dcv). 2nd+: the PerformDcvV2IfNeededAsync poll + // loop and EnrollV2Async's post-DCV re-check both see "issued" immediately. + mock.SetupSequence(c => c.TrackOrderV2Async(It.IsAny(), OrderId, It.IsAny())) + .ReturnsAsync(PendingDcvStatus()) + .ReturnsAsync(IssuedStatus()) + .ReturnsAsync(IssuedStatus()); + + mock.Setup(c => c.GetDcvV2Async(OrderId, It.IsAny(), It.IsAny())) + .ThrowsAsync(new System.Exception( + $"CERTInext V2 API error during 'V2 get DCV challenge'. HTTP 422. " + + "Unprocessable Entity: EMS-1080 Domain is already verified.")); + + mock.Setup(c => c.DownloadCertificateV2Async(It.IsAny(), OrderId, It.IsAny())) + .ReturnsAsync(DownloadResponse()); + + var validator = new FakeDomainValidator(); + var plugin = BuildV2DcvPlugin(mock.Object, new FakeDomainValidatorFactory(validator)); + + var result = await Enroll(plugin); + + result.Status.Should().Be((int)EndEntityStatus.GENERATED, + "EMS-1080 must be treated as DCV satisfied, not a failure — the order should " + + "proceed to tracking and come back issued"); + validator.StagedRecords.Should().BeEmpty( + "GetDcv returning EMS-1080 means there is no fresh challenge to publish"); + + // VerifyDcv must never be reached — there is nothing to verify when GetDcv itself + // reports the domain is already verified. + mock.Verify(c => c.VerifyDcvV2Async( + It.IsAny(), It.IsAny(), It.IsAny(), It.IsAny()), + Times.Never); + } + + // --------------------------------------------------------------------------- + // Regression (issues/0020): VerifyDcv returns EMS-1080 + // --------------------------------------------------------------------------- + + [Fact] + public async Task PerformDcvV2_VerifyDcvReturnsEms1080_TreatedAsSatisfied_ProceedsToTracking() + { + var mock = NewMock(); + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(PlaceOrderResponse()); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), OrderId, It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + + mock.SetupSequence(c => c.TrackOrderV2Async(It.IsAny(), OrderId, It.IsAny())) + .ReturnsAsync(PendingDcvStatus()) + .ReturnsAsync(IssuedStatus()) + .ReturnsAsync(IssuedStatus()); + + // GetDcv succeeds normally and returns a token to publish... + mock.Setup(c => c.GetDcvV2Async(OrderId, It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2DcvChallengeResponse + { + OrderNumber = OrderId, + DomainName = "example.com", + DcvMethod = "2", + FileNameContent = "dcv-token-abc123" + }); + + // ...but by the time VerifyDcv is called, the domain became already-verified. + mock.Setup(c => c.VerifyDcvV2Async(OrderId, "example.com", It.IsAny(), It.IsAny())) + .ThrowsAsync(new System.Exception( + $"CERTInext V2 API error during 'V2 verify DCV'. HTTP 422. " + + "Unprocessable Entity: EMS-1080 Domain is already verified.")); + + mock.Setup(c => c.DownloadCertificateV2Async(It.IsAny(), OrderId, It.IsAny())) + .ReturnsAsync(DownloadResponse()); + + var validator = new FakeDomainValidator(); + var plugin = BuildV2DcvPlugin(mock.Object, new FakeDomainValidatorFactory(validator)); + + var result = await Enroll(plugin); + + result.Status.Should().Be((int)EndEntityStatus.GENERATED, + "EMS-1080 from VerifyDcv must be treated as verified, not a failure — the order " + + "should proceed to tracking and come back issued"); + + // The TXT record was staged (GetDcv succeeded) — this exercises the "verified between + // GetDcv and VerifyDcv" race rather than the GetDcv-level no-op. + validator.StagedRecords.Should().ContainSingle(); + validator.CleanedUpKeys.Should().ContainSingle( + "staged records are always cleaned up, including on the EMS-1080 verify path"); + } + } +} diff --git a/CERTInext.Tests/CERTInextCAPluginV2Tests.cs b/CERTInext.Tests/CERTInextCAPluginV2Tests.cs new file mode 100644 index 0000000..f217b1a --- /dev/null +++ b/CERTInext.Tests/CERTInextCAPluginV2Tests.cs @@ -0,0 +1,656 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Concurrent; +using System.Collections.Generic; +using System.Threading; +using System.Threading.Tasks; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Keyfactor.Extensions.CAPlugin.CERTInext; +using Keyfactor.PKI.Enums.EJBCA; +using Moq; +using WireMock.RequestBuilders; +using WireMock.ResponseBuilders; +using WireMock.Server; +using Xunit; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Tests +{ + /// + /// Moq-based unit tests that verify V2 dispatch in . + /// All V2 client methods are mocked — no network calls are made. + /// + public class CERTInextCAPluginV2Tests + { + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + private static Mock NewMock() => + new Mock(MockBehavior.Strict); + + private static CERTInextCAPlugin BuildV2Plugin(ICERTInextClient client) => + new CERTInextCAPlugin(client, new CERTInextConfig + { + UseV2Api = true, + ApiUrlV2 = "https://v2.certinext.io", + ClientId = "my-client", + ClientSecret = "my-secret", + ApiUrl = "https://v1.certinext.io", + AccountNumber = "12345", + AuthMode = "AccessKey", + ApiKey = "v1-key", + RequestorName = "Test User", + RequestorEmail = "test@example.com", + SignerIp = "1.2.3.4", + SignerPlace = "New York", + PickupRetries = 0 + }); + + private static EnrollmentProductInfo MakeV2ProductInfo( + string productCode = "842", + string productFamily = "ssl", + string productVariant = "dv", + string domainName = "example.com") + { + return new EnrollmentProductInfo + { + ProductID = "DV SSL", + ProductParameters = new Dictionary(System.StringComparer.OrdinalIgnoreCase) + { + ["ProductCode"] = productCode, + ["ProductFamily"] = productFamily, + ["ProductVariant"] = productVariant, + ["DomainName"] = domainName + } + }; + } + + // --------------------------------------------------------------------------- + // Ping routes to V2 + // --------------------------------------------------------------------------- + + [Fact] + public async Task Ping_V2Enabled_CallsPingV2Async() + { + var mock = NewMock(); + mock.Setup(c => c.PingV2Async(It.IsAny())) + .Returns(Task.CompletedTask); + + var plugin = BuildV2Plugin(mock.Object); + await plugin.Ping(); + + mock.Verify(c => c.PingV2Async(It.IsAny()), Times.Once); + } + + [Fact] + public async Task Ping_V2Enabled_DoesNotCallV1Ping() + { + var mock = new Mock(); // Loose — verifying absence + mock.Setup(c => c.PingV2Async(It.IsAny())) + .Returns(Task.CompletedTask); + + var plugin = BuildV2Plugin(mock.Object); + await plugin.Ping(); + + mock.Verify(c => c.PingAsync(It.IsAny()), Times.Never); + } + + // --------------------------------------------------------------------------- + // Enroll routes to V2 + // --------------------------------------------------------------------------- + + [Fact] + public async Task Enroll_V2Enabled_PlacesV2Order_PendingResult() + { + var mock = NewMock(); + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2CreateOrderResponse + { + OrderId = MockCertificateData.V2OrderId1, + RequestId = "req_001", + Status = "pending-dcv" + }); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), MockCertificateData.V2OrderId1, + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.TrackOrderV2Async( + It.IsAny(), MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync(new V2OrderStatusResponse { OrderId = MockCertificateData.V2OrderId1, Status = "pending-dcv" }); + + var plugin = BuildV2Plugin(mock.Object); + var result = await plugin.Enroll( + MockCertificateData.FakeCsrPem, + "CN=example.com, O=Acme", + new Dictionary(), + MakeV2ProductInfo(), + RequestFormat.PKCS10, + EnrollmentType.New); + + result.CARequestID.Should().Be(MockCertificateData.V2OrderId1); + result.Status.Should().Be((int)EndEntityStatus.EXTERNALVALIDATION); + } + + [Fact] + public async Task Enroll_V2Enabled_IssuedImmediately_DownloadsCert() + { + var mock = NewMock(); + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2CreateOrderResponse + { + OrderId = MockCertificateData.V2OrderId1, + Status = "issued" + }); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), MockCertificateData.V2OrderId1, + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.TrackOrderV2Async( + It.IsAny(), MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync(new V2OrderStatusResponse { OrderId = MockCertificateData.V2OrderId1, Status = "issued" }); + + mock.Setup(c => c.DownloadCertificateV2Async( + It.IsAny(), MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync(new V2CertificateDownloadResponse + { + OrderId = MockCertificateData.V2OrderId1, + SerialNumber = "AABBCC", + CertificatePem = MockCertificateData.FakePemCertificate + }); + + var plugin = BuildV2Plugin(mock.Object); + var result = await plugin.Enroll( + MockCertificateData.FakeCsrPem, + "CN=example.com, O=Acme", + new Dictionary(), + MakeV2ProductInfo(), + RequestFormat.PKCS10, + EnrollmentType.New); + + result.CARequestID.Should().Be(MockCertificateData.V2OrderId1); + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + result.Certificate.Should().StartWith("-----BEGIN CERTIFICATE-----"); + } + + [Fact] + public async Task Enroll_V2Enabled_RenewOrReissue_AlsoUsesV2() + { + var mock = NewMock(); + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2CreateOrderResponse + { + OrderId = MockCertificateData.V2OrderId2, + Status = "pending-csr" + }); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), MockCertificateData.V2OrderId2, + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.TrackOrderV2Async( + It.IsAny(), MockCertificateData.V2OrderId2, It.IsAny())) + .ReturnsAsync(new V2OrderStatusResponse { OrderId = MockCertificateData.V2OrderId2, Status = "pending-validation" }); + + var plugin = BuildV2Plugin(mock.Object); + var result = await plugin.Enroll( + MockCertificateData.FakeCsrPem, + "CN=example.com, O=Acme", + new Dictionary(), + MakeV2ProductInfo(), + RequestFormat.PKCS10, + EnrollmentType.RenewOrReissue); + + result.CARequestID.Should().Be(MockCertificateData.V2OrderId2); + mock.Verify(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny()), Times.Once); + } + + // --------------------------------------------------------------------------- + // GetSingleRecord routes to V2 + // --------------------------------------------------------------------------- + + [Fact] + public async Task GetSingleRecord_V2Enabled_UsesResolveAndTrack() + { + var mock = NewMock(); + mock.Setup(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync((Constants.ApiV2.FamilySsl, new V2OrderStatusResponse + { + OrderId = MockCertificateData.V2OrderId1, + Status = "issued", + ProductVariant = "dv" + })); + + mock.Setup(c => c.ResolveAndDownloadCertificateV2Async( + MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync(new V2CertificateDownloadResponse + { + OrderId = MockCertificateData.V2OrderId1, + SerialNumber = "AABB", + CertificatePem = MockCertificateData.FakePemCertificate + }); + + var plugin = BuildV2Plugin(mock.Object); + var record = await plugin.GetSingleRecord(MockCertificateData.V2OrderId1); + + record.CARequestID.Should().Be(MockCertificateData.V2OrderId1); + record.Status.Should().Be((int)EndEntityStatus.GENERATED); + record.Certificate.Should().StartWith("-----BEGIN CERTIFICATE-----"); + + mock.Verify(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + MockCertificateData.V2OrderId1, It.IsAny()), Times.Once); + } + + [Fact] + public async Task GetSingleRecord_V2Enabled_DoesNotCallV1GetCertificate() + { + var mock = new Mock(); // Loose + mock.Setup(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync((Constants.ApiV2.FamilySsl, new V2OrderStatusResponse { OrderId = "ord_x", Status = "pending-dcv" })); + + var plugin = BuildV2Plugin(mock.Object); + await plugin.GetSingleRecord("ord_x"); + + mock.Verify(c => c.GetCertificateAsync(It.IsAny(), It.IsAny()), Times.Never); + } + + // --------------------------------------------------------------------------- + // Revoke routes to V2 + // --------------------------------------------------------------------------- + + [Fact] + public async Task Revoke_V2Enabled_ResolvesAndRevokes() + { + var mock = new Mock(); // Loose + mock.Setup(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync((Constants.ApiV2.FamilySsl, new V2OrderStatusResponse + { + OrderId = MockCertificateData.V2OrderId1, + Status = "issued" + })); + + mock.Setup(c => c.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1, + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + + var plugin = BuildV2Plugin(mock.Object); + var status = await plugin.Revoke(MockCertificateData.V2OrderId1, "AABB", 4u); + + status.Should().Be((int)EndEntityStatus.REVOKED); + } + + [Fact] + public async Task Revoke_V2Enabled_DoesNotCallV1RevokeCertificate() + { + var mock = new Mock(); + mock.Setup(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + It.IsAny(), It.IsAny())) + .ReturnsAsync((Constants.ApiV2.FamilySsl, new V2OrderStatusResponse { Status = "issued", OrderId = "ord_x" })); + + mock.Setup(c => c.RevokeOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + + var plugin = BuildV2Plugin(mock.Object); + await plugin.Revoke("ord_x", "AA", 1u); + + mock.Verify(c => c.RevokeCertificateAsync( + It.IsAny(), It.IsAny(), It.IsAny()), Times.Never); + } + + // --------------------------------------------------------------------------- + // Regression (issues/0019): revoke 404 after the family is already resolved + // must not be reported as a family miss. + // --------------------------------------------------------------------------- + + [Fact] + public async Task Revoke_V2Enabled_RevokeReturns404AfterFamilyResolved_ReportsNotRevokable_NotFamilyMiss() + { + var mock = new Mock(); // Loose + mock.Setup(c => c.ResolveAndTrackOrderV2WithFamilyAsync( + MockCertificateData.V2OrderId1, It.IsAny())) + .ReturnsAsync((Constants.ApiV2.FamilySsl, new V2OrderStatusResponse + { + OrderId = MockCertificateData.V2OrderId1, + Status = "issued" + })); + + // Order is confirmed to live in the SSL family (TrackOrder above succeeded), + // but the revoke call itself 404s — per spec that means "not revokable", + // not "wrong family". The plugin must not retry other families for it. + mock.Setup(c => c.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1, + It.IsAny(), It.IsAny())) + .ThrowsAsync(new KeyNotFoundException( + $"V2 order '{MockCertificateData.V2OrderId1}' in family '{Constants.ApiV2.FamilySsl}' " + + "not found or not in a revokable state.")); + + var plugin = BuildV2Plugin(mock.Object); + var ex = await Assert.ThrowsAsync( + () => plugin.Revoke(MockCertificateData.V2OrderId1, "AABB", 4u)); + + ex.Message.Should().Contain("not found or not in a revokable state"); + ex.Message.Should().NotContain("any product family", + "a 404 after the family was already resolved must not be mislabeled as a family miss"); + + // Must not have probed the other two families. + mock.Verify(c => c.RevokeOrderV2Async( + Constants.ApiV2.FamilyPrivatePki, It.IsAny(), + It.IsAny(), It.IsAny()), Times.Never); + mock.Verify(c => c.RevokeOrderV2Async( + Constants.ApiV2.FamilySignature, It.IsAny(), + It.IsAny(), It.IsAny()), Times.Never); + } + + // --------------------------------------------------------------------------- + // Synchronize still uses V1 + // --------------------------------------------------------------------------- + + [Fact] + public async Task Synchronize_V2Enabled_StillCallsV1ListCertificatesAsync() + { + var mock = new Mock(); + + // V1 sync path uses ListCertificatesAsync (the legacy wrapper) + mock.Setup(c => c.ListCertificatesAsync( + It.IsAny(), + It.IsAny(), + It.IsAny())) + .Returns(AsyncEnumerable()); + + var plugin = BuildV2Plugin(mock.Object); + var buffer = new BlockingCollection(100); + buffer.CompleteAdding(); + + // Run sync — should not throw + await plugin.Synchronize(buffer, null, true, CancellationToken.None); + + mock.Verify(c => c.ListCertificatesAsync( + It.IsAny(), + It.IsAny(), + It.IsAny()), Times.AtLeastOnce); + } + + // --------------------------------------------------------------------------- + // Chain PEM assembly — Enroll V2 with chainPem + // --------------------------------------------------------------------------- + + [Fact] + public async Task Enroll_V2_WithChainPem_ConcatenatesLeafAndIntermediate() + { + var mock = NewMock(); + + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2CreateOrderResponse + { + OrderId = "ord_chain_test", + Status = "issued" + }); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), "ord_chain_test", + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.TrackOrderV2Async( + It.IsAny(), "ord_chain_test", It.IsAny())) + .ReturnsAsync(new V2OrderStatusResponse { OrderId = "ord_chain_test", Status = "issued" }); + + // Download response includes a chain PEM entry + mock.Setup(c => c.DownloadCertificateV2Async( + It.IsAny(), "ord_chain_test", It.IsAny())) + .ReturnsAsync(new V2CertificateDownloadResponse + { + OrderId = "ord_chain_test", + SerialNumber = "AABBCC", + CertificatePem = MockCertificateData.FakePemCertificate, + ChainPem = new System.Collections.Generic.List + { + MockCertificateData.FakeIntermediatePemCertificate + } + }); + + mock.Setup(c => c.Dispose()); + + mock.Setup(c => c.Dispose()); + + var plugin = BuildV2Plugin(mock.Object); + var result = await plugin.Enroll( + MockCertificateData.FakeCsrPem, + "CN=example.com", + new Dictionary(), + MakeV2ProductInfo(productVariant: "dv"), + RequestFormat.PKCS10, + EnrollmentType.New); + + result.CARequestID.Should().Be("ord_chain_test"); + result.Status.Should().Be((int)EndEntityStatus.GENERATED); + // Full chain must contain both leaf and intermediate + result.Certificate.Should().Contain("-----BEGIN CERTIFICATE-----"); + result.Certificate.Should().Contain("INTERMEDIATE", + because: "chain PEM from the CA should be appended to the leaf"); + } + + [Fact] + public async Task Enroll_V2_WithoutChainPem_ReturnsCertificatePemOnly() + { + var mock = NewMock(); + + mock.Setup(c => c.PlaceOrderV2Async( + It.IsAny(), It.IsAny(), + It.IsAny(), It.IsAny())) + .ReturnsAsync(new V2CreateOrderResponse { OrderId = "ord_nochain", Status = "issued" }); + + mock.Setup(c => c.SubmitCsrV2Async( + It.IsAny(), "ord_nochain", + It.IsAny(), It.IsAny())) + .Returns(Task.CompletedTask); + mock.Setup(c => c.TrackOrderV2Async( + It.IsAny(), "ord_nochain", It.IsAny())) + .ReturnsAsync(new V2OrderStatusResponse { OrderId = "ord_nochain", Status = "issued" }); + + mock.Setup(c => c.DownloadCertificateV2Async( + It.IsAny(), "ord_nochain", It.IsAny())) + .ReturnsAsync(new V2CertificateDownloadResponse + { + OrderId = "ord_nochain", + CertificatePem = MockCertificateData.FakePemCertificate, + ChainPem = null + }); + + mock.Setup(c => c.Dispose()); + + var plugin = BuildV2Plugin(mock.Object); + var result = await plugin.Enroll( + MockCertificateData.FakeCsrPem, + "CN=example.com", + new Dictionary(), + MakeV2ProductInfo(productVariant: "dv"), + RequestFormat.PKCS10, + EnrollmentType.New); + + result.Certificate.Should().Be(MockCertificateData.FakePemCertificate, + because: "no chainPem means only the leaf cert is returned"); + } + + // --------------------------------------------------------------------------- + // G1: ValidateCAConnectionInfo — V2 branch (ApiUrlV2/ClientId/ClientSecret) + // + // These test the CURRENT requirements: the V1 fields (ApiUrl/AccountNumber/AuthMode/...) + // are always required, independent of UseV2Api. Phase 4 may relax that in V2 mode — each + // case below builds its own minimal `info` dictionary so that change is a local edit per + // test rather than a shared fixture that would need to be untangled. + // --------------------------------------------------------------------------- + + private static Dictionary ValidV1Fields() => new() + { + ["ApiUrl"] = "https://v1.certinext.io", + ["AccountNumber"] = "12345", + ["AuthMode"] = "AccessKey", + ["ApiKey"] = "v1-key" + }; + + [Fact] + public async Task ValidateCAConnectionInfo_Throws_WhenApiUrlV2Missing() + { + var plugin = BuildV2Plugin(NewMock().Object); + var info = ValidV1Fields(); + info["UseV2Api"] = true; + info["ClientId"] = "my-client"; + info["ClientSecret"] = "my-secret"; + // No ApiUrlV2 + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + await act.Should().ThrowAsync() + .WithMessage("*ApiUrlV2*required*"); + } + + [Fact] + public async Task ValidateCAConnectionInfo_Throws_WhenApiUrlV2IsNotUri() + { + var plugin = BuildV2Plugin(NewMock().Object); + var info = ValidV1Fields(); + info["UseV2Api"] = true; + info["ApiUrlV2"] = "not-a-url"; + info["ClientId"] = "my-client"; + info["ClientSecret"] = "my-secret"; + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + await act.Should().ThrowAsync() + .WithMessage("*ApiUrlV2*valid absolute URI*"); + } + + [Fact] + public async Task ValidateCAConnectionInfo_Throws_WhenClientIdMissing() + { + var plugin = BuildV2Plugin(NewMock().Object); + var info = ValidV1Fields(); + info["UseV2Api"] = true; + info["ApiUrlV2"] = "https://v2.certinext.io"; + // No ClientId + info["ClientSecret"] = "my-secret"; + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + await act.Should().ThrowAsync() + .WithMessage("*ClientId*required*"); + } + + [Fact] + public async Task ValidateCAConnectionInfo_Throws_WhenClientSecretMissing() + { + var plugin = BuildV2Plugin(NewMock().Object); + var info = ValidV1Fields(); + info["UseV2Api"] = true; + info["ApiUrlV2"] = "https://v2.certinext.io"; + info["ClientId"] = "my-client"; + // No ClientSecret + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + await act.Should().ThrowAsync() + .WithMessage("*ClientSecret*required*"); + } + + [Fact] + public async Task ValidateCAConnectionInfo_UseV2ApiFalse_IgnoresV2Fields() + { + // V1 field deliberately missing (ApiUrl) so the method throws before attempting any + // live connectivity — proving this offline. The point of the test is that the + // resulting error is about the V1 field only; the missing/invalid V2 fields below + // must not appear in the error at all when UseV2Api is false. + var plugin = BuildV2Plugin(NewMock().Object); + var info = new Dictionary + { + ["AccountNumber"] = "12345", + ["AuthMode"] = "AccessKey", + ["ApiKey"] = "v1-key", + // No ApiUrl + ["UseV2Api"] = false, + ["ApiUrlV2"] = "not-a-url", + // ClientId / ClientSecret also missing + }; + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + var ex = await act.Should().ThrowAsync(); + ex.Which.Message.Should().Contain("ApiUrl").And.NotContain("ApiUrlV2") + .And.NotContain("ClientId").And.NotContain("ClientSecret"); + } + + [Fact] + public async Task ValidateCAConnectionInfo_AllV2FieldsPresent_Passes() + { + using var server = WireMockServer.Start(); + server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2TokenResponseJson())); + server + .Given(Request.Create().WithPath("/api/certinext/v2/auth/me").UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson())); + + var plugin = BuildV2Plugin(NewMock().Object); + var info = ValidV1Fields(); + info["UseV2Api"] = true; + info["ApiUrlV2"] = server.Urls[0]; + info["ClientId"] = "my-client"; + info["ClientSecret"] = "my-secret"; + + Func act = () => plugin.ValidateCAConnectionInfo(info); + + await act.Should().NotThrowAsync( + "all V1 and V2 fields are present and valid, and the live V2 ping succeeds"); + } + + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + private static async IAsyncEnumerable AsyncEnumerable(params T[] items) + { + foreach (var item in items) + yield return item; + await Task.CompletedTask; + } + } +} diff --git a/CERTInext.Tests/CERTInextClientRequestShapeTests.cs b/CERTInext.Tests/CERTInextClientRequestShapeTests.cs index 4e59495..fd61dfb 100644 --- a/CERTInext.Tests/CERTInextClientRequestShapeTests.cs +++ b/CERTInext.Tests/CERTInextClientRequestShapeTests.cs @@ -288,5 +288,59 @@ public async Task ValidityDays_OnRequest_OverridesConnectorDefault() CapturedOrderBody().GetProperty("subscriptionDetails") .GetProperty("validity").GetString().Should().Be("2"); } + + // ----------------------------------------------------------------------- + // RenewCertificateAsync — productCode resolution (issue #26 / local issues/0012) + // Renewals go out as a fresh GenerateOrderSSL order; the product code must + // come from the template (RenewCertificateRequest.ProfileId) when supplied, + // falling back to the connector's DefaultProductCode only when it is not. + // ----------------------------------------------------------------------- + + [Fact] + public async Task RenewCertificateAsync_ProfileIdSet_UsesTemplateProductCode() + { + StubHappyEnroll(); + var cfg = MinimalConfig(); + cfg.DefaultProductCode = "connector-default-code"; + + var renewReq = new RenewCertificateRequest + { + Csr = MockCertificateData.FakeCsrPem, + ProfileId = "template-product-code", + ValidityDays = 365, + Comment = "Renewal test" + }; + + await BuildClient(cfg).RenewCertificateAsync(MockCertificateData.OrderNumber1, renewReq); + + CapturedOrderBody().GetProperty("productCode").GetString() + .Should().Be("template-product-code", + "the template's own product code must win over the connector default"); + } + + [Theory] + [InlineData(null)] + [InlineData("")] + [InlineData(" ")] + public async Task RenewCertificateAsync_ProfileIdBlank_FallsBackToConnectorDefault(string blankProfileId) + { + StubHappyEnroll(); + var cfg = MinimalConfig(); + cfg.DefaultProductCode = "connector-default-code"; + + var renewReq = new RenewCertificateRequest + { + Csr = MockCertificateData.FakeCsrPem, + ProfileId = blankProfileId, + ValidityDays = 365, + Comment = "Renewal test" + }; + + await BuildClient(cfg).RenewCertificateAsync(MockCertificateData.OrderNumber1, renewReq); + + CapturedOrderBody().GetProperty("productCode").GetString() + .Should().Be("connector-default-code", + "a blank ProfileId must fall back to the connector's DefaultProductCode, not an empty string"); + } } } diff --git a/CERTInext.Tests/CERTInextClientTests.cs b/CERTInext.Tests/CERTInextClientTests.cs index e473e89..a0ade72 100644 --- a/CERTInext.Tests/CERTInextClientTests.cs +++ b/CERTInext.Tests/CERTInextClientTests.cs @@ -790,6 +790,42 @@ await act.Should().ThrowAsync() .WithMessage("*GetDcv failed*"); } + /// + /// Regression: this client is built with ThrowOnAnyError=false, so RestSharp catches a + /// cancelled HttpClient.SendAsync internally and returns a non-throwing, unsuccessful + /// RestResponse instead of propagating OperationCanceledException. Before this fix, + /// ExecuteWithRetryAsync passed that response straight to DeserializeOrThrow, which wrapped + /// it in a plain Exception — indistinguishable from a genuine API failure. A caller such as + /// PerformDcvIfNeededAsync's per-domain "catch (OperationCanceledException) { throw; }" guard + /// (added specifically to stop a DCV timeout from being mislabeled as an ordinary per-domain + /// failure) could never actually see the real cancellation, because it never arrived as + /// OperationCanceledException in the first place — a gap a Moq-level test of the plugin alone + /// cannot expose, since a mock can be told to throw whatever type is asked for. This test + /// exercises the real client against a real (if local) HTTP call, which is the only way to + /// pin the actual failure mode. + /// + [Fact] + public async Task GetDcvAsync_ThrowsOperationCanceled_WhenCancellationTokenIsCancelled() + { + _server + .Given(Request.Create().WithPath("/GetDcv").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.GetDcvSuccessJson())); + + var client = BuildClient(); + using var cts = new CancellationTokenSource(); + cts.Cancel(); + + Func act = () => client.GetDcvAsync( + MockCertificateData.OrderNumber1, "example.com", Constants.Dcv.MethodDnsTxt, cts.Token); + + await act.Should().ThrowAsync( + "a cancelled token must surface as a genuine cancellation, not get wrapped into a " + + "plain Exception that a caller's cancellation-specific catch clause cannot recognize"); + } + [Fact] public async Task GetDcvAsync_Throws_WhenServerReturns401() { diff --git a/CERTInext.Tests/CERTInextClientV2Tests.cs b/CERTInext.Tests/CERTInextClientV2Tests.cs new file mode 100644 index 0000000..35ac3c5 --- /dev/null +++ b/CERTInext.Tests/CERTInextClientV2Tests.cs @@ -0,0 +1,846 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Generic; +using System.Linq; +using System.Reflection; +using System.Threading.Tasks; +using FluentAssertions; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using WireMock.RequestBuilders; +using WireMock.ResponseBuilders; +using WireMock.Server; +using Xunit; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Tests +{ + /// + /// WireMock-based tests for V2 REST API methods on . + /// A real WireMockServer handles the V2 token endpoint and all V2 REST paths so + /// serialisation, routing, and token caching are fully exercised. + /// + public class CERTInextClientV2Tests : IDisposable + { + private readonly WireMockServer _server; + private readonly string _baseUrl; + + public CERTInextClientV2Tests() + { + _server = WireMockServer.Start(); + _baseUrl = _server.Urls[0]; + } + + public void Dispose() => _server.Stop(); + + // --------------------------------------------------------------------------- + // Helpers + // --------------------------------------------------------------------------- + + private CERTInextClient BuildV2Client() => + new CERTInextClient(new CERTInextConfig + { + // V1 fields still required (Synchronize uses V1) + ApiUrl = _baseUrl, + AuthMode = "AccessKey", + ApiKey = "test-v1-key", + AccountNumber = "12345", + // V2 fields + UseV2Api = true, + ApiUrlV2 = _baseUrl, + ClientId = "my-v2-client", + ClientSecret = "my-v2-secret", + RequestorName = "Test User", + RequestorEmail = "test@example.com", + PageSize = 100 + }); + + private void StubV2Token(int expiresIn = 3600) + { + _server + .Given(Request.Create() + .WithPath("/oauth/token") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2TokenResponseJson(expiresIn))); + } + + // --------------------------------------------------------------------------- + // Token fetch + // --------------------------------------------------------------------------- + + [Fact] + public async Task PingV2Async_FetchesTokenAndCallsAuthMe() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/auth/me") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson())); + + using var client = BuildV2Client(); + await client.PingV2Async(); + + // Verify both token and auth/me endpoints were called + _server.LogEntries.Should().Contain(e => e.RequestMessage.Path == "/oauth/token"); + _server.LogEntries.Should().Contain(e => e.RequestMessage.Path == "/api/certinext/v2/auth/me"); + } + + [Fact] + public async Task GetAuthMeV2Async_ReturnsAccountNumber() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/auth/me") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson("99887766"))); + + using var client = BuildV2Client(); + var result = await client.GetAuthMeV2Async(); + + result.AccountNumber.Should().Be("99887766"); + result.AuthType.Should().Be("oauth2"); + } + + [Fact] + public async Task PingV2Async_TokenCached_OnlyOneFetch() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/auth/me") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson())); + + using var client = BuildV2Client(); + await client.PingV2Async(); + await client.PingV2Async(); // second call — should reuse cached token + + var tokenCalls = 0; + foreach (var entry in _server.LogEntries) + if (entry.RequestMessage.Path == "/oauth/token") tokenCalls++; + + tokenCalls.Should().Be(1, "token should be cached after the first fetch"); + } + + // --------------------------------------------------------------------------- + // PlaceOrderV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task PlaceOrderV2Async_ReturnsPendingOrder() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/ssl-certificates") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(201) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2CreateOrderPendingJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.PlaceOrderV2Async( + Constants.ApiV2.FamilySsl, + "842", + new V2CreateSslOrderRequest + { + ProductVariant = "dv", + Requestor = new V2Requestor { Name = "Test", Email = "t@t.com", Phone = "555", Designation = "IT" }, + Certificate = new V2CertificateParams { Domain = "example.com" }, + Subscription = new V2SubscriptionParams { ValidityYears = 1 }, + Agreement = new V2AgreementParams { SignerName = "Test", SignerIp = "1.2.3.4", SignerPlace = "NY", Accepted = true } + }); + + result.OrderId.Should().Be(MockCertificateData.V2OrderId1); + result.Status.Should().Be("pending-dcv"); + } + + [Fact] + public async Task PlaceOrderV2Async_SetsProductCodeHeader() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/ssl-certificates") + .UsingPost() + .WithHeader("X-Product-Code", "842")) + .RespondWith(Response.Create() + .WithStatusCode(201) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2CreateOrderPendingJson())); + + using var client = BuildV2Client(); + var result = await client.PlaceOrderV2Async( + Constants.ApiV2.FamilySsl, "842", + new V2CreateSslOrderRequest + { + Requestor = new V2Requestor { Name = "T", Email = "t@t.com", Phone = "1", Designation = "IT" }, + Certificate = new V2CertificateParams { Domain = "example.com" }, + Subscription = new V2SubscriptionParams(), + Agreement = new V2AgreementParams { SignerName = "T", SignerIp = "1.1.1.1", SignerPlace = "NY", Accepted = true } + }); + + result.Should().NotBeNull(); + } + + // --------------------------------------------------------------------------- + // TrackOrderV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task TrackOrderV2Async_Issued_ReturnsIssuedStatus() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2TrackOrderIssuedJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.TrackOrderV2Async(Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1); + + result.Status.Should().Be("issued"); + result.OrderId.Should().Be(MockCertificateData.V2OrderId1); + } + + [Fact] + public async Task TrackOrderV2Async_NotFound_ThrowsKeyNotFoundException() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/nonexistent") + .UsingGet()) + .RespondWith(Response.Create().WithStatusCode(404)); + + using var client = BuildV2Client(); + await Assert.ThrowsAsync( + () => client.TrackOrderV2Async(Constants.ApiV2.FamilySsl, "nonexistent")); + } + + // --------------------------------------------------------------------------- + // DownloadCertificateV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task DownloadCertificateV2Async_ReturnsPem() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/certificate") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2CertificateDownloadJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.DownloadCertificateV2Async(Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1); + + result.CertificatePem.Should().StartWith("-----BEGIN CERTIFICATE-----"); + result.SerialNumber.Should().Be("0A1B2C3D4E5F"); + result.OrderId.Should().Be(MockCertificateData.V2OrderId1); + } + + // --------------------------------------------------------------------------- + // RevokeOrderV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task RevokeOrderV2Async_SuccessfulRevoke() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/revoke") + .UsingPost()) + .RespondWith(Response.Create().WithStatusCode(204)); + + using var client = BuildV2Client(); + // Should not throw + await client.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, + MockCertificateData.V2OrderId1, + new V2RevokeRequest { Reason = "superseded", Note = "Replaced." }); + } + + [Fact] + public async Task RevokeOrderV2Async_422_ThrowsInvalidOperationException() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/revoke") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(422) + .WithHeader("Content-Type", "application/problem+json") + .WithBody(MockCertificateData.V2ProblemDetailsJson(422, "Unprocessable Entity", "Order not in issued state", "EMS-931"))); + + using var client = BuildV2Client(); + await Assert.ThrowsAsync( + () => client.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, + MockCertificateData.V2OrderId1, + new V2RevokeRequest { Reason = "superseded" })); + } + + // --------------------------------------------------------------------------- + // Regression (issues/0019): 422 message reflects the CA's actual detail + // rather than presuming "order not in issued state" for every 422. + // --------------------------------------------------------------------------- + + [Fact] + public async Task RevokeOrderV2Async_422_LabelsByActualDetail_NotHardcodedIssuedStateMessage() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/revoke") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(422) + .WithHeader("Content-Type", "application/problem+json") + // Observed live sandbox behavior for a revoke attempted while the + // order is still internally finalizing — no EMS code in this detail. + .WithBody(MockCertificateData.V2ProblemDetailsJson( + 422, "Unprocessable Entity", "Certificate Request still being processed"))); + + using var client = BuildV2Client(); + var ex = await Assert.ThrowsAsync( + () => client.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, + MockCertificateData.V2OrderId1, + new V2RevokeRequest { Reason = "superseded" })); + + ex.Message.Should().Contain("still being processed"); + ex.Message.Should().NotContain("not in issued state", + "the message must reflect the CA's actual detail text, not a hardcoded assumption"); + } + + [Fact] + public async Task RevokeOrderV2Async_422_DistinctEmsCode_LabelsByThatCode() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/revoke") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(422) + .WithHeader("Content-Type", "application/problem+json") + .WithBody(MockCertificateData.V2ProblemDetailsJson( + 422, "Unprocessable Entity", "EMS-969 Revoke reason ID missing"))); + + using var client = BuildV2Client(); + var ex = await Assert.ThrowsAsync( + () => client.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, + MockCertificateData.V2OrderId1, + new V2RevokeRequest { Reason = "superseded" })); + + ex.Message.Should().Contain("EMS-969"); + ex.Message.Should().NotContain("not in issued state"); + } + + [Fact] + public async Task RevokeOrderV2Async_404_ThrowsNotFoundOrNotRevokable_NotGenericNotFound() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/revoke") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(404) + .WithHeader("Content-Type", "application/problem+json") + .WithBody(MockCertificateData.V2ProblemDetailsJson( + 404, "Not Found", "Order not found or not in a revokable state."))); + + using var client = BuildV2Client(); + var ex = await Assert.ThrowsAsync( + () => client.RevokeOrderV2Async( + Constants.ApiV2.FamilySsl, + MockCertificateData.V2OrderId1, + new V2RevokeRequest { Reason = "superseded" })); + + ex.Message.Should().Contain("not found or not in a revokable state"); + } + + // --------------------------------------------------------------------------- + // Product-family resolution + // --------------------------------------------------------------------------- + + [Fact] + public async Task ResolveAndTrackOrderV2Async_FindsOrderInSslFamily() + { + StubV2Token(); + // SSL family returns 404 → should try private-pki... wait, we want to find it in SSL + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2TrackOrderIssuedJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.ResolveAndTrackOrderV2Async(MockCertificateData.V2OrderId1); + + result.OrderId.Should().Be(MockCertificateData.V2OrderId1); + result.Status.Should().Be("issued"); + } + + [Fact] + public async Task ResolveAndTrackOrderV2Async_FindsOrderInPrivatePkiFamily() + { + StubV2Token(); + // SSL → 404, private-pki → 200 + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId2}") + .UsingGet()) + .RespondWith(Response.Create().WithStatusCode(404)); + + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/private-pki-certificates/{MockCertificateData.V2OrderId2}") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2TrackOrderIssuedJson(MockCertificateData.V2OrderId2))); + + using var client = BuildV2Client(); + var result = await client.ResolveAndTrackOrderV2Async(MockCertificateData.V2OrderId2); + + result.OrderId.Should().Be(MockCertificateData.V2OrderId2); + } + + [Fact] + public async Task ResolveAndTrackOrderV2Async_NotInAnyFamily_ThrowsKeyNotFoundException() + { + StubV2Token(); + foreach (var family in new[] { "ssl-certificates", "private-pki-certificates", "signature-certificates" }) + { + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/{family}/ord_missing") + .UsingGet()) + .RespondWith(Response.Create().WithStatusCode(404)); + } + + using var client = BuildV2Client(); + await Assert.ThrowsAsync( + () => client.ResolveAndTrackOrderV2Async("ord_missing")); + } + + // --------------------------------------------------------------------------- + // GetDcvV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task GetDcvV2Async_ReturnsChallengeWithToken() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2DcvChallengeJson(MockCertificateData.V2OrderId1, "example.com", "my-dcv-token"))); + + using var client = BuildV2Client(); + var result = await client.GetDcvV2Async(MockCertificateData.V2OrderId1, Constants.ApiV2.FamilySsl); + + result.OrderNumber.Should().Be(MockCertificateData.V2OrderId1); + result.DomainName.Should().Be("example.com"); + result.DcvMethod.Should().Be("2"); + result.FileNameContent.Should().Be("my-dcv-token"); + } + + [Fact] + public async Task GetDcvV2Async_NonSuccess_Throws() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(400) + .WithHeader("Content-Type", "application/problem+json") + .WithBody(MockCertificateData.V2ProblemDetailsJson(400, "Bad Request", "Order not found"))); + + using var client = BuildV2Client(); + await Assert.ThrowsAsync( + () => client.GetDcvV2Async(MockCertificateData.V2OrderId1, Constants.ApiV2.FamilySsl)); + } + + // --------------------------------------------------------------------------- + // VerifyDcvV2Async + // --------------------------------------------------------------------------- + + [Fact] + public async Task VerifyDcvV2Async_200Ok_ReturnsVerified() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv/verify") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2DcvVerifySuccessJson())); + + using var client = BuildV2Client(); + var result = await client.VerifyDcvV2Async(MockCertificateData.V2OrderId1, "example.com", Constants.ApiV2.FamilySsl); + + result.OverallStatus.Should().Be("VERIFIED"); + } + + [Fact] + public async Task VerifyDcvV2Async_204NoContent_ReturnsVerified() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv/verify") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(204)); + + using var client = BuildV2Client(); + var result = await client.VerifyDcvV2Async(MockCertificateData.V2OrderId1, "example.com", Constants.ApiV2.FamilySsl); + + result.OverallStatus.Should().Be("VERIFIED"); + } + + [Fact] + public async Task VerifyDcvV2Async_422_ThrowsInvalidOperationException() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv/verify") + .UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(422) + .WithHeader("Content-Type", "application/problem+json") + .WithBody(MockCertificateData.V2ProblemDetailsJson(422, "Unprocessable Entity", "DNS record not found"))); + + using var client = BuildV2Client(); + var ex = await Assert.ThrowsAsync( + () => client.VerifyDcvV2Async(MockCertificateData.V2OrderId1, "example.com", Constants.ApiV2.FamilySsl)); + + ex.Message.Should().Contain("DCV verification failed"); + } + + [Fact] + public async Task VerifyDcvV2Async_SendsDnsTxtMethod() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/dcv/verify") + .UsingPost() + .WithBody(b => b != null && b.Contains("\"dns-txt\""))) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2DcvVerifySuccessJson())); + + using var client = BuildV2Client(); + var result = await client.VerifyDcvV2Async(MockCertificateData.V2OrderId1, "example.com", Constants.ApiV2.FamilySsl); + + result.OverallStatus.Should().Be("VERIFIED"); + } + + // --------------------------------------------------------------------------- + // DownloadCertificateV2Async — chain PEM assembly + // --------------------------------------------------------------------------- + + [Fact] + public async Task DownloadCertificateV2Async_WithChainPem_DeserializesChain() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/certificate") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2CertificateDownloadWithChainJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.DownloadCertificateV2Async(Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1); + + result.CertificatePem.Should().StartWith("-----BEGIN CERTIFICATE-----"); + result.ChainPem.Should().NotBeNullOrEmpty("API returned a chainPem array"); + result.ChainPem.Should().HaveCount(1); + result.ChainPem[0].Should().Contain("INTERMEDIATE"); + } + + [Fact] + public async Task DownloadCertificateV2Async_WithoutChainPem_ChainIsNull() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}/certificate") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2CertificateDownloadJson(MockCertificateData.V2OrderId1))); + + using var client = BuildV2Client(); + var result = await client.DownloadCertificateV2Async(Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1); + + result.CertificatePem.Should().StartWith("-----BEGIN CERTIFICATE-----"); + result.ChainPem.Should().BeNullOrEmpty("API did not return chainPem"); + } + + // --------------------------------------------------------------------------- + // Token refresh when expired + // --------------------------------------------------------------------------- + + [Fact] + public async Task Token_CachedAndReused_WhenNotNearExpiry() + { + // Restates PingV2Async_TokenCached_OnlyOneFetch's proof via GetAuthMeV2Async — kept + // as its own case (G11) so cache-reuse and expiry-refetch (below) are each one + // single-purpose test rather than folded into one. + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/auth/me") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson())); + + using var client = BuildV2Client(); + await client.GetAuthMeV2Async(); + await client.GetAuthMeV2Async(); + + TokenFetchCount(_server).Should().Be(1, "a non-expired cached token must be reused"); + } + + /// + /// G11: a cached token past its early-expiry window must be re-fetched via a fresh + /// client_credentials call — never via refresh_token. Per the V2 spec, + /// refresh tokens are single-use and refreshing invalidates the current access token, so + /// this locks in the client's current (safe) behaviour of only ever using + /// client_credentials. + /// + /// The real cache TTL floors at 30 seconds (Math.Max(expires_in - 60, 30) in + /// GetOrRefreshV2TokenAsync), which is too slow to wait out in a unit test — so this + /// reaches into the private _v2TokenExpiry field via reflection to simulate the + /// passage of time instead of actually waiting. + /// + [Fact] + public async Task Token_RefetchedViaClientCredentials_WhenPastEarlyExpiryWindow() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath("/api/certinext/v2/auth/me") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.V2AuthMeJson())); + + using var client = BuildV2Client(); + await client.GetAuthMeV2Async(); + TokenFetchCount(_server).Should().Be(1); + + // Simulate the cached token having entered/passed its early-expiry window. + SetV2TokenExpiry(client, DateTime.UtcNow.AddSeconds(-1)); + + await client.GetAuthMeV2Async(); + TokenFetchCount(_server).Should().Be(2, + "a token past its early-expiry window must be re-fetched, not reused"); + + // Every /oauth/token call must use client_credentials — never refresh_token, even + // though the stubbed token response includes a refresh_token field. + foreach (var entry in _server.LogEntries.Where(e => e.RequestMessage.Path == "/oauth/token")) + { + string body = entry.RequestMessage.Body ?? string.Empty; + body.Should().Contain("grant_type=client_credentials"); + body.Should().NotContain("grant_type=refresh_token", + "refresh tokens are single-use per the V2 spec — the client must never send this grant proactively"); + } + } + + private static int TokenFetchCount(WireMockServer server) => + server.LogEntries.Count(e => e.RequestMessage.Path == "/oauth/token"); + + private static void SetV2TokenExpiry(CERTInextClient client, DateTime value) + { + var field = typeof(CERTInextClient) + .GetField("_v2TokenExpiry", BindingFlags.NonPublic | BindingFlags.Instance); + field.Should().NotBeNull("test relies on CERTInextClient's private _v2TokenExpiry field existing"); + field!.SetValue(client, value); + } + + // --------------------------------------------------------------------------- + // G2: OAuth2 token failure hints (401 invalid_client vs 403 unauthorized_client) + // --------------------------------------------------------------------------- + + [Fact] + public async Task GetOrRefreshV2Token_Throws_DistinctHint_On401InvalidClient() + { + _server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(401) + .WithHeader("Content-Type", "application/json") + .WithBody(@"{""error"":""invalid_client"",""error_description"":""Client authentication failed.""}")); + + using var client = BuildV2Client(); + + Func act = () => client.PingV2Async(); + + await act.Should().ThrowAsync() + .WithMessage("*401*") + .Where(ex => ex.Message.Contains("ClientId", StringComparison.OrdinalIgnoreCase) + || ex.Message.Contains("ClientSecret", StringComparison.OrdinalIgnoreCase)); + } + + [Fact] + public async Task GetOrRefreshV2Token_Throws_DistinctHint_On403UnauthorizedClient() + { + _server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(403) + .WithHeader("Content-Type", "application/json") + .WithBody(@"{""error"":""unauthorized_client"",""error_description"":""Key not generated in OAuth mode.""}")); + + using var client = BuildV2Client(); + + Func act = () => client.PingV2Async(); + + await act.Should().ThrowAsync() + .WithMessage("*403*") + .Where(ex => ex.Message.Contains("OAuth mode", StringComparison.OrdinalIgnoreCase)); + } + + [Fact] + public async Task GetOrRefreshV2Token_401And403_ProduceDifferentMessages() + { + // The two hints must actually differ — otherwise the distinction above is cosmetic. + _server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(401) + .WithHeader("Content-Type", "application/json") + .WithBody(@"{""error"":""invalid_client""}")); + using var client401 = BuildV2Client(); + Exception ex401 = null; + try { await client401.PingV2Async(); } catch (Exception ex) { ex401 = ex; } + + _server.Reset(); + _server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(403) + .WithHeader("Content-Type", "application/json") + .WithBody(@"{""error"":""unauthorized_client""}")); + using var client403 = BuildV2Client(); + Exception ex403 = null; + try { await client403.PingV2Async(); } catch (Exception ex) { ex403 = ex; } + + ex401.Should().NotBeNull(); + ex403.Should().NotBeNull(); + ex401!.Message.Should().NotBe(ex403!.Message); + } + + [Fact] + public async Task GetOrRefreshV2Token_Throws_WhenTokenResponseLacksAccessToken() + { + _server + .Given(Request.Create().WithPath("/oauth/token").UsingPost()) + .RespondWith(Response.Create() + .WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(@"{""token_type"":""Bearer"",""expires_in"":3600}")); + + using var client = BuildV2Client(); + + Func act = () => client.PingV2Async(); + + await act.Should().ThrowAsync() + .WithMessage("*access_token*"); + } + + // --------------------------------------------------------------------------- + // G12: RFC 7807 field-level errors surfaced in the exception message + // --------------------------------------------------------------------------- + + [Fact] + public async Task ThrowOnV2Failure_IncludesFieldLevelErrors_FromProblemJson() + { + StubV2Token(); + _server + .Given(Request.Create() + .WithPath($"/api/certinext/v2/ssl-certificates/{MockCertificateData.V2OrderId1}") + .UsingGet()) + .RespondWith(Response.Create() + .WithStatusCode(400) + .WithHeader("Content-Type", "application/problem+json") + .WithBody( + @"{""type"":""https://api.certinext.io/errors/validation""," + + @"""title"":""Bad Request"",""status"":400," + + @"""detail"":""Body malformed""," + + @"""errors"":[{""field"":""certificate.domain"",""message"":""must not be blank""}]}")); + + using var client = BuildV2Client(); + + Func act = () => client.TrackOrderV2Async(Constants.ApiV2.FamilySsl, MockCertificateData.V2OrderId1); + + await act.Should().ThrowAsync() + .WithMessage("*certificate.domain*must not be blank*"); + } + } +} diff --git a/CERTInext.Tests/FakeDomainValidator.cs b/CERTInext.Tests/FakeDomainValidator.cs index 6b42475..f8ffeb8 100644 --- a/CERTInext.Tests/FakeDomainValidator.cs +++ b/CERTInext.Tests/FakeDomainValidator.cs @@ -2,6 +2,7 @@ // Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. // At http://www.apache.org/licenses/LICENSE-2.0 +using System; using System.Collections.Generic; using System.Threading; using System.Threading.Tasks; @@ -21,10 +22,20 @@ internal sealed class FakeDomainValidator : IDomainValidator /// All keys passed to . public List CleanedUpKeys { get; } = new(); + /// All CancellationTokens passed to . + public List CleanupTokens { get; } = new(); + /// When false, returns a failure result. public bool StageSucceeds { get; init; } = true; - /// Error message returned when is false. + /// + /// When set, overrides on a per-key basis — e.g. + /// key => key.Contains("bad", StringComparison.OrdinalIgnoreCase) to fail only a + /// specific hostname in a multi-domain test while the others still stage successfully. + /// + public Func ShouldFail { get; init; } + + /// Error message returned when a StageValidation call fails. public string StageError { get; init; } = "Stage failed (test stub)"; public void Initialize(IDomainValidatorConfigProvider configProvider) { } @@ -32,18 +43,67 @@ public void Initialize(IDomainValidatorConfigProvider configProvider) { } public Task StageValidation(string key, string value, CancellationToken cancellationToken) { cancellationToken.ThrowIfCancellationRequested(); - StagedRecords.Add((key, value)); + bool fail = ShouldFail?.Invoke(key) ?? !StageSucceeds; + if (!fail) + StagedRecords.Add((key, value)); + return Task.FromResult(new DomainValidationResult { - Success = StageSucceeds, - ErrorMessage = StageSucceeds ? null : StageError + Success = !fail, + ErrorMessage = fail ? StageError : null }); } - public Task CleanupValidation(string key, CancellationToken cancellationToken) + /// + /// Artificial delay applied inside before completing — lets + /// tests distinguish "cleanup calls run concurrently" (wall time ~= one delay) from + /// "cleanup calls run sequentially" (wall time ~= N x delay). + /// + public TimeSpan CleanupDelay { get; init; } = TimeSpan.Zero; + + // Cleanup calls can genuinely run concurrently (that's what CleanupDelay exists to prove), + // so the two List fields below need a lock — unlike StagedRecords above, which only ever + // sees synchronously-completing calls in practice. + private readonly object _cleanupLock = new(); + + // Tracks how many CleanupValidation calls were in flight (past the increment below, + // still inside CleanupDelay) at the same time. This is the direct, wall-clock-independent + // proof that cleanup ran concurrently rather than sequentially — see + // Dcv_CleanupOfMultipleDomains_RunsConcurrently_NotSequentially, which asserts on this + // instead of total elapsed time (0023: elapsed time also includes fixed overhead from the + // surrounding DCV flow — propagation delay + verification poll interval — unrelated to + // cleanup concurrency, which made a wall-clock threshold an unreliable proxy). + private int _inFlightCleanups; + + /// + /// The maximum number of calls observed executing + /// concurrently (i.e. inside the artificial ) at once. + /// + public int PeakConcurrentCleanups { get; private set; } + + public async Task CleanupValidation(string key, CancellationToken cancellationToken) { - CleanedUpKeys.Add(key); - return Task.FromResult(new DomainValidationResult { Success = true }); + int inFlight = Interlocked.Increment(ref _inFlightCleanups); + lock (_cleanupLock) + { + if (inFlight > PeakConcurrentCleanups) + PeakConcurrentCleanups = inFlight; + } + try + { + if (CleanupDelay > TimeSpan.Zero) + await Task.Delay(CleanupDelay, cancellationToken); + } + finally + { + Interlocked.Decrement(ref _inFlightCleanups); + } + lock (_cleanupLock) + { + CleanedUpKeys.Add(key); + CleanupTokens.Add(cancellationToken); + } + return new DomainValidationResult { Success = true }; } public Task ValidateConfiguration(Dictionary configuration) => Task.CompletedTask; @@ -53,15 +113,24 @@ public Task CleanupValidation(string key, CancellationTo /// /// Factory that returns a single pre-configured for every - /// domain. Pass null as the validator to simulate "no DNS provider configured". + /// domain, or only for if set. Pass null as the + /// validator to simulate "no DNS provider configured". /// internal sealed class FakeDomainValidatorFactory : IDomainValidatorFactory { private readonly IDomainValidator _validator; + private readonly string _resolvableDomain; - public FakeDomainValidatorFactory(IDomainValidator validator = null) => _validator = validator; + public FakeDomainValidatorFactory(IDomainValidator validator = null, string resolvableDomain = null) + { + _validator = validator; + _resolvableDomain = resolvableDomain; + } - public IDomainValidator ResolveDomainValidator(string domain, string validationType) => _validator; + public IDomainValidator ResolveDomainValidator(string domain, string validationType) => + (_resolvableDomain == null || string.Equals(domain, _resolvableDomain, StringComparison.OrdinalIgnoreCase)) + ? _validator + : null; /// The validator this factory returns; exposed for assertions in tests. public IDomainValidator PrimaryValidator => _validator; diff --git a/CERTInext.Tests/MockCertificateData.cs b/CERTInext.Tests/MockCertificateData.cs index ee6644b..83fdbea 100644 --- a/CERTInext.Tests/MockCertificateData.cs +++ b/CERTInext.Tests/MockCertificateData.cs @@ -294,6 +294,20 @@ public static EnrollCertificateResponse PendingEnrollResponse(string id = null) Message = "Awaiting approval." }; + // Reproduces the CERTInext "auto-approved" race: TrackOrder reports a + // certificateStatusId the client legacy-maps to "issued", but the immediate + // GetCertificate download failed (cert bytes not generated yet), so no PEM + // ever arrived. See issue 0009. + public static EnrollCertificateResponse AutoApprovedNoBodyEnrollResponse(string id = null) => + new EnrollCertificateResponse + { + Id = id ?? CertId1, + Status = "issued", + Certificate = null, + ProfileId = ProfileIdTls, + Message = "Order auto-approved." + }; + // ----------------------------------------------------------------------- // GetCertificate response (object helpers — used by Moq-based plugin tests) // These use the legacy inferred type (LegacyGetCertificateResponse). @@ -478,6 +492,69 @@ public static string ServerErrorJson() => public static string UnauthorizedJson() => @"{""error"":""UNAUTHORIZED"",""message"":""Invalid API key."",""statusCode"":401}"; + // ----------------------------------------------------------------------- + // V2 API JSON factories + // ----------------------------------------------------------------------- + + // V2 well-known order IDs + public const string V2OrderId1 = "ord_abc001"; + public const string V2OrderId2 = "ord_abc002"; + + /// Standard OAuth2 client_credentials token response. + public static string V2TokenResponseJson(int expiresIn = 3600) => + $@"{{""access_token"":""eyJhbGciOiJSUzI1NiJ9.test-token"",""token_type"":""Bearer"",""expires_in"":{expiresIn},""refresh_token"":""refresh-opaque-token""}}"; + + /// V2 create order response (status = pending-dcv). + public static string V2CreateOrderPendingJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""requestId"":""req_xyz001"",""status"":""pending-dcv"",""_links"":{{""self"":{{""href"":""/api/certinext/v2/ssl-certificates/{orderId}""}}}}}}"; + + /// V2 create order response (status = issued — unlikely on fresh order but usable for testing). + public static string V2CreateOrderIssuedJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""requestId"":""req_xyz001"",""status"":""issued"",""_links"":{{""self"":{{""href"":""/api/certinext/v2/ssl-certificates/{orderId}""}}}}}}"; + + /// V2 track order response — pending DCV. + public static string V2TrackOrderPendingJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""requestId"":""req_xyz001"",""status"":""pending-dcv"",""productVariant"":""dv"",""domain"":""example.com"",""_links"":{{""self"":{{""href"":""/api/certinext/v2/ssl-certificates/{orderId}""}}}}}}"; + + /// V2 track order response — issued. + public static string V2TrackOrderIssuedJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""requestId"":""req_xyz001"",""status"":""issued"",""productVariant"":""dv"",""domain"":""example.com"",""_links"":{{""certificate"":{{""href"":""/api/certinext/v2/ssl-certificates/{orderId}/certificate""}}}}}}"; + + /// V2 track order response — revoked. + public static string V2TrackOrderRevokedJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""requestId"":""req_xyz001"",""status"":""revoked"",""productVariant"":""dv"",""domain"":""example.com"",""revocationReason"":""superseded"",""_links"":{{}}}}"; + + /// V2 certificate download response (leaf PEM only). + public static string V2CertificateDownloadJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""serialNumber"":""0A1B2C3D4E5F"",""subject"":""CN=example.com"",""issuer"":""CN=CERTInext TLS Intermediate"",""notBefore"":""2026-01-01T00:00:00Z"",""notAfter"":""2027-01-01T00:00:00Z"",""certificatePem"":""{EscapeForJson(FakePemCertificate)}""}}"; + + /// V2 auth/me response. + public static string V2AuthMeJson(string accountNumber = "99887766") => + $@"{{""accountNumber"":""{accountNumber}"",""authType"":""oauth2""}}"; + + /// RFC 7807 problem+json error response. + public static string V2ProblemDetailsJson(int status = 403, string title = "Forbidden", string detail = "OAuth2 not enabled", string type = "EMS-2022") => + $@"{{""type"":""{type}"",""title"":""{title}"",""status"":{status},""detail"":""{detail}"",""instance"":null}}"; + + /// V2 DCV challenge response (DNS-TXT method). + public static string V2DcvChallengeJson(string orderId = "ord_abc001", string domain = "example.com", string token = "emudhra-dcv-abc123") => + $@"{{""orderNumber"":""{orderId}"",""domainName"":""{domain}"",""dcvMethod"":""2"",""fileNameContent"":""{token}"",""tokenExpiryDate"":""2026-12-31 23:59:59""}}"; + + /// V2 DCV verify response (success). + public static string V2DcvVerifySuccessJson(string domain = "example.com") => + $@"{{""overallStatus"":""VERIFIED"",""method"":""dns-txt"",""verifiedAt"":""2026-09-21T10:00:00Z""}}"; + + /// V2 DCV verify response (failure). + public static string V2DcvVerifyFailedJson() => + $@"{{""overallStatus"":""FAILED"",""method"":""dns-txt"",""verifiedAt"":null}}"; + + /// V2 certificate download response with chain PEM. + public static string V2CertificateDownloadWithChainJson(string orderId = "ord_abc001") => + $@"{{""orderId"":""{orderId}"",""serialNumber"":""0A1B2C3D4E5F"",""subject"":""CN=example.com"",""issuer"":""CN=CERTInext TLS Intermediate"",""notBefore"":""2026-01-01T00:00:00Z"",""notAfter"":""2027-01-01T00:00:00Z"",""certificatePem"":""{EscapeForJson(FakePemCertificate)}"",""chainPem"":[""{EscapeForJson(FakeIntermediatePemCertificate)}""]}}"; + + public static readonly string FakeIntermediatePemCertificate = + "-----BEGIN CERTIFICATE-----\nMIIBfakeBASE64INTERMEDIATE==\n-----END CERTIFICATE-----"; + // ----------------------------------------------------------------------- // Helpers // ----------------------------------------------------------------------- diff --git a/CERTInext.Tests/SanSubmissionTests.cs b/CERTInext.Tests/SanSubmissionTests.cs new file mode 100644 index 0000000..c305665 --- /dev/null +++ b/CERTInext.Tests/SanSubmissionTests.cs @@ -0,0 +1,707 @@ +// Copyright 2026 Keyfactor +// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. +// You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 +// Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions +// and limitations under the License. + +using System; +using System.Collections.Generic; +using System.Linq; +using System.Reflection; +using System.Text.Json; +using System.Threading; +using System.Threading.Tasks; +using FluentAssertions; +using Keyfactor.AnyGateway.Extensions; +using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.Client; +using Moq; +using Org.BouncyCastle.Asn1; +using Org.BouncyCastle.Asn1.Pkcs; +using Org.BouncyCastle.Asn1.X509; +using Org.BouncyCastle.Crypto; +using Org.BouncyCastle.Crypto.Generators; +using Org.BouncyCastle.Pkcs; +using Org.BouncyCastle.Security; +using WireMock.RequestBuilders; +using WireMock.ResponseBuilders; +using WireMock.Server; +using Xunit; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Tests +{ + /// + /// Regression tests for UCC SAN submission. + /// + /// The defect these pin down: the AnyCA REST Gateway keys its SAN dictionary + /// dnsname, but MapSanType only recognized dns. Every DNS SAN was + /// therefore typed "dnsname", filtered out by a DNS-only test when building + /// certificateInformation.additionalDomains, and the order reached CERTInext with + /// no additional domains at all — yielding a certificate holding only the CN. Because + /// CERTInext ignores the CSR's subjectAltName extension entirely (measured; see + /// SanSubmissionProbeTests), SANs present on the CSR did not compensate. + /// + /// The end-to-end tests below drive a real against WireMock + /// so they assert on the JSON actually put on the wire, not on an intermediate object. + /// A test that only checked the mapping function would not have caught this bug, since + /// the mapping "worked" — it was the interaction with the downstream filter that lost + /// the names. + /// + public class SanSubmissionTests : IDisposable + { + private readonly WireMockServer _server; + + public SanSubmissionTests() + { + _server = WireMockServer.Start(); + StubHappyEnroll(); + } + + public void Dispose() => _server.Stop(); + + // ----------------------------------------------------------------------- + // Harness + // ----------------------------------------------------------------------- + + private void StubHappyEnroll() + { + _server.Given(Request.Create().WithPath("/GenerateOrderSSL").UsingPost()) + .RespondWith(Response.Create().WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.GenerateOrderSuccessJson(MockCertificateData.OrderNumber1))); + + _server.Given(Request.Create().WithPath("/TrackOrder").UsingPost()) + .RespondWith(Response.Create().WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.TrackOrderIssuedJson(MockCertificateData.OrderNumber1))); + + _server.Given(Request.Create().WithPath("/GetCertificate").UsingPost()) + .RespondWith(Response.Create().WithStatusCode(200) + .WithHeader("Content-Type", "application/json") + .WithBody(MockCertificateData.GetCertificateSuccessJson())); + } + + private CERTInextClient BuildRealClient() => new CERTInextClient(new CERTInextConfig + { + ApiUrl = _server.Urls[0], + AuthMode = "AccessKey", + ApiKey = "test-key", + AccountNumber = "12345", + RequestorName = "Default Requestor", + RequestorEmail = "default@example.com", + RequestorIsdCode = "1", + RequestorMobileNumber = "5550000000", + SignerPlace = "Austin", + SignerIp = "203.0.113.10", + PageSize = 100 + }); + + /// + /// Plugin wired to a real client pointed at WireMock. PickupRetries = 0 is set on + /// the plugin's own config (not the client's) — that is where the synchronous-pickup + /// budget is read, and leaving it at the default would make every test here sit in a + /// polling loop. + /// + private CERTInextCAPlugin BuildPlugin() => + new CERTInextCAPlugin(BuildRealClient(), new CERTInextConfig { PickupRetries = 0 }); + + private static EnrollmentProductInfo MakeProductInfo(string profileId = "842") => + new EnrollmentProductInfo + { + ProductID = profileId, + ProductParameters = new Dictionary(StringComparer.OrdinalIgnoreCase) + { + ["ProfileId"] = profileId + } + }; + + /// The orderDetails.certificateInformation block actually POSTed. + private JsonElement CapturedCertificateInformation() + { + var posts = _server.LogEntries + .Where(e => e.RequestMessage.Path == "/GenerateOrderSSL") + .ToList(); + posts.Should().HaveCount(1, "exactly one GenerateOrderSSL POST should have been emitted"); + + string body = posts[0].RequestMessage.Body; + body.Should().NotBeNullOrEmpty(); + + return JsonDocument.Parse(body!).RootElement + .GetProperty("orderDetails") + .GetProperty("certificateInformation"); + } + + private static List AdditionalDomains(JsonElement certificateInformation) => + certificateInformation.TryGetProperty("additionalDomains", out var el) + ? el.EnumerateArray().Select(x => x.GetString()).ToList() + : null; + + // ----------------------------------------------------------------------- + // CSR generation (BouncyCastle — project crypto policy) + // ----------------------------------------------------------------------- + + /// + /// Builds a real PKCS#10 CSR for carrying arbitrary + /// in its subjectAltName extension — used to exercise + /// GeneralName types that have no domain-name rendering. + /// + private static string GenerateCsrPemWithGeneralNames(string cn, params GeneralName[] names) + { + var keyGen = new RsaKeyPairGenerator(); + keyGen.Init(new KeyGenerationParameters(new SecureRandom(), 2048)); + AsymmetricCipherKeyPair kp = keyGen.GenerateKeyPair(); + + Asn1Set attributes = null; + if (names != null && names.Length > 0) + { + var extGen = new X509ExtensionsGenerator(); + extGen.AddExtension(X509Extensions.SubjectAlternativeName, critical: false, + extValue: new GeneralNames(names)); + + attributes = new DerSet(new AttributePkcs( + PkcsObjectIdentifiers.Pkcs9AtExtensionRequest, + new DerSet(extGen.Generate()))); + } + + var csr = new Pkcs10CertificationRequest( + "SHA256withRSA", new X509Name($"CN={cn}"), kp.Public, attributes, kp.Private); + + return "-----BEGIN CERTIFICATE REQUEST-----\n" + + Convert.ToBase64String(csr.GetEncoded(), Base64FormattingOptions.InsertLineBreaks) + + "\n-----END CERTIFICATE REQUEST-----"; + } + + /// + /// Builds a real PKCS#10 CSR for , optionally carrying a + /// subjectAltName extension holding . + /// + private static string GenerateCsrPem(string cn, params string[] dnsSans) => + GenerateCsrPemWithGeneralNames( + cn, (dnsSans ?? Array.Empty()).Select(d => new GeneralName(GeneralName.DnsName, d)).ToArray()); + + // ======================================================================= + // End-to-end: Command's SAN dictionary → the JSON on the wire + // ======================================================================= + + /// + /// THE regression test. "dnsname" is the key the real gateway sends — verified against + /// a customer gateway log: + /// SANs=dnsname:CLAUDIOTEST20.ucsd.edu; dnsname:CLAUDIOTEST20.ad.ucsd.edu + /// Before the fix, additionalDomains was absent from the body entirely. + /// + [Fact] + public async Task GatewayDnsNameKey_ReachesAdditionalDomains() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "host.example.com", "alt.example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + var certInfo = CapturedCertificateInformation(); + certInfo.GetProperty("domainName").GetString().Should().Be("host.example.com"); + + AdditionalDomains(certInfo).Should().BeEquivalentTo(new[] { "alt.example.com" }, + "the extra SAN must reach additionalDomains, and the CN must not be repeated there"); + } + + /// + /// The short "dns" spelling must keep working — some callers and older hosts use it. + /// + [Fact] + public async Task ShortDnsKey_StillReachesAdditionalDomains() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dns"] = new[] { "alt.example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com" }); + } + + /// + /// SANs present only on the CSR must still reach additionalDomains. CERTInext does not + /// read the CSR's SAN extension, so if we don't forward these the names never appear + /// on the certificate. + /// + [Fact] + public async Task CsrSans_ReachAdditionalDomains_WhenGatewaySuppliesNone() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com", "host.example.com", "fromcsr.example.com"), + subject: "CN=host.example.com", + san: null, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "fromcsr.example.com" }); + } + + /// + /// Union, not either/or: names unique to each source survive and the overlap collapses. + /// + [Fact] + public async Task CsrOnlySans_AreIgnored_WhenGatewaySuppliesAnyEntries() + { + // Regression: this test used to assert the CSR was unioned in on top of whatever the + // gateway supplied. Full-review's security lens found that risky: Command's SAN + // dictionary is how an enrollment pattern's SAN policy is expressed, and a signed CSR — + // usually generated by the subscriber's own tooling, not by Command — can legitimately + // carry more names than that policy allows. Unioning them in would re-introduce a name + // the policy excluded. The CSR is now consulted only as a fallback when the gateway + // supplies nothing at all (see CsrSans_ReachAdditionalDomains_WhenGatewaySuppliesNone). + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com", "host.example.com", "csronly.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "gatewayonly.example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + var domains = AdditionalDomains(CapturedCertificateInformation()); + + domains.Should().BeEquivalentTo(new[] { "gatewayonly.example.com" }, + "the gateway supplied a (non-empty) SAN set, so the CSR's own SAN extension must be " + + "ignored entirely, not merged in on top of it"); + } + + /// + /// Regression: the CSR-fallback trigger used to be "the gateway dictionary computed to zero + /// added entries", which cannot distinguish "Command never populated SAN data" (the case the + /// fallback exists for) from "Command's enrollment pattern ran and deliberately computed + /// zero SANs for this request" (an explicit policy decision this plugin must respect). A + /// non-null dictionary whose only key maps to an empty array is the latter — the fallback + /// must not engage, even though it computes to the same "0 SANs added" outcome as a null + /// dictionary would. + /// + [Fact] + public async Task CsrSans_AreIgnored_WhenGatewaySuppliesNonNullDictWithOnlyEmptyValues() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com", "host.example.com", "csronly.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + // Non-null dictionary, but the key maps to no values — computes to zero added + // SANs, same as san == null would, but it must NOT be treated the same way. + ["dnsname"] = Array.Empty() + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()).Should().BeNull( + "a non-null gateway SAN dictionary that computes to zero entries must be respected " + + "as Command's own decision, not treated as 'Command supplied nothing' and " + + "backfilled from the CSR"); + } + + /// + /// The CN is already submitted as domainName; repeating it in additionalDomains is + /// suppressed. CERTInext collapses it anyway (measured), so this keeps the body matching + /// what we log rather than relying on undocumented CA-side behaviour. + /// + [Fact] + public async Task Cn_IsNotRepeatedInAdditionalDomains() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com", "host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "host.example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + var certInfo = CapturedCertificateInformation(); + certInfo.GetProperty("domainName").GetString().Should().Be("host.example.com"); + AdditionalDomains(certInfo).Should().BeNull( + "with the CN as the only SAN there is nothing left to send, so the field is omitted"); + } + + /// + /// Non-DNS SANs are submitted rather than silently discarded. CERTInext accepts them + /// verbatim (measured) and the resulting order cannot pass validation — a visible + /// failure, deliberately preferred over issuing a certificate that quietly lacks names + /// the subscriber requested. + /// + [Fact] + public async Task NonDnsSans_AreSubmitted_NotDropped() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "alt.example.com" }, + ["ipaddress"] = new[] { "192.0.2.10" }, + ["rfc822name"] = new[] { "admin@example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com", "192.0.2.10", "admin@example.com" }); + } + + /// + /// Regression for a stale-count bug in BuildSanList's own audit log: with a mixed + /// DNS/non-DNS gateway SAN dictionary and SubmitNonDnsSans=false, the "Resolved N SAN(s)" + /// log line reported the pre-filter gateway count (3) alongside the post-filter total (1) — + /// an arithmetic impossibility ("Resolved 1 ... FromGatewayRequest=3"). There is no log- + /// capture seam in this codebase (ILogger comes from a fixed LogHandler.GetClassLogger() + /// field, not an injectable dependency), so this pins the payload-level data the log line is + /// computed from instead: with the non-DNS entries filtered out, exactly the one DNS name + /// must reach additionalDomains — proving the surviving gateway-sourced count is 1, not the + /// pre-filter 3 the stale log line used to claim. + /// + [Fact] + public async Task MixedGatewaySans_SubmitNonDnsSansFalse_OnlyDnsNameSurvivesFiltering() + { + var plugin = new CERTInextCAPlugin( + BuildRealClient(), + new CERTInextConfig { PickupRetries = 0, SubmitNonDnsSans = false }); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "alt.example.com" }, + ["ipaddress"] = new[] { "192.0.2.10" }, + ["rfc822name"] = new[] { "admin@example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com" }, + "only the DNS entry should survive the SubmitNonDnsSans=false filter, out of " + + "3 the gateway supplied"); + } + + /// + /// A CSR we cannot parse must not break enrollment — the gateway-supplied SANs still go. + /// FakeCsrPem is deliberately truncated, so this also guards the many existing + /// tests that pass it. + /// + [Fact] + public async Task UnparseableCsr_DoesNotBlockGatewaySuppliedSans() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: MockCertificateData.FakeCsrPem, + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "alt.example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com" }); + } + + /// + /// No SANs from either source → the field is omitted rather than emitted as null/empty. + /// + [Fact] + public async Task NoSansAnywhere_OmitsAdditionalDomains() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: null, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()).Should().BeNull(); + } + + // ======================================================================= + // GeneralName types with no domain-name rendering + // ======================================================================= + + /// + /// A UPN otherName and a directoryName must NOT be submitted. + /// + /// Regression: GeneralNameToValue's default branch returned BouncyCastle's ASN.1 + /// stringification, so a Windows-generated CSR carrying a UPN otherName put + /// "[1.3.6.1.4.1.311.20.2.3, [CONTEXT 0]svc@corp.example.com]" into additionalDomains as if + /// it were a domain name — breaking orders that previously succeeded, and contradicting the + /// method's own doc comment. These types cannot become a certificate SAN via a domain-name + /// field at all, which is why they are skipped (with a Warning) rather than submitted the way + /// well-formed IP/email/URI SANs are. + /// + [Fact] + public async Task CsrOtherNameAndDirectoryName_AreNotSubmittedAsDomains() + { + // UPN otherName, as emitted by Windows/AD certificate tooling. + var upn = new GeneralName(GeneralName.OtherName, new DerSequence( + new DerObjectIdentifier("1.3.6.1.4.1.311.20.2.3"), + new DerTaggedObject(true, 0, new DerUtf8String("svc@corp.example.com")))); + + var directoryName = new GeneralName( + GeneralName.DirectoryName, new X509Name("CN=host.example.com,O=Acme")); + + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPemWithGeneralNames( + "host.example.com", + new GeneralName(GeneralName.DnsName, "alt.example.com"), + upn, + directoryName), + subject: "CN=host.example.com", + san: null, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + var domains = AdditionalDomains(CapturedCertificateInformation()); + + domains.Should().BeEquivalentTo(new[] { "alt.example.com" }, + "only the renderable DNS name may be submitted"); + domains.Should().NotContain(d => d.Contains("1.3.6.1.4.1.311.20.2.3"), + "an otherName must never be submitted as an ASN.1 dump"); + domains.Should().NotContain(d => d.Contains("CONTEXT"), + "BouncyCastle ASN.1 debris must never reach the wire"); + domains.Should().NotContain(d => d.StartsWith("CN=", StringComparison.OrdinalIgnoreCase), + "a directoryName must never be submitted as a domain"); + } + + // ======================================================================= + // Log-injection hardening (CWE-117) + // ======================================================================= + + /// + /// SAN values reach the log from the CSR and from Command's SAN dictionary — i.e. from the + /// requester. Structured message templates stop format-string abuse but not embedded + /// newlines, so a value carrying CRLF could forge audit records in the very log lines added + /// to make the submitted SAN set auditable. LogSanitizer is internal (not private) and + /// shared between the plugin and the client, so this is a direct call, not reflection. + /// + [Theory] + [InlineData("evil.example.com\r\nINFO forged record", "evil.example.com\\r\\nINFO forged record")] + [InlineData("a\nb", "a\\nb")] + [InlineData("a\tb", "a\\tb")] + [InlineData("plain.example.com", "plain.example.com")] + [InlineData("", "")] + [InlineData(null, null)] + public void SanitizeForLog_NeutralizesControlCharacters(string input, string expected) + { + var actual = Keyfactor.Extensions.CAPlugin.CERTInext.Models.LogSanitizer.Strip(input); + + actual.Should().Be(expected); + } + + /// + /// A CRLF-bearing SAN must not break enrollment, and the value is still submitted verbatim — + /// the scrub is a logging concern and deliberately does not mutate the payload sent to the CA. + /// + [Fact] + public async Task SanValueWithCrLf_DoesNotBreakEnrollment() + { + var plugin = BuildPlugin(); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "alt.example.com\r\nforged log line" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().ContainSingle().Which.Should().Contain("alt.example.com"); + } + + // ======================================================================= + // SubmitNonDnsSans escape hatch + // ======================================================================= + + /// + /// Submitting non-DNS SANs flips affected enrollments from "issues, silently missing the + /// name" to "parks pending". SubmitNonDnsSans=false restores the pre-1.0.1 behaviour so an + /// upgraded host has a way back that isn't a plugin downgrade. + /// + [Fact] + public async Task SubmitNonDnsSansFalse_SubmitsDnsNamesOnly() + { + var plugin = new CERTInextCAPlugin( + BuildRealClient(), + new CERTInextConfig { PickupRetries = 0, SubmitNonDnsSans = false }); + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "alt.example.com" }, + ["ipaddress"] = new[] { "192.0.2.10" }, + ["rfc822name"] = new[] { "admin@example.com" } + }, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com" }, + "with the switch off, only DNS names are submitted"); + } + + /// + /// The switch defaults to true, so the documented default behaviour is pinned independently + /// of any test that sets it explicitly. + /// + [Fact] + public void SubmitNonDnsSans_DefaultsToTrue() + { + new CERTInextConfig().SubmitNonDnsSans.Should().BeTrue(); + } + + /// + /// Regression for a self-contradicting audit record: BuildSanList used to log "N SAN(s) + /// ... have been added to the order" for CSR-fallback entries, then filter exactly those + /// entries back out two lines later when SubmitNonDnsSans is false — a false claim in the + /// same call. The fix reordered the method to filter first and log the final result, which + /// this test exercises functionally: with the gateway supplying nothing (so the CSR fallback + /// engages) and a non-DNS CSR SAN present, SubmitNonDnsSans=false must still result in that + /// name being genuinely absent from the wire, not merely mis-described in the log. + /// + [Fact] + public async Task CsrFallbackNonDnsSan_IsExcluded_WhenSubmitNonDnsSansFalse() + { + var plugin = new CERTInextCAPlugin( + BuildRealClient(), + new CERTInextConfig { PickupRetries = 0, SubmitNonDnsSans = false }); + + await plugin.Enroll( + csr: GenerateCsrPemWithGeneralNames( + "host.example.com", + new GeneralName(GeneralName.DnsName, "host.example.com"), + new GeneralName(GeneralName.DnsName, "alt.example.com"), + new GeneralName(GeneralName.Rfc822Name, "admin@example.com")), + subject: "CN=host.example.com", + san: null, + productInfo: MakeProductInfo(), + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.New); + + AdditionalDomains(CapturedCertificateInformation()) + .Should().BeEquivalentTo(new[] { "alt.example.com" }, + "the CSR-fallback email SAN must be genuinely absent from the order, not just " + + "misreported as present"); + } + + // ======================================================================= + // Renew path — previously submitted no SANs at all + // ======================================================================= + + /// + /// A renewal that goes through the CERTInext renew API must carry the same domain set + /// as a new enrollment, and must take its primary domain from the subject's CN rather + /// than from the prior order's requestor name. + /// + [Fact] + public async Task RenewalRequest_CarriesSubjectAndSans() + { + var clientMock = new Mock(MockBehavior.Loose); + RenewCertificateRequest captured = null; + + clientMock + .Setup(c => c.RenewCertificateAsync( + It.IsAny(), + It.IsAny(), + It.IsAny())) + .Callback((_, req, __) => captured = req) + .ReturnsAsync(MockCertificateData.IssuedEnrollResponse()); + + var readerMock = new Mock(MockBehavior.Loose); + readerMock + .Setup(r => r.GetRequestIDBySerialNumber(It.IsAny())) + .ReturnsAsync("PRIOR-ORDER-1"); + + // The renewal-window decision reads expiry from the data reader, not from the CA. + // Put the prior cert 10 days out so it lands inside the 30-day window below and the + // renew API path is actually taken. + readerMock + .Setup(r => r.GetExpirationDateByRequestId(It.IsAny())) + .Returns(DateTime.UtcNow.AddDays(10)); + + var plugin = new CERTInextCAPlugin(clientMock.Object, readerMock.Object); + + var productInfo = MakeProductInfo(); + productInfo.ProductParameters["PriorCertSN"] = "AABBCCDDEEFF"; + productInfo.ProductParameters["RenewalWindowDays"] = "30"; + + await plugin.Enroll( + csr: GenerateCsrPem("host.example.com", "host.example.com", "alt.example.com"), + subject: "CN=host.example.com", + san: new Dictionary + { + ["dnsname"] = new[] { "host.example.com", "alt.example.com" } + }, + productInfo: productInfo, + requestFormat: RequestFormat.PKCS10, + enrollmentType: EnrollmentType.Renew); + + captured.Should().NotBeNull("the renew API path should have been taken"); + + // Bind to a local so the compiler's null-flow analysis is satisfied — a + // FluentAssertions NotBeNull() does not narrow the nullable reference. + RenewCertificateRequest renewReq = captured!; + + renewReq.Subject.Should().Be("CN=host.example.com", + "without the subject the renewal order has no usable primary domain"); + renewReq.Sans.Should().NotBeNull("renewals previously dropped every SAN"); + renewReq.Sans.Select(s => s.Value) + .Should().BeEquivalentTo(new[] { "host.example.com", "alt.example.com" }); + } + } +} diff --git a/CERTInext.Tests/StatusMapperV2Tests.cs b/CERTInext.Tests/StatusMapperV2Tests.cs new file mode 100644 index 0000000..78321cd --- /dev/null +++ b/CERTInext.Tests/StatusMapperV2Tests.cs @@ -0,0 +1,130 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Collections.Generic; +using FluentAssertions; +using Keyfactor.Extensions.CAPlugin.CERTInext.Models; +using Keyfactor.PKI.Enums.EJBCA; +using Xunit; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Tests +{ + /// + /// Unit tests for the V2-specific mapping methods on . + /// + public class StatusMapperV2Tests + { + // --------------------------------------------------------------------------- + // V2StatusToRequestDisposition + // --------------------------------------------------------------------------- + + [Theory] + [InlineData("issued", (int)EndEntityStatus.GENERATED)] + [InlineData("ISSUED", (int)EndEntityStatus.GENERATED)] // case-insensitive + [InlineData("pending-dcv", (int)EndEntityStatus.EXTERNALVALIDATION)] + [InlineData("pending-csr", (int)EndEntityStatus.EXTERNALVALIDATION)] + [InlineData("pending-agreement", (int)EndEntityStatus.EXTERNALVALIDATION)] + [InlineData("revoked", (int)EndEntityStatus.REVOKED)] + [InlineData("cancelled", (int)EndEntityStatus.FAILED)] + [InlineData("unknown-future", (int)EndEntityStatus.FAILED)] + [InlineData("", (int)EndEntityStatus.FAILED)] + [InlineData(null, (int)EndEntityStatus.FAILED)] + public void V2StatusToRequestDisposition_MapsCorrectly(string v2Status, int expectedDisposition) + { + StatusMapper.V2StatusToRequestDisposition(v2Status).Should().Be(expectedDisposition); + } + + // --------------------------------------------------------------------------- + // ToV2RevocationReason + // --------------------------------------------------------------------------- + + [Theory] + [InlineData(0u, Constants.RevocationReasonV2.Unspecified)] + [InlineData(1u, Constants.RevocationReasonV2.KeyCompromise)] + [InlineData(2u, Constants.RevocationReasonV2.CACompromise)] + [InlineData(3u, Constants.RevocationReasonV2.AffiliationChanged)] + [InlineData(4u, Constants.RevocationReasonV2.Superseded)] + [InlineData(5u, Constants.RevocationReasonV2.CessationOfOperation)] + [InlineData(6u, Constants.RevocationReasonV2.CertificateHold)] + [InlineData(8u, Constants.RevocationReasonV2.Unspecified)] // removeFromCRL: CRL-only, not a valid revoke reason + [InlineData(9u, Constants.RevocationReasonV2.PrivilegeWithdrawn)] + [InlineData(10u, Constants.RevocationReasonV2.AACompromise)] + [InlineData(99u, Constants.RevocationReasonV2.Unspecified)] // unknown → unspecified + public void ToV2RevocationReason_MapsCorrectly(uint crlReason, string expectedV2Reason) + { + StatusMapper.ToV2RevocationReason(crlReason).Should().Be(expectedV2Reason); + } + + // --------------------------------------------------------------------------- + // Round-trip: ToV2RevocationReason never returns null or empty + // --------------------------------------------------------------------------- + + [Theory] + [InlineData(0u), InlineData(1u), InlineData(3u), InlineData(4u), InlineData(5u), InlineData(9u)] + public void ToV2RevocationReason_NeverReturnsNullOrEmpty(uint crlReason) + { + StatusMapper.ToV2RevocationReason(crlReason).Should().NotBeNullOrEmpty(); + } + + // --------------------------------------------------------------------------- + // Regression (issues/0019): every CRL reason code Keyfactor Command can send + // to IAnyCAPlugin.Revoke must map to a value in the V2 spec's kebab-case + // `reason` enum (docs/reference/specs/CERTInext API v2.postman_collection.json, + // "Revoke Certificate"), never to a camelCase string that would get HTTP 400. + // --------------------------------------------------------------------------- + + /// + /// The V2 spec's `reason` enum, hardcoded from the spec text rather than from + /// so this test still catches a + /// future accidental edit to that class drifting away from the spec. + /// + private static readonly HashSet SpecRevocationReasonEnum = new() + { + "unspecified", + "key-compromise", + "ca-compromise", + "affiliation-changed", + "superseded", + "cessation-of-operation", + "certificate-hold", + "privilege-withdrawn", + "aa-compromise", + }; + + // RFC 5280 CRLReason codes that Keyfactor Command can pass through to + // IAnyCAPlugin.Revoke's revocationReason parameter (0-10, minus the two + // codes RFC 5280 never assigns: 7 and, for a *request* reason, 8 + // (removeFromCRL is CRL-only) is still exercised here to prove it degrades + // safely to "unspecified" rather than to an invalid string). + [Theory] + [InlineData(0u)] + [InlineData(1u)] + [InlineData(2u)] + [InlineData(3u)] + [InlineData(4u)] + [InlineData(5u)] + [InlineData(6u)] + [InlineData(8u)] + [InlineData(9u)] + [InlineData(10u)] + public void ToV2RevocationReason_EveryCrlCode_MapsToASpecEnumValue(uint crlReason) + { + string v2Reason = StatusMapper.ToV2RevocationReason(crlReason); + + SpecRevocationReasonEnum.Should().Contain(v2Reason, + $"CRL reason code {crlReason} mapped to '{v2Reason}', which is not one of the V2 spec's " + + "kebab-case reason values — sending it would get HTTP 400 (issues/0019)."); + } + } +} diff --git a/CERTInext/API/CertificateRequest.cs b/CERTInext/API/CertificateRequest.cs index 7f02df0..29c26cb 100644 --- a/CERTInext/API/CertificateRequest.cs +++ b/CERTInext/API/CertificateRequest.cs @@ -570,6 +570,10 @@ public class EnrollCertificateRequest [JsonPropertyName("csr")] public string Csr { get; set; } + [JsonPropertyName("validityYears")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public int? ValidityYears { get; set; } + [JsonPropertyName("validityDays")] [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] public int? ValidityDays { get; set; } @@ -622,6 +626,36 @@ public class RenewCertificateRequest [JsonPropertyName("csr")] public string Csr { get; set; } + /// + /// Distinguished name of the certificate being renewed. Supplies the renewal order's + /// primary domain via its CN — without it the renewal falls back to the prior order's + /// requestor name, which is not a domain at all. + /// + [JsonPropertyName("subject")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string Subject { get; set; } + + /// + /// Template/enrollment product code to submit the renewal order under. Without it, the + /// renewal falls back to the connector-level default product code, which is often unset — + /// leaving renewals to go out under an empty product code regardless of the template used. + /// + [JsonPropertyName("profileId")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string ProfileId { get; set; } + + /// + /// SANs to carry onto the renewal order. Renewals previously submitted none, so a + /// renewed UCC certificate came back holding only its primary domain. + /// + [JsonPropertyName("sans")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public System.Collections.Generic.List Sans { get; set; } + + [JsonPropertyName("validityYears")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public int? ValidityYears { get; set; } + [JsonPropertyName("validityDays")] [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] public int? ValidityDays { get; set; } diff --git a/CERTInext/API/V2/CertificateRequestV2.cs b/CERTInext/API/V2/CertificateRequestV2.cs new file mode 100644 index 0000000..d645c09 --- /dev/null +++ b/CERTInext/API/V2/CertificateRequestV2.cs @@ -0,0 +1,153 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System.Text.Json.Serialization; +using System.Text.Json; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.API.V2 +{ + // --------------------------------------------------------------------------- + // V2 REST API — Request DTOs + // + // Auth: POST {ApiUrlV2}/oauth/token (form-encoded client_credentials) + // Product code: X-Product-Code header (not in body) + // Idempotency: Idempotency-Key header required on all unsafe POSTs + // --------------------------------------------------------------------------- + + /// + /// Requestor information block sent with every V2 order. + /// + public class V2Requestor + { + [JsonPropertyName("name")] + public string Name { get; set; } + + [JsonPropertyName("email")] + public string Email { get; set; } + + [JsonPropertyName("phone")] + public string Phone { get; set; } + + [JsonPropertyName("designation")] + public string Designation { get; set; } + } + + /// + /// Certificate parameters block for V2 SSL orders. + /// + public class V2CertificateParams + { + [JsonPropertyName("domain")] + public string Domain { get; set; } + + [JsonPropertyName("autoSecureWww")] + public bool AutoSecureWww { get; set; } = false; + } + + /// + /// Subscription parameters block for V2 orders (validity, auto-renewal). + /// + public class V2SubscriptionParams + { + [JsonPropertyName("validityYears")] + public int ValidityYears { get; set; } = 1; + + [JsonPropertyName("autoRenew")] + public bool AutoRenew { get; set; } = false; + + [JsonPropertyName("renewBeforeDays")] + public int RenewBeforeDays { get; set; } = 30; + } + + /// + /// Subscriber agreement block required for V2 SSL orders. + /// + public class V2AgreementParams + { + [JsonPropertyName("signerName")] + public string SignerName { get; set; } + + /// Optional in V2. Omitted from serialisation when null or empty. + [JsonPropertyName("signerIp")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string SignerIp { get; set; } + + /// Optional in V2. Omitted from serialisation when null or empty. + [JsonPropertyName("signerPlace")] + [JsonIgnore(Condition = JsonIgnoreCondition.WhenWritingNull)] + public string SignerPlace { get; set; } + + [JsonPropertyName("accepted")] + public bool Accepted { get; set; } = true; + } + + /// + /// Request body for POST /api/certinext/v2/ssl-certificates. + /// Product code is sent as the X-Product-Code header (not in this body). + /// + public class V2CreateSslOrderRequest + { + [JsonPropertyName("productVariant")] + public string ProductVariant { get; set; } = "dv"; + + [JsonPropertyName("emailNotifications")] + public string EmailNotifications { get; set; } = "all"; + + [JsonPropertyName("requestor")] + public V2Requestor Requestor { get; set; } + + [JsonPropertyName("certificate")] + public V2CertificateParams Certificate { get; set; } + + [JsonPropertyName("subscription")] + public V2SubscriptionParams Subscription { get; set; } + + [JsonPropertyName("agreement")] + public V2AgreementParams Agreement { get; set; } + + [JsonPropertyName("remarks")] + public string Remarks { get; set; } + } + + /// + /// Request body for PUT /api/certinext/v2/{family}-certificates/{orderId}/csr. + /// + public class V2SubmitCsrRequest + { + [JsonPropertyName("csr")] + public string Csr { get; set; } + + [JsonPropertyName("attested")] + public bool Attested { get; set; } = false; + } + + /// + /// Request body for POST /api/certinext/v2/{family}-certificates/{orderId}/revoke. + /// + public class V2RevokeRequest + { + /// + /// RFC 5280 string reason, kebab-case per the V2 spec. Valid values: unspecified, + /// key-compromise, ca-compromise, affiliation-changed, superseded, + /// cessation-of-operation, certificate-hold, privilege-withdrawn (plus + /// aa-compromise on the signature-certificates / private-pki-certificates + /// endpoints). Sending camelCase gets HTTP 400 — see issues/0019. + /// + [JsonPropertyName("reason")] + public string Reason { get; set; } = "unspecified"; + + [JsonPropertyName("note")] + public string Note { get; set; } + } +} diff --git a/CERTInext/API/V2/CertificateResponseV2.cs b/CERTInext/API/V2/CertificateResponseV2.cs new file mode 100644 index 0000000..c091b45 --- /dev/null +++ b/CERTInext/API/V2/CertificateResponseV2.cs @@ -0,0 +1,288 @@ +// Copyright 2026 Keyfactor +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +using System; +using System.Collections.Generic; +using System.Text.Json.Serialization; + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.API.V2 +{ + // --------------------------------------------------------------------------- + // V2 REST API — Response DTOs + // --------------------------------------------------------------------------- + + /// + /// Standard OAuth2 client_credentials token response (flat shape — no tokenDetails wrapper). + /// POST {ApiUrlV2}/oauth/token with form-encoded body. + /// + public class V2TokenResponse + { + [JsonPropertyName("access_token")] + public string AccessToken { get; set; } + + [JsonPropertyName("token_type")] + public string TokenType { get; set; } + + /// Lifetime in seconds. Typically 3600 (1 hour). + [JsonPropertyName("expires_in")] + public int ExpiresIn { get; set; } = 3600; + + [JsonPropertyName("refresh_token")] + public string RefreshToken { get; set; } + } + + /// + /// HATEOAS link object present in V2 responses. + /// + public class V2Link + { + [JsonPropertyName("href")] + public string Href { get; set; } + } + + /// + /// _links map returned by V2 order responses. + /// Known keys: self, dcv, csr, agreement, certificate, cancel, revoke. + /// + public class V2Links + { + [JsonPropertyName("self")] + public V2Link Self { get; set; } + + [JsonPropertyName("dcv")] + public V2Link Dcv { get; set; } + + [JsonPropertyName("csr")] + public V2Link Csr { get; set; } + + [JsonPropertyName("agreement")] + public V2Link Agreement { get; set; } + + [JsonPropertyName("certificate")] + public V2Link Certificate { get; set; } + + [JsonPropertyName("cancel")] + public V2Link Cancel { get; set; } + + [JsonPropertyName("revoke")] + public V2Link Revoke { get; set; } + } + + /// + /// Response body for POST /api/certinext/v2/{family}-certificates (201 Created). + /// + public class V2CreateOrderResponse + { + [JsonPropertyName("orderId")] + public string OrderId { get; set; } + + [JsonPropertyName("requestId")] + public string RequestId { get; set; } + + /// + /// Initial order status. Typically "pending-dcv" for SSL DV orders. + /// + [JsonPropertyName("status")] + public string Status { get; set; } + + [JsonPropertyName("_links")] + public V2Links Links { get; set; } + } + + /// + /// Response body for GET /api/certinext/v2/{family}-certificates/{orderId}. + /// Contains lifecycle status only — serial number and validity dates are NOT present; + /// those are only in the Download Certificate response. + /// + public class V2OrderStatusResponse + { + [JsonPropertyName("orderId")] + public string OrderId { get; set; } + + [JsonPropertyName("requestId")] + public string RequestId { get; set; } + + /// Current order status string (e.g. "pending-dcv", "issued", "revoked"). + [JsonPropertyName("status")] + public string Status { get; set; } + + [JsonPropertyName("productVariant")] + public string ProductVariant { get; set; } + + [JsonPropertyName("domain")] + public string Domain { get; set; } + + [JsonPropertyName("_links")] + public V2Links Links { get; set; } + + // These fields are unconfirmed in the V2 spec (OQ-1). They are included as + // nullable so a live response that does include them deserializes correctly. + [JsonPropertyName("revocationReason")] + public string RevocationReason { get; set; } + + [JsonPropertyName("revocationDate")] + public DateTime? RevocationDate { get; set; } + + /// ISO 8601 timestamp when the certificate was issued. Present when status = "issued". + [JsonPropertyName("issuedAt")] + public string IssuedAt { get; set; } + + /// ISO 8601 timestamp when the certificate expires. Present when status = "issued". + [JsonPropertyName("expiresAt")] + public string ExpiresAt { get; set; } + } + + /// + /// Response body for GET /api/certinext/v2/{family}-certificates/{orderId}/certificate. + /// Returns the leaf certificate and, when present, intermediate chain PEM strings. + /// + public class V2CertificateDownloadResponse + { + [JsonPropertyName("orderId")] + public string OrderId { get; set; } + + [JsonPropertyName("serialNumber")] + public string SerialNumber { get; set; } + + [JsonPropertyName("subject")] + public string Subject { get; set; } + + [JsonPropertyName("issuer")] + public string Issuer { get; set; } + + [JsonPropertyName("notBefore")] + public DateTime? NotBefore { get; set; } + + [JsonPropertyName("notAfter")] + public DateTime? NotAfter { get; set; } + + /// PEM-encoded leaf certificate. + [JsonPropertyName("certificatePem")] + public string CertificatePem { get; set; } + + /// + /// Array of intermediate PEM strings returned alongside the leaf cert. + /// May be null or empty when the CA does not include chain in the response. + /// + [JsonPropertyName("chainPem")] + public List ChainPem { get; set; } + } + + /// + /// Response body for GET /api/certinext/v2/ssl-certificates/{orderId}/dcv. + /// Returns the DCV challenge details needed to publish a DNS TXT record. + /// dcvMethod: "2" = DNS-TXT, "1" = HTTP file. + /// + public class V2DcvChallengeResponse + { + [JsonPropertyName("orderNumber")] + public string OrderNumber { get; set; } + + [JsonPropertyName("domainName")] + public string DomainName { get; set; } + + /// "2" = DNS-TXT, "1" = HTTP file. + [JsonPropertyName("dcvMethod")] + public string DcvMethod { get; set; } + + /// Value to publish as the DNS TXT record (the token). + [JsonPropertyName("fileNameContent")] + public string FileNameContent { get; set; } + + [JsonPropertyName("tokenExpiryDate")] + public string TokenExpiryDate { get; set; } + } + + /// + /// Request body for POST /api/certinext/v2/ssl-certificates/{orderId}/dcv/verify. + /// + public class V2DcvVerifyRequest + { + [JsonPropertyName("domain")] + public string Domain { get; set; } + + /// "dns-txt" for DNS TXT record validation. + [JsonPropertyName("method")] + public string Method { get; set; } + } + + /// + /// Response body for POST /api/certinext/v2/ssl-certificates/{orderId}/dcv/verify. + /// 200 OK with this body, or 204 No Content, both indicate success. + /// 422 with overallStatus="FAILED" indicates verification failure. + /// + public class V2DcvVerifyResponse + { + /// "VERIFIED" on success, "FAILED" on failure. + [JsonPropertyName("overallStatus")] + public string OverallStatus { get; set; } + + [JsonPropertyName("method")] + public string Method { get; set; } + + [JsonPropertyName("verifiedAt")] + public string VerifiedAt { get; set; } + } + + /// + /// RFC 7807 Problem Details error response from the V2 API. + /// Content-Type: application/problem+json + /// + public class V2ProblemDetails + { + [JsonPropertyName("type")] + public string Type { get; set; } + + [JsonPropertyName("title")] + public string Title { get; set; } + + [JsonPropertyName("status")] + public int Status { get; set; } + + [JsonPropertyName("detail")] + public string Detail { get; set; } + + [JsonPropertyName("instance")] + public string Instance { get; set; } + + /// Field-level validation errors (optional). + [JsonPropertyName("errors")] + public List Errors { get; set; } + } + + /// + /// A single field-level validation error from RFC 7807 errors array. + /// + public class V2FieldError + { + [JsonPropertyName("field")] + public string Field { get; set; } + + [JsonPropertyName("message")] + public string Message { get; set; } + } + + /// + /// Response body for GET /api/certinext/v2/auth/me. + /// Used as the V2 connectivity/ping check. + /// + public class V2AuthMeResponse + { + [JsonPropertyName("accountNumber")] + public string AccountNumber { get; set; } + + [JsonPropertyName("authType")] + public string AuthType { get; set; } + } +} diff --git a/CERTInext/CERTInextCAPlugin.cs b/CERTInext/CERTInextCAPlugin.cs index 231f611..cc40a6d 100644 --- a/CERTInext/CERTInextCAPlugin.cs +++ b/CERTInext/CERTInextCAPlugin.cs @@ -14,6 +14,7 @@ using System.Threading.Tasks; using Keyfactor.AnyGateway.Extensions; using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; using Keyfactor.Extensions.CAPlugin.CERTInext.Client; using Keyfactor.Extensions.CAPlugin.CERTInext.Models; using Keyfactor.Logging; @@ -240,6 +241,13 @@ public void Initialize(IAnyCAPluginConfigProvider configProvider, ICertificateDa bool hasClientId = !string.IsNullOrWhiteSpace(_config.OAuth2ClientId); bool hasClientSecret= !string.IsNullOrWhiteSpace(_config.OAuth2ClientSecret); bool hasTokenUrl = !string.IsNullOrWhiteSpace(_config.OAuth2TokenUrl); + bool hasOrganizationNumber = !string.IsNullOrWhiteSpace(_config.OrganizationNumber); + bool hasDefaultProductCode = !string.IsNullOrWhiteSpace(_config.DefaultProductCode); + bool hasGroupNumber = !string.IsNullOrWhiteSpace(_config.GroupNumber); + + int effectivePickupRetries = _config.GetEffectivePickupRetries(); + int effectivePickupDelay = _config.GetEffectivePickupDelaySeconds(); + string preVettingMode = hasOrganizationNumber ? "1 (use pre-vetted org)" : "omitted (no org configured)"; _logger.LogInformation( "CERTInext plugin initialized. " + @@ -247,15 +255,35 @@ public void Initialize(IAnyCAPluginConfigProvider configProvider, ICertificateDa "ApiKeyPresent={ApiKeyPresent}, UsernamePresent={UsernamePresent}, " + "PasswordPresent={PasswordPresent}, OAuth2ClientIdPresent={OAuth2ClientIdPresent}, " + "OAuth2ClientSecretPresent={OAuth2ClientSecretPresent}, OAuth2TokenUrlPresent={OAuth2TokenUrlPresent}, " + - "PageSize={PageSize}, IgnoreExpired={IgnoreExpired}, " + + "OrganizationNumber={OrganizationNumber}, PreVetting={PreVetting}, " + + "DefaultProductCode={DefaultProductCode}, GroupNumber={GroupNumber}, " + + "AccountingModel={AccountingModel}, EmailNotifications={EmailNotifications}, " + + "AutoSecureWww={AutoSecureWww}, ValidityYears={ValidityYears}, " + + "AutoRenew={AutoRenew}, RenewCriteriaDays={RenewCriteriaDays}, " + + "PageSize={PageSize}, IgnoreExpired={IgnoreExpired}, SubmitNonDnsSans={SubmitNonDnsSans}, " + + "PickupRetries={PickupRetries}, PickupDelay={PickupDelay}, " + "DcvEnabled={DcvEnabled}, DcvTxtRecordTemplate={DcvTxtRecordTemplate}, " + + "DcvPropagationDelaySeconds={DcvPropagationDelay}, DcvTimeoutMinutes={DcvTimeout}, " + + "DcvWaitForChallengeSeconds={DcvWaitChallenge}, DcvWaitForIssuanceSeconds={DcvWaitIssuance}, " + "DomainValidatorFactoryInjected={FactoryInjected}", _config.ApiUrl, _config.AuthMode, _config.Enabled, hasApiKey, hasUsername, hasPassword, hasClientId, hasClientSecret, hasTokenUrl, - _config.PageSize, _config.IgnoreExpired, + hasOrganizationNumber ? _config.OrganizationNumber : "(not configured)", preVettingMode, + hasDefaultProductCode ? _config.DefaultProductCode : "(not configured)", + hasGroupNumber ? _config.GroupNumber : "(not configured)", + string.IsNullOrWhiteSpace(_config.AccountingModel) ? "2 (default)" : _config.AccountingModel, + string.IsNullOrWhiteSpace(_config.EmailNotifications) ? "0 (default)" : _config.EmailNotifications, + string.IsNullOrWhiteSpace(_config.AutoSecureWww) ? "0 (default)" : _config.AutoSecureWww, + string.IsNullOrWhiteSpace(_config.SubscriptionValidityYears) ? "1 (default)" : _config.SubscriptionValidityYears, + string.IsNullOrWhiteSpace(_config.SubscriptionAutoRenew) ? "0 (default)" : _config.SubscriptionAutoRenew, + string.IsNullOrWhiteSpace(_config.SubscriptionRenewCriteriaDays) ? "30 (default)" : _config.SubscriptionRenewCriteriaDays, + _config.PageSize, _config.IgnoreExpired, _config.SubmitNonDnsSans, + effectivePickupRetries, effectivePickupDelay, _config.DcvEnabled, _config.DcvTxtRecordTemplate, + _config.DcvPropagationDelaySeconds, _config.DcvTimeoutMinutes, + _config.DcvWaitForChallengeSeconds, _config.DcvWaitForIssuanceSeconds, _domainValidatorFactory != null); // SOC2 CC7.1: surface silent functional downgrades. If DCV is enabled in @@ -330,15 +358,24 @@ public async Task Ping() try { - await _client.PingAsync(); - // SOC2 CC9.2: connectivity confirmation is a security-relevant event; must be - // at Information so it survives production log filters. - _logger.LogInformation("CERTInext ping successful. ApiUrl={ApiUrl}", _config.ApiUrl); + if (_config.UseV2Api) + { + await _client.PingV2Async(); + _logger.LogInformation("CERTInext V2 ping successful. ApiUrlV2={ApiUrlV2}", _config.ApiUrlV2); + } + else + { + await _client.PingAsync(); + // SOC2 CC9.2: connectivity confirmation is a security-relevant event; must be + // at Information so it survives production log filters. + _logger.LogInformation("CERTInext ping successful. ApiUrl={ApiUrl}", _config.ApiUrl); + } } catch (Exception ex) { - _logger.LogError(ex, "CERTInext ping failed. ApiUrl={ApiUrl}", _config.ApiUrl); - throw new Exception($"Unable to reach CERTInext at {_config.ApiUrl}: {ex.Message}", ex); + string url = _config.UseV2Api ? _config.ApiUrlV2 : _config.ApiUrl; + _logger.LogError(ex, "CERTInext ping failed. Url={Url}, UseV2Api={UseV2Api}", url, _config.UseV2Api); + throw new Exception($"Unable to reach CERTInext at {url}: {ex.Message}", ex); } finally { @@ -413,6 +450,27 @@ public async Task ValidateCAConnectionInfo(Dictionary connection break; } + // V2 additional validation (independent of V1 auth mode errors above) + bool useV2 = connectionInfo.TryGetValue(Constants.ConfigV2.UseV2Api, out object v2Obj) + && v2Obj is bool v2Bool && v2Bool; + if (useV2) + { + string apiUrlV2 = GetStringValue(connectionInfo, Constants.ConfigV2.ApiUrlV2); + string clientId = GetStringValue(connectionInfo, Constants.ConfigV2.ClientId); + string clientSecret = GetStringValue(connectionInfo, Constants.ConfigV2.ClientSecret); + + if (string.IsNullOrWhiteSpace(apiUrlV2)) + errors.Add($"'{Constants.ConfigV2.ApiUrlV2}' is required when UseV2Api is true."); + else if (!Uri.TryCreate(apiUrlV2, UriKind.Absolute, out _)) + errors.Add($"'{Constants.ConfigV2.ApiUrlV2}' is not a valid absolute URI."); + + if (string.IsNullOrWhiteSpace(clientId)) + errors.Add($"'{Constants.ConfigV2.ClientId}' is required when UseV2Api is true."); + + if (string.IsNullOrWhiteSpace(clientSecret)) + errors.Add($"'{Constants.ConfigV2.ClientSecret}' is required when UseV2Api is true."); + } + if (errors.Any()) { // SOX CC6.1: log the validation failure at Warning so it survives production log filters. @@ -430,9 +488,14 @@ public async Task ValidateCAConnectionInfo(Dictionary connection // Build a transient config from the supplied connectionInfo so we don't // rely on the already-initialized _client (which may hold stale creds) string rawConfig = JsonSerializer.Serialize(connectionInfo); - tempConfig = JsonSerializer.Deserialize(rawConfig); + tempConfig = JsonSerializer.Deserialize(rawConfig) + ?? throw new InvalidOperationException("Failed to deserialize connection info."); tempClient = new CERTInextClient(tempConfig); - await tempClient.PingAsync(); + + if (tempConfig.UseV2Api) + await tempClient.PingV2Async(); + else + await tempClient.PingAsync(); } catch (Exception ex) { @@ -441,8 +504,8 @@ public async Task ValidateCAConnectionInfo(Dictionary connection _logger.LogError( ex, "CA connection validation failed — live connectivity test unsuccessful. " + - "ApiUrl={ApiUrl}, AuthMode={AuthMode}", - attemptedApiUrl, attemptedAuthMode); + "ApiUrl={ApiUrl}, UseV2Api={UseV2Api}, AuthMode={AuthMode}", + attemptedApiUrl, tempConfig?.UseV2Api ?? false, attemptedAuthMode); // The inner exception message is NOT forwarded to the AnyCAValidationException // because it may contain HTTP response bodies or header fragments from the @@ -463,7 +526,9 @@ public async Task ValidateCAConnectionInfo(Dictionary connection tempConfig.ApiKey = string.Empty; tempConfig.OAuthClientSecret = string.Empty; tempConfig.Password = string.Empty; + tempConfig.ClientSecret = string.Empty; } + tempClient?.Dispose(); } _logger.LogInformation( @@ -479,15 +544,10 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction string rawConfig = JsonSerializer.Serialize(connectionInfo); var tempConfig = JsonSerializer.Deserialize(rawConfig); - var tempClient = new CERTInextClient(tempConfig); var params_ = new EnrollmentParams(productInfo); string profileId = params_.ProfileId; - _logger.LogInformation( - "Product/profile validation attempt started. ProfileId={ProfileId}, ProductID={ProductID}", - profileId, productInfo?.ProductID); - if (string.IsNullOrWhiteSpace(profileId)) { _logger.LogWarning( @@ -497,6 +557,12 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction $"Template parameter '{Constants.EnrollmentParam.ProfileId}' is required but was not set."); } + _logger.LogInformation( + "Product/profile validation attempt started. ProfileId={ProfileId}, ProductID={ProductID}", + profileId, productInfo?.ProductID); + + var tempClient = new CERTInextClient(tempConfig); + try { var profiles = await tempClient.GetProfilesAsync(); @@ -540,7 +606,9 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction tempConfig.ApiKey = string.Empty; tempConfig.OAuthClientSecret = string.Empty; tempConfig.Password = string.Empty; + tempConfig.ClientSecret = string.Empty; } + tempClient?.Dispose(); } _logger.LogInformation("Product/profile validation succeeded. ProfileId={ProfileId}", profileId); @@ -573,40 +641,48 @@ public async Task Enroll( _logger.LogInformation( "Enrollment attempt started. " + - "EnrollmentType={EnrollmentType}, Subject={Subject}, " + + "EnrollmentType={EnrollmentType}, RequestFormat={RequestFormat}, Subject={Subject}, " + "ProfileId={ProfileId}, SANs={SANs}, " + "RequesterName={RequesterName}, RequesterEmail={RequesterEmail}", - enrollmentType, subject, - ep.ProfileId, sanSummary, - ep.RequesterName, ep.RequesterEmail); + enrollmentType, requestFormat, LogSanitizer.Strip(subject), + ep.ProfileId, LogSanitizer.Strip(sanSummary), + LogSanitizer.Strip(ep.RequesterName), LogSanitizer.Strip(ep.RequesterEmail)); if (string.IsNullOrWhiteSpace(ep.ProfileId)) { _logger.LogError( "Enrollment rejected — ProfileId parameter is missing. Subject={Subject}, EnrollmentType={EnrollmentType}", - subject, enrollmentType); + LogSanitizer.Strip(subject), enrollmentType); throw new Exception($"Template parameter '{Constants.EnrollmentParam.ProfileId}' is required."); } EnrollmentResult result; - switch (enrollmentType) + if (_config.UseV2Api) { - case EnrollmentType.New: - case EnrollmentType.Reissue: - result = await EnrollNewAsync(csr, subject, san, ep); - break; - - case EnrollmentType.Renew: - case EnrollmentType.RenewOrReissue: - result = await RenewOrReissueAsync(csr, subject, san, productInfo, ep); - break; - - default: - _logger.LogError( - "Enrollment rejected — unsupported enrollment type. EnrollmentType={EnrollmentType}, Subject={Subject}", - enrollmentType, subject); - throw new NotSupportedException($"Enrollment type '{enrollmentType}' is not supported."); + // V2 path: all enrollment types go through EnrollV2Async + result = await EnrollV2Async(csr, subject, san, ep, enrollmentType); + } + else + { + switch (enrollmentType) + { + case EnrollmentType.New: + case EnrollmentType.Reissue: + result = await EnrollNewAsync(csr, subject, san, ep); + break; + + case EnrollmentType.Renew: + case EnrollmentType.RenewOrReissue: + result = await RenewOrReissueAsync(csr, subject, san, productInfo, ep); + break; + + default: + _logger.LogError( + "Enrollment rejected — unsupported enrollment type. EnrollmentType={EnrollmentType}, Subject={Subject}", + enrollmentType, LogSanitizer.Strip(subject)); + throw new NotSupportedException($"Enrollment type '{enrollmentType}' is not supported."); + } } // SOX: the completion log must include the CA-assigned identifier, serial number, @@ -617,7 +693,7 @@ public async Task Enroll( "SerialNumber={SerialNumber}, Subject={Subject}, ProfileId={ProfileId}", enrollmentType, result.CARequestID, result.Status, result.Certificate != null ? ExtractSerialFromPem(result.Certificate) : "(pending)", - subject, ep.ProfileId); + LogSanitizer.Strip(subject), ep.ProfileId); _logger.MethodExit(LogLevel.Debug); return result; } @@ -630,7 +706,10 @@ public async Task Enroll( public async Task GetSingleRecord(string caRequestID) { _logger.MethodEntry(LogLevel.Debug); - _logger.LogInformation("GetSingleRecord started. CARequestID={Id}", caRequestID); + _logger.LogInformation("GetSingleRecord started. CARequestID={Id}, UseV2Api={UseV2Api}", caRequestID, _config.UseV2Api); + + if (_config.UseV2Api) + return await GetSingleRecordV2Async(caRequestID); try { @@ -690,6 +769,9 @@ public async Task Revoke(string caRequestID, string hexSerialNumber, uint r { _logger.MethodEntry(LogLevel.Debug); + if (_config.UseV2Api) + return await RevokeV2Async(caRequestID, hexSerialNumber, revocationReason); + string reasonString = StatusMapper.ToRevocationReason(revocationReason); // SOX: log the revocation attempt before any state change so the intent is @@ -727,7 +809,7 @@ public async Task Revoke(string caRequestID, string hexSerialNumber, uint r _logger.LogWarning( "Revocation skipped — certificate is already revoked. " + "CARequestID={Id}, HexSerialNumber={Serial}, Subject={Subject}", - caRequestID, hexSerialNumber, current.Subject); + caRequestID, hexSerialNumber, LogSanitizer.Strip(current.Subject)); return (int)EndEntityStatus.REVOKED; } @@ -756,7 +838,7 @@ public async Task Revoke(string caRequestID, string hexSerialNumber, uint r "Revocation complete. " + "CARequestID={Id}, HexSerialNumber={Serial}, Subject={Subject}, " + "ReasonCode={ReasonCode}, ReasonString={ReasonString}", - caRequestID, hexSerialNumber, current.Subject, + caRequestID, hexSerialNumber, LogSanitizer.Strip(current.Subject), revocationReason, reasonString); _logger.MethodExit(LogLevel.Debug); return (int)EndEntityStatus.REVOKED; @@ -777,9 +859,18 @@ public async Task Synchronize( DateTime? issuedAfter = fullSync ? (DateTime?)null : lastSync; + if (_config.UseV2Api) + { + // V2 /reports/orders endpoint returns 501 Not Implemented. + // Synchronize continues to use the V1 GetOrderReport until V2 reports ship. + _logger.LogWarning( + "Synchronize uses V1 GetOrderReport; V2 /reports/orders is not yet available. " + + "UseV2Api=true does not affect sync — V1 credentials (ApiUrl, ApiKey/AccountNumber) must remain configured."); + } + _logger.LogInformation( - "Starting CERTInext synchronization. FullSync={FullSync}, IssuedAfter={IssuedAfter}", - fullSync, issuedAfter?.ToString("O") ?? "none"); + "Starting CERTInext synchronization. FullSync={FullSync}, IssuedAfter={IssuedAfter}, UseV2Api={UseV2Api}", + fullSync, issuedAfter?.ToString("O") ?? "none", _config.UseV2Api); int synced = 0; int skipped = 0; @@ -937,7 +1028,8 @@ public async Task Synchronize( status = StatusMapper.ToRequestDisposition(current.Status); _logger.LogDebug( "Sync: refetched order Id={Id} — status={Status}, certBytes={Bytes}, subject={Subject}.", - current.Id, status, current.Certificate?.Length ?? 0, current.Subject); + current.Id, status, current.Certificate?.Length ?? 0, + LogSanitizer.Strip(current.Subject)); } catch (Exception fetchEx) { @@ -970,7 +1062,8 @@ public async Task Synchronize( } _logger.LogDebug( "Sync emit: CARequestID={Id}, Status={Status}, CertBytes={CertBytes}, Subject={Subject}", - record.CARequestID, record.Status, record.Certificate?.Length ?? 0, current.Subject); + record.CARequestID, record.Status, record.Certificate?.Length ?? 0, + LogSanitizer.Strip(current.Subject)); blockingBuffer.Add(record, cancelToken); synced++; @@ -1079,6 +1172,428 @@ internal static DcvSyncDecision EvaluateDcvSyncEligibility( return DcvSyncDecision.Attempt; } + // --------------------------------------------------------------------------- + // V2 API private helpers — only called when _config.UseV2Api is true + // --------------------------------------------------------------------------- + + /// + /// Dispatches all enrollment types through the V2 REST API. + /// + private async Task EnrollV2Async( + string csr, + string subject, + Dictionary san, + EnrollmentParams ep, + EnrollmentType enrollmentType) + { + _logger.MethodEntry(LogLevel.Debug); + _logger.LogInformation( + "EnrollV2Async started. EnrollmentType={EnrollmentType}, ProductFamily={Family}, ProductVariant={Variant}, ProductCode={Code}", + enrollmentType, ep.ProductFamilySlug, ep.ProductVariant, ep.ProductCode); + + // Derive the primary domain from subject CN + string domain = ep.DomainName; + if (string.IsNullOrWhiteSpace(domain)) + domain = ExtractCnFromSubject(subject); + if (string.IsNullOrWhiteSpace(domain)) + throw new Exception("Cannot determine primary domain for V2 order — set the DomainName enrollment parameter or ensure the CSR subject has a CN."); + + // V2 API only supports single-domain certificates. autoSecureWww covers the + // www. variant; any other DNS SAN in the CSR would be silently dropped + // or cause a CA-side rejection. Fail fast with a clear message rather than + // letting the CA return an opaque error. See issues/f3-v2-multi-san-limitation.md. + { + var sanEntries = ExtractSanEntriesFromCsr(csr, out _); + var extraSans = sanEntries + .Where(s => string.Equals(s.Type, "dns", StringComparison.OrdinalIgnoreCase)) + .Select(s => s.Value?.ToLowerInvariant()) + .Where(v => !string.IsNullOrWhiteSpace(v)) + .Where(v => !string.Equals(v, domain, StringComparison.OrdinalIgnoreCase)) + .Where(v => !string.Equals(v, "www." + domain, StringComparison.OrdinalIgnoreCase)) + .ToList(); + + if (extraSans.Count > 0) + { + _logger.LogWarning( + "EnrollV2Async rejected multi-SAN CSR for order on domain '{Domain}'. " + + "V2 only supports single-domain certificates (autoSecureWww covers www.). " + + "ExtraSans=[{ExtraSans}]", + LogSanitizer.Strip(domain), + LogSanitizer.Strip(string.Join(", ", extraSans))); + _logger.MethodExit(LogLevel.Debug); + return new EnrollmentResult + { + CARequestID = string.Empty, + Certificate = null, + Status = (int)EndEntityStatus.FAILED, + StatusMessage = $"V2 enrollment rejected: the CSR contains {extraSans.Count} SAN(s) beyond " + + $"the primary domain ('{domain}') and its www. variant. " + + "The V2 API only supports single-domain certificates. " + + "Resubmit with a single-domain CSR." + }; + } + } + + string requestorName = string.IsNullOrWhiteSpace(ep.RequesterName) ? _config.RequestorName : ep.RequesterName; + string requestorEmail = string.IsNullOrWhiteSpace(ep.RequesterEmail) ? _config.RequestorEmail : ep.RequesterEmail; + string signerName = string.IsNullOrWhiteSpace(ep.SignerName) ? requestorName : ep.SignerName; + string signerIp = string.IsNullOrWhiteSpace(ep.SignerIp) ? _config.SignerIp : ep.SignerIp; + string signerPlace = string.IsNullOrWhiteSpace(ep.SignerPlace) ? _config.SignerPlace : ep.SignerPlace; + int validityYears = ep.ValidityYears > 0 ? ep.ValidityYears + : (int.TryParse(_config.SubscriptionValidityYears, out int cfgYears) && cfgYears > 0 ? cfgYears : 1); + + var orderReq = new V2CreateSslOrderRequest + { + ProductVariant = ep.ProductVariant, + EmailNotifications = "all", + Requestor = new V2Requestor + { + Name = requestorName, + Email = requestorEmail, + Phone = _config.RequestorMobileNumber ?? string.Empty, + Designation = "IT Administrator" + }, + Certificate = new V2CertificateParams + { + Domain = domain, + AutoSecureWww = _config.AutoSecureWww == "1" + }, + Subscription = new V2SubscriptionParams + { + ValidityYears = validityYears, + AutoRenew = false, + RenewBeforeDays = 30 + }, + Agreement = new V2AgreementParams + { + SignerName = signerName, + SignerIp = string.IsNullOrWhiteSpace(signerIp) ? null : signerIp, + SignerPlace = string.IsNullOrWhiteSpace(signerPlace) ? null : signerPlace, + Accepted = true + }, + Remarks = "Issued via Keyfactor Command AnyCA REST Gateway." + }; + + var createResp = await _client.PlaceOrderV2Async(ep.ProductFamilySlug, ep.ProductCode, orderReq); + string orderId = createResp.OrderId; + + _logger.LogInformation( + "V2 order placed. OrderId={OrderId}, Status={Status}, EnrollmentType={EnrollmentType}", + orderId, createResp.Status, enrollmentType); + + // The V2 API creates the order in 'pending-csr' and requires a separate PUT to submit + // the CSR before the order can progress to validation or issuance. + await _client.SubmitCsrV2Async(ep.ProductFamilySlug, orderId, csr); + _logger.LogInformation("V2 CSR submitted. OrderId={OrderId}", orderId); + + // Re-read status after CSR submission — the order advances past pending-csr. + // Guard: if TrackOrderV2Async fails transiently here the order is already + // placed and the CSR submitted; return pending with the known orderId so Command + // has a CARequestID and the next sync can resolve the status. + V2OrderStatusResponse postCsrStatus; + int disposition; + try + { + postCsrStatus = await _client.TrackOrderV2Async(ep.ProductFamilySlug, orderId); + disposition = StatusMapper.V2StatusToRequestDisposition(postCsrStatus.Status); + } + catch (Exception trackEx) + { + _logger.LogWarning(trackEx, + "V2 TrackOrderV2Async failed after CSR submission for order {OrderId}; " + + "returning pending so sync can pick it up.", orderId); + _logger.MethodExit(LogLevel.Debug); + return new EnrollmentResult + { + CARequestID = orderId, + Certificate = null, + Status = (int)EndEntityStatus.EXTERNALVALIDATION, + StatusMessage = "V2 order placed and CSR submitted; status check failed transiently — sync will resolve." + }; + } + +#if SUPPORTS_DCV + // Attempt DCV inline when the order lands in pending-dcv and DCV is configured + if (disposition == (int)EndEntityStatus.EXTERNALVALIDATION) + { + int timeoutMinutes = _config.GetEffectiveDcvTimeoutMinutes(); + using var dcvCts = CancellationTokenSource.CreateLinkedTokenSource(CancellationToken.None); + dcvCts.CancelAfter(TimeSpan.FromMinutes(timeoutMinutes)); + try + { + bool dcvDone = await PerformDcvV2IfNeededAsync(orderId, domain, ep.ProductFamilySlug, dcvCts.Token); + if (dcvDone) + { + // Re-check status after DCV completes + var tracked = await _client.TrackOrderV2Async(ep.ProductFamilySlug, orderId); + disposition = StatusMapper.V2StatusToRequestDisposition(tracked.Status); + _logger.LogInformation( + "V2 DCV completed inline for order {OrderId}. Post-DCV status={Status}", + orderId, tracked.Status); + } + } + catch (Exception dcvEx) + { + _logger.LogWarning(dcvEx, + "V2 inline DCV attempt failed for order {OrderId}; order will remain pending for sync.", + orderId); + } + } +#endif + + // If the order issued immediately, download the certificate + if (disposition == (int)EndEntityStatus.GENERATED) + { + try + { + var certResp = await _client.DownloadCertificateV2Async(ep.ProductFamilySlug, orderId); + string fullChain = AssembleV2CertChain(certResp); + _logger.LogInformation( + "V2 certificate downloaded immediately. OrderId={OrderId}, SerialNumber={Serial}, ChainPemCount={ChainCount}", + orderId, certResp.SerialNumber, certResp.ChainPem?.Count ?? 0); + _logger.MethodExit(LogLevel.Debug); + return new EnrollmentResult + { + CARequestID = orderId, + Certificate = fullChain, + Status = (int)EndEntityStatus.GENERATED, + StatusMessage = "Certificate issued via V2 API." + }; + } + catch (Exception dlEx) + { + _logger.LogWarning(dlEx, + "V2 order is 'issued' but certificate download failed — returning pending. OrderId={OrderId}", + orderId); + } + } + + // Return as pending for gateway to pick up via sync + _logger.MethodExit(LogLevel.Debug); + return new EnrollmentResult + { + CARequestID = orderId, + Certificate = null, + Status = disposition == (int)EndEntityStatus.GENERATED + ? (int)EndEntityStatus.EXTERNALVALIDATION + : disposition, + StatusMessage = $"V2 order placed. Status={createResp.Status}" + }; + } + + /// + /// Retrieves a single certificate record via the V2 REST API. + /// + private async Task GetSingleRecordV2Async(string caRequestID) + { + _logger.MethodEntry(LogLevel.Debug); + + try + { + // Use the family-aware resolve so DCV (if needed) hits the correct endpoint for + // non-SSL families (private-pki, signature). ResolveAndTrackOrderV2Async discards + // the family; here we keep it to thread through PerformDcvV2IfNeededAsync. + var (resolvedFamily, statusResp) = await _client.ResolveAndTrackOrderV2WithFamilyAsync(caRequestID); + int disposition = StatusMapper.V2StatusToRequestDisposition(statusResp.Status); + +#if SUPPORTS_DCV + // Mirror V1 GetSingleRecord: attempt DCV on pending-dcv orders so a manual + // single-record refresh can unstick an order whose DCV wasn't completed at enroll time. + if (disposition == (int)EndEntityStatus.EXTERNALVALIDATION + && !string.IsNullOrWhiteSpace(statusResp.Domain)) + { + int timeoutMinutes = _config.GetEffectiveDcvTimeoutMinutes(); + using var dcvCts = new CancellationTokenSource(TimeSpan.FromMinutes(timeoutMinutes)); + try + { + bool dcvDone = await PerformDcvV2IfNeededAsync( + caRequestID, statusResp.Domain, resolvedFamily, dcvCts.Token); + if (dcvDone) + { + statusResp = await _client.ResolveAndTrackOrderV2Async(caRequestID); + disposition = StatusMapper.V2StatusToRequestDisposition(statusResp.Status); + } + } + catch (Exception dcvEx) + { + _logger.LogWarning(dcvEx, + "V2 GetSingleRecord: DCV attempt failed for order {Id}.", caRequestID); + } + } +#endif + + string certPem = null; + if (disposition == (int)EndEntityStatus.GENERATED) + { + if (!string.IsNullOrWhiteSpace(statusResp.ExpiresAt)) + _logger.LogDebug( + "V2 order expiry from status response. CARequestID={Id}, ExpiresAt={ExpiresAt}", + caRequestID, statusResp.ExpiresAt); + + try + { + var certResp = await _client.ResolveAndDownloadCertificateV2Async(caRequestID); + certPem = AssembleV2CertChain(certResp); + } + catch (Exception dlEx) + { + _logger.LogWarning(dlEx, + "V2 GetSingleRecord: order is issued but certificate download failed. CARequestID={Id}", + caRequestID); + } + } + + _logger.LogInformation( + "GetSingleRecordV2 complete. CARequestID={Id}, V2Status={Status}, Disposition={Disposition}", + caRequestID, statusResp.Status, disposition); + _logger.MethodExit(LogLevel.Debug); + + return new AnyCAPluginCertificate + { + CARequestID = caRequestID, + Certificate = certPem, + Status = disposition, + ProductID = statusResp.ProductVariant ?? string.Empty + }; + } + catch (KeyNotFoundException) + { + _logger.LogWarning("V2: Certificate not found. CARequestID={Id}", caRequestID); + throw; + } + catch (Exception ex) + { + _logger.LogError(ex, "V2: Error retrieving certificate. CARequestID={Id}", caRequestID); + throw; + } + } + + /// + /// Assembles a full PEM chain from a V2 certificate download response. + /// Concatenates the leaf certificatePem and any intermediate PEM strings + /// in chainPem (when present) in leaf-first order, matching the V1 chain format. + /// + private static string AssembleV2CertChain(V2CertificateDownloadResponse certResp) + { + if (certResp?.ChainPem == null || certResp.ChainPem.Count == 0) + return certResp?.CertificatePem; + + var sb = new System.Text.StringBuilder(); + if (string.IsNullOrWhiteSpace(certResp.CertificatePem)) + throw new InvalidOperationException( + $"V2 certificate download for order '{certResp?.OrderId}' returned a null or empty leaf " + + "certificate PEM while a chain PEM is present; cannot assemble a valid chain without the leaf."); + sb.Append(certResp.CertificatePem.TrimEnd()); + foreach (var intermediate in certResp.ChainPem) + { + if (string.IsNullOrWhiteSpace(intermediate)) continue; + sb.AppendLine(); + sb.Append(intermediate.TrimEnd()); + } + return sb.ToString(); + } + + /// + /// Revokes a certificate via the V2 REST API. + /// + private async Task RevokeV2Async(string caRequestID, string hexSerialNumber, uint revocationReason) + { + _logger.MethodEntry(LogLevel.Debug); + + string v2Reason = StatusMapper.ToV2RevocationReason(revocationReason); + + _logger.LogInformation( + "Revocation V2 attempt started. CARequestID={Id}, HexSerialNumber={Serial}, " + + "ReasonCode={ReasonCode}, V2Reason={V2Reason}", + caRequestID, hexSerialNumber, revocationReason, v2Reason); + + // Pre-flight: resolve which product family owns this order (via TrackOrder, + // which probes families and 404s cleanly per-family) and verify it is revocable. + // This resolves the family definitively *before* we ever call revoke, so a 404 + // from RevokeOrderV2Async below is unambiguous — issues/0019: revoke's own 404 + // means "not found or not revokable" (per spec), and probing multiple families + // on a revoke 404 previously produced a misleading "not found in any product + // family" for orders that legitimately exist but simply aren't revokable yet. + V2OrderStatusResponse currentStatus; + string resolvedFamily; + try + { + (resolvedFamily, currentStatus) = await _client.ResolveAndTrackOrderV2WithFamilyAsync(caRequestID); + } + catch (Exception ex) + { + _logger.LogError(ex, + "V2 revocation pre-flight failed. CARequestID={Id}", + caRequestID); + throw; + } + + int disposition = StatusMapper.V2StatusToRequestDisposition(currentStatus.Status); + if (disposition == (int)EndEntityStatus.REVOKED) + { + _logger.LogWarning( + "V2 revocation skipped — already revoked. CARequestID={Id}", + caRequestID); + _logger.MethodExit(LogLevel.Debug); + return (int)EndEntityStatus.REVOKED; + } + + if (disposition != (int)EndEntityStatus.GENERATED) + { + throw new Exception( + $"V2 certificate '{caRequestID}' cannot be revoked: current status is '{currentStatus.Status}'. " + + "Only issued certificates may be revoked."); + } + + var revokeReq = new V2RevokeRequest + { + Reason = v2Reason, + Note = $"Revoked via Keyfactor Command. CRL reason code: {revocationReason} ({v2Reason})." + }; + + try + { + await _client.RevokeOrderV2Async(resolvedFamily, caRequestID, revokeReq); + } + catch (KeyNotFoundException knf) + { + // We already confirmed the order lives in `resolvedFamily` via TrackOrder + // above, so a 404 here is the spec's other documented meaning — "not in a + // revokable state" — not a genuine family miss. Surface that plainly + // instead of retrying other families. + throw new InvalidOperationException( + $"V2 order '{caRequestID}' (family '{resolvedFamily}') could not be revoked: " + + $"CERTInext reports it as not found or not in a revokable state. {knf.Message}"); + } + + _logger.LogInformation( + "V2 revocation complete. CARequestID={Id}, HexSerialNumber={Serial}, V2Reason={V2Reason}, Family={Family}", + caRequestID, hexSerialNumber, v2Reason, resolvedFamily); + _logger.MethodExit(LogLevel.Debug); + return (int)EndEntityStatus.REVOKED; + } + + // --------------------------------------------------------------------------- + // V2 private utility + // --------------------------------------------------------------------------- + + private static string ExtractCnFromSubject(string subject) + { + if (string.IsNullOrWhiteSpace(subject)) return null; + // subject format: "CN=example.com, O=Org, ..." + foreach (var part in subject.Split(',')) + { + var trimmed = part.Trim(); + if (trimmed.StartsWith("CN=", StringComparison.OrdinalIgnoreCase)) + return trimmed.Substring(3).Trim(); + } + return null; + } + + // --------------------------------------------------------------------------- + // V1 private helpers + // --------------------------------------------------------------------------- + /// /// Handles New and Reissue enrollment flows by submitting a fresh certificate /// request to CERTInext. @@ -1094,9 +1609,10 @@ private async Task EnrollNewAsync( { ProfileId = ep.ProfileId, Csr = csr, + ValidityYears = ep.ValidityYears > 0 ? ep.ValidityYears : (int?)null, ValidityDays = ep.ValidityDays > 0 ? ep.ValidityDays : (int?)null, Subject = subject, - Sans = BuildSanList(san), + Sans = BuildSanList(san, csr, subject), RequesterName = string.IsNullOrWhiteSpace(ep.RequesterName) ? null : ep.RequesterName, RequesterEmail = string.IsNullOrWhiteSpace(ep.RequesterEmail) ? null : ep.RequesterEmail, KeyType = string.IsNullOrWhiteSpace(ep.KeyType) ? null : ep.KeyType, @@ -1105,12 +1621,38 @@ private async Task EnrollNewAsync( var enrollResp = await _client.EnrollCertificateAsync(enrollReq); + // Whether the DCV block below took ownership of the in-call issuance wait for this + // order. Declared outside the #if so both build flavors compile the pickup gate the + // same way (it simply stays false on the no-DCV build). When true, the synchronous + // pickup poll is skipped: on the DCV build the DCV path already owns the issuance + // decision — it either ran WaitForIssuanceAfterDcvAsync itself, deferred to another + // in-flight caller, or determined the order is terminal / not yet validated — so a + // second stacked poll would either double the wait or burn the budget polling an + // order that can never issue in-call (regression guard: a cancelled/rejected order + // must not be re-polled here after DCV already short-circuited it). + bool dcvIssuanceWaitRan = false; + #if SUPPORTS_DCV // DCV: run domain validation if enabled, the factory was injected, and the // order was accepted (not immediately failed). string orderNumber = enrollResp.Id; if (_domainValidatorFactory != null && _config.DcvEnabled && !string.IsNullOrEmpty(orderNumber)) { + // DCV owns the in-call issuance wait for this order from here on: every exit from + // this block (duplicate in-flight, DCV-validated + issuance poll, terminal order, + // or challenge-not-yet-exposed) is a decision the pickup poll must not second-guess. + // Set before any await so it holds on every path out of the block. + // + // This is intentionally coarse — keyed on "the DCV subsystem engaged for this order", + // not on "a DCV wait is actively running". The one case it over-defers is an order + // whose pending domains are all assigned to a non-DNS-01 method (HTTP/email): DCV does + // no work, yet pickup is skipped. That is an accepted trade: this plugin only drives + // DNS-01, so such orders depend on out-of-band validation and would not issue within + // the ~55s pickup window anyway — the next sync completes them. Distinguishing that + // sub-case from the terminal/cancelled case (which MUST skip pickup) would require a + // richer PerformDcvIfNeededAsync result and risk re-opening the terminal-order regression. + dcvIssuanceWaitRan = true; + // SOX CC7.3: bound the entire DCV flow with a hard timeout so a stuck // DNS provider or extreme propagation delay cannot hold a gateway worker // thread indefinitely. Configurable via DcvTimeoutMinutes (config or @@ -1170,8 +1712,15 @@ private async Task EnrollNewAsync( } #endif + // Synchronous certificate pickup (Sectigo-parity): poll for the issued certificate so + // a fast-issuing order returns GENERATED + PEM in this same call. No-op for the + // already-issued/failed case and for OV/EV orders that CERTInext issues asynchronously + // — those fall back to the pending result and are imported by the next sync. + var newResult = BuildEnrollmentResult(enrollResp, ep.AutoApprove); + newResult = await PickUpEnrolledCertificateAsync(newResult, enrollResp.Id, dcvIssuanceWaitRan); + _logger.MethodExit(LogLevel.Debug); - return BuildEnrollmentResult(enrollResp, ep.AutoApprove); + return newResult; } /// @@ -1196,7 +1745,7 @@ private async Task RenewOrReissueAsync( _logger.LogInformation( "Renewal/reissue probe — read PriorCertSN from EnrollmentProductInfo. " + "Subject={Subject}, PriorCertSN={PriorCertSN}, RenewalWindowDays={WindowDays}", - subject, string.IsNullOrWhiteSpace(priorCertSn) ? "(none)" : priorCertSn, + LogSanitizer.Strip(subject), string.IsNullOrWhiteSpace(priorCertSn) ? "(none)" : priorCertSn, ep.RenewalWindowDays); if (string.IsNullOrWhiteSpace(priorCertSn)) @@ -1205,7 +1754,7 @@ private async Task RenewOrReissueAsync( // production log filters and are available for anomaly detection. _logger.LogInformation( "Renewal/reissue has no PriorCertSN — treating as new enrollment. Subject={Subject}", - subject); + LogSanitizer.Strip(subject)); return await EnrollNewAsync(csr, subject, san, ep); } @@ -1226,7 +1775,7 @@ private async Task RenewOrReissueAsync( { _logger.LogInformation( "CARequestID for serial '{SN}' is empty — falling back to new enrollment. Subject={Subject}", - priorCertSn, subject); + priorCertSn, LogSanitizer.Strip(subject)); return await EnrollNewAsync(csr, subject, san, ep); } @@ -1275,11 +1824,18 @@ private async Task RenewOrReissueAsync( _logger.LogInformation( "Renewal via CERTInext renew API started. " + "PriorCARequestID={PriorId}, Subject={Subject}, ProfileId={ProfileId}", - priorCaRequestId, subject, ep.ProfileId); + priorCaRequestId, LogSanitizer.Strip(subject), ep.ProfileId); var renewReq = new RenewCertificateRequest { Csr = csr, + // Renewals go out as a fresh CERTInext order, so they need the same domain + // set as a new enrollment — otherwise a renewed UCC certificate comes back + // holding only its primary domain. + Subject = subject, + Sans = BuildSanList(san, csr, subject), + ProfileId = ep.ProductCode, + ValidityYears = ep.ValidityYears > 0 ? ep.ValidityYears : (int?)null, ValidityDays = ep.ValidityDays > 0 ? ep.ValidityDays : (int?)null, RequesterName = string.IsNullOrWhiteSpace(ep.RequesterName) ? null : ep.RequesterName, RequesterEmail = string.IsNullOrWhiteSpace(ep.RequesterEmail) ? null : ep.RequesterEmail, @@ -1297,13 +1853,17 @@ private async Task RenewOrReissueAsync( "PriorCARequestID={PriorId}, NewCARequestID={NewId}, Status={Status}", priorCaRequestId, renewResult.CARequestID, renewResult.Status); + // Synchronous certificate pickup (Sectigo-parity), same as the new-enrollment path. + // The renew path never runs an in-call DCV issuance wait, so pickup always applies. + renewResult = await PickUpEnrolledCertificateAsync(renewResult, renewResp.Id, dcvIssuanceWaitRan: false); + return renewResult; } else { _logger.LogInformation( "Certificate '{Id}' is outside the renewal window ({Window} days) — issuing new certificate. Subject={Subject}", - priorCaRequestId, ep.RenewalWindowDays, subject); + priorCaRequestId, ep.RenewalWindowDays, LogSanitizer.Strip(subject)); return await EnrollNewAsync(csr, subject, san, ep); } } @@ -1518,6 +2078,9 @@ private async Task PerformDcvIfNeededAsync( } catch (OperationCanceledException) { + // Rethrow if the gateway-level token is cancelled so shutdown is not blocked; + // only swallow an internal timeout (e.g. a per-poll deadline CTS). + ct.ThrowIfCancellationRequested(); return false; } } @@ -1565,27 +2128,61 @@ private async Task PerformDcvIfNeededAsync( // SOX CC6.1: validate domain names before passing them to the DNS provider plugin // or the CERTInext API. A malformed domain (empty, whitespace, or containing // characters outside the FQDN alphabet) could cause log injection or unexpected - // DNS plugin behaviour. Invalid entries are rejected loudly rather than silently - // skipped so the condition is visible in the audit trail. - foreach (var (domain, _) in pendingDomains) + // DNS plugin behaviour. Invalid entries are rejected loudly — LogError, so the + // condition is visible in the audit trail — but they are EXCLUDED rather than + // thrown on. + // + // Throwing here would fail the whole order: the exception escapes Enroll (which has + // no catch) after the order was already placed at the CA, so the enrollment reports + // failure with an orphaned order, and no TXT record is staged for the *valid* domains + // on the same order. Worse, it is unrecoverable — every later Synchronize / + // GetSingleRecord retry re-enters here, hits the same undrainable domain, and + // TryRunDcvDuringSyncAsync swallows the exception and returns false, so the order sits + // at EXTERNALVALIDATION forever. + // + // This is reachable in normal operation now that non-DNS SANs are submitted to + // CERTInext (see BuildSanList): the CA registers an email/URI SAN verbatim as an order + // domain, and that key is not an FQDN. One such SAN must not strand the DNS names + // alongside it. Same principle the EMS-956 branch below states explicitly: do not throw + // out of DCV for a condition that leaves the order legitimately pending. + var invalidDomains = new List(); + var validPendingDomains = new List>(); + + foreach (var entry in pendingDomains) { - if (string.IsNullOrWhiteSpace(domain)) - throw new InvalidOperationException( - $"TrackOrder returned a blank domain key in domainVerification for order '{orderNumber}'. " + - "Cannot proceed with DCV."); + string domain = entry.Key; + + // Allow standard FQDN characters plus wildcard prefix (*.example.com). + // + // \A/\z, not ^/$: in .NET's default (non-Multiline) mode, $ matches immediately + // before a single trailing '\n', not only at the true end of the string — so + // "evil.com\n" passes a ^...$ version of this regex. \A and \z are absolute + // start/end-of-string anchors regardless of RegexOptions, so a value with any + // trailing control character is correctly rejected here rather than reaching the + // unsanitized-looking-safe domain this validation exists to guarantee. + bool valid = !string.IsNullOrWhiteSpace(domain) + && System.Text.RegularExpressions.Regex.IsMatch( + domain, @"\A(\*\.)?[a-zA-Z0-9]([a-zA-Z0-9\-\.]*[a-zA-Z0-9])?\z"); + + if (valid) + validPendingDomains.Add(entry); + else + invalidDomains.Add(string.IsNullOrWhiteSpace(domain) ? "(blank)" : domain); + } - // Allow standard FQDN characters plus wildcard prefix (*.example.com) - if (!System.Text.RegularExpressions.Regex.IsMatch(domain, @"^(\*\.)?[a-zA-Z0-9]([a-zA-Z0-9\-\.]*[a-zA-Z0-9])?$")) - { - _logger.LogError( - "DCV domain name failed validation and will not be processed. OrderNumber={OrderNumber}, Domain={Domain}", - orderNumber, domain); - throw new InvalidOperationException( - $"TrackOrder returned an invalid domain name '{domain}' in domainVerification for order '{orderNumber}'. " + - "Domain names must conform to FQDN syntax."); - } + if (invalidDomains.Count > 0) + { + _logger.LogError( + "{Count} domain(s) on order {OrderNumber} are not valid FQDNs and cannot be DNS-01 validated: " + + "[{Domains}]. They are skipped so the remaining {ValidCount} domain(s) can still be validated. " + + "This order cannot be issued by CERTInext until these are removed — they usually come from a " + + "non-DNS SAN (IP address, email, URI) that was requested on the enrollment.", + invalidDomains.Count, orderNumber, LogSanitizer.Strip(string.Join(", ", invalidDomains)), + validPendingDomains.Count); } + pendingDomains = validPendingDomains; + if (pendingDomains.Count == 0) return false; @@ -1595,75 +2192,269 @@ private async Task PerformDcvIfNeededAsync( var stagedValidations = new List<(string domain, string hostname, Keyfactor.AnyGateway.Extensions.IDomainValidator validator)>(); - // Stage DNS TXT records for all pending domains - foreach (var (domain, _) in pendingDomains) + // Domains this pass could not stage, with why — purely for the summary LogError after + // the loop. Every failure mode below is loud (its own LogError, sanitized) before being + // skipped, so nothing here is silent; this list just avoids repeating that detail twice. + var skippedDomains = new List<(string domain, string reason)>(); + + // Set instead of an immediate `return false` inside the loop below, so a not-yet-ready + // deferral goes through the same cleanup as every other exit path — see the try/catch + // around the loop. + bool deferToNextSyncCycle = false; + + // Removes whatever TXT records were already published before an early exit from the + // staging loop. Nothing else in this method cleans up mid-loop: the try/finally further + // down only runs once every pending domain has been staged, so without this, an early + // exit orphans every TXT record already published for the earlier domains in the *same* + // order — permanently, since nothing else in the codebase calls CleanupValidation for + // them. Kept even though every per-domain failure below is now skip-and-continue rather + // than throw: it is the safety net for a genuinely unexpected exception (cancellation, a + // bug, a validator implementation that throws instead of returning a failure result). + // + // Shares its per-entry cleanup logic with the try/finally's own cleanup loop further + // down via CleanupOneStagedValidation — the two call sites differ only in when they run + // (an early exit here vs. always-run-at-the-end there), not in what "clean up one TXT + // record" means. + async Task CleanupPartialStagingAsync() + { + // Concurrent, not sequential: each cleanup call already has its own independent + // CleanupValidationTimeoutSeconds bound (see CleanupOneStagedValidationAsync), but + // running them one after another meant that bound was per-call, not in aggregate — a + // UCC order with N staged domains could hold the calling request open for up to + // N × CleanupValidationTimeoutSeconds if the DNS provider was merely slow (not even + // hung) on every delete, which can exceed DcvTimeoutMinutes itself and defeats the + // "entire DCV flow is hard-timeout-bounded" guarantee for exactly the multi-SAN case + // this diff exists to support. Running them concurrently bounds the wall-clock time + // for the whole batch to the slowest single call, regardless of domain count — these + // are independent per-domain operations (different hostnames/records) with no shared + // mutable state, so there is nothing for concurrent execution to race on. + await Task.WhenAll(stagedValidations.Select(entry => + CleanupOneStagedValidationAsync(entry, " after an early exit from DCV staging"))); + } + + // Shared by CleanupPartialStagingAsync above and the try/finally's own cleanup loop + // below — both mean "remove one already-published TXT record", just at different times + // (an early exit vs. always-run-at-the-end). `context` distinguishes the two in the log + // text without duplicating the try/catch/log structure itself. + async Task CleanupOneStagedValidationAsync( + (string domain, string hostname, Keyfactor.AnyGateway.Extensions.IDomainValidator validator) entry, + string context) { - GetDcvResponse dcvResp; + var (domain, hostname, validator) = entry; try { - dcvResp = await _client.GetDcvAsync(orderNumber, domain, Constants.Dcv.MethodDnsTxt, ct); - } - catch (Exception ex) when (IsDcvNotYetReady(ex)) - { - // CERTInext occasionally exposes the DCV slot in TrackOrder (so - // domainVerification is populated and dcvStatus="0") before the GetDcv - // endpoint will accept calls for that order — observed as EMS-956 - // "Invalid Request for this API" for several hours after enrollment. - // Treat this as "DCV not ready yet": skip the DCV ceremony for now and - // let the sync-driven retry pick it up on a later cycle. We must NOT - // throw, because that would fail the entire Enroll call and prevent the - // gateway from recording the pending order at all. + // A fresh, independently-bounded token — deliberately neither `ct` nor + // CancellationToken.None. + // + // Not `ct`: this is a best-effort compensating action — removing a TXT record we + // already published — and it must run regardless of WHY we are cleaning up, + // including the case where `ct` itself is the reason (the dominant real trigger + // for the early-exit call site is the shared DcvTimeoutMinutes-bound token firing + // mid-loop, which means `ct` is guaranteed already cancelled there). A + // cooperative IDomainValidator that forwards its token into its own HTTP calls — + // the reference CloudflareDomainValidator in this repo does exactly that — would + // throw immediately on an already-cancelled token and never even attempt the + // delete, silently leaving the record published with only a Warning logged. + // + // Not CancellationToken.None either: this method's own SOX CC7.3 guarantee is + // that the whole DCV flow is hard-timeout-bounded so a stuck DNS provider cannot + // hold a gateway worker thread indefinitely. That bound has to come from + // somewhere for THIS call too — including the routine, always-runs finally-block + // cleanup on the ordinary successful-DCV path, which was never cancellation- + // related to begin with and would otherwise hang forever on a DNS provider + // plugin whose underlying network call stalls. + using var cleanupCts = new CancellationTokenSource( + TimeSpan.FromSeconds(Constants.Dcv.CleanupValidationTimeoutSeconds)); + await validator.CleanupValidation(hostname, cleanupCts.Token); _logger.LogInformation( - "GetDcv not yet accepting calls for order {OrderNumber} domain {Domain} ({Error}). " + - "Deferring DCV to the next sync cycle.", - orderNumber, domain, ex.Message); - return false; + "DNS TXT record cleaned up{Context}. Domain={Domain}, Hostname={Hostname}", + context, LogSanitizer.Strip(domain), LogSanitizer.Strip(hostname)); } catch (Exception ex) { - _logger.LogError(ex, "GetDcv failed for order {OrderNumber} domain {Domain}", orderNumber, domain); - throw; + _logger.LogWarning(ex, + "Failed to clean up DNS TXT record{Context}. Domain={Domain}, Hostname={Hostname}. " + + "May require manual removal.", + context, LogSanitizer.Strip(domain), LogSanitizer.Strip(hostname)); } - - string token = dcvResp.DcvDetails?.Token; - if (string.IsNullOrWhiteSpace(token)) - throw new InvalidOperationException( - $"GetDcv returned no token for order '{orderNumber}' domain '{domain}'."); - - string template = string.IsNullOrWhiteSpace(_config.DcvTxtRecordTemplate) - ? Constants.Dcv.DefaultTxtRecordTemplate - : _config.DcvTxtRecordTemplate; - string hostname = string.Format(template, domain); - - var validator = DomainValidatorFactory.ResolveDomainValidator(domain, "dns-01"); - if (validator == null) - throw new InvalidOperationException( - $"No DNS provider plugin is configured for domain '{domain}'. " + - "Ensure the appropriate DNS provider plugin is deployed and configured on the gateway."); - - _logger.LogInformation( - "Staging DNS TXT record for DCV. OrderNumber={OrderNumber}, Domain={Domain}, Hostname={Hostname}", - orderNumber, domain, hostname); - - var stageResult = await validator.StageValidation(hostname, token, ct); - if (!stageResult.Success) - throw new InvalidOperationException( - $"Failed to stage DNS validation for '{domain}': {stageResult.ErrorMessage}"); - - stagedValidations.Add((domain, hostname, validator)); } - if (stagedValidations.Count == 0) - return false; - try { - // Allow DNS propagation before asking CERTInext to verify. The sync path passes - // a short override (issue 0002) so a bounded set of recent pending orders doesn't - // each burn the full configured delay; Enroll uses the full configured value. - int delaySeconds = propagationDelaySecondsOverride - ?? (_config.DcvPropagationDelaySeconds > 0 ? _config.DcvPropagationDelaySeconds : 30); - _logger.LogInformation( + // Stage DNS TXT records for all pending domains. Every failure below is scoped to + // the one domain that hit it — logged loudly (LogError, so the audit trail carries + // the reason before the domain is dropped) and skipped, never thrown. A throw here + // would abort the WHOLE order after Enroll already placed it at the CA — Enroll has + // no catch around this call, so the exception would escape as a failed enrollment + // with an orphaned CERTInext order, and TryRunDcvDuringSyncAsync would swallow the + // same exception on every later sync retry, leaving the order stuck at + // EXTERNALVALIDATION forever. That is worse than parking the order pending with a + // clear log entry, for EVERY failure shape here — not just the ones distinguishable + // as "bad input" — because nothing downstream ever gets to see or act on the + // exception anyway. This directly caused three real regressions across the first two + // rounds of fixing this file: a GetDcv error or an empty token for a non-DNS SAN + // (submitted on purpose — see BuildSanList) aborted co-tenant DNS domains on the same + // order; a StageValidation failure on domain N+1 orphaned domain N's TXT record; and + // a misconfiguration-detection throw fired on an ordinary non-DNS Subject CN, which + // no setting could prevent since SubmitNonDnsSans only filters the SAN list, not the + // subject. There is no longer a "this must still throw" case in this loop at all. + foreach (var (domain, _) in pendingDomains) + { + GetDcvResponse dcvResp; + try + { + dcvResp = await _client.GetDcvAsync(orderNumber, domain, Constants.Dcv.MethodDnsTxt, ct); + } + catch (Exception ex) when (IsDcvNotYetReady(ex)) + { + // CERTInext occasionally exposes the DCV slot in TrackOrder (so + // domainVerification is populated and dcvStatus="0") before the GetDcv + // endpoint will accept calls for that order — observed as EMS-956 + // "Invalid Request for this API" for several hours after enrollment. This is + // an order-readiness condition, not a per-domain one, so unlike every other + // case in this loop it defers the whole pass rather than skipping one domain. + _logger.LogInformation( + "GetDcv not yet accepting calls for order {OrderNumber} domain {Domain} ({Error}). " + + "Deferring DCV to the next sync cycle.", + orderNumber, LogSanitizer.Strip(domain), ex.Message); + deferToNextSyncCycle = true; + break; + } + catch (OperationCanceledException) + { + // The shared, DcvTimeoutMinutes-bound cancellation firing mid-loop. This is + // NOT a per-domain CA/DNS-provider failure — it must not be caught by the + // generic clause below, which would mislabel it as "GetDcv failed" for + // whichever domain happened to be in flight and send an operator chasing the + // wrong cause. Propagate to the outer catch, which logs and cleans up. + throw; + } + catch (Exception ex) + { + // Any other GetDcv failure — genuinely unmeasured against the live API for a + // non-DNS order-domain, which is exactly why this must not be allowed to fail + // the whole order on a guess. Skip just this domain. + _logger.LogError(ex, + "GetDcv failed for order {OrderNumber} domain {Domain}; skipping this domain so the " + + "rest of the order can still be validated.", orderNumber, LogSanitizer.Strip(domain)); + skippedDomains.Add((domain, "GetDcv failed")); + continue; + } + + string token = dcvResp.DcvDetails?.Token; + if (string.IsNullOrWhiteSpace(token)) + { + _logger.LogError( + "GetDcv returned no token for order {OrderNumber} domain {Domain}; skipping this " + + "domain so the rest of the order can still be validated.", + orderNumber, LogSanitizer.Strip(domain)); + skippedDomains.Add((domain, "no DCV token returned")); + continue; + } + + string template = string.IsNullOrWhiteSpace(_config.DcvTxtRecordTemplate) + ? Constants.Dcv.DefaultTxtRecordTemplate + : _config.DcvTxtRecordTemplate; + string hostname = string.Format(template, domain); + + var validator = DomainValidatorFactory.ResolveDomainValidator(domain, "dns-01"); + if (validator == null) + { + // The canonical case: an IP-literal SAN (or a non-DNS Subject CN) satisfies + // the FQDN regex above but no DNS zone can ever match it. + _logger.LogError( + "No DNS provider plugin resolved for domain '{Domain}' on order {OrderNumber}; " + + "skipping this domain so the rest of the order can still be validated. If this is " + + "a real domain, ensure the appropriate DNS provider plugin is deployed and " + + "configured on the gateway; if it came from a non-DNS SAN (e.g. an IP address) or a " + + "non-DNS Subject CN, remove it from the request.", + LogSanitizer.Strip(domain), orderNumber); + skippedDomains.Add((domain, "no DNS provider resolved")); + continue; + } + + _logger.LogInformation( + "Staging DNS TXT record for DCV. OrderNumber={OrderNumber}, Domain={Domain}, Hostname={Hostname}", + orderNumber, LogSanitizer.Strip(domain), LogSanitizer.Strip(hostname)); + + DomainValidationResult stageResult; + try + { + stageResult = await validator.StageValidation(hostname, token, ct); + } + catch (OperationCanceledException) + { + // Same reasoning as the GetDcv cancellation catch above: not a per-domain + // failure, must reach the outer catch rather than the generic clause below. + throw; + } + catch (Exception ex) + { + _logger.LogError(ex, + "DNS provider plugin threw while staging '{Domain}' for order {OrderNumber}; " + + "skipping this domain so the rest of the order can still be validated.", + LogSanitizer.Strip(domain), orderNumber); + skippedDomains.Add((domain, "DNS provider plugin threw")); + continue; + } + + if (!stageResult.Success) + { + _logger.LogError( + "Failed to stage DNS validation for '{Domain}' on order {OrderNumber}: {Error}. " + + "Skipping this domain so the rest of the order can still be validated.", + LogSanitizer.Strip(domain), orderNumber, LogSanitizer.Strip(stageResult.ErrorMessage)); + skippedDomains.Add((domain, $"stage failed: {stageResult.ErrorMessage}")); + continue; + } + + stagedValidations.Add((domain, hostname, validator)); + } + } + catch (Exception ex) + { + // Nothing in the loop above throws for a per-domain reason any more — this is the + // safety net for a genuinely unexpected failure: cancellation (the shared + // DcvTimeoutMinutes-bound token expiring mid-loop — explicitly re-thrown past the + // per-domain catches above rather than mislabeled as a per-domain failure) or a bug. + // Log before rethrowing: neither caller (EnrollNewAsync's try/finally, or Enroll + // itself) adds a catch, so without a log line here an unanticipated failure on the + // synchronous Enroll-time DCV path would leave no plugin-emitted record at all + // identifying the order or cause — only whatever the gateway host's own unhandled- + // exception logging happens to capture. + _logger.LogError(ex, + "Unexpected failure during DCV staging for order {OrderNumber}; cleaning up any " + + "already-staged TXT records before this propagates.", orderNumber); + await CleanupPartialStagingAsync(); + throw; + } + + if (deferToNextSyncCycle) + { + await CleanupPartialStagingAsync(); + return false; + } + + if (skippedDomains.Count > 0) + { + _logger.LogError( + "{Count} domain(s) on order {OrderNumber} could not be staged for DCV and were skipped: " + + "[{Domains}]. This order cannot be issued by CERTInext until they are resolved.", + skippedDomains.Count, orderNumber, + LogSanitizer.Strip(string.Join(", ", skippedDomains.Select(d => $"{d.domain} ({d.reason})")))); + } + + if (stagedValidations.Count == 0) + return false; + + try + { + // Allow DNS propagation before asking CERTInext to verify. The sync path passes + // a short override (issue 0002) so a bounded set of recent pending orders doesn't + // each burn the full configured delay; Enroll uses the full configured value. + int delaySeconds = propagationDelaySecondsOverride + ?? (_config.DcvPropagationDelaySeconds > 0 ? _config.DcvPropagationDelaySeconds : 30); + _logger.LogInformation( "Waiting {Delay}s for DNS propagation before verifying DCV. OrderNumber={OrderNumber}", delaySeconds, orderNumber); await Task.Delay(TimeSpan.FromSeconds(delaySeconds), ct); @@ -1671,7 +2462,8 @@ private async Task PerformDcvIfNeededAsync( foreach (var (domain, hostname, _) in stagedValidations) { _logger.LogInformation( - "Triggering CERTInext DCV verification. OrderNumber={OrderNumber}, Domain={Domain}", orderNumber, domain); + "Triggering CERTInext DCV verification. OrderNumber={OrderNumber}, Domain={Domain}", + orderNumber, LogSanitizer.Strip(domain)); await _client.VerifyDcvAsync(orderNumber, domain, Constants.Dcv.MethodDnsTxt, ct); } @@ -1682,24 +2474,259 @@ private async Task PerformDcvIfNeededAsync( } finally { - // Always clean up staged DNS records — even on failure - foreach (var (domain, hostname, validator) in stagedValidations) + // Always clean up staged DNS records — even on failure. Concurrent, not sequential + // — see CleanupPartialStagingAsync's comment above for why: sequential cleanup made + // the aggregate wall-clock time for this block scale with the number of staged SAN + // domains, unbounded relative to DcvTimeoutMinutes, on this ordinary success path too. + await Task.WhenAll(stagedValidations.Select(entry => + CleanupOneStagedValidationAsync(entry, ""))); + } + + return true; + } + + /// + /// True when the exception's message contains the CERTInext V2 EMS-1080 code + /// ("Domain is already verified"), the spec's documented no-op for both + /// GetDcv and VerifyDcv on a domain that is still within its DCV reuse window + /// (issues/0020). Message-based rather than a typed field because the API's + /// RFC 7807 body carries the EMS code as text embedded in `detail`/`title`, + /// not as a separate structured field (see ). + /// + private static bool IsEms1080DomainAlreadyVerified(Exception ex) => + ex?.Message?.IndexOf("EMS-1080", StringComparison.OrdinalIgnoreCase) >= 0; + + /// + /// Performs DNS-01 DCV for a V2 SSL order using the V2 DCV endpoints. + /// Mirrors for the V2 API path. + /// + /// Flow: + /// 1. GET /ssl-certificates/{orderId}/dcv → retrieve token (fileNameContent) + /// 2. Publish TXT record at _emudhra-challenge.{domain} via + /// 3. POST /ssl-certificates/{orderId}/dcv/verify → trigger CA-side verification + /// 4. Poll until status != "pending-dcv" + /// 5. Clean up TXT record + /// + /// EMS-1080 ("Domain is already verified") from either GetDcv or VerifyDcv is + /// treated as DCV already satisfied (issues/0020): publishing is skipped and + /// the flow proceeds straight to step 4. + /// + /// Returns true when DCV steps were executed, false when skipped. + /// + private async Task PerformDcvV2IfNeededAsync( + string orderId, + string domain, + string productFamilySlug, + CancellationToken ct) + { + if (_domainValidatorFactory == null || !_config.DcvEnabled) + { + _logger.LogDebug( + "V2 DCV skipped: DCV factory not configured or DcvEnabled=false. OrderId={OrderId}", orderId); + return false; + } + + if (string.IsNullOrWhiteSpace(domain)) + { + _logger.LogWarning( + "V2 DCV skipped: no domain name available for order {OrderId}.", orderId); + return false; + } + + _logger.LogInformation( + "V2 DCV starting for order {OrderId}, domain {Domain}.", orderId, LogSanitizer.Strip(domain)); + + // Prevent concurrent DCV staging for the same order (enrollment + sync overlap). + // Mirrors the _dcvInFlight guard in TryRunDcvDuringSyncAsync (V1 path). + if (!_dcvInFlight.TryAdd(orderId, 0)) + { + _logger.LogInformation( + "DCV already in flight for V2 order {OrderId}; skipping concurrent attempt.", orderId); + return false; + } + + // 1. Fetch challenge + V2DcvChallengeResponse challenge = null; + bool dcvAlreadySatisfied = false; + try + { + challenge = await _client.GetDcvV2Async(orderId, productFamilySlug, ct); + } + catch (Exception ex) when (IsEms1080DomainAlreadyVerified(ex)) + { + // EMS-1080 "Domain is already verified" is a documented no-op (issues/0020), + // not a failure: the domain is account-scoped and reusable, so there is no + // fresh challenge to fetch. Treat DCV as already satisfied and skip straight + // to tracking/issuance instead of deferring to the next sync cycle. + _logger.LogInformation( + "V2 DCV already satisfied (EMS-1080 domain already verified) for order {OrderId}; " + + "skipping TXT publish and proceeding to tracking.", orderId); + dcvAlreadySatisfied = true; + } + catch (Exception ex) + { + _dcvInFlight.TryRemove(orderId, out _); + _logger.LogWarning(ex, + "V2 GetDcv failed for order {OrderId}; deferring DCV to next sync cycle.", orderId); + return false; + } + + string token = null; + string hostname = null; + Keyfactor.AnyGateway.Extensions.IDomainValidator validator = null; + + if (!dcvAlreadySatisfied) + { + token = challenge?.FileNameContent; + if (string.IsNullOrWhiteSpace(token)) { + _dcvInFlight.TryRemove(orderId, out _); + _logger.LogWarning( + "V2 GetDcv returned no token for order {OrderId}; deferring DCV.", orderId); + return false; + } + + // V2 TXT record name uses the _emudhra-challenge prefix + hostname = $"_emudhra-challenge.{domain}"; + + validator = DomainValidatorFactory.ResolveDomainValidator(domain, "dns-01"); + if (validator == null) + { + _dcvInFlight.TryRemove(orderId, out _); + _logger.LogError( + "No DNS provider plugin resolved for domain '{Domain}' on V2 order {OrderId}. " + + "Ensure the appropriate DNS provider plugin is deployed and configured.", + LogSanitizer.Strip(domain), orderId); + return false; + } + } + + // staged=true only after a successful StageValidation so the finally only attempts + // cleanup when there is a record to remove (Finding C — cleanup skipped on !Success). + bool staged = false; + try + { + if (!dcvAlreadySatisfied) + { + // 2. Publish TXT record + _logger.LogInformation( + "Staging V2 DNS TXT record. OrderId={OrderId}, Hostname={Hostname}", orderId, LogSanitizer.Strip(hostname)); + + DomainValidationResult stageResult; try { - await validator.CleanupValidation(hostname, ct); + // Non-null here: only reached when !dcvAlreadySatisfied, and + // validator/hostname are always assigned together in that branch above. + stageResult = await validator!.StageValidation(hostname!, token, ct); + } + catch (Exception ex) + { + _logger.LogError(ex, + "V2 DCV: DNS provider threw while staging '{Domain}' for order {OrderId}.", + LogSanitizer.Strip(domain), orderId); + return false; + } + + if (!stageResult.Success) + { + _logger.LogError( + "V2 DCV: Failed to stage DNS TXT for '{Domain}' on order {OrderId}: {Error}.", + LogSanitizer.Strip(domain), orderId, LogSanitizer.Strip(stageResult.ErrorMessage)); + return false; + } + staged = true; + + // Wait for DNS propagation + int delaySeconds = _config.DcvPropagationDelaySeconds > 0 ? _config.DcvPropagationDelaySeconds : 30; + _logger.LogInformation( + "Waiting {Delay}s for DNS propagation before V2 DCV verify. OrderId={OrderId}", delaySeconds, orderId); + await Task.Delay(TimeSpan.FromSeconds(delaySeconds), ct); + + // 3. Trigger CA-side verification + _logger.LogInformation( + "Triggering V2 DCV verification. OrderId={OrderId}, Domain={Domain}", orderId, LogSanitizer.Strip(domain)); + try + { + var verifyResp = await _client.VerifyDcvV2Async(orderId, domain, productFamilySlug, ct); + _logger.LogInformation( + "V2 DCV verify response. OrderId={OrderId}, OverallStatus={Status}", + orderId, verifyResp?.OverallStatus ?? "(null)"); + + if (!string.Equals(verifyResp?.OverallStatus, "VERIFIED", StringComparison.OrdinalIgnoreCase)) + { + _logger.LogWarning( + "V2 DCV verify did not return VERIFIED for order {OrderId}. Status={Status}", + orderId, verifyResp?.OverallStatus); + return false; + } + } + catch (Exception ex) when (IsEms1080DomainAlreadyVerified(ex)) + { + // Same no-op as the GetDcv branch above, but surfaced at Verify time + // instead — the domain became/was already verified between the two + // calls. Treat as verified and continue to tracking rather than + // deferring (issues/0020). _logger.LogInformation( - "DNS TXT record cleaned up. Domain={Domain}, Hostname={Hostname}", domain, hostname); + "V2 DCV already satisfied (EMS-1080 domain already verified) for order {OrderId} " + + "during VerifyDcv; treating as verified and proceeding to tracking.", orderId); + } + } + + // 4. Poll TrackOrderV2 until status leaves pending-dcv + int timeoutMinutes = _config.GetEffectiveDcvTimeoutMinutes(); + var deadline = DateTime.UtcNow.AddMinutes(timeoutMinutes); + // Fixed short cadence — decoupled from DcvPropagationDelaySeconds (one-shot + // DNS wait), not a poll interval. Reusing it here would yield only ~2 polls + // before the 5-minute timeout. + int pollSeconds = Constants.Dcv.SyncPropagationDelaySeconds; + + while (DateTime.UtcNow < deadline && !ct.IsCancellationRequested) + { + await Task.Delay(TimeSpan.FromSeconds(pollSeconds), ct); + try + { + var trackResp = await _client.TrackOrderV2Async(productFamilySlug, orderId, ct); + _logger.LogDebug( + "V2 DCV poll. OrderId={OrderId}, Status={Status}", orderId, trackResp.Status); + if (!string.Equals(trackResp.Status, "pending-dcv", StringComparison.OrdinalIgnoreCase)) + break; } catch (Exception ex) { - _logger.LogWarning(ex, - "Failed to clean up DNS TXT record. Domain={Domain}, Hostname={Hostname}", domain, hostname); + _logger.LogWarning(ex, "V2 DCV: TrackOrderV2 poll failed for order {OrderId}.", orderId); + break; } } + + return true; } + finally + { + // Release the in-flight guard regardless of how the staged block exits. + _dcvInFlight.TryRemove(orderId, out _); - return true; + // 5. Clean up TXT record — only when staging succeeded (staged=true). + if (staged) + { + try + { + using var cleanupCts = new CancellationTokenSource( + TimeSpan.FromSeconds(Constants.Dcv.CleanupValidationTimeoutSeconds)); + // Non-null here: staged is only true when !dcvAlreadySatisfied, in + // which case validator/hostname were assigned before staging began. + await validator!.CleanupValidation(hostname!, cleanupCts.Token); + _logger.LogInformation( + "V2 DCV: DNS TXT record cleaned up. OrderId={OrderId}, Hostname={Hostname}", + orderId, LogSanitizer.Strip(hostname)); + } + catch (Exception ex) + { + _logger.LogWarning(ex, + "V2 DCV: Failed to clean up DNS TXT record. OrderId={OrderId}, Hostname={Hostname}. " + + "May require manual removal.", orderId, LogSanitizer.Strip(hostname)); + } + } + } } #endif @@ -1805,7 +2832,10 @@ private async Task WaitForDcvVerificationAsync(string orderNumber, IReadOnlyList if (domains.Count == 0) return; var pending = new HashSet(domains, StringComparer.OrdinalIgnoreCase); - int pollSeconds = Math.Max(1, _config.DcvPropagationDelaySeconds); + // Fixed short cadence — decoupled from DcvPropagationDelaySeconds, which is a + // one-shot DNS propagation wait, not a polling interval. Reusing it here would + // reduce the number of polls to ~2 before the 5-minute timeout. + int pollSeconds = Constants.Dcv.SyncPropagationDelaySeconds; // Defense-in-depth deadline: SOX CC7.3 requires every wait to be bounded. // The caller passes a `ct` derived from a CancellationTokenSource that already @@ -1823,7 +2853,8 @@ private async Task WaitForDcvVerificationAsync(string orderNumber, IReadOnlyList "DCV verification poll exceeded its internal deadline ({Minutes}min). " + "OrderNumber={OrderNumber}, StillPendingDomains=[{Pending}]. " + "Exiting and leaving TXT records for the caller's finally block to clean up.", - _config.GetEffectiveDcvTimeoutMinutes(), orderNumber, string.Join(",", pending)); + _config.GetEffectiveDcvTimeoutMinutes(), orderNumber, + LogSanitizer.Strip(string.Join(",", pending))); return; } @@ -1856,18 +2887,210 @@ private async Task WaitForDcvVerificationAsync(string orderNumber, IReadOnlyList if (string.Equals(detail.DcvStatus, Constants.Dcv.StatusValidated, StringComparison.Ordinal)) { - _logger.LogInformation("DCV verified by CERTInext. OrderNumber={OrderNumber}, Domain={Domain}", orderNumber, domain); + _logger.LogInformation("DCV verified by CERTInext. OrderNumber={OrderNumber}, Domain={Domain}", + orderNumber, LogSanitizer.Strip(domain)); pending.Remove(domain); } else if (string.Equals(detail.DcvStatus, Constants.Dcv.StatusRejected, StringComparison.Ordinal)) { - _logger.LogWarning("DCV rejected by CERTInext. OrderNumber={OrderNumber}, Domain={Domain}", orderNumber, domain); + _logger.LogWarning("DCV rejected by CERTInext. OrderNumber={OrderNumber}, Domain={Domain}", + orderNumber, LogSanitizer.Strip(domain)); pending.Remove(domain); } } } } + /// + /// Synchronous certificate pickup — parity with the legacy Sectigo connector's + /// PickUpEnrolledCertificate. After an order is submitted, polls + /// GetCertificate up to PickupRetries times, PickupDelay seconds + /// apart (after a fixed initial delay), so an order that issues quickly is returned + /// GENERATED + PEM in the same enrollment call instead of waiting for the next + /// synchronization. If the certificate has not issued within the budget, the original + /// pending result is returned unchanged and the order is imported by a later sync — + /// behaviour identical to before this feature. + /// + /// Applies to ALL products. CERTInext issues OV/EV asynchronously (organization + /// verification, minutes to hours; confirmed by CERTInext support ticket #162763), so + /// those typically exhaust the budget and fall back to pending; only DV / already-approved + /// orders return in-call. Never throws — any polling error degrades to the pending result. + /// + private async Task PickUpEnrolledCertificateAsync( + EnrollmentResult pendingResult, string orderNumber, bool dcvIssuanceWaitRan, + CancellationToken ct = default) + { + // The DCV path already owns the in-call issuance wait for this order — running a second + // stacked poll here would double the wait budget (when DCV ran WaitForIssuanceAfterDcvAsync) + // or waste it polling an order DCV already found terminal / not-yet-validated. Defer to + // the pending result; a later sync completes it. + if (dcvIssuanceWaitRan) + return pendingResult; + + // Only a still-pending (external-validation) result can benefit from a pickup poll. + // An already issued/failed/revoked result is returned as-is. + if (pendingResult == null + || pendingResult.Status != (int)EndEntityStatus.EXTERNALVALIDATION) + return pendingResult; + + // A pending result with no order number cannot be polled — surface the anomaly rather + // than silently returning, so an un-pollable pending state leaves an audit trace. + if (string.IsNullOrWhiteSpace(orderNumber)) + { + _logger.LogWarning( + "Synchronous pickup skipped: a pending enrollment was returned with no order " + + "number to poll. The certificate can only be reconciled by a later synchronization."); + return pendingResult; + } + + int retries = _config.GetEffectivePickupRetries(); + if (retries <= 0) + { + _logger.LogInformation( + "Synchronous certificate pickup disabled (PickupRetries<=0). Order {OrderNumber} " + + "will be picked up on the next synchronization.", orderNumber); + return pendingResult; + } + + int delaySeconds = _config.GetEffectivePickupDelaySeconds(); + + // Hard ceiling on total in-call occupancy. PickupRetries and PickupDelay are each clamped + // independently, but their product can still reach ~30 min at the extremes — enough to push + // Enroll() past Command's own enrollment timeout. If the configured budget would exceed the + // ceiling, cap the retry count to fit; the remainder is imported by the next synchronization. + int maxPollRetries = Math.Max(1, + (Constants.Pickup.MaxTotalWaitSeconds - Constants.Pickup.InitialDelaySeconds) / delaySeconds); + if (retries > maxPollRetries) + { + _logger.LogInformation( + "Configured pickup budget (PickupRetries={Configured}, PickupDelaySeconds={Delay}) exceeds the " + + "{MaxTotal}s in-call ceiling; capping to {Capped} attempts. The certificate will be imported by " + + "the next synchronization if it has not issued by then.", + retries, delaySeconds, Constants.Pickup.MaxTotalWaitSeconds, maxPollRetries); + retries = maxPollRetries; + } + + _logger.LogInformation( + "Starting synchronous certificate pickup. OrderNumber={OrderNumber}, PickupRetries={Retries}, " + + "PickupDelaySeconds={Delay} (max ~{Max}s including a {Initial}s initial delay).", + orderNumber, retries, delaySeconds, + Constants.Pickup.InitialDelaySeconds + retries * delaySeconds, Constants.Pickup.InitialDelaySeconds); + + int pollErrors = 0; + try + { + // Small static delay before the first poll — mirrors the Sectigo connector's + // attempt to let a fast order finish issuing before we start polling at all. + await Task.Delay(TimeSpan.FromSeconds(Constants.Pickup.InitialDelaySeconds), ct); + + for (int attempt = 1; attempt <= retries; attempt++) + { + try + { + var cert = await _client.GetCertificateAsync(orderNumber, ct); + int disposition = StatusMapper.ToRequestDisposition(cert.Status); + + // SOC2 CC7.3: record each poll's observed disposition so the issuance + // timeline is reconstructable (how many polls ran, what each returned). + _logger.LogDebug( + "Pickup poll observed status. OrderNumber={OrderNumber}, Attempt={Attempt}/{Retries}, " + + "MappedDisposition={Disposition}, Status='{Status}', BodyPresent={HasBody}.", + orderNumber, attempt, retries, disposition, cert.Status, + !string.IsNullOrWhiteSpace(cert.Certificate)); + + // Issued: only surface GENERATED when the PEM is actually present — never + // hand Command a body-less "issued" record. A body-less issued state keeps + // polling until the body appears or the budget runs out. + if (disposition == (int)EndEntityStatus.GENERATED + && !string.IsNullOrWhiteSpace(cert.Certificate)) + { + _logger.LogInformation( + "Synchronous pickup complete. OrderNumber={OrderNumber}, SerialNumber={Serial}, " + + "Attempt={Attempt}/{Retries}.", + orderNumber, + string.IsNullOrWhiteSpace(cert.SerialNumber) ? "(not provided by CA)" : cert.SerialNumber, + attempt, retries); + return new EnrollmentResult + { + CARequestID = string.IsNullOrWhiteSpace(cert.Id) ? orderNumber : cert.Id, + Certificate = cert.Certificate, + Status = (int)EndEntityStatus.GENERATED, + StatusMessage = $"Certificate issued successfully. CERTInext ID: {orderNumber}." + }; + } + + // Terminal non-issued outcomes carry no body and are surfaced immediately. + if (disposition == (int)EndEntityStatus.REVOKED + || disposition == (int)EndEntityStatus.FAILED) + { + // SOX/SOC2 CC7.2: an issuance FAILURE must cross the error threshold that + // SIEM issuance-failure rules key on (parity with BuildEnrollmentResult's + // enroll-time FAILED handling); a REVOKED terminal state is a warning. + if (disposition == (int)EndEntityStatus.FAILED) + _logger.LogError( + "Order {OrderNumber} reached terminal FAILED status '{Status}' during " + + "synchronous pickup (attempt {Attempt}/{Retries}).", + orderNumber, cert.Status, attempt, retries); + else + _logger.LogWarning( + "Order {OrderNumber} was REVOKED ('{Status}') during synchronous pickup " + + "(attempt {Attempt}/{Retries}).", + orderNumber, cert.Status, attempt, retries); + return new EnrollmentResult + { + CARequestID = string.IsNullOrWhiteSpace(cert.Id) ? orderNumber : cert.Id, + Certificate = cert.Certificate, + Status = disposition, + StatusMessage = $"Order {orderNumber} reached status '{cert.Status}' during enrollment pickup." + }; + } + } + catch (Exception ex) + { + if (ex is OperationCanceledException) throw; + // A transient fetch failure consumes an attempt rather than aborting the + // wait; if it never recovers the pending result is returned below. + pollErrors++; + _logger.LogWarning(ex, + "Pickup GetCertificate failed for order {OrderNumber} (attempt {Attempt}/{Retries}).", + orderNumber, attempt, retries); + } + + // Delay after every attempt (including the last), matching the Sectigo + // connector's pickup cadence so the max-occupancy ceiling is identical. + await Task.Delay(TimeSpan.FromSeconds(delaySeconds), ct); + } + + // SOC1 accuracy: don't attribute non-completion to "OV/EV async by design" when the + // real cause was every poll erroring (e.g. a CA-side TrackOrder outage). Distinguish + // the two so the log reflects what actually happened. + if (pollErrors == retries) + _logger.LogWarning( + "Synchronous pickup exhausted {Retries} attempts for order {OrderNumber} — ALL polls " + + "errored (see preceding warnings). Returning pending result; the next synchronization " + + "will re-attempt retrieval.", + retries, orderNumber); + else + _logger.LogInformation( + "Synchronous pickup did not complete within {Retries} attempts for order {OrderNumber} " + + "({Errors} poll error(s); remainder still pending). Returning pending result; the " + + "certificate will be imported by the next synchronization. CERTInext issues OV/EV " + + "asynchronously by design (support ticket #162763).", + retries, orderNumber, pollErrors); + pendingResult.StatusMessage = + $"{pendingResult.StatusMessage} The certificate was not issued within the enrollment-pickup " + + "window; it will be imported by a later synchronization."; + } + catch (Exception ex) + { + _logger.LogWarning(ex, + "Synchronous pickup failed for order {OrderNumber}. Returning pending result; " + + "sync will pick up the certificate later.", orderNumber); + } + + return pendingResult; + } + /// /// Converts a CERTInext API enrollment/renewal response into the /// expected by the AnyCA gateway. @@ -1878,6 +3101,16 @@ private EnrollmentResult BuildEnrollmentResult(EnrollCertificateResponse resp, b throw new Exception("CERTInext returned a null enrollment response."); int status = StatusMapper.ToRequestDisposition(resp.Status); + + // CertiNext's "auto-approved"/"downloadable" statuses can arrive before the + // certificate bytes are actually generated — GetCertificate right after order + // placement then fails, leaving resp.Certificate null while resp.Status still + // says issued. Never hand Command a GENERATED result with no PEM (it crashes + // CertificateConverterFactory.FromPEM downstream); demote to pending instead, + // matching the same invariant PickUpEnrolledCertificateAsync already enforces. + if (status == (int)EndEntityStatus.GENERATED && string.IsNullOrWhiteSpace(resp.Certificate)) + status = (int)EndEntityStatus.EXTERNALVALIDATION; + string message; switch (status) @@ -1958,46 +3191,358 @@ private static int MapRevocationReasonStringToCode(string reason) } /// - /// Converts the multi-valued SAN dictionary from the AnyCA gateway into the - /// list expected by the CERTInext API. + /// Builds the list submitted to CERTInext: the multi-valued SAN + /// dictionary the AnyCA gateway hands us, falling back to the subjectAltName extension + /// carried inside the CSR itself only when the gateway supplies nothing at all. + /// + /// Fallback, not union, deliberately: Command's SAN dictionary is the channel through + /// which an enrollment pattern's SAN policy is expressed for this request, and a signed + /// CSR — typically generated by the subscriber's own tooling, not by Command — can + /// legitimately carry more names than that policy allows. Unioning them in would + /// re-introduce a name the policy excluded. The CSR is only consulted when the dictionary + /// argument is null — not merely empty or all-empty-arrays. A non-null dictionary, + /// even one that computes to zero names, means Command's enrollment pattern ran and + /// deliberately produced no SANs for this request; only its literal absence means no + /// policy-derived set exists to defer to. + /// + /// The CSR still matters even though CERTInext ignores its subjectAltName extension + /// outright — measured on the US sandbox in SanSubmissionProbeTests: a CSR + /// carrying two DNS names, submitted with additionalDomains omitted, produced an + /// order with only the CN registered. Production behaves the same way: the customer + /// report that prompted this fix was a production UCC order whose CSR carried the SANs + /// and whose issued certificate held only the CN. So on whichever path populates the + /// gateway dictionary — or, in the fallback case, the CSR — this method is the only way + /// those names reach additionalDomains and therefore the certificate. + /// + /// History (UCC SANs silently dropped): the gateway keys this dictionary + /// dnsname, not dns. did not recognize + /// dnsname, so every DNS SAN was typed "dnsname", filtered out by the + /// DNS-only test in BuildAdditionalDomains, and the order went to CERTInext + /// with no additionalDomains at all. The certificate came back holding only + /// the CN, which reads as the CA stripping SANs supplied on the CSR. /// - private static List BuildSanList(Dictionary san) + private List BuildSanList(Dictionary san, string csr, string subject) { - if (san == null || san.Count == 0) - return null; - var result = new List(); - - // AnyCA passes SANs keyed by type name (e.g. "Dns", "Ip", "Email", "Uri") - foreach (var kvp in san) + // Type+value identity, so the same name requested as two different SAN types is + // preserved while an exact repeat across the two sources collapses. + var seen = new HashSet(StringComparer.OrdinalIgnoreCase); + // "type|value" keys of entries that came from the CSR fallback, not the gateway + // dictionary — used only to word the provenance log accurately once the final, + // possibly-filtered result is known (see below). + var fromCsrKeys = new HashSet(StringComparer.OrdinalIgnoreCase); + + void Add(string type, string value, bool fromCsr = false) { - string sanType = MapSanType(kvp.Key); - if (kvp.Value == null) continue; + if (string.IsNullOrWhiteSpace(value)) return; + string trimmed = value.Trim(); + string key = $"{type}|{trimmed}"; + if (!seen.Add(key)) return; + result.Add(new SanEntry { Type = type, Value = trimmed }); + if (fromCsr) fromCsrKeys.Add(key); + } - foreach (string value in kvp.Value) + string FormatSans(IEnumerable sans) => + LogSanitizer.Strip(string.Join("; ", sans.Select(s => $"{s.Type}:{s.Value}"))); + + // AnyCA passes SANs keyed by type name — the real gateway uses "dnsname", + // "rfc822name", "ipaddress"; MapSanType normalizes the spelling variants. + if (san != null) + { + foreach (var kvp in san) { - if (!string.IsNullOrWhiteSpace(value)) - result.Add(new SanEntry { Type = sanType, Value = value.Trim() }); + string sanType = MapSanType(kvp.Key); + if (kvp.Value == null) continue; + + foreach (string value in kvp.Value) + Add(sanType, value); } } - return result.Count > 0 ? result : null; + // CSR fallback — only when the gateway dictionary is itself absent (san == null), NOT + // merely "computed to zero SAN entries" (i.e. result.Count == 0 at this point). Those + // are different things: + // a non-null dictionary — even an empty one, or one whose keys all map to empty arrays + // — means Command's enrollment pattern ran and deliberately produced no SANs for this + // request, which the CSR fallback must respect rather than override. san == null means + // Command never populated SAN data for this enrollment path at all, which is the one + // case this fallback exists for. Checking "computed to zero" instead of "san is null" + // would let an enrollment pattern that explicitly computes zero SANs still have + // CSR-derived names spliced back in — reopening the policy-reintroduction risk the + // fallback-over-union redesign exists to close. + var skippedCsrTags = new List(); + if (san == null) + { + var csrSans = ExtractSanEntriesFromCsr(csr, out skippedCsrTags); + foreach (var csrSan in csrSans) + Add(csrSan.Type, csrSan.Value, fromCsr: true); + } + + if (skippedCsrTags.Count > 0) + { + // GeneralName types with no domain-name rendering (otherName — e.g. a UPN from a + // Windows-generated CSR — directoryName, x400Address, ediPartyName, registeredID). + // They cannot be expressed in additionalDomains, so they are not forwarded. Warn + // rather than drop silently: the operator needs to know the CSR asked for something + // the certificate will not carry. + _logger.LogWarning( + "{Count} SAN(s) in the CSR use a type that cannot be represented as a domain name " + + "and were not submitted (ASN.1 GeneralName tag(s): {Tags}). CERTInext's " + + "additionalDomains field carries domain names only, so these cannot appear on the " + + "issued certificate. Remove them from the CSR if they are required. Subject={Subject}", + skippedCsrTags.Count, string.Join(", ", skippedCsrTags), LogSanitizer.Strip(subject)); + } + + if (result.Count == 0) + { + _logger.LogDebug( + "No SANs supplied by the gateway and none found in the CSR — submitting the order " + + "with domainName only. Subject={Subject}", LogSanitizer.Strip(subject)); + return null; + } + + // CERTInext's certificateInformation.additionalDomains is a domain-name field, and + // non-DNS SANs are submitted into it deliberately rather than discarded: dropping + // them would issue a certificate silently missing names the subscriber asked for, + // which is the worse failure. + // + // Measured on the US SANDBOX only (SanSubmissionProbeTests, product 844, + // 2026-08-12): CERTInext did NOT reject these at order placement. It accepted the + // order and registered the value verbatim as an order domain — an email address, an + // IP literal and a URI all came back as domainVerification keys. The order then + // cannot pass domain validation, so it parks pending instead of failing fast. + // + // Production is UNVERIFIED for this case and may reject the order outright instead. + // The warning below therefore describes the sandbox outcome as the expected one + // without promising it: either way the operator is told which SANs are the problem, + // which is the part that matters for diagnosis. + // + // This filtering runs BEFORE any of the logging below, and all of that logging is + // computed from `result` as it stands afterward — not from the pre-filter set. A + // prior version of this method logged "resolved" and "added to the order" against the + // pre-filter set and only THEN applied this filter, so with SubmitNonDnsSans=false the + // audit trail could claim a SAN was added when it had in fact just been dropped two + // lines later — a self-contradicting record for the same enrollment. The fix is + // ordering, not new logic: decide what is actually being submitted first, describe + // that. + var nonDns = result.Where(s => !string.Equals(s.Type, "dns", StringComparison.OrdinalIgnoreCase)).ToList(); + + if (nonDns.Count > 0 && !_config.SubmitNonDnsSans) + { + _logger.LogWarning( + "{Count} requested SAN(s) are not DNS names and are being DROPPED because " + + "SubmitNonDnsSans is false: {Sans}. The order will issue, but the certificate will " + + "NOT contain these names. Set SubmitNonDnsSans back to true to submit them and have " + + "CERTInext surface the problem instead. Subject={Subject}", + nonDns.Count, FormatSans(nonDns), LogSanitizer.Strip(subject)); + + result = result + .Where(s => string.Equals(s.Type, "dns", StringComparison.OrdinalIgnoreCase)) + .ToList(); + nonDns = new List(); + + if (result.Count == 0) + return null; + } + + // The blind spot that hid the original defect was that nothing logged what we + // resolved. Log the final, post-filter resolved set and its provenance at Information. + int fromCsrKept = result.Count(s => fromCsrKeys.Contains($"{s.Type}|{s.Value}")); + // Post-filter, not the pre-filter `fromGateway` snapshot: gateway- and CSR-sourced + // entries are mutually exclusive by construction (the CSR fallback only ever runs when + // the gateway supplied nothing at all), so whatever's left in `result` and isn't + // fromCsrKept must be gateway-sourced. Using the pre-filter count here reproduced the + // exact self-contradicting-audit-trail bug this method was already restructured once to + // fix — with SubmitNonDnsSans=false this line could read e.g. "Resolved 1 SAN(s) ... + // FromGatewayRequest=3", an arithmetic impossibility for anyone reconciling counts. + int fromGatewayKept = result.Count - fromCsrKept; + _logger.LogInformation( + "Resolved {Total} SAN(s) for submission. FromGatewayRequest={FromGateway}, " + + "AddedFromCsrFallback={FromCsr}, Sans={Sans}, Subject={Subject}", + result.Count, fromGatewayKept, fromCsrKept, FormatSans(result), + LogSanitizer.Strip(subject)); + + if (fromCsrKept > 0) + { + // Worth a Warning, not Debug: it means Command handed us no SAN data at all for + // this enrollment, which is a gateway/template wiring smell even though the CSR + // fallback recovers it here. + _logger.LogWarning( + "Command supplied no SAN data for this enrollment; {Count} SAN(s) present in the CSR " + + "have been added to the order instead. Review the enrollment pattern / template SAN " + + "configuration. Subject={Subject}", + fromCsrKept, LogSanitizer.Strip(subject)); + } + + if (nonDns.Count > 0) + { + // Reaching this line means SubmitNonDnsSans is true (the false case already + // returned above), so these are being submitted, not dropped. + _logger.LogWarning( + "{Count} requested SAN(s) are not DNS names: {Sans}. CERTInext's additionalDomains " + + "field takes domain names, so this order will either be rejected outright or be " + + "created and then fail domain validation and sit pending — on the US sandbox it was " + + "accepted verbatim and parked pending. They are submitted rather than dropped on " + + "purpose: a visible failure is preferable to a certificate issued without names the " + + "subscriber requested. Remove them from the CSR or the enrollment pattern if the " + + "order should proceed. Subject={Subject}", + nonDns.Count, FormatSans(nonDns), LogSanitizer.Strip(subject)); + } + + return result; } private static string MapSanType(string anyCAType) { switch (anyCAType?.ToLowerInvariant()) { - case "dns": return "dns"; + // "dnsname" is what the AnyCA REST Gateway actually sends; "dns"/"dnsnames" + // are kept for callers and older hosts that use the shorter spelling. + case "dns": + case "dnsname": + case "dnsnames": return "dns"; case "ip": - case "ipaddress": return "ip"; + case "ipaddress": + case "ipaddresses": return "ip"; case "email": - case "rfc822": return "email"; - case "uri": return "uri"; + case "rfc822": + case "rfc822name": return "email"; + case "uri": + case "uniformresourceidentifier": return "uri"; default: return anyCAType?.ToLowerInvariant() ?? "dns"; } } + /// + /// Extracts the subjectAltName entries from a PEM-encoded PKCS#10 CSR. + /// + /// Implemented with BouncyCastle (per the project's crypto policy: all certificate + /// and key handling goes through BouncyCastle, never BCL System.Security.Cryptography). + /// Never throws — an absent, truncated, or otherwise unparseable CSR returns an empty + /// list so enrollment continues on the gateway-supplied SAN data alone. + /// + /// PEM-encoded PKCS#10 request, or null/garbage. + /// + /// ASN.1 GeneralName tag numbers present in the CSR that have no domain-name rendering and + /// were therefore not returned (otherName, directoryName, x400Address, ediPartyName, + /// registeredID, and any malformed IPAddress). Reported so the caller can warn instead of + /// dropping them silently. + /// + private static List ExtractSanEntriesFromCsr(string csrPem, out List skippedTagNumbers) + { + var result = new List(); + skippedTagNumbers = new List(); + if (string.IsNullOrWhiteSpace(csrPem)) + return result; + + try + { + string b64 = csrPem + .Replace("-----BEGIN CERTIFICATE REQUEST-----", string.Empty) + .Replace("-----END CERTIFICATE REQUEST-----", string.Empty) + .Replace("-----BEGIN NEW CERTIFICATE REQUEST-----", string.Empty) + .Replace("-----END NEW CERTIFICATE REQUEST-----", string.Empty) + .Replace("\r", string.Empty) + .Replace("\n", string.Empty) + .Trim(); + + if (string.IsNullOrWhiteSpace(b64)) + return result; + + var csr = new Org.BouncyCastle.Pkcs.Pkcs10CertificationRequest(Convert.FromBase64String(b64)); + + // SANs live in the PKCS#9 extensionRequest attribute, not the CSR body. + var extensions = csr.GetRequestedExtensions(); + var sanExtension = extensions?.GetExtension( + Org.BouncyCastle.Asn1.X509.X509Extensions.SubjectAlternativeName); + if (sanExtension == null) + return result; + + var names = Org.BouncyCastle.Asn1.X509.GeneralNames.GetInstance(sanExtension.GetParsedValue()); + foreach (var generalName in names.GetNames()) + { + var entry = GeneralNameToSanEntry(generalName); + if (entry != null) + result.Add(entry); + else + skippedTagNumbers.Add(generalName.TagNo); + } + } + catch (Exception ex) + { + // Enrollment must not fail because we could not read the CSR's SANs — the + // gateway-supplied set still applies, and CERTInext validates the CSR itself. + // Debug so an operator diagnosing a missing SAN can see the parse was skipped. + LogHandler.GetClassLogger(typeof(CERTInextCAPlugin)) + .LogDebug(ex, "ExtractSanEntriesFromCsr suppressed CSR parse failure"); + } + + return result; + } + + /// + /// Maps a GeneralName to the this plugin would submit for it, or null + /// for a name whose value cannot be rendered meaningfully — skipped rather than submitted as + /// ASN.1 debris. One switch, not two: a separate tag→type mapping alongside this one used to + /// assign a type string ("directoryname", "registeredid", ...) to tags that always return a + /// null value here anyway, so those branches were dead — the type never reached a caller + /// with no value to pair it with. + /// + private static SanEntry GeneralNameToSanEntry(Org.BouncyCastle.Asn1.X509.GeneralName generalName) + { + string type; + string value; + + switch (generalName.TagNo) + { + case Org.BouncyCastle.Asn1.X509.GeneralName.DnsName: + type = "dns"; + value = Org.BouncyCastle.Asn1.DerIA5String.GetInstance(generalName.Name).GetString(); + break; + + case Org.BouncyCastle.Asn1.X509.GeneralName.Rfc822Name: + type = "email"; + value = Org.BouncyCastle.Asn1.DerIA5String.GetInstance(generalName.Name).GetString(); + break; + + case Org.BouncyCastle.Asn1.X509.GeneralName.UniformResourceIdentifier: + type = "uri"; + value = Org.BouncyCastle.Asn1.DerIA5String.GetInstance(generalName.Name).GetString(); + break; + + case Org.BouncyCastle.Asn1.X509.GeneralName.IPAddress: + type = "ip"; + // Octet string → dotted-quad / RFC 5952 text, so what we submit and log is + // the address the subscriber asked for rather than its hex encoding. + byte[] octets = Org.BouncyCastle.Asn1.Asn1OctetString.GetInstance(generalName.Name).GetOctets(); + value = octets.Length == 4 || octets.Length == 16 + ? new System.Net.IPAddress(octets).ToString() + : null; + break; + + default: + // otherName, directoryName, x400Address, ediPartyName, registeredID. + // + // Deliberately null, not Name.ToString(). BouncyCastle renders these as an + // ASN.1 dump — a UPN otherName from a Windows-generated CSR stringifies to + // "[1.3.6.1.4.1.311.20.2.3, [CONTEXT 0]svc@corp.example.com]" and a + // directoryName to "CN=host.example.com,O=Acme". Submitting that as an entry in + // additionalDomains is not "forwarding the name the subscriber asked for" — it + // is putting ASN.1 debris in a domain-name field, which cannot become a + // certificate SAN under any circumstances and only breaks the order. That is + // different from a well-formed non-DNS SAN (IP/email/URI), which we do submit + // on purpose so nothing the subscriber requested is dropped silently. + // + // Skipped is not silent: BuildSanList warns with the tag numbers so the + // operator can see a SAN was present and not forwarded. + type = null; + value = null; + break; + } + + return string.IsNullOrWhiteSpace(value) ? null : new SanEntry { Type = type, Value = value }; + } + private static string GetStringValue( Dictionary dict, string key, string defaultValue = "") { diff --git a/CERTInext/CERTInextCAPluginConfig.cs b/CERTInext/CERTInextCAPluginConfig.cs index 43d0537..5fcbbb8 100644 --- a/CERTInext/CERTInextCAPluginConfig.cs +++ b/CERTInext/CERTInextCAPluginConfig.cs @@ -256,6 +256,19 @@ public static Dictionary GetCAConnectorAnnotations() DefaultValue = false, Type = "Boolean" }, + [Constants.Config.SubmitNonDnsSans] = new PropertyConfigInfo + { + Comments = "If true (default), SANs that are not DNS names (IP address, email, URI) are " + + "submitted to CERTInext in additionalDomains along with the DNS names. CERTInext " + + "registers them verbatim as order domains and they cannot pass domain validation, " + + "so such an order will not issue until they are removed — but nothing the " + + "subscriber requested is dropped silently. Set to false to submit DNS names only, " + + "which restores the pre-1.0.1 behaviour: the order issues, but the certificate " + + "will not contain the non-DNS names. Default: true.", + Hidden = false, + DefaultValue = true, + Type = "Boolean" + }, [Constants.Config.PageSize] = new PropertyConfigInfo { Comments = "Number of orders to fetch per page during synchronization. " + @@ -272,6 +285,31 @@ public static Dictionary GetCAConnectorAnnotations() DefaultValue = true, Type = "Boolean" }, + [Constants.Config.PickupRetries] = new PropertyConfigInfo + { + Comments = "OPTIONAL: Number of times Enroll() will poll CERTInext to download the certificate after a " + + "successful order submission. If the certificate has not issued within this window it is " + + "picked up during the next synchronization instead. Set to 0 to disable the wait. " + + $"Default: {Constants.Pickup.DefaultRetries}. NOTE: CERTInext issues OV/EV certificates " + + "asynchronously (organization verification, minutes to hours), so those typically exhaust " + + "the wait and are returned pending regardless of this value.", + Hidden = false, + DefaultValue = Constants.Pickup.DefaultRetries, + Type = "Number" + }, + [Constants.Config.PickupDelay] = new PropertyConfigInfo + { + Comments = "OPTIONAL: Number of seconds between certificate-pickup retries. PickupRetries times this " + + "delay (plus a short initial delay) is the maximum time an enrollment call occupies a Command " + + "worker thread. If the duration is too long the request may time out, so target a total well " + + $"under ~90s. As a safety backstop the plugin additionally caps the effective total at " + + $"{Constants.Pickup.MaxTotalWaitSeconds}s regardless of how PickupRetries/PickupDelay are set, " + + $"reducing the retry count to fit. Default: {Constants.Pickup.DefaultDelaySeconds} " + + $"(with default retries this yields a ~{Constants.Pickup.InitialDelaySeconds + Constants.Pickup.DefaultRetries * Constants.Pickup.DefaultDelaySeconds}s ceiling).", + Hidden = false, + DefaultValue = Constants.Pickup.DefaultDelaySeconds, + Type = "Number" + }, [Constants.Config.DcvEnabled] = new PropertyConfigInfo { Comments = "OPTIONAL: When true, the gateway will perform DNS-based Domain Control Validation (DCV) " + @@ -358,6 +396,47 @@ public static Dictionary GetCAConnectorAnnotations() Hidden = false, DefaultValue = Constants.Dcv.DefaultSyncMaxPerPass, Type = "Number" + }, + + // ----------------------------------------------------------------------- + // V2 API settings — only required when UseV2Api = true + // ----------------------------------------------------------------------- + + [Constants.ConfigV2.UseV2Api] = new PropertyConfigInfo + { + Comments = "OPTIONAL: When true, the plugin routes Enroll / GetSingleRecord / Revoke through the " + + "CERTInext V2 REST API (/api/certinext/v2/). Requires ApiUrlV2, ClientId, and ClientSecret. " + + "Synchronize continues to use the V1 GetOrderReport until the V2 reports endpoint ships. " + + "Default: false (V1 API).", + Hidden = false, + DefaultValue = false, + Type = "Boolean" + }, + [Constants.ConfigV2.ApiUrlV2] = new PropertyConfigInfo + { + Comments = "REQUIRED when UseV2Api is true: CERTInext V2 API base URL " + + "(e.g. https://sandbox-us-api.certinext.io). No trailing slash or path suffix. " + + "V2 is hosted on a different endpoint than V1; both must be configured separately.", + Hidden = false, + DefaultValue = string.Empty, + Type = "String" + }, + [Constants.ConfigV2.ClientId] = new PropertyConfigInfo + { + Comments = "REQUIRED when UseV2Api is true: OAuth2 client ID for V2 API authentication. " + + "Provisioned separately from V1 AccessKey credentials — obtain from the CERTInext " + + "portal under Integration → REST APIs → OAuth2.", + Hidden = false, + DefaultValue = string.Empty, + Type = "String" + }, + [Constants.ConfigV2.ClientSecret] = new PropertyConfigInfo + { + Comments = "REQUIRED when UseV2Api is true: OAuth2 client secret for V2 API authentication. " + + "Stored as a secret — never transmitted outside the gateway's encrypted config store.", + Hidden = true, + DefaultValue = string.Empty, + Type = "String" } }; } @@ -406,8 +485,8 @@ public static Dictionary GetTemplateParameterAnnotat }, [Constants.EnrollmentParam.AutoApprove] = new PropertyConfigInfo { - Comments = "OPTIONAL: If true, the gateway will attempt automatic approval of certificates " + - "that are returned in a pending-approval state. Default: false.", + Comments = "Currently has no effect — reserved for future use. The plugin does not call " + + "any approval endpoint against CERTInext regardless of this setting.", Hidden = false, DefaultValue = false, Type = "Boolean" @@ -476,6 +555,29 @@ public static Dictionary GetTemplateParameterAnnotat Hidden = false, DefaultValue = string.Empty, Type = "String" + }, + + // ----------------------------------------------------------------------- + // V2 API enrollment parameters (only used when UseV2Api = true) + // ----------------------------------------------------------------------- + + [Constants.EnrollmentParam.ProductFamily] = new PropertyConfigInfo + { + Comments = "V2 API ONLY: Product family for this template. " + + "Accepted values: 'ssl' (default), 'private-pki', 'signature'. " + + "Maps to the corresponding V2 resource path (/api/certinext/v2/{family}-certificates/).", + Hidden = false, + DefaultValue = "ssl", + Type = "String" + }, + [Constants.EnrollmentParam.ProductVariant] = new PropertyConfigInfo + { + Comments = "V2 API ONLY: Product variant sent in the V2 order body. " + + "Accepted values: 'dv' (default), 'ov', 'ev'. " + + "Must match the variant associated with the configured product code.", + Hidden = false, + DefaultValue = "dv", + Type = "String" } }; } @@ -666,6 +768,23 @@ public class CERTInextConfig [JsonPropertyName("IgnoreExpired")] public bool IgnoreExpired { get; set; } = false; + /// + /// Whether non-DNS SANs (IP address, email, URI) are submitted to CERTInext. + /// + /// Defaults to true: nothing the subscriber requested is dropped silently. CERTInext + /// registers such values verbatim as order domains, and they cannot pass domain validation, + /// so the order will not issue until they are removed — a visible failure, deliberately + /// preferred over a certificate quietly missing requested names. + /// + /// Set to false to submit DNS names only, restoring the pre-1.0.1 behaviour where the + /// order issues but the non-DNS names are absent from the certificate. This exists as an + /// upgrade escape hatch: on a host that was issuing certificates for requests carrying an IP + /// or email SAN, the default flips those enrollments from "issues (incomplete)" to "parks + /// pending", and an operator needs a way back that does not involve downgrading the plugin. + /// + [JsonPropertyName("SubmitNonDnsSans")] + public bool SubmitNonDnsSans { get; set; } = true; + [JsonPropertyName("PageSize")] public int PageSize { get; set; } = Constants.Api.DefaultPageSize; @@ -695,6 +814,23 @@ public class CERTInextConfig /// Seconds to wait after publishing the DNS TXT record before calling VerifyDcv. /// Default: 30. /// + /// + /// Number of GetCertificate poll attempts inside Enroll() after an order is + /// submitted, before falling back to a pending result (picked up by the next sync). + /// Mirrors the legacy Sectigo connector's PickupRetries. Set to 0 to disable. + /// Default: 5. + /// + [JsonPropertyName("PickupRetries")] + public int PickupRetries { get; set; } = Constants.Pickup.DefaultRetries; + + /// + /// Seconds between certificate-pickup retries. PickupRetries * PickupDelay (plus a + /// short initial delay) bounds the time an enrollment call occupies a Command worker + /// thread. Mirrors the legacy Sectigo connector's PickupDelay. Default: 10. + /// + [JsonPropertyName("PickupDelay")] + public int PickupDelayInSeconds { get; set; } = Constants.Pickup.DefaultDelaySeconds; + [JsonPropertyName("DcvPropagationDelaySeconds")] public int DcvPropagationDelaySeconds { get; set; } = 30; @@ -746,6 +882,39 @@ public class CERTInextConfig [JsonPropertyName("DcvSyncMaxPerPass")] public int DcvSyncMaxPerPass { get; set; } = Constants.Dcv.DefaultSyncMaxPerPass; + // ----------------------------------------------------------------------- + // V2 API settings + // ----------------------------------------------------------------------- + + /// + /// When true, Enroll / GetSingleRecord / Revoke use the CERTInext V2 REST API. + /// Synchronize continues to use the V1 GetOrderReport endpoint. + /// Default: false. + /// + [JsonPropertyName("UseV2Api")] + public bool UseV2Api { get; set; } = false; + + /// + /// Base URL for the V2 API (e.g. https://sandbox-us-api.certinext.io). + /// Required when UseV2Api is true. No trailing slash or path suffix. + /// + [JsonPropertyName("ApiUrlV2")] + public string ApiUrlV2 { get; set; } = string.Empty; + + /// + /// OAuth2 client ID for V2 API authentication. + /// Required when UseV2Api is true. Separate from the V1 AccessKey credential. + /// + [JsonPropertyName("ClientId")] + public string ClientId { get; set; } = string.Empty; + + /// + /// OAuth2 client secret for V2 API authentication. + /// Required when UseV2Api is true. NEVER logged or transmitted in plaintext. + /// + [JsonPropertyName("ClientSecret")] + public string ClientSecret { get; set; } = string.Empty; + /// /// Returns the effective DCV timeout, preferring the environment variable over the /// config field so operators can adjust the ceiling without a connector reconfiguration. @@ -782,5 +951,22 @@ public int GetEffectiveDcvWaitForIssuanceSeconds() return envVal; return DcvWaitForIssuanceSeconds >= 0 ? DcvWaitForIssuanceSeconds : 60; } + + /// + /// Effective number of certificate-pickup retries, clamped to + /// [0, ]. 0 disables the synchronous pickup. + /// + public int GetEffectivePickupRetries() + => System.Math.Max(0, System.Math.Min(PickupRetries, Constants.Pickup.MaxRetries)); + + /// + /// Effective seconds between pickup retries, clamped to + /// [1, ]. A non-positive configured value + /// falls back to the default rather than producing a tight busy-loop. + /// + public int GetEffectivePickupDelaySeconds() + => System.Math.Max(1, System.Math.Min( + PickupDelayInSeconds > 0 ? PickupDelayInSeconds : Constants.Pickup.DefaultDelaySeconds, + Constants.Pickup.MaxDelaySeconds)); } } diff --git a/CERTInext/Client/CERTInextClient.cs b/CERTInext/Client/CERTInextClient.cs index 255b65a..7bc5a18 100644 --- a/CERTInext/Client/CERTInextClient.cs +++ b/CERTInext/Client/CERTInextClient.cs @@ -7,6 +7,7 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Net; using System.Runtime.CompilerServices; using System.Text; @@ -14,6 +15,7 @@ using System.Threading; using System.Threading.Tasks; using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; using Keyfactor.Extensions.CAPlugin.CERTInext.Models; using Keyfactor.Logging; using Microsoft.Extensions.Logging; @@ -41,11 +43,17 @@ public class CERTInextClient : ICERTInextClient, IDisposable private readonly CERTInextConfig _config; private readonly RestClient _http; - // OAuth2 token cache — refreshed when expired + // OAuth2 token cache — refreshed when expired (V1) private string _cachedToken; private DateTime _tokenExpiry = DateTime.MinValue; private readonly SemaphoreSlim _tokenLock = new SemaphoreSlim(1, 1); + // V2 API HTTP client and token cache + private readonly RestClient _httpV2; + private string _v2Token; + private DateTime _v2TokenExpiry = DateTime.MinValue; + private readonly SemaphoreSlim _v2TokenLock = new SemaphoreSlim(1, 1); + // --------------------------------------------------------------------------- // Construction // --------------------------------------------------------------------------- @@ -67,6 +75,18 @@ public CERTInextClient(CERTInextConfig config) }; _http = new RestClient(options); + + // V2 client — only constructed when V2 is enabled and ApiUrlV2 is set. + // No authenticator: tokens are injected per-request via BuildV2RequestAsync. + if (config.UseV2Api && !string.IsNullOrWhiteSpace(config.ApiUrlV2)) + { + var v2Options = new RestClientOptions(config.ApiUrlV2.TrimEnd('/')) + { + ThrowOnAnyError = false, + Timeout = TimeSpan.FromSeconds(120) + }; + _httpV2 = new RestClient(v2Options); + } } // --------------------------------------------------------------------------- @@ -77,6 +97,8 @@ public void Dispose() { _http?.Dispose(); _tokenLock?.Dispose(); + _httpV2?.Dispose(); + _v2TokenLock?.Dispose(); } // --------------------------------------------------------------------------- @@ -186,9 +208,20 @@ public async Task PlaceOrderAsync( if (request.Meta == null) request.Meta = await BuildMetaAsync(ct); + // The domain set is logged here, at the wire, not just where Command hands it to us. + // A UCC order that silently lost its SANs upstream of this point is otherwise + // indistinguishable in the gateway log from one the CA stripped — reconciling the + // enrollment-start "SANs=" line against this one localizes the loss immediately. + var certInfo = request.OrderDetails?.CertificateInformation; Logger.LogInformation( - "Submitting order to CERTInext. ProductCode={ProductCode}", - request.OrderDetails?.ProductCode); + "Submitting order to CERTInext. ProductCode={ProductCode}, DomainName={DomainName}, " + + "AdditionalDomainCount={AdditionalDomainCount}, AdditionalDomains={AdditionalDomains}", + request.OrderDetails?.ProductCode, + LogSanitizer.Strip(certInfo?.DomainName), + certInfo?.AdditionalDomains?.Count ?? 0, + certInfo?.AdditionalDomains != null && certInfo.AdditionalDomains.Count > 0 + ? LogSanitizer.Strip(string.Join("; ", certInfo.AdditionalDomains)) + : "(none)"); GenerateOrderResponse result = null; RestResponse resp = null; @@ -213,10 +246,16 @@ public async Task PlaceOrderAsync( request.Meta = await BuildMetaAsync(ct); var req = new RestRequest(Constants.Api.GenerateOrderSslPath, Method.Post); - req.AddJsonBody(JsonSerializer.Serialize(request, GetJsonOptions())); + string jsonBody = JsonSerializer.Serialize(request, GetJsonOptions()); + Logger.LogTrace("PlaceOrderAsync request payload: {Payload}", RedactCredentials(jsonBody)); + req.AddJsonBody(jsonBody); var sw = System.Diagnostics.Stopwatch.StartNew(); - resp = await ExecuteWithRetryAsync(req, ct); + // idempotent:false — order submission is non-idempotent. A network-level + // timeout may occur after CERTInext already created the order, so re-sending the + // same requestTxn would be rejected as EMS-947 and orphan the created order + // Rate-limit retries are still handled below (with a fresh txn). + resp = await ExecuteWithRetryAsync(req, ct, idempotent: false); sw.Stop(); Logger.LogInformation( @@ -232,6 +271,26 @@ public async Task PlaceOrderAsync( $"Authentication failure during certificate order. HTTP {(int)resp.StatusCode}. See gateway logs for details."); } + // Transient/network failure (5xx or no HTTP status) on a non-idempotent submit: + // CERTInext may have already created the order (the response just didn't reach us). + // We deliberately did not retry (see idempotent:false above). Fail clearly instead + // of deserializing an empty body; if the order was created, the next sync imports it. + bool transientFailure = !resp.IsSuccessful + && !((int)resp.StatusCode >= 400 && (int)resp.StatusCode < 500); + if (transientFailure) + { + Logger.LogWarning( + "PlaceOrder received no usable response (DomainName={Domain}, HttpStatus={Status}, LatencyMs={Latency}). " + + "Not retrying to avoid a duplicate order (EMS-947). If CERTInext created the order it " + + "will be imported by the next synchronization.", + LogSanitizer.Strip(request.OrderDetails?.CertificateInformation?.DomainName), + (int)resp.StatusCode, sw.ElapsedMilliseconds); + throw new Exception( + "CERTInext did not return a usable response to the order submission. If the order was " + + "created it will be imported by the next synchronization — do not resubmit immediately. " + + "See gateway logs for details."); + } + result = DeserializeOrThrow(resp, "place order"); if (result.Meta != null && !result.Meta.IsSuccess) @@ -259,6 +318,31 @@ public async Task PlaceOrderAsync( continue; // retry } + // EMS-947 "Duplicate requestTxn": CERTInext already received an order for this + // transaction. With the non-idempotent-retry fix above this should no longer be + // caused by our own retry, but if it still surfaces the order exists on the CA + // side and will be imported by the next sync — say so, not a generic failure. + bool isDuplicateTxn = + string.Equals(result.Meta.ErrorCode, "EMS-947", StringComparison.OrdinalIgnoreCase) + || (result.Meta.ErrorMessage?.IndexOf("Duplicate requestTxn", StringComparison.OrdinalIgnoreCase) >= 0); + if (isDuplicateTxn) + { + // Log the classification decision itself (parity with the transient-failure + // branch above) so an auditor sees the plugin deliberately treated this as a + // benign duplicate rather than a hard failure. + Logger.LogWarning( + "PlaceOrder classified {ErrorCode} as a duplicate transaction (not a hard failure). " + + "DomainName={Domain}, Path={Path}, HttpStatus={Status}, LatencyMs={Latency}. If an order exists " + + "for this transaction it will be imported by the next synchronization.", + result.Meta.ErrorCode, + LogSanitizer.Strip(request.OrderDetails?.CertificateInformation?.DomainName), + Constants.Api.GenerateOrderSslPath, (int)resp.StatusCode, sw.ElapsedMilliseconds); + throw new Exception( + "CERTInext reported a duplicate order transaction (EMS-947). If an order was created " + + "for this transaction it will be imported by the next synchronization — do not resubmit " + + "immediately. See gateway logs for details."); + } + throw new Exception( $"CERTInext order failed: {result.Meta.ErrorMessage ?? result.Meta.ErrorCode}. " + "See gateway logs for details."); @@ -300,7 +384,9 @@ public async Task SubmitCsrAsync(SubmitCsrRequest request, CancellationToken ct req.AddJsonBody(JsonSerializer.Serialize(request, GetJsonOptions())); var sw = System.Diagnostics.Stopwatch.StartNew(); - var resp = await ExecuteWithRetryAsync(req, ct); + // idempotent:false — submitting a CSR is non-idempotent; do not resend on a network + // timeout (the first attempt may have been received). See PlaceOrderAsync. + var resp = await ExecuteWithRetryAsync(req, ct, idempotent: false); sw.Stop(); Logger.LogInformation( @@ -310,6 +396,23 @@ public async Task SubmitCsrAsync(SubmitCsrRequest request, CancellationToken ct if (!resp.IsSuccessful) { LogApiFailure(Constants.Api.SubmitCsrPath, resp); + // Parity with PlaceOrderAsync: a transient/network failure on this non-idempotent + // submit was NOT retried, so record that decision (the CSR may already have been + // received). 4xx client errors fall through to the generic failure below. + bool transientFailure = !((int)resp.StatusCode >= 400 && (int)resp.StatusCode < 500); + if (transientFailure) + { + Logger.LogWarning( + "SubmitCSR received no usable response (OrderNumber={OrderNumber}, HttpStatus={Status}, " + + "LatencyMs={Latency}); not retrying (non-idempotent). If CERTInext already received the CSR, " + + "do not resubmit immediately.", + request.OrderDetails?.OrderNumber, (int)resp.StatusCode, sw.ElapsedMilliseconds); + // Parity with PlaceOrderAsync: carry the actionable guidance into the surfaced + // exception, not only the log line. + throw new Exception( + "CERTInext did not return a usable response to the CSR submission. If the CSR was received " + + "it will take effect — do not resubmit immediately. See gateway logs for details."); + } throw new Exception($"CERTInext SubmitCSR failed. HTTP {(int)resp.StatusCode}. See gateway logs for details."); } @@ -354,6 +457,8 @@ public async Task TrackOrderAsync(string orderNumber, Cancel } var result = DeserializeOrThrow(resp, $"track order {orderNumber}"); + Logger.LogTrace("TrackOrderAsync response payload (Order={OrderNumber}): {Payload}", + orderNumber, resp.Content); // A meta status of "0" with errorCode EMS-913 or similar means the order was not found if (result.Meta != null && !result.Meta.IsSuccess) @@ -710,15 +815,47 @@ public async Task RenewCertificateAsync( throw new KeyNotFoundException($"Cannot renew: prior order '{certificateId}' was not found in CERTInext."); } - // We don't have the product code from TrackOrder — build an order using - // the config defaults and the CSR from the renewal request. + // Primary domain for the renewal order. Prefer the CN of the subject Command gave + // us; the prior order's requestorName is only a last resort and is not a domain — + // it is retained solely so an old caller that sets no Subject behaves as before. + // Hoisted: the same parse drives both the domain and the "did we get a CN?" warning, + // mirroring BuildOrderRequestFromLegacyEnrollRequest. + string subjectCn = ExtractCnFromSubject(request.Subject); + + string renewalDomainName = + subjectCn + ?? priorTrack.OrderDetails?.RequestorInformation?.RequestorName + ?? "unknown"; + + if (subjectCn == null) + { + Logger.LogWarning( + "Renewal of order {PriorId} has no usable CN in its subject; falling back to " + + "DomainName='{DomainName}' from the prior order. Verify the renewed certificate's " + + "primary domain.", + certificateId, LogSanitizer.Strip(renewalDomainName)); + } + + // Prefer the template's own product code (threaded through via request.ProfileId); + // only fall back to the connector-level default when the caller didn't supply one. + // EnrollmentParams.ProductCode never returns null (it returns string.Empty when it + // can't resolve a code), so this must be a blank check, not a null-coalesce — a + // null-coalesce here would make the DefaultProductCode fallback unreachable, the + // same dead-fallback bug that made DefaultProductCode a no-op for new enrollments. var orderReq = new GenerateOrderSslRequest { Meta = await BuildMetaAsync(ct), OrderDetails = new SslOrderDetails { - ProductCode = _config.DefaultProductCode ?? string.Empty, + ProductCode = string.IsNullOrWhiteSpace(request.ProfileId) + ? (_config.DefaultProductCode ?? string.Empty) + : request.ProfileId, SaveAndHold = "0", + // Mirrors BuildOrderRequestFromLegacyEnrollRequest — omit when blank so the + // order falls back to the unvetted/ungroup path, same as new enrollments. + DelegationInformation = !string.IsNullOrWhiteSpace(_config.GroupNumber) + ? new DelegationInformation { GroupNumber = _config.GroupNumber } + : null, RequestorInformation = new RequestorInformation { RequestorName = request.RequesterName ?? _config.RequestorName, @@ -726,10 +863,26 @@ public async Task RenewCertificateAsync( RequestorIsdCode = _config.RequestorIsdCode ?? "1", RequestorMobileNumber = _config.RequestorMobileNumber ?? string.Empty }, + TechnicalPointOfContact = new TechnicalPointOfContact + { + TpcName = string.IsNullOrWhiteSpace(_config.TechnicalContactName) + ? (request.RequesterName ?? _config.RequestorName) + : _config.TechnicalContactName, + TpcEmail = string.IsNullOrWhiteSpace(_config.TechnicalContactEmail) + ? (request.RequesterEmail ?? _config.RequestorEmail) + : _config.TechnicalContactEmail, + TpcIsdCode = string.IsNullOrWhiteSpace(_config.TechnicalContactIsdCode) + ? (string.IsNullOrWhiteSpace(_config.RequestorIsdCode) ? "1" : _config.RequestorIsdCode) + : _config.TechnicalContactIsdCode, + TpcMobileNumber = string.IsNullOrWhiteSpace(_config.TechnicalContactMobileNumber) + ? (_config.RequestorMobileNumber ?? string.Empty) + : _config.TechnicalContactMobileNumber + }, SubscriptionDetails = new SubscriptionDetails { Validity = "1" }, CertificateInformation = new CertificateInformation { - DomainName = priorTrack.OrderDetails?.RequestorInformation?.RequestorName ?? "unknown" + DomainName = renewalDomainName, + AdditionalDomains = BuildAdditionalDomains(request.Sans, renewalDomainName) }, Csr = request.Csr, AgreementDetails = BuildDefaultAgreementDetails() @@ -1143,6 +1296,597 @@ private static string GenerateTxnId() /// /// Returns a valid OAuth2 access token, refreshing it if expired. Thread-safe. /// + // --------------------------------------------------------------------------- + // ICERTInextClient — V2 REST API methods + // --------------------------------------------------------------------------- + + /// + public async Task GetAuthMeV2Async(CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + var req = await BuildV2RequestAsync(Constants.ApiV2.AuthMePath, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + ThrowOnV2Failure(resp, "auth/me"); + var result = DeserializeV2OrThrow(resp, "auth/me"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task PingV2Async(CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + var me = await GetAuthMeV2Async(ct); + Logger.LogInformation( + "CERTInext V2 ping successful. AccountNumber={AccountNumber}, AuthType={AuthType}", + me.AccountNumber, me.AuthType); + Logger.MethodExit(LogLevel.Trace); + } + + /// + public async Task PlaceOrderV2Async( + string productFamilySlug, + string productCode, + V2CreateSslOrderRequest request, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string idempotencyKey = Guid.NewGuid().ToString(); + string path = $"{Constants.ApiV2.SslCertificatesPath.Replace("ssl-certificates", productFamilySlug)}"; + var req = await BuildV2RequestAsync(path, Method.Post, ct, idempotencyKey); + req.AddHeader("X-Product-Code", productCode ?? string.Empty); + string json = JsonSerializer.Serialize(request, GetJsonOptions()); + Logger.LogTrace("PlaceOrderV2Async request payload: {Payload}", json); + req.AddJsonBody(json); + var sw = System.Diagnostics.Stopwatch.StartNew(); + var resp = await _httpV2.ExecuteAsync(req, ct); + sw.Stop(); + Logger.LogInformation( + "CERTInext V2 API call: Method=POST, Path={Path}, HttpStatus={Status}, LatencyMs={Latency}", + path, (int)resp.StatusCode, sw.ElapsedMilliseconds); + Logger.LogTrace("PlaceOrderV2Async response: {Body}", resp.Content); + ThrowOnV2Failure(resp, "V2 place order"); + var result = DeserializeV2OrThrow(resp, "V2 place order"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task SubmitCsrV2Async( + string productFamilySlug, + string orderId, + string csrPem, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string path = BuildV2OrderPath(productFamilySlug, orderId) + "/csr"; + var req = await BuildV2RequestAsync(path, Method.Put, ct); + var body = new V2SubmitCsrRequest { Csr = csrPem }; + req.AddJsonBody(JsonSerializer.Serialize(body, GetJsonOptions())); + var resp = await _httpV2.ExecuteAsync(req, ct); + ThrowOnV2Failure(resp, "V2 submit CSR"); + Logger.MethodExit(LogLevel.Trace); + } + + /// + public async Task TrackOrderV2Async( + string productFamilySlug, + string orderId, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string path = BuildV2OrderPath(productFamilySlug, orderId); + var req = await BuildV2RequestAsync(path, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + if (resp.StatusCode == HttpStatusCode.NotFound) + { + Logger.MethodExit(LogLevel.Trace); + throw new KeyNotFoundException($"V2 order '{orderId}' not found in family '{productFamilySlug}'."); + } + ThrowOnV2Failure(resp, "V2 track order"); + var result = DeserializeV2OrThrow(resp, "V2 track order"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task DownloadCertificateV2Async( + string productFamilySlug, + string orderId, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string path = BuildV2OrderPath(productFamilySlug, orderId) + "/certificate"; + var req = await BuildV2RequestAsync(path, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + if (resp.StatusCode == HttpStatusCode.NotFound) + { + Logger.MethodExit(LogLevel.Trace); + throw new KeyNotFoundException($"V2 certificate for order '{orderId}' not found in family '{productFamilySlug}'."); + } + ThrowOnV2Failure(resp, "V2 download certificate"); + var result = DeserializeV2OrThrow(resp, "V2 download certificate"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task RevokeOrderV2Async( + string productFamilySlug, + string orderId, + V2RevokeRequest request, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string idempotencyKey = Guid.NewGuid().ToString(); + string path = BuildV2OrderPath(productFamilySlug, orderId) + "/revoke"; + var req = await BuildV2RequestAsync(path, Method.Post, ct, idempotencyKey); + req.AddJsonBody(JsonSerializer.Serialize(request, GetJsonOptions())); + var resp = await _httpV2.ExecuteAsync(req, ct); + if (resp.StatusCode == HttpStatusCode.NotFound) + { + Logger.MethodExit(LogLevel.Trace); + // Per the V2 spec ("Revoke Certificate", 404 response): "Order not found + // or not in a revokable state." This is deliberately ambiguous on the + // wire — callers that have already confirmed the order lives in + // `productFamilySlug` (e.g. via TrackOrderV2Async) should treat a 404 + // here as "not revokable", not as a family miss (issues/0019). + throw new KeyNotFoundException( + $"V2 order '{orderId}' in family '{productFamilySlug}' not found or not in a revokable state."); + } + if (resp.StatusCode == (HttpStatusCode)422) + { + // Label by whatever EMS code/detail CERTInext actually returned rather + // than presuming "not in issued state" — 422s here cover multiple + // distinct conditions (EMS-969 revoke reason ID missing, sandbox-timing + // "Certificate Request still being processed", etc. — see issues/0019). + string detail = ExtractV2ErrorMessage(resp.Content, "V2 revoke"); + throw new InvalidOperationException($"V2 revoke rejected. {detail}"); + } + ThrowOnV2Failure(resp, "V2 revoke order"); + Logger.MethodExit(LogLevel.Trace); + } + + /// + public async Task ResolveAndTrackOrderV2Async( + string orderId, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + var (_, status) = await ResolveV2OrderFamilyAsync(orderId, ct); + Logger.MethodExit(LogLevel.Trace); + return status; + } + + /// + public async Task<(string family, V2OrderStatusResponse status)> ResolveAndTrackOrderV2WithFamilyAsync( + string orderId, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + var result = await ResolveV2OrderFamilyAsync(orderId, ct); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task ResolveAndDownloadCertificateV2Async( + string orderId, + CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + var (family, _) = await ResolveV2OrderFamilyAsync(orderId, ct); + var cert = await DownloadCertificateV2Async(family, orderId, ct); + Logger.MethodExit(LogLevel.Trace); + return cert; + } + + /// + public async Task GetDcvV2Async(string orderId, string familySlug, CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string path = $"/api/certinext/v2/{familySlug}/{orderId}/dcv"; + var req = await BuildV2RequestAsync(path, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + Logger.LogInformation( + "CERTInext V2 API call: Method=GET, Path={Path}, HttpStatus={Status}", + path, (int)resp.StatusCode); + ThrowOnV2Failure(resp, "V2 get DCV challenge"); + var result = DeserializeV2OrThrow(resp, "V2 get DCV challenge"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task VerifyDcvV2Async(string orderId, string domain, string familySlug, CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + string path = $"/api/certinext/v2/{familySlug}/{orderId}/dcv/verify"; + var req = await BuildV2RequestAsync(path, Method.Post, ct); + var body = new V2DcvVerifyRequest { Domain = domain, Method = "dns-txt" }; + req.AddJsonBody(JsonSerializer.Serialize(body, GetJsonOptions())); + var resp = await _httpV2.ExecuteAsync(req, ct); + Logger.LogInformation( + "CERTInext V2 API call: Method=POST, Path={Path}, HttpStatus={Status}", + path, (int)resp.StatusCode); + + if (resp.StatusCode == (HttpStatusCode)422) + { + string detail = ExtractV2ErrorMessage(resp.Content, "V2 verify DCV"); + throw new InvalidOperationException( + $"V2 DCV verification failed for order '{orderId}', domain '{domain}'. {detail}"); + } + + // 204 No Content is a valid success — return an empty verified response + if (resp.StatusCode == System.Net.HttpStatusCode.NoContent || string.IsNullOrWhiteSpace(resp.Content)) + { + Logger.MethodExit(LogLevel.Trace); + return new V2DcvVerifyResponse { OverallStatus = "VERIFIED" }; + } + + ThrowOnV2Failure(resp, "V2 verify DCV"); + var result = DeserializeV2OrThrow(resp, "V2 verify DCV"); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + public async Task> GetProductDetailsV2Async(CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + var req = await BuildV2RequestAsync(Constants.ApiV2.CatalogProductsPath, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + Logger.LogInformation( + "CERTInext V2 API call: Method=GET, Path={Path}, HttpStatus={Status}", + Constants.ApiV2.CatalogProductsPath, (int)resp.StatusCode); + ThrowOnV2Failure(resp, "V2 get product details"); + var result = ParseProductDetailsV2Response(resp.Content); + Logger.MethodExit(LogLevel.Trace); + return result; + } + + /// + /// Minimal, read-only escape hatch for probing V2 endpoints that don't yet have a + /// typed client method (e.g. /reports/orders, /domains during discovery). + /// Issues a GET against the V2 base URL using the same token/header machinery as the + /// typed V2 methods, and returns the raw status/content instead of throwing on + /// non-success so callers can inspect 4xx/5xx bodies directly. Intended for + /// integration-test spikes — prefer a typed method once the response shape is known. + /// + public async Task<(int StatusCode, string ContentType, string Content)> ProbeV2GetAsync( + string pathAndQuery, CancellationToken ct = default) + { + Logger.MethodEntry(LogLevel.Trace); + EnsureV2Client(); + var req = await BuildV2RequestAsync(pathAndQuery, Method.Get, ct); + var resp = await _httpV2.ExecuteAsync(req, ct); + Logger.LogInformation( + "CERTInext V2 probe call: Method=GET, Path={Path}, HttpStatus={Status}", + pathAndQuery, (int)resp.StatusCode); + Logger.MethodExit(LogLevel.Trace); + return ((int)resp.StatusCode, resp.ContentType, resp.Content); + } + + // --------------------------------------------------------------------------- + // V2 private helpers + // --------------------------------------------------------------------------- + + /// + /// Parses the GET /api/certinext/v2/catalog/products response into a flat + /// list. The endpoint may return a bare JSON array + /// or a JSON object that wraps the list under a known property name + /// ("products", "data", "items", or "catalog"). Both shapes are handled so + /// the method stays resilient as the API evolves. + /// + private List ParseProductDetailsV2Response(string content) + { + if (string.IsNullOrWhiteSpace(content)) + return new List(); + + using var doc = JsonDocument.Parse(content); + var root = doc.RootElement; + + if (root.ValueKind == JsonValueKind.Array) + { + return JsonSerializer.Deserialize>(content, GetJsonOptions()) + ?? new List(); + } + + if (root.ValueKind == JsonValueKind.Object) + { + // Log the top-level property names so the actual schema is visible in test output. + var keys = string.Join(", ", root.EnumerateObject().Select(p => p.Name)); + Logger.LogInformation( + "GetProductDetailsV2Async: response is a JSON object with top-level keys: [{Keys}]", keys); + + // Try known wrapper property names in order of likelihood. + foreach (string candidate in new[] { "products", "data", "items", "catalog" }) + { + if (root.TryGetProperty(candidate, out JsonElement arr) && arr.ValueKind == JsonValueKind.Array) + { + return JsonSerializer.Deserialize>(arr.GetRawText(), GetJsonOptions()) + ?? new List(); + } + } + + // No recognised array property found — surface the object keys in the exception + // so the caller/test can see the actual schema and create a proper DTO. + throw new InvalidOperationException( + $"V2 catalog/products returned an unexpected JSON object. Top-level keys: [{keys}]. " + + "Update ParseProductDetailsV2Response with the correct property name."); + } + + throw new InvalidOperationException( + $"V2 catalog/products returned unexpected JSON kind: {root.ValueKind}."); + } + + private void EnsureV2Client() + { + if (_httpV2 == null) + throw new InvalidOperationException( + "V2 API client is not initialised. Ensure UseV2Api=true and ApiUrlV2 is set in the connector configuration."); + } + + private static string BuildV2OrderPath(string productFamilySlug, string orderId) + => $"/api/certinext/v2/{productFamilySlug}/{orderId}"; + + /// + /// Probes all three V2 product families (SSL → Private PKI → Signature) to find + /// which one owns the given order ID. Returns the matching family slug and the + /// TrackOrder response. Throws if not found. + /// + private async Task<(string family, V2OrderStatusResponse status)> ResolveV2OrderFamilyAsync( + string orderId, + CancellationToken ct) + { + foreach (var family in new[] + { + Constants.ApiV2.FamilySsl, + Constants.ApiV2.FamilyPrivatePki, + Constants.ApiV2.FamilySignature + }) + { + try + { + var status = await TrackOrderV2Async(family, orderId, ct); + return (family, status); + } + catch (KeyNotFoundException) + { + // Not in this family — try the next one + } + } + throw new KeyNotFoundException($"V2 order '{orderId}' not found in any product family."); + } + + /// + /// Fetches or returns the cached V2 OAuth2 bearer token. + /// Uses standard client_credentials grant with form-encoded body. + /// Token is cached until 60 seconds before its expiry. + /// + private async Task GetOrRefreshV2TokenAsync(CancellationToken ct) + { + if (!string.IsNullOrEmpty(_v2Token) && DateTime.UtcNow < _v2TokenExpiry) + return _v2Token; + + await _v2TokenLock.WaitAsync(ct); + try + { + if (!string.IsNullOrEmpty(_v2Token) && DateTime.UtcNow < _v2TokenExpiry) + return _v2Token; + + Logger.LogInformation( + "V2 OAuth2 token acquisition started. ApiUrlV2={ApiUrlV2}, ClientId={ClientId}", + _config.ApiUrlV2, _config.ClientId); + + string tokenUrl = _config.ApiUrlV2.TrimEnd('/') + Constants.ApiV2.TokenPath; + using var tokenClient = new RestClient(tokenUrl); + var tokenReq = new RestRequest(string.Empty, Method.Post); + tokenReq.AddHeader("Content-Type", "application/x-www-form-urlencoded"); + tokenReq.AddParameter("grant_type", "client_credentials"); + tokenReq.AddParameter("client_id", _config.ClientId); + tokenReq.AddParameter("client_secret", _config.ClientSecret); + + var tokenResp = await tokenClient.ExecuteAsync(tokenReq, ct); + if (!tokenResp.IsSuccessful || string.IsNullOrWhiteSpace(tokenResp.Content)) + { + // SOX CC6.1: never log tokenResp.Content — may contain client_secret. + // Per the V2 spec's OAuth2 error table: 401 invalid_client = wrong client_id / + // client_secret (or a revoked key); 403 unauthorized_client = the key exists but + // was never generated in OAuth mode in the portal. These are distinct failure + // modes with distinct fixes, so each gets its own hint rather than sharing one. + if ((int)tokenResp.StatusCode == 401) + { + Logger.LogError( + "V2 OAuth2 token acquisition failed with 401 Unauthorized (invalid_client). " + + "ApiUrlV2={ApiUrlV2}, ClientId={ClientId}. " + + "Hint: the ClientId or ClientSecret is wrong, or the key was revoked in the portal.", + _config.ApiUrlV2, _config.ClientId); + throw new Exception( + "V2 OAuth2 token request denied (401 Unauthorized, invalid_client). " + + "The ClientId or ClientSecret is incorrect, or the key was revoked. " + + "Regenerate the client secret in the CERTInext portal (Integration → REST APIs → OAuth2) " + + "and update the connector config. See gateway logs for details."); + } + if ((int)tokenResp.StatusCode == 403) + { + Logger.LogError( + "V2 OAuth2 token acquisition failed with 403 Forbidden (unauthorized_client). " + + "ApiUrlV2={ApiUrlV2}, ClientId={ClientId}. " + + "Hint: the access key exists but was not generated in OAuth mode in the portal.", + _config.ApiUrlV2, _config.ClientId); + throw new Exception( + "V2 OAuth2 token request denied (403 Forbidden, unauthorized_client). " + + "The access key was not generated in OAuth mode. Recreate the key in the CERTInext " + + "portal (Integration → REST APIs → OAuth2) with the OAuth radio button selected. " + + "See gateway logs for details."); + } + Logger.LogError( + "V2 OAuth2 token acquisition failed. ApiUrlV2={ApiUrlV2}, ClientId={ClientId}, HttpStatus={Status}", + _config.ApiUrlV2, _config.ClientId, (int)tokenResp.StatusCode); + throw new Exception( + $"Failed to obtain V2 OAuth2 token. HTTP {(int)tokenResp.StatusCode}. See gateway logs for details."); + } + + var tokenPayload = JsonSerializer.Deserialize(tokenResp.Content, GetJsonOptions()); + if (tokenPayload == null || string.IsNullOrEmpty(tokenPayload.AccessToken)) + { + Logger.LogError( + "V2 OAuth2 token response did not contain access_token. ApiUrlV2={ApiUrlV2}", + _config.ApiUrlV2); + throw new Exception("V2 OAuth2 token response did not contain an access_token."); + } + + _v2Token = tokenPayload.AccessToken; + _v2TokenExpiry = DateTime.UtcNow.AddSeconds(Math.Max(tokenPayload.ExpiresIn - 60, 30)); + + Logger.LogInformation( + "V2 OAuth2 token acquired. ApiUrlV2={ApiUrlV2}, ClientId={ClientId}, ExpiresAt={Expiry:u}", + _config.ApiUrlV2, _config.ClientId, _v2TokenExpiry); + return _v2Token; + } + finally + { + _v2TokenLock.Release(); + } + } + + /// + /// Builds a V2 REST request with the Authorization: Bearer header populated from + /// the cached/refreshed V2 token. Optionally adds an Idempotency-Key header. + /// + private async Task BuildV2RequestAsync( + string path, + Method method, + CancellationToken ct, + string idempotencyKey = null) + { + string token = await GetOrRefreshV2TokenAsync(ct); + var req = new RestRequest(path, method); + req.AddHeader("Authorization", $"Bearer {token}"); + req.AddHeader("Accept", "application/json"); + if (!string.IsNullOrEmpty(idempotencyKey)) + req.AddHeader("Idempotency-Key", idempotencyKey); + return req; + } + + /// + /// Throws an appropriate exception for V2 API non-success responses. + /// Handles RFC 7807 problem+json and plain HTTP errors. + /// + private static void ThrowOnV2Failure(RestResponse resp, string operation) + { + if (resp.IsSuccessful) return; + + if (resp.StatusCode == HttpStatusCode.Unauthorized) + { + LogV2ApiFailure(operation, resp, LogLevel.Error); + throw new Exception($"V2 authentication failure during '{operation}'. HTTP 401. See gateway logs for details."); + } + + if (resp.StatusCode == HttpStatusCode.Forbidden) + { + LogV2ApiFailure(operation, resp, LogLevel.Error); + string hint = ExtractV2ErrorMessage(resp.Content, operation); + throw new Exception( + $"V2 access denied during '{operation}'. HTTP 403. {hint} " + + "If error code is EMS-2022, ensure OAuth2 is enabled in the CERTInext portal."); + } + + LogV2ApiFailure(operation, resp, LogLevel.Warning); + string msg = ExtractV2ErrorMessage(resp.Content, operation); + throw new Exception($"CERTInext V2 API error during '{operation}'. HTTP {(int)resp.StatusCode}. {msg}"); + } + + /// + /// Writes a structured log for a V2 API non-success response — matching the V1 + /// pattern but adapted for V2's RFC 7807 error shape. + /// Call immediately before throwing so the exception's "See gateway logs for details" + /// message has a corresponding structured entry in the gateway log. + /// + private static void LogV2ApiFailure(string operation, RestResponse resp, LogLevel level = LogLevel.Warning) + { + string sanitizedBody = Truncate(RedactCredentials(resp?.Content) ?? "(empty)", LoggedResponseBodyCapBytes); + Logger.Log( + level, + "CERTInext V2 API non-success. Operation={Operation}, Method={Method}, Path={Path}, " + + "HttpStatus={HttpStatus}, ResponseBody={ResponseBody}", + operation, + resp?.Request?.Method.ToString() ?? "(unknown)", + resp?.Request?.Resource ?? "(unknown)", + (int?)resp?.StatusCode ?? 0, + sanitizedBody); + } + + /// + /// Parses an RFC 7807 problem+json body and returns a human-readable message. + /// Falls back to a generic message on parse failure. + /// + private static string ExtractV2ErrorMessage(string content, string operation) + { + if (string.IsNullOrWhiteSpace(content)) + return $"CERTInext V2 returned no body for '{operation}'."; + + string capped = content.Length > MaxErrorBodyBytes + ? content.Substring(0, MaxErrorBodyBytes) + : content; + + try + { + var problem = JsonSerializer.Deserialize(capped, GetJsonOptions()); + if (problem != null && (!string.IsNullOrWhiteSpace(problem.Detail) || !string.IsNullOrWhiteSpace(problem.Title) + || (problem.Errors != null && problem.Errors.Count > 0))) + { + string msg = $"{problem.Title}: {problem.Detail}".Trim(':').Trim(); + + // RFC 7807 per-field validation errors (spec's "errors[]", e.g. a 400 on + // order create naming exactly which field failed) — fold them into the + // message so the operator doesn't have to go dig the raw response out of + // the gateway log to find out which field CERTInext rejected. + if (problem.Errors != null && problem.Errors.Count > 0) + { + string fieldErrors = string.Join("; ", problem.Errors + .Where(e => !string.IsNullOrWhiteSpace(e?.Field) || !string.IsNullOrWhiteSpace(e?.Message)) + .Select(e => $"{e.Field}: {e.Message}".Trim(':').Trim())); + if (!string.IsNullOrWhiteSpace(fieldErrors)) + msg = string.IsNullOrWhiteSpace(msg) ? fieldErrors : $"{msg} [{fieldErrors}]"; + } + + if (!string.IsNullOrWhiteSpace(msg)) + return msg; + } + } + catch + { + // Not a problem+json body — fall through + } + + return $"See gateway logs for raw response. Operation='{operation}'."; + } + + private static T DeserializeV2OrThrow(RestResponse resp, string operation) where T : class + { + if (string.IsNullOrWhiteSpace(resp.Content)) + throw new Exception($"CERTInext V2 returned an empty body for '{operation}'."); + var result = JsonSerializer.Deserialize(resp.Content, GetJsonOptions()); + if (result == null) + throw new Exception($"CERTInext V2 returned a null/unrecognised body for '{operation}'."); + return result; + } + + // --------------------------------------------------------------------------- + // V1 token helper (unchanged) + // --------------------------------------------------------------------------- + private async Task GetOrRefreshTokenAsync(CancellationToken ct) { if (!string.IsNullOrEmpty(_cachedToken) && DateTime.UtcNow < _tokenExpiry) @@ -1213,27 +1957,78 @@ private async Task GetOrRefreshTokenAsync(CancellationToken ct) /// attempts, retrying on HTTP 5xx and network-level failures (no status code). /// 4xx responses are returned immediately — client errors will not be resolved /// by retrying. + /// + /// When is false the request is sent exactly + /// once and transient failures are NOT retried. This is required for non-idempotent + /// order-submission calls: a network-level timeout can occur *after* CERTInext has + /// already received and created the order, so re-sending the same body (same + /// requestTxn) is rejected as "Duplicate requestTxn" (EMS-947) and orphans the + /// order the first attempt actually created. /// private async Task ExecuteWithRetryAsync( RestRequest req, CancellationToken ct, - int maxAttempts = 3) + int maxAttempts = 3, + bool idempotent = true) { + int attempts = idempotent ? maxAttempts : 1; RestResponse resp = null; - for (int attempt = 1; attempt <= maxAttempts; attempt++) + var sw = System.Diagnostics.Stopwatch.StartNew(); + for (int attempt = 1; attempt <= attempts; attempt++) { resp = await _http.ExecuteAsync(req, ct); - // Success or 4xx client error — return immediately + // Success or 4xx client error — return immediately, checked BEFORE the + // cancellation check below. `_http.ExecuteAsync` already ran to completion by the + // time control reaches this line; whether `ct` has *since* flipped to cancelled is + // a separate, unsynchronized fact (a check-after-await race, not a fabricated one — + // a CancellationTokenSource(TimeSpan) callback and this awaited Task's completion + // are not mutually exclusive events). A deadline (the shared DcvTimeoutMinutes + // budget) firing at essentially the same instant a call genuinely succeeded must not + // discard that success: for VerifyDcv specifically, discarding it here would abort + // PerformDcvIfNeededAsync's loop before WaitForDcvVerificationAsync ever ran, and + // its finally block would delete the just-staged TXT record even though CERTInext + // had genuinely received the verify trigger — turning a real CA-side success into a + // self-inflicted DCV failure. bool isClientError = (int)resp.StatusCode >= 400 && (int)resp.StatusCode < 500; if (resp.IsSuccessful || isClientError) return resp; - if (attempt < maxAttempts) + // Only for a call that did NOT succeed: this client is built with + // ThrowOnAnyError=false (see the constructor), so a cancelled ct does not surface as + // OperationCanceledException from ExecuteAsync — RestSharp catches + // HttpClient.SendAsync's cancellation internally and returns a non-throwing, + // unsuccessful RestResponse instead. Left unchecked, that response reaches + // DeserializeOrThrow and becomes a plain Exception indistinguishable from a genuine + // API failure — which is exactly how a caller such as PerformDcvIfNeededAsync's + // shared DCV-timeout cancellation was still landing in a generic "GetDcv failed" + // per-domain catch instead of the cancellation-specific one, even after that method + // was hardened to re-throw a real OperationCanceledException past its per-domain + // catches. Surface the true cancellation here, at the one place in the client that + // actually holds `ct`, before any retry or error-wrapping logic sees the response. + // + // Throwing here means every caller's own per-call audit line (Method/Path/HttpStatus/ + // LatencyMs, logged after ExecuteWithRetryAsync returns) never executes for the + // cancelled call — that specific attempt would otherwise vanish from the audit trail + // entirely, leaving only a coarser, order-level "unexpected failure" log with no + // domain/endpoint/status/latency. Log that record here instead, at the one place that + // reliably sees every cancellation regardless of which of ExecuteWithRetryAsync's ~10 + // callers is in flight. + if (ct.IsCancellationRequested) + { + Logger.LogWarning( + "CERTInext API call cancelled: Method={Method}, Path={Path}, HttpStatus={Status}, " + + "ResponseStatus={ResponseStatus}, LatencyMs={Latency}, Attempt={Attempt}/{Max}.", + req.Method, req.Resource, (int)resp.StatusCode, resp.ResponseStatus, + sw.ElapsedMilliseconds, attempt, attempts); + } + ct.ThrowIfCancellationRequested(); + + if (attempt < attempts) { Logger.LogWarning( "CERTInext API returned {Status} on attempt {Attempt}/{Max} — retrying...", - (int)resp.StatusCode, attempt, maxAttempts); + (int)resp.StatusCode, attempt, attempts); } } @@ -1312,18 +2107,24 @@ private static LegacyGetCertificateResponse MapOrderReportEntryToLegacy(OrderRep private GenerateOrderSslRequest BuildOrderRequestFromLegacyEnrollRequest(EnrollCertificateRequest request) { - // Map ValidityDays → CERTInext's year-based validity. Default 1. - string validityYears = request.ValidityDays.HasValue - ? Math.Ceiling(request.ValidityDays.Value / 365.0).ToString("0") - : (string.IsNullOrWhiteSpace(_config.SubscriptionValidityYears) - ? "1" - : _config.SubscriptionValidityYears); + // ValidityYears takes precedence; ValidityDays is converted to years as a fallback. + string validityYears = request.ValidityYears.HasValue + ? request.ValidityYears.Value.ToString() + : request.ValidityDays.HasValue + ? Math.Ceiling(request.ValidityDays.Value / 365.0).ToString("0") + : (string.IsNullOrWhiteSpace(_config.SubscriptionValidityYears) + ? "1" + : _config.SubscriptionValidityYears); string requestorName = request.RequesterName ?? _config.RequestorName ?? "Keyfactor Gateway"; string requestorEmail = request.RequesterEmail ?? _config.RequestorEmail ?? string.Empty; string requestorIsd = string.IsNullOrWhiteSpace(_config.RequestorIsdCode) ? "1" : _config.RequestorIsdCode; string requestorMobile = _config.RequestorMobileNumber ?? string.Empty; + // Hoisted: additionalDomains is de-duplicated against the primary domain, so both + // fields have to be built from the same value. + string domainName = ExtractCnFromSubject(request.Subject) ?? "unknown"; + return new GenerateOrderSslRequest { // Meta will be set by PlaceOrderAsync @@ -1369,8 +2170,8 @@ private GenerateOrderSslRequest BuildOrderRequestFromLegacyEnrollRequest(EnrollC }, CertificateInformation = new CertificateInformation { - DomainName = ExtractCnFromSubject(request.Subject) ?? "unknown", - AdditionalDomains = BuildAdditionalDomains(request.Sans), + DomainName = domainName, + AdditionalDomains = BuildAdditionalDomains(request.Sans, domainName), AutoSecureWww = string.IsNullOrWhiteSpace(_config.AutoSecureWww) ? "0" : _config.AutoSecureWww }, @@ -1432,16 +2233,57 @@ private static string ExtractCnFromSubject(string subject) return null; } - private static List BuildAdditionalDomains(System.Collections.Generic.List sans) + /// + /// Projects the resolved SAN list onto certificateInformation.additionalDomains. + /// + /// Every requested SAN is submitted regardless of type. Filtering to DNS-only (the + /// original behaviour) issued certificates quietly missing names the subscriber had + /// requested, which is the worse failure; the caller warns about the non-DNS entries + /// before we get here. + /// + /// is the value already going out as the order's primary + /// domain, and Command normally includes the CN in the SAN set as well. On the US + /// sandbox CERTInext was measured to collapse that repetition itself + /// (SanSubmissionProbeTests: CN submitted twice came back registered once), but that is + /// undocumented and unverified against production — which is exactly why we exclude it + /// here rather than relying on CA-side de-duplication. It also keeps the submitted body + /// matching what we log. + /// + private List BuildAdditionalDomains( + System.Collections.Generic.List sans, + string domainName) { if (sans == null || sans.Count == 0) return null; + var domains = new List(); + var seen = new HashSet(StringComparer.OrdinalIgnoreCase); + + bool haveDomainName = !string.IsNullOrWhiteSpace(domainName); + if (haveDomainName) + seen.Add(domainName.Trim()); + + int duplicates = 0; foreach (var san in sans) { - if (string.Equals(san.Type, "dns", StringComparison.OrdinalIgnoreCase) && - !string.IsNullOrWhiteSpace(san.Value)) - domains.Add(san.Value); + if (san == null || string.IsNullOrWhiteSpace(san.Value)) continue; + + string value = san.Value.Trim(); + if (!seen.Add(value)) + { + duplicates++; + continue; + } + domains.Add(value); + } + + if (duplicates > 0) + { + Logger.LogDebug( + "Collapsed {Count} duplicate SAN value(s) out of additionalDomains " + + "(already submitted as domainName '{DomainName}', or repeated in the SAN set).", + duplicates, LogSanitizer.Strip(domainName)); } + return domains.Count > 0 ? domains : null; } diff --git a/CERTInext/Client/ICERTInextClient.cs b/CERTInext/Client/ICERTInextClient.cs index cbba099..0d99f3d 100644 --- a/CERTInext/Client/ICERTInextClient.cs +++ b/CERTInext/Client/ICERTInextClient.cs @@ -10,6 +10,7 @@ using System.Threading; using System.Threading.Tasks; using Keyfactor.Extensions.CAPlugin.CERTInext.API; +using Keyfactor.Extensions.CAPlugin.CERTInext.API.V2; namespace Keyfactor.Extensions.CAPlugin.CERTInext.Client { @@ -172,5 +173,116 @@ Task VerifyDcvAsync( string domainName, string dcvMethod, CancellationToken ct = default); + + // ----------------------------------------------------------------------- + // V2 REST API methods — only active when UseV2Api = true + // ----------------------------------------------------------------------- + + /// + /// V2 connectivity check via GET /api/certinext/v2/auth/me. + /// Throws if the V2 endpoint is unreachable or credentials are invalid. + /// + Task PingV2Async(CancellationToken ct = default); + + /// + /// Places a new order via POST /api/certinext/v2/{productFamilySlug}. + /// The product code is sent as the X-Product-Code header. + /// An Idempotency-Key is generated automatically. + /// + Task PlaceOrderV2Async( + string productFamilySlug, + string productCode, + V2CreateSslOrderRequest request, + CancellationToken ct = default); + + /// + /// Submits a CSR to an existing V2 order via PUT /api/certinext/v2/{family}/{orderId}/csr. + /// + Task SubmitCsrV2Async( + string productFamilySlug, + string orderId, + string csrPem, + CancellationToken ct = default); + + /// + /// Returns the current status of a V2 order via GET /api/certinext/v2/{family}/{orderId}. + /// Throws when the order does not exist in that family. + /// + Task TrackOrderV2Async( + string productFamilySlug, + string orderId, + CancellationToken ct = default); + + /// + /// Downloads the issued certificate for a V2 order. + /// GET /api/certinext/v2/{family}/{orderId}/certificate + /// + Task DownloadCertificateV2Async( + string productFamilySlug, + string orderId, + CancellationToken ct = default); + + /// + /// Revokes a V2 certificate via POST /api/certinext/v2/{family}/{orderId}/revoke. + /// An Idempotency-Key is generated automatically. + /// + Task RevokeOrderV2Async( + string productFamilySlug, + string orderId, + V2RevokeRequest request, + CancellationToken ct = default); + + /// + /// Returns V2 auth/me response (accountNumber, authType). + /// + Task GetAuthMeV2Async(CancellationToken ct = default); + + /// + /// Resolves the product-family slug for the given V2 order ID by probing all three + /// families (ssl → private-pki → signature), then returns the track response. + /// Throws if the order is not found in any family. + /// + Task ResolveAndTrackOrderV2Async( + string orderId, + CancellationToken ct = default); + + /// + /// Resolves the product-family slug for the given V2 order ID and downloads the certificate. + /// Throws if the order is not found in any family. + /// + Task ResolveAndDownloadCertificateV2Async( + string orderId, + CancellationToken ct = default); + + /// + /// Returns the DCV challenge details for a V2 order. + /// GET /api/certinext/v2/{familySlug}/{orderId}/dcv + /// + Task GetDcvV2Async(string orderId, string familySlug, CancellationToken ct = default); + + /// + /// Asks CERTInext to verify the DNS TXT record for the given domain on a V2 order. + /// POST /api/certinext/v2/{familySlug}/{orderId}/dcv/verify + /// Both 200 OK and 204 No Content are treated as success. + /// Throws on 422 (verification failed). + /// + Task VerifyDcvV2Async(string orderId, string domain, string familySlug, CancellationToken ct = default); + + /// + /// Resolves the product-family slug for the given V2 order ID by probing all three + /// families (ssl → private-pki → signature), then returns both the resolved slug and the + /// track response. Use this when the caller needs to pass the family slug to downstream + /// operations such as DCV. + /// Throws if the order is not found in any family. + /// + Task<(string family, V2OrderStatusResponse status)> ResolveAndTrackOrderV2WithFamilyAsync( + string orderId, + CancellationToken ct = default); + + /// + /// Returns the list of products available in the V2 catalog. + /// GET /api/certinext/v2/catalog/products + /// + Task> GetProductDetailsV2Async(CancellationToken ct = default); } } diff --git a/CERTInext/Constants.cs b/CERTInext/Constants.cs index 83e6929..8946780 100644 --- a/CERTInext/Constants.cs +++ b/CERTInext/Constants.cs @@ -20,7 +20,18 @@ public static class Config public const string AuthMode = "AuthMode"; public const string Enabled = "Enabled"; public const string IgnoreExpired = "IgnoreExpired"; + public const string SubmitNonDnsSans = "SubmitNonDnsSans"; public const string PageSize = "PageSize"; + + // Synchronous certificate pickup (parity with the legacy Sectigo connector). + // After submitting an order, Enroll() polls GetCertificate up to PickupRetries + // times, PickupDelay seconds apart (after a fixed initial delay), so a fast-issuing + // order returns the issued certificate in the same enrollment call instead of + // waiting for the next synchronization. On timeout the order is returned pending and + // imported by a later sync — behaviour identical to before this feature. + public const string PickupRetries = "PickupRetries"; + public const string PickupDelay = "PickupDelay"; + public const string RequestorName = "RequestorName"; public const string RequestorEmail = "RequestorEmail"; public const string RequestorIsdCode = "RequestorIsdCode"; @@ -111,6 +122,10 @@ public static class EnrollmentParam public const string SignerIp = "SignerIp"; public const string DomainName = "DomainName"; // primary domain for SSL/TLS orders public const string KeyType = "KeyType"; + + // V2 API enrollment parameters + public const string ProductFamily = "ProductFamily"; // V2: "ssl", "private-pki", or "signature" + public const string ProductVariant = "ProductVariant"; // V2: "dv", "ov", or "ev" } public static class Products @@ -268,6 +283,34 @@ public static class RevocationReasonId public const int Default = KeyCompromise; } + public static class Pickup + { + // Defaults mirror the legacy Sectigo connector's PickUpEnrolledCertificate: + // a 5-second initial delay, then up to 5 poll attempts 10 seconds apart, so the + // maximum time an enrollment call occupies a Command worker thread is + // InitialDelaySeconds + DefaultRetries * DefaultDelaySeconds = 5 + 5*10 = 55 seconds. + // Set PickupRetries to 0 to disable the wait entirely (immediate pending return). + public const int DefaultRetries = 5; + public const int DefaultDelaySeconds = 10; + + // Small static delay before the first poll — gives a fast order a chance to finish + // issuing before we poll at all, avoiding a guaranteed-miss first attempt. + public const int InitialDelaySeconds = 5; + + // Per-factor safety clamps so a single mis-typed value cannot produce a tight busy-loop + // or an absurd per-attempt delay. These bound each knob independently; the *product* + // (retries * delay) is bounded separately by MaxTotalWaitSeconds below. + public const int MaxRetries = 30; + public const int MaxDelaySeconds = 60; + + // Hard ceiling on total in-call pickup occupancy (initial delay + retries * delay). + // The per-factor clamps above still permit a ~1805s product at the extremes, which could + // push Enroll() past Command's enrollment timeout; PickUpEnrolledCertificateAsync caps the + // effective retry count so the total never exceeds this. Kept comfortably under a typical + // enrollment timeout while leaving room for the documented ~90s default guidance. + public const int MaxTotalWaitSeconds = 180; + } + public static class Dcv { // CERTInext dcvMethod values (dcvDetails.dcvMethod in GetDcv / VerifyDcv) @@ -285,6 +328,17 @@ public static class Dcv // Override via the DcvTxtRecordTemplate connector config field. public const string DefaultTxtRecordTemplate = "_emsign-validation.{0}"; + // Independent bound for a single CleanupValidation (TXT-record removal) call. This is + // deliberately its own fixed ceiling, not a fraction of DcvTimeoutMinutes and not the + // ambient DCV-flow cancellation token: cleanup is a best-effort compensating action that + // must get a real chance to run even when the operation it's cleaning up after was + // itself cancelled (the ambient token would already be cancelled at that point), but it + // still must not be allowed to hang the calling gateway request forever if a DNS + // provider plugin's underlying network call stalls. 60s comfortably covers a single + // DELETE-shaped call under normal conditions (the reference CloudflareDomainValidator's + // HttpClient default alone is 100s) without risking an indefinite hang. + public const int CleanupValidationTimeoutSeconds = 60; + // Defaults for the DCV-during-sync bounds (issue 0002). public const int DefaultSyncMaxOrderAgeHours = 24; public const int DefaultSyncMaxPerPass = 50; @@ -297,7 +351,51 @@ public static class Dcv public const int SyncPropagationDelaySeconds = 3; } + /// + /// V2 REST API constants — all paths, status strings, and family slugs for the + /// /api/certinext/v2/ surface. Auth is OAuth2 client_credentials; every + /// unsafe call requires an Idempotency-Key header. + /// + public static class ApiV2 + { + // Auth / connectivity + public const string TokenPath = "/oauth/token"; + public const string AuthMePath = "/api/certinext/v2/auth/me"; + + // Product-family resource paths (appended to base URL) + public const string SslCertificatesPath = "/api/certinext/v2/ssl-certificates"; + public const string PrivatePkiCertificatesPath = "/api/certinext/v2/private-pki-certificates"; + public const string SignatureCertificatesPath = "/api/certinext/v2/signature-certificates"; + public const string CatalogProductsPath = "/api/certinext/v2/catalog/products"; + + // Order status strings (V2 REST — NOT numeric IDs) + public const string StatusPendingDcv = "pending-dcv"; + public const string StatusPendingCsr = "pending-csr"; + public const string StatusPendingAgreement = "pending-agreement"; + public const string StatusIssued = "issued"; + public const string StatusCancelled = "cancelled"; + public const string StatusRevoked = "revoked"; + + // Product-family slugs (used as URL path segments) + public const string FamilySsl = "ssl-certificates"; + public const string FamilyPrivatePki = "private-pki-certificates"; + public const string FamilySignature = "signature-certificates"; + } + + // V2 config key constants (added here alongside existing Config constants) + public static class ConfigV2 + { + public const string UseV2Api = "UseV2Api"; + public const string ApiUrlV2 = "ApiUrlV2"; + public const string ClientId = "ClientId"; + public const string ClientSecret = "ClientSecret"; + } + // Legacy string revocation reasons — retained so StatusMapper still compiles. + // V1 never puts these on the wire (RevokeOrderRequest sends a numeric + // revokeReasonId — see CERTInextClient.RevokeCertificateAsync / + // MapLegacyReasonStringToCrlCode), so this class is intentionally left + // untouched by the 0019 V2 kebab-case fix; see RevocationReasonV2 below. public static class RevocationReason { public const string Unspecified = "unspecified"; @@ -311,5 +409,27 @@ public static class RevocationReason public const string PrivilegeWithdrawn = "privilegeWithdrawn"; public const string AACompromise = "aACompromise"; } + + // V2 API revocation reason strings. These must match the CERTInext V2 spec's + // kebab-case `reason` enum exactly (docs/reference/specs/CERTInext API + // v2.postman_collection.json, "Revoke Certificate"). Sending camelCase (the + // pre-fix values, shared with the legacy RevocationReason class above) gets + // HTTP 400 — see issues/0019. `AACompromise` is accepted on the + // signature-certificates / private-pki-certificates revoke endpoints per spec, + // but is not documented on ssl-certificates; kept here as the RFC 5280 code-10 + // mapping for those other families. There is no V2 equivalent of the RFC 5280 + // CRL-only "removeFromCRL" (code 8) reason, so it is intentionally absent here. + public static class RevocationReasonV2 + { + public const string Unspecified = "unspecified"; + public const string KeyCompromise = "key-compromise"; + public const string CACompromise = "ca-compromise"; + public const string AffiliationChanged = "affiliation-changed"; + public const string Superseded = "superseded"; + public const string CessationOfOperation = "cessation-of-operation"; + public const string CertificateHold = "certificate-hold"; + public const string PrivilegeWithdrawn = "privilege-withdrawn"; + public const string AACompromise = "aa-compromise"; + } } } diff --git a/CERTInext/Models/EnrollmentParams.cs b/CERTInext/Models/EnrollmentParams.cs index 69b662f..82f7ba3 100644 --- a/CERTInext/Models/EnrollmentParams.cs +++ b/CERTInext/Models/EnrollmentParams.cs @@ -52,6 +52,9 @@ public string ProductCode /// Alias for ProductCode — kept for backward compat. public string ProfileId => ProductCode; + /// Requested subscription validity in years (1, 2, or 3). Takes precedence over ValidityDays. + public int ValidityYears => GetInt(Constants.EnrollmentParam.ValidityYears, 0); + /// Requested validity in days; 0 means "use profile default". public int ValidityDays => GetInt(Constants.EnrollmentParam.ValidityDays, 0); @@ -96,6 +99,35 @@ public string ProductCode /// public string SignerIp => GetString(Constants.EnrollmentParam.SignerIp, string.Empty); + // ------------------------------------------------------------------ + // V2 API parameters + // ------------------------------------------------------------------ + + /// + /// V2 product family. Accepted values: "ssl" (default), "private-pki", "signature". + /// Used to select the correct V2 resource path. + /// + public string ProductFamily => GetString(Constants.EnrollmentParam.ProductFamily, "ssl"); + + /// + /// V2 product family as the REST path slug used in V2 URL construction. + /// Maps "ssl" → "ssl-certificates", "private-pki" → "private-pki-certificates", + /// "signature" → "signature-certificates". + /// + public string ProductFamilySlug => ProductFamily.ToLowerInvariant() switch + { + "ssl" => Constants.ApiV2.FamilySsl, + "private-pki" => Constants.ApiV2.FamilyPrivatePki, + "signature" => Constants.ApiV2.FamilySignature, + _ => Constants.ApiV2.FamilySsl + }; + + /// + /// V2 product variant sent in the order body (e.g. "dv", "ov", "ev"). + /// Default: "dv". + /// + public string ProductVariant => GetString(Constants.EnrollmentParam.ProductVariant, "dv"); + // ------------------------------------------------------------------ // Helpers // ------------------------------------------------------------------ diff --git a/CERTInext/Models/LogSanitizer.cs b/CERTInext/Models/LogSanitizer.cs new file mode 100644 index 0000000..d341f09 --- /dev/null +++ b/CERTInext/Models/LogSanitizer.cs @@ -0,0 +1,33 @@ +// Copyright 2026 Keyfactor +// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. +// At http://www.apache.org/licenses/LICENSE-2.0 + +namespace Keyfactor.Extensions.CAPlugin.CERTInext.Models +{ + /// + /// Neutralizes control characters before a requester-controlled value is interpolated into a + /// log message. + /// + /// SAN values reach the log from the CSR and from Command's SAN dictionary, i.e. from the + /// requester. Structured message templates stop format-string abuse but not embedded newlines, + /// and NLog's text layout does not escape them — so an unsanitized value can forge additional, + /// well-formed-looking records in the gateway log (CWE-117). That matters here specifically + /// because these log lines exist to make the submitted SAN set auditable; a forged line could + /// assert a different SAN set than the one actually sent. + /// + /// Shared between CERTInextCAPlugin and Client.CERTInextClient — both sanitize the + /// same kind of value at their respective log sinks, so this used to be defined twice, byte- + /// identical, one per class. + /// + internal static class LogSanitizer + { + internal static string Strip(string value) + { + if (string.IsNullOrEmpty(value)) return value; + return value + .Replace("\r", "\\r") + .Replace("\n", "\\n") + .Replace("\t", "\\t"); + } + } +} diff --git a/CERTInext/Models/StatusMapper.cs b/CERTInext/Models/StatusMapper.cs index 59795f8..376ebb0 100644 --- a/CERTInext/Models/StatusMapper.cs +++ b/CERTInext/Models/StatusMapper.cs @@ -191,6 +191,50 @@ public static string ToRevocationReason(uint crlReason) } } + // ----------------------------------------------------------------------- + // V2 API status mapping + // ----------------------------------------------------------------------- + + /// + /// Maps a V2 REST API order status string to the Keyfactor + /// integer code expected by the gateway. + /// + /// Status string from the V2 order response. + public static int V2StatusToRequestDisposition(string v2Status) => + v2Status?.ToLowerInvariant() switch + { + Constants.ApiV2.StatusIssued => (int)EndEntityStatus.GENERATED, + Constants.ApiV2.StatusPendingDcv => (int)EndEntityStatus.EXTERNALVALIDATION, + Constants.ApiV2.StatusPendingCsr => (int)EndEntityStatus.EXTERNALVALIDATION, + Constants.ApiV2.StatusPendingAgreement => (int)EndEntityStatus.EXTERNALVALIDATION, + Constants.ApiV2.StatusRevoked => (int)EndEntityStatus.REVOKED, + Constants.ApiV2.StatusCancelled => (int)EndEntityStatus.FAILED, + _ => (int)EndEntityStatus.FAILED + }; + + /// + /// Converts an RFC 5280 CRL reason code to the V2 API revocation reason string. + /// Values are the CERTInext V2 spec's kebab-case `reason` enum (see + /// and issues/0019 — sending the + /// legacy camelCase strings gets HTTP 400). Codes without a direct V2 + /// equivalent (e.g. RFC 5280 code 8, "removeFromCRL", which is CRL-only and + /// not a valid revocation request reason) are mapped to "unspecified". + /// + /// RFC 5280 CRL reason code from the gateway. + public static string ToV2RevocationReason(uint crlReason) => + crlReason switch + { + 1 => Constants.RevocationReasonV2.KeyCompromise, // RFC: keyCompromise + 2 => Constants.RevocationReasonV2.CACompromise, // RFC: cACompromise + 3 => Constants.RevocationReasonV2.AffiliationChanged, // RFC: affiliationChanged + 4 => Constants.RevocationReasonV2.Superseded, // RFC: superseded + 5 => Constants.RevocationReasonV2.CessationOfOperation,// RFC: cessationOfOperation + 6 => Constants.RevocationReasonV2.CertificateHold, // RFC: certificateHold + 9 => Constants.RevocationReasonV2.PrivilegeWithdrawn, // RFC: privilegeWithdrawn + 10 => Constants.RevocationReasonV2.AACompromise, // RFC: aACompromise + _ => Constants.RevocationReasonV2.Unspecified + }; + /// /// Converts a CERTInext revokeReasonId integer back to the RFC 5280 CRL /// reason code for storage in the Keyfactor Command database. diff --git a/CHANGELOG.md b/CHANGELOG.md index 6065cb2..fc11ea5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,39 @@ +# 1.0.1 + +## Features +- feat(v2): Add opt-in CERTInext V2 REST API code path — OAuth2 `client_credentials` auth, `ord_`-prefixed order IDs, and V2 status mapping — controlled by `UseV2Api` config flag (defaults `false`; V1 unchanged). +- feat(v2): V2 enrollment handles all three `EnrollmentType` values (New/Reissue/RenewOrReissue) via a single V2 order placement; issued orders download the certificate immediately. +- feat(v2): V2 revocation probes SSL → PrivatePKI → Signature families to locate and revoke an order by its `ord_` ID. +- feat(v2): V2 `GetSingleRecord` resolves order status across all three V2 product families without touching the V1 path. +- feat(v2): Synchronization continues to use V1 `GetOrderReport` (V2 `/reports/orders` returns 501); a warning is logged when `UseV2Api` is true to document this. +- **Faster enrollment for quickly-issued certificates.** Enrollment now waits briefly and returns the certificate in the same request when it issues fast, instead of always waiting for the next sync. Configurable via `PickupRetries` (default 5, `0` disables) and `PickupDelay` (default 10s). Orders that don't issue in time (e.g. OV/EV) return pending and are picked up by the next sync, as before. + +## Bug Fixes +- **UCC certificates no longer come back with only the common name.** The gateway sends SANs under the key `dnsname`, which the plugin didn't recognize, so orders went out with an empty domain list. SANs are now read from every key the gateway sends, plus from the CSR itself. +- **Renewals no longer lose their SANs.** Renewals were submitted with no additional domains and the wrong primary domain; both now come from the certificate being renewed. +- **Enrollment no longer fails on an order CERTInext auto-approves before it finishes issuing.** The plugin used to report these as issued with no certificate attached, which the gateway rejected. It now returns pending and picks up the certificate once CERTInext finishes issuing it. +- **Renewals now use the certificate template's product code.** Renewals previously always used the connector's `DefaultProductCode`, which could send an empty product code if that setting was never configured. Renewals now use the template's code, falling back to `DefaultProductCode` only when the template doesn't have one. +- **V2 OAuth errors now name the right cause.** 401 means a bad ClientId/ClientSecret; 403 means the key wasn't created in OAuth mode. +- **V2 error messages now include CERTInext's per-field validation errors.** +- **V2 revocation no longer fails with HTTP 400 for most reasons.** Reasons are now sent in the kebab-case form the API requires. +- **V2 revocation now reports "not found or not revokable" instead of a misleading product-family error.** +- **V2 DCV now treats an already-verified domain (EMS-1080) as satisfied instead of deferring.** + +## Chores +- chore(tests): WireMock-based unit tests for all V2 client methods (token fetch, caching, PlaceOrder, TrackOrder, Download, Revoke, family resolution). +- chore(tests): Moq-based unit tests verifying V2 dispatch in `CERTInextCAPlugin` (Ping, Enroll, GetSingleRecord, Revoke, Synchronize) with `Times.Never` assertions on V1 paths. +- chore(tests): `StatusMapperV2Tests` covering all V2 status strings and CRL-to-V2-reason mappings. +- chore(tests): Integration test stubs in `V2ApiTests.cs` (gated behind `CERTINEXT_USE_V2_API=1`); skip gracefully when V2 credentials are absent. +- chore(tests): Unit tests for V2 `ValidateCAConnectionInfo`. +- chore(tests): Unit tests for V2 token caching and expiry (`refresh_token` grant never sent). +- chore(tests): DCV cleanup-concurrency test now checks peak concurrency instead of wall-clock time. +- **`OrganizationNumber`, `DefaultProductCode`, and `GroupNumber` are now visible in the startup log.** Whether each is set is now logged alongside the other connector settings, making a misconfigured connector easier to diagnose from logs alone. +- **Corrected the `AutoApprove` template setting's description.** It previously implied the plugin would attempt automatic approval of pending certificates; it does not currently do this. + +## Upgrade Notes +- **Non-DNS SANs (IP, email, URI) are now submitted instead of silently dropped.** CERTInext can't validate them, so such an order won't issue until the SAN is removed. Set `SubmitNonDnsSans` to `false` to restore the old drop-silently behavior. +- **No more duplicate or orphaned orders after a network timeout.** Order/CSR submissions no longer auto-retry after a timeout, since the CA may have already created the order. If it was created, the next sync imports it. + # 1.0.0 Initial release of the CERTInext (emSign Hub) AnyCA REST Gateway plugin. diff --git a/README.md b/README.md index ff91ab1..efe3d27 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,7 @@ The CERTInext AnyCA Gateway REST plugin extends the certificate lifecycle capabi * New certificate enrollment (new keys and certificate). * Certificate renewal — submits a new `GenerateOrderSSL` order when the prior certificate is within the configured renewal window (CERTInext has no dedicated renewal endpoint; the renewal-window check governs how Command tracks old→new, not which API is called). * Certificate reissuance (new keys with the same or updated subject/SANs) when outside the renewal window or no prior certificate is found. + * Synchronous certificate pickup — a fast-issuing order (DV, or already-approved) can return the certificate in the same enrollment call instead of always waiting for the next sync, via `PickupRetries`/`PickupDelay`. * Certificate Revocation: * Request revocation of a previously issued certificate using any RFC 5280 CRL reason code. * Supported authentication modes for calls to the CERTInext API: @@ -159,11 +160,11 @@ In the Keyfactor Command Management Portal, navigate to **Certificate Templates* | Parameter | Required / Optional | Type | Description | Example / Default | |---|---|---|---|---| -| `ProductCode` | Optional | String | Override the numeric CERTInext product code for this template. Product codes are provisioned per account by eMudhra — obtain the correct code from `GetProductDetails` for your account. Set this explicitly when targeting the sandbox environment or when the connector `DefaultProductCode` should not apply to this template. See the [Product Codes](#product-codes) section for the sandbox/production lookup table. | DV SSL: `842` (sandbox) or `838` (production) | +| `ProductCode` | Optional | String | Override the numeric CERTInext product code for this template. Product codes are provisioned per account by eMudhra — obtain the correct code from `GetProductDetails` for your account. If omitted, the built-in default code for the selected product name is used (see [Product Codes](#product-codes)). Set this explicitly when targeting the sandbox environment or a non-standard code. | DV SSL: `842` (sandbox) or `838` (production) | | `ProfileId` | Deprecated | String | Legacy alias for `ProductCode`. Accepted for backward compatibility — if `ProductCode` is not set, `ProfileId` is used in its place. New templates should use `ProductCode`. | `838` | | `ValidityYears` | Optional | Number | Subscription validity period in years: `1`, `2`, or `3`. Default: `1`. CERTInext certificates are issued within a subscription term at up to 390 days per certificate, with free renewals within the term. | `1` | | `ValidityDays` | Deprecated | Number | Legacy validity field. If set, the value is divided by 365 and rounded up to derive a year count. New templates should use `ValidityYears`. | `365` | -| `AutoApprove` | Optional | Boolean | If `true`, the gateway will attempt automatic approval of certificates returned in a pending-approval state. Only set this if your CERTInext product is configured with automatic approval. Default: `false`. | `false` | +| `AutoApprove` | Optional | Boolean | **Currently has no effect** — reserved for future use. The plugin does not call any approval endpoint against CERTInext regardless of this setting. See [issue tracking this](https://github.com/Keyfactor/certinext-caplugin/issues/25). | `false` | | `RequesterName` | Optional | String | Per-template override for the requestor name. When set, overrides the connector-level `RequestorName` for orders using this template. | `Keyfactor Automation` | | `RequesterEmail` | Optional | String | Per-template override for the requestor email address. When set, overrides the connector-level `RequestorEmail` for orders using this template. | `pki-admin@example.com` | | `RenewalWindowDays` | Optional | Number | Number of days before certificate expiration within which a renewal is attempted instead of a reissue. Default: `90`. | `90` | @@ -238,7 +239,9 @@ If your CERTInext account has OAuth enabled, you can use OAuth client credential ## CA Configuration -The following fields are presented in the Keyfactor Command Management Portal when creating or editing the CERTInext CA connector. All fields marked **Required** must be provided before the connector can be saved in an enabled state. +The following fields are presented in the Keyfactor Command Management Portal when creating or editing the CERTInext CA connector. + +> Note: the connector's own save-time validation only enforces `ApiUrl`, `AccountNumber`, and the credential fields for the selected `AuthMode`. Other fields marked **Required** below are required by CERTInext for a successful order — the connector will save without them, but enrollment will fail or the order will be parked pending until they're set. | Field | Required / Optional | Description | Where to find it | Example | |---|---|---|---|---| @@ -255,15 +258,43 @@ The following fields are presented in the Keyfactor Command Management Portal wh | `RequestorMobileNumber` | Optional | Requestor mobile number (digits only, no country code). Included in the `requestorInformation` block. | N/A | `5551234567` | | `SignerPlace` | Required | City or location of the person accepting the subscriber agreement on behalf of your organization. Required by CERTInext for all orders. | Use the physical city where the signer is located. | `Austin` | | `SignerIp` | Required | Public IP address of the host accepting the subscriber agreement. Required by CERTInext for all orders. | Use the outbound IP of the AnyCA Gateway host, or the IP of the workstation from which the agreement was accepted. | `203.0.113.10` | -| `GroupNumber` | Optional | CERTInext group (delegation) number. When set, it is passed in the `productDetails.groupNumber` field of `GetProductDetails` requests. Some sandbox accounts return an empty product list from `GetProductDetails` unless this field is included. Available in the CERTInext portal under **Delegation → Groups**. | Portal → **Delegation → Groups**. | `2345678901` | -| `DefaultProductCode` | Optional | Default numeric product code to use when no product code is set on the certificate template. If omitted and the template also has no product code, enrollment will fail. Product codes are provisioned per account by eMudhra — contact your eMudhra account representative to obtain the numeric codes available to your account. | Call `GetProductDetails` against your account/environment (see product code table below). | `842` | +| `GroupNumber` | Optional | CERTInext group (delegation) number. When set, it is passed in the `productDetails.groupNumber` field of `GetProductDetails` requests *and* in `delegationInformation.groupNumber` on every SSL order. Some sandbox accounts return an empty product list from `GetProductDetails` unless this field is included. Available in the CERTInext portal under **Delegation → Groups**. | Portal → **Delegation → Groups**. | `2345678901` | +| `OrganizationNumber` | Optional, strongly recommended for OV/EV and faster DV | Numeric CERTInext organization number for a pre-vetted organization. When set, every SSL order is submitted with `organizationDetails.preVetting="1"` and this number, telling CERTInext to skip its manual organization-vetting queue. Without it, orders may sit in `Pending System RA` for extended manual review (observed: tens of hours). | Portal → **Organizations → Pre-vetted Organizations**. | `1234567` | +| `TechnicalContactName` / `TechnicalContactEmail` / `TechnicalContactIsdCode` / `TechnicalContactMobileNumber` | Optional | Populate `technicalPointOfContact` on every SSL order. Each defaults to the corresponding `Requestor*` field when blank. Some product configurations require a technical point of contact to be present; omitting it can cause CERTInext to park orders awaiting manual completion of the field. | N/A | *(defaults to Requestor fields)* | +| `AccountingModel` | Optional | CERTInext billing model sent in `orderDetails.accountingModel`. `2` = credit-based (most accounts). `1` = cash model. Default: `2`. | N/A | `2` | +| `EmailNotifications` | Optional | Whether CERTInext sends lifecycle-event emails to the requestor. `1` = enabled, `0` = silent (recommended for gateway-driven orders). Default: `0`. | N/A | `0` | +| `SubscriptionValidityYears` | Optional | Connector-level default validity in years for SSL orders (`1`, `2`, or `3`). Overridden per template by the `ValidityYears` enrollment parameter. Default: `1`. | N/A | `1` | +| `SubscriptionAutoRenew` | Optional | Whether CERTInext should auto-renew certificates issued through this connector. `0` = disabled (recommended — renewal is driven by Keyfactor Command), `1` = enabled. Default: `0`. | N/A | `0` | +| `SubscriptionRenewCriteriaDays` | Optional | Days before expiry at which CERTInext auto-renews. Only honored when `SubscriptionAutoRenew` is `1`. Default: `30`. | N/A | `30` | +| `AutoSecureWww` | Optional | If `1`, CERTInext automatically adds the `www.` variant of the primary domain as an additional SAN. Default: `0`. | N/A | `0` | +| `SubmitNonDnsSans` | Optional | If `true` (default), SANs that aren't DNS names (IP address, email, URI) are submitted to CERTInext instead of silently dropped. CERTInext can't validate them, so such an order won't issue until they're removed. Set to `false` to restore the pre-1.0.1 behavior of submitting DNS names only. Default: `true`. | N/A | `true` | +| `DefaultProductCode` | Optional, but effectively required if you use renewals | Numeric product code used for **renewals only** — CERTInext's `TrackOrder` doesn't return the prior order's product code, so the renewal path sends this value verbatim, ignoring the template's `ProductCode`/`ProfileId`. If left blank, renewals go out with an empty product code. Has **no effect on new enrollments** — the `ProductCode`/`ProfileId` template resolution never falls back to it. See [issue tracking this](https://github.com/Keyfactor/certinext-caplugin/issues/26). | Call `GetProductDetails` against your account/environment (see product code table below). | `842` | | `IgnoreExpired` | Optional | If `true`, expired certificates are skipped during synchronization and are not imported into Keyfactor Command. Default: `false`. | N/A | `false` | | `PageSize` | Optional | Number of orders to retrieve per page during synchronization. Default: `100`. Maximum: `500`. Reduce this value if synchronization requests time out. | N/A | `100` | | `Enabled` | Optional | Enables or disables the CA connector. Setting this to `false` allows the connector record to be created before all credentials are available, without triggering a live connectivity test. Default: `true`. | N/A | `true` | +| `PickupRetries` | Optional | Number of times `Enroll` polls CERTInext for the certificate after a successful order submission, before returning pending and leaving pickup to the next sync. Set to `0` to disable the wait entirely. OV/EV orders validate asynchronously (minutes to hours) and typically exhaust this wait regardless of the value. Default: `5`. | N/A | `5` | +| `PickupDelay` | Optional | Seconds between certificate-pickup retries. The total pickup budget is a fixed 5-second initial delay + (`PickupRetries` × `PickupDelay`), hard-capped at 180 seconds regardless of how the two values are set. Aim for well under ~90s total so the call doesn't run long enough to trip Command's own enrollment timeout. Default: `10` (a ~55s ceiling with default `PickupRetries`). | N/A | `10` | + +> **Pickup timing detail:** after a successful order placement, the plugin waits a fixed 5-second initial delay before the first poll attempt, then polls CERTInext every `PickupDelay` seconds up to `PickupRetries` times. Each poll calls `GetCertificate` to check whether the certificate has been issued. The total time budget is: **5s + (PickupRetries × PickupDelay) + API round-trip time per poll (~1s each)**. With defaults this is approximately 5 + (5 × 10) + 5 = **~60 seconds**. +> +> **Tuning for faster pickup:** if the CERTInext API typically issues certificates within a few seconds of order placement (as observed with DV and auto-approved orders), you can reduce per-enrollment wait time by lowering `PickupDelay` and raising `PickupRetries` to compensate — this polls more frequently without changing the total budget. For example: +> +> | Configuration | PickupRetries | PickupDelay | Total budget | Poll cadence | +> |---------------|:---:|:---:|---|---| +> | Default | `5` | `10` | ~55s | Every 10s | +> | Faster polling | `10` | `5` | ~55s | Every 5s | +> | Aggressive | `50` | `1` | ~55s | Every 1s | +> | Minimal wait | `0` | — | 0s | No polling; defers to sync | +> +> The 5-second initial delay before the first poll is not configurable. The 180-second hard ceiling applies regardless of configuration. | `DcvEnabled` | Optional | When `true`, the gateway performs DNS-based Domain Control Validation (DCV) during enrollment for orders that require it. Requires a DNS provider plugin (e.g. `azure-azuredns-dnsplugin`) to be deployed on the gateway. Default: `false`. | N/A | `false` | | `DcvTxtRecordTemplate` | Optional | Format string for the DNS TXT record hostname published during DCV. `{0}` is replaced with the domain being validated. Default: `_emsign-validation.{0}`. | N/A | `_emsign-validation.{0}` | -| `DcvPropagationDelaySeconds` | Optional | Seconds to wait after publishing the DNS TXT record before asking CERTInext to verify it. Increase for zones with slow propagation. Default: `30`. | N/A | `30` | +| `DcvPropagationDelaySeconds` | Optional | Seconds to wait after publishing the DNS TXT record before asking CERTInext to verify it. Increase for zones with slow propagation. Applies only to the `Enroll()`-time DCV path — DCV driven during sync uses its own fixed 3-second delay. Default: `30`. | N/A | `30` | | `DcvTimeoutMinutes` | Optional | Maximum minutes to wait for the entire DCV flow (DNS publish + propagation + verify) before cancelling the enrollment. Can also be set via the `CERTINEXT_DCV_TIMEOUT_MINUTES` environment variable; the environment variable takes precedence when both are set. Default: `10`. | N/A | `10` | +| `DcvWaitForChallengeSeconds` | Optional | How long `Enroll()` waits for CERTInext to expose the DCV challenge after order placement, before giving up and deferring to the next sync. Set to `0` to disable the wait. Can also be set via `CERTINEXT_DCV_WAIT_FOR_CHALLENGE_SECONDS`. Default: `60`. | N/A | `60` | +| `DcvWaitForIssuanceSeconds` | Optional | How long `Enroll()` waits for CERTInext to finish generating the certificate after DCV verifies. Set to `0` to disable the wait. Can also be set via `CERTINEXT_DCV_WAIT_FOR_ISSUANCE_SECONDS`. Default: `60`. | N/A | `60` | +| `DcvSyncMaxOrderAgeHours` | Optional | During synchronization, only pending DV orders younger than this many hours are driven through DCV, so a large backlog of old/abandoned pending orders doesn't slow down every sync pass. Set to `0` to disable the age filter. Default: `24`. | N/A | `24` | +| `DcvSyncMaxPerPass` | Optional | Maximum number of pending DV orders driven through DCV in a single sync pass. Set to `0` to disable the cap. Default: `50`. | N/A | `50` | > Note: `AccountNumber` and group-level identifiers are distinct values. The `AccountNumber` is your top-level user account identifier. CERTInext groups (cost centers or departments) each have their own `groupNumber`, which is passed per-order and is separate from any organization number displayed on the Organizations page. @@ -338,6 +369,62 @@ To retrieve the full list of product codes available to your account, call the ` > Note: SSL/TLS products are supported on standard accounts — see the SSL/TLS table above for the exact sandbox/production code pair for each product. Private PKI (Production `100`, `104` / Sandbox `149`), S/MIME (`894`), and document-signing products (`819`–`827`) require special provisioning by eMudhra and are not available on standard SSL/TLS accounts — ordering them returns EMS-1162. +## V2 API (Preview) + +The plugin includes an opt-in CERTInext V2 REST API code path that uses modern OAuth2 `client_credentials` authentication and a new order-centric resource model. V2 is disabled by default; V1 remains the active path unless `UseV2Api` is explicitly set to `true`. + +> **Synchronization note:** The V2 `/reports/orders` endpoint is not yet available (returns HTTP 501). When `UseV2Api` is `true`, synchronization continues to use the V1 `GetOrderReport` endpoint. V1 credentials (`ApiUrl`, `ApiKey`, `AccountNumber`) must remain configured even when V2 is enabled. + +### V2 CA Connector Fields + +| Field | Required / Optional | Description | Example | +|---|---|---|---| +| `UseV2Api` | Optional | Enable the V2 API code path for enrollment, revocation, and status checks. V1 is used for synchronization regardless. Default: `false`. | `false` | +| `ApiUrlV2` | Conditional | Base URL for the CERTInext V2 REST API (no trailing path suffix). Required when `UseV2Api` is `true`. | `https://sandbox-us-api.certinext.io` | +| `ClientId` | Conditional | OAuth2 client ID for V2 authentication. Required when `UseV2Api` is `true`. | `keyfactor-gateway` | +| `ClientSecret` | Conditional | OAuth2 client secret for V2 authentication. This field is masked in the UI. Required when `UseV2Api` is `true`. | *(generated, masked in UI)* | + +#### V2 OAuth2 Setup + +1. Log in to the CERTInext portal for your environment. +2. Navigate to **Integrations → APIs**. +3. Click **+ Create API Credentials** and select **Auth Type**: `OAuth2 (V2)`. +4. Note the **Client ID** and **Client Secret**. Enter them in `ClientId` and `ClientSecret`. +5. Set `UseV2Api` to `true` and enter the V2 base URL in `ApiUrlV2`. +6. Leave all V1 fields (`ApiUrl`, `ApiKey`, `AccountNumber`) configured — they are still used for synchronization. + +#### V2 Token Caching + +The plugin obtains a V2 bearer token via the standard OAuth2 `client_credentials` grant (`grant_type=client_credentials`, form-encoded) against `{ApiUrlV2}/oauth/token`. Tokens are cached in memory and reused until 60 seconds before expiry (minimum 30-second cache). Token refresh is thread-safe. + +### V2 Certificate Template Fields + +When `UseV2Api` is `true`, two additional enrollment parameters become relevant: + +| Parameter | Required / Optional | Type | Description | Example / Default | +|---|---|---|---|---| +| `ProductFamily` | Optional | String | CERTInext V2 product family. Accepted values: `ssl`, `private-pki`, `signature`. Default: `ssl`. | `ssl` | +| `ProductVariant` | Optional | String | Product variant within the family (e.g. `dv`, `ov`, `ev`). Default: `dv`. | `dv` | + +`ProductCode` continues to carry the numeric product code and is sent in the `X-Product-Code` header on V2 order placement. + +### V2 Order Lifecycle + +V2 orders are identified by an opaque string ID prefixed with `ord_` (e.g. `ord_a1b2c3d4`). This ID is returned by the V2 order placement endpoint and stored as the `CARequestID`. It is stable for the lifetime of the order and is used for all subsequent tracking, certificate download, and revocation calls. + +V2 status strings map to Keyfactor enrollment statuses as follows: + +| V2 Status | Keyfactor Status | Notes | +|---|---|---| +| `issued` | Issued | Certificate is immediately downloaded and returned to Command. | +| `pending-dcv` | Pending External Validation | Order is awaiting domain control validation. | +| `pending-csr` | Pending External Validation | Order is awaiting CSR submission or processing. | +| `pending-agreement` | Pending External Validation | Order requires subscriber agreement acceptance. | +| `revoked` | Revoked | Order has been revoked. | +| `cancelled` | Failed | Order was cancelled; a new enrollment is required. | + +Because V2 has no distinct renewal endpoint, all three enrollment types (New, Reissue, RenewOrReissue) place a fresh V2 order. + ## Architecture This document describes how the CERTInext AnyCA Gateway REST plugin integrates with Keyfactor Command and the CERTInext certificate authority. It covers the three primary certificate lifecycle operations — synchronization, enrollment, and revocation — and how the plugin routes each through the CERTInext API. @@ -366,9 +453,17 @@ This document describes how the CERTInext AnyCA Gateway REST plugin integrates w ┌────────────────────────────▼────────────────────────────┐ │ CERTInext REST API (eMudhra) │ │ │ -│ ValidateCredentials GenerateOrderSSL TrackOrder │ -│ GetCertificate RevokeOrder GetOrderReport │ -│ GetProductDetails SubmitCSR │ +│ V1 (HMAC) ValidateCredentials · GenerateOrderSSL │ +│ TrackOrder · GetCertificate · GetOrderReport │ +│ RevokeOrder · GetProductDetails · SubmitCSR │ +│ │ +│ V2 (OAuth2 Bearer) POST /oauth/token │ +│ POST /ssl-certificates │ +│ GET /ssl-certificates/{id} │ +│ GET /ssl-certificates/{id}/dcv │ +│ POST /ssl-certificates/{id}/dcv/verify │ +│ GET /ssl-certificates/{id}/certificate │ +│ POST /ssl-certificates/{id}/revoke │ └─────────────────────────────────────────────────────────┘ ``` @@ -384,6 +479,8 @@ A unique transaction ID (`requestTxnId`) is generated for each request. The time An OAuth client-credentials mode is also available as an alternative. When OAuth is configured, the plugin exchanges a client ID and secret for a short-lived bearer token and automatically refreshes it before expiry. +When `UseV2Api` is enabled, the plugin uses a dedicated OAuth2 `client_credentials` flow — separate from the V1 OAuth alternative. The plugin posts `client_id` and `client_secret` (form-encoded) to `/oauth/token`, caches the resulting bearer token for its 1-hour lifetime, and automatically refreshes it 60 seconds before expiry. V2 credentials are provisioned separately by CERTInext and are not derived from the V1 access key. + ## Certificate Identifiers CERTInext assigns two different reference numbers to each order. Understanding the difference matters when tracing certificates across systems: @@ -453,6 +550,8 @@ sequenceDiagram **Expired certificates:** The `IgnoreExpired` connector setting controls whether expired certificates are included in synchronization. When enabled, expired certificates are silently skipped and will not appear in the Keyfactor Command inventory. +**DCV-during-sync:** on a DCV-enabled build, each sync pass also drives DNS-01 validation forward for pending DV orders that are still waiting on it, bounded by `DcvSyncMaxOrderAgeHours` (skip orders older than this) and `DcvSyncMaxPerPass` (cap how many are attempted per pass), so a large backlog of stalled pending orders can't slow down every sync. + --- ## Certificate Enrollment @@ -474,13 +573,27 @@ sequenceDiagram Plugin->>API: Place certificate order\n(CSR, domain, organization details,\nsubscriber agreement, requestor info) API-->>Plugin: Order accepted — order number assigned + opt DNS-01 DCV build, DCV enabled, and this order requires it + Plugin->>Plugin: Publish DNS TXT challenge\nvia the configured DNS provider plugin + Plugin->>API: Ask CERTInext to verify the record + API-->>Plugin: Domain validated (or still pending —\nfalls through to the pending path below) + end + Plugin->>API: Check order status API-->>Plugin: Order status and certificate details alt Certificate issued immediately Plugin-->>CMD: Certificate ready — PEM returned - else Certificate pending approval - Plugin-->>CMD: Pending — Command will pick it up\nduring the next synchronization + else Certificate pending or not yet downloadable + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, default 3 × 5 s; ceiling 180 s) + Plugin->>API: Poll order status\nand attempt certificate download + API-->>Plugin: Status / certificate PEM + end + alt Certificate became available during pickup + Plugin-->>CMD: Certificate ready — PEM returned + else Still not available + Plugin-->>CMD: Pending — Command will pick it up\nduring the next synchronization + end else Order rejected by CERTInext Plugin-->>CMD: Enrollment failed — see gateway logs end @@ -488,12 +601,18 @@ sequenceDiagram Plugin->>Plugin: Record enrollment outcome in audit log\n(order number, serial number, status) ``` +**DCV:** on a DCV-enabled build, DNS-01 validation runs inline for DV orders that require it, bounded by `DcvTimeoutMinutes`. When DCV isn't enabled, isn't built into this host, or the order doesn't require it, this step is skipped entirely and the order proceeds straight to the pending/pickup path like any other asynchronously-issued order. + +**Synchronous certificate pickup:** after placing an order (or after DCV completes), the plugin polls CERTInext a bounded number of times — `PickupRetries` attempts spaced `PickupDelay` seconds apart, with a hard ceiling of 180 seconds — before returning a pending disposition to Command. This lets fast-issuing DV certificates (and pre-approved renewals) come back in the same enrollment call. OV and EV orders undergo human review over minutes to hours and almost always exhaust this window; they are picked up by the next synchronization run. + ### Renewal When Command initiates a renewal, the plugin checks whether the existing certificate is within the configured renewal window. If it is, the prior order record is used as context for the new request. If it is outside the window (or the prior certificate cannot be located), the plugin falls back to issuing a new certificate. > **Note:** CERTInext does not have a dedicated certificate renewal endpoint. Both renewal and reissuance paths submit a new `GenerateOrderSSL` order. The distinction affects how Keyfactor Command tracks the certificate record, not what is sent to CERTInext. +> **Note:** If the prior-order lookup itself throws (rather than cleanly returning "not found" — e.g. a transient database error), the plugin falls back to issuing a new certificate rather than failing the enrollment. + ```mermaid flowchart TD A([Renewal requested]) --> B{Prior certificate\nserial number\nprovided?} @@ -509,6 +628,107 @@ flowchart TD C --> I ``` +### V2 API Path (UseV2Api = true) + +When `UseV2Api` is enabled, Ping, Enroll, GetSingleRecord, and Revoke route through the V2 REST API. Synchronize continues to call the V1 `GetOrderReport` endpoint until the V2 `/reports/orders` endpoint is available. + +#### DCV required (DV SSL) + +```mermaid +sequenceDiagram + participant CMD as Keyfactor Command + participant Plugin as CERTInext Plugin + participant API as CERTInext API (V2) + participant DNS as DNS Provider + + CMD->>Plugin: Request new certificate\n(CSR, subject, SANs, product code, requester details) + Plugin->>Plugin: Record enrollment intent in audit log + + Plugin->>API: POST /oauth/token\n(client_credentials grant) + API-->>Plugin: Bearer token (1-hour TTL) + + Plugin->>API: POST /ssl-certificates\n(X-Product-Code header · Idempotency-Key · JSON body) + API-->>Plugin: 201 Created — orderId assigned\nstatus: pending-dcv + + Plugin->>API: GET /ssl-certificates/{orderId}/dcv + API-->>Plugin: DCV challenge\n(fileNameContent = TXT value,\ndcvMethod = "2" for DNS-TXT) + + Plugin->>DNS: Publish TXT record\n_emudhra-challenge.{domain} → fileNameContent + Plugin->>Plugin: Wait for DNS propagation + + Plugin->>API: POST /ssl-certificates/{orderId}/dcv/verify\n(domain, method: "dns-txt") + API-->>Plugin: { "overallStatus": "VERIFIED" }\n(multi-perspective check) + + Plugin->>DNS: Remove TXT record + + loop Poll until status leaves pending-dcv\n(bounded by DcvTimeoutMinutes) + Plugin->>API: GET /ssl-certificates/{orderId} + API-->>Plugin: Current status + end + + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, ceiling 180 s) + Plugin->>API: GET /ssl-certificates/{orderId}\nGET /ssl-certificates/{orderId}/certificate + API-->>Plugin: Status · certificatePem · chainPem[] + end + + alt Certificate issued + Plugin->>Plugin: Assemble full chain\n(leaf + intermediates from chainPem[]) + Plugin-->>CMD: Certificate ready — PEM chain returned + else Still pending + Plugin-->>CMD: Pending — picked up by next sync + else Order rejected + Plugin-->>CMD: Enrollment failed — see gateway logs + end + + Plugin->>Plugin: Record enrollment outcome in audit log +``` + +#### No DCV required (OV/EV/Private PKI) + +```mermaid +sequenceDiagram + participant CMD as Keyfactor Command + participant Plugin as CERTInext Plugin + participant API as CERTInext API (V2) + + CMD->>Plugin: Request new certificate + Plugin->>Plugin: Record enrollment intent in audit log + + Plugin->>API: POST /oauth/token + API-->>Plugin: Bearer token + + Plugin->>API: POST /ssl-certificates\n(or /private-pki-certificates · /signature-certificates) + API-->>Plugin: 201 Created — orderId assigned\nstatus: pending-csr or pending-agreement + + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, ceiling 180 s) + Plugin->>API: GET /ssl-certificates/{orderId} + API-->>Plugin: Current status + end + + alt Certificate issued + Plugin->>API: GET /ssl-certificates/{orderId}/certificate + API-->>Plugin: certificatePem · chainPem[] + Plugin->>Plugin: Assemble full chain + Plugin-->>CMD: Certificate ready — PEM chain returned + else Still pending (OV/EV human review) + Plugin-->>CMD: Pending — picked up by next sync + else Order rejected + Plugin-->>CMD: Enrollment failed + end + + Plugin->>Plugin: Record enrollment outcome in audit log +``` + +**Token caching:** the Bearer token is cached for its 1-hour lifetime and shared across all V2 calls in the same gateway process. A new token is fetched automatically 60 seconds before expiry. + +**Idempotency:** every unsafe V2 POST carries a unique `Idempotency-Key` UUID. If the gateway retries the same request (for example after a timeout), CERTInext returns the original response without creating a duplicate order. + +**Full certificate chain:** the V2 `/certificate` endpoint returns the leaf certificate in `certificatePem` and any intermediate certificates in `chainPem[]`. The plugin concatenates these into a single PEM before returning to Command. + +**Order IDs:** V2 order IDs are opaque strings (e.g. `ord_abc123`). They are stored as the `CARequestID` in Command alongside V1 numeric IDs — both coexist in the database. + +**Synchronize stays on V1:** the V2 `/reports/orders` endpoint returns 501 Not Implemented. Synchronization always calls the V1 `GetOrderReport` endpoint regardless of `UseV2Api`. A warning is logged when `UseV2Api = true` to make this visible. A follow-up update will switch sync to V2 once the endpoint ships. + --- ## Revocation @@ -573,6 +793,8 @@ flowchart TD The table below maps each Keyfactor Command operation to the CERTInext API endpoint it calls. +**V1 endpoints (default)** + | Operation | CERTInext API endpoint | |---|---| | Test connection / verify credentials | `POST ValidateCredentials` | @@ -584,6 +806,23 @@ The table below maps each Keyfactor Command operation to the CERTInext API endpo | List available product codes | `POST GetProductDetails` | | Attach CSR to draft order | `POST SubmitCSR` | +**V2 endpoints (UseV2Api = true)** + +| Operation | V2 endpoint | +|---|---| +| Obtain Bearer token | `POST /oauth/token` | +| Test connection | `GET /api/certinext/v2/auth/me` | +| Issue / renew certificate | `POST /api/certinext/v2/{family}-certificates` | +| Check order status | `GET /api/certinext/v2/{family}-certificates/{orderId}` | +| Get DCV challenge (DV SSL) | `GET /api/certinext/v2/ssl-certificates/{orderId}/dcv` | +| Verify DCV | `POST /api/certinext/v2/ssl-certificates/{orderId}/dcv/verify` | +| Download certificate | `GET /api/certinext/v2/{family}-certificates/{orderId}/certificate` | +| Revoke certificate | `POST /api/certinext/v2/{family}-certificates/{orderId}/revoke` | +| List available products | `GET /api/certinext/v2/catalog/products` | +| Synchronize inventory | `POST GetOrderReport` (V1 — V2 /reports/orders not yet available) | + +`{family}` is `ssl-certificates`, `private-pki-certificates`, or `signature-certificates`. + ## License Apache License 2.0, see [LICENSE](LICENSE). diff --git a/docsource/architecture.md b/docsource/architecture.md index 93ac459..46ca311 100644 --- a/docsource/architecture.md +++ b/docsource/architecture.md @@ -26,9 +26,17 @@ This document describes how the CERTInext AnyCA Gateway REST plugin integrates w ┌────────────────────────────▼────────────────────────────┐ │ CERTInext REST API (eMudhra) │ │ │ -│ ValidateCredentials GenerateOrderSSL TrackOrder │ -│ GetCertificate RevokeOrder GetOrderReport │ -│ GetProductDetails SubmitCSR │ +│ V1 (HMAC) ValidateCredentials · GenerateOrderSSL │ +│ TrackOrder · GetCertificate · GetOrderReport │ +│ RevokeOrder · GetProductDetails · SubmitCSR │ +│ │ +│ V2 (OAuth2 Bearer) POST /oauth/token │ +│ POST /ssl-certificates │ +│ GET /ssl-certificates/{id} │ +│ GET /ssl-certificates/{id}/dcv │ +│ POST /ssl-certificates/{id}/dcv/verify │ +│ GET /ssl-certificates/{id}/certificate │ +│ POST /ssl-certificates/{id}/revoke │ └─────────────────────────────────────────────────────────┘ ``` @@ -44,6 +52,8 @@ A unique transaction ID (`requestTxnId`) is generated for each request. The time An OAuth client-credentials mode is also available as an alternative. When OAuth is configured, the plugin exchanges a client ID and secret for a short-lived bearer token and automatically refreshes it before expiry. +When `UseV2Api` is enabled, the plugin uses a dedicated OAuth2 `client_credentials` flow — separate from the V1 OAuth alternative. The plugin posts `client_id` and `client_secret` (form-encoded) to `/oauth/token`, caches the resulting bearer token for its 1-hour lifetime, and automatically refreshes it 60 seconds before expiry. V2 credentials are provisioned separately by CERTInext and are not derived from the V1 access key. + ## Certificate Identifiers CERTInext assigns two different reference numbers to each order. Understanding the difference matters when tracing certificates across systems: @@ -113,6 +123,8 @@ sequenceDiagram **Expired certificates:** The `IgnoreExpired` connector setting controls whether expired certificates are included in synchronization. When enabled, expired certificates are silently skipped and will not appear in the Keyfactor Command inventory. +**DCV-during-sync:** on a DCV-enabled build, each sync pass also drives DNS-01 validation forward for pending DV orders that are still waiting on it, bounded by `DcvSyncMaxOrderAgeHours` (skip orders older than this) and `DcvSyncMaxPerPass` (cap how many are attempted per pass), so a large backlog of stalled pending orders can't slow down every sync. + --- ## Certificate Enrollment @@ -134,13 +146,27 @@ sequenceDiagram Plugin->>API: Place certificate order\n(CSR, domain, organization details,\nsubscriber agreement, requestor info) API-->>Plugin: Order accepted — order number assigned + opt DNS-01 DCV build, DCV enabled, and this order requires it + Plugin->>Plugin: Publish DNS TXT challenge\nvia the configured DNS provider plugin + Plugin->>API: Ask CERTInext to verify the record + API-->>Plugin: Domain validated (or still pending —\nfalls through to the pending path below) + end + Plugin->>API: Check order status API-->>Plugin: Order status and certificate details alt Certificate issued immediately Plugin-->>CMD: Certificate ready — PEM returned - else Certificate pending approval - Plugin-->>CMD: Pending — Command will pick it up\nduring the next synchronization + else Certificate pending or not yet downloadable + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, default 3 × 5 s; ceiling 180 s) + Plugin->>API: Poll order status\nand attempt certificate download + API-->>Plugin: Status / certificate PEM + end + alt Certificate became available during pickup + Plugin-->>CMD: Certificate ready — PEM returned + else Still not available + Plugin-->>CMD: Pending — Command will pick it up\nduring the next synchronization + end else Order rejected by CERTInext Plugin-->>CMD: Enrollment failed — see gateway logs end @@ -148,12 +174,18 @@ sequenceDiagram Plugin->>Plugin: Record enrollment outcome in audit log\n(order number, serial number, status) ``` +**DCV:** on a DCV-enabled build, DNS-01 validation runs inline for DV orders that require it, bounded by `DcvTimeoutMinutes`. When DCV isn't enabled, isn't built into this host, or the order doesn't require it, this step is skipped entirely and the order proceeds straight to the pending/pickup path like any other asynchronously-issued order. + +**Synchronous certificate pickup:** after placing an order (or after DCV completes), the plugin polls CERTInext a bounded number of times — `PickupRetries` attempts spaced `PickupDelay` seconds apart, with a hard ceiling of 180 seconds — before returning a pending disposition to Command. This lets fast-issuing DV certificates (and pre-approved renewals) come back in the same enrollment call. OV and EV orders undergo human review over minutes to hours and almost always exhaust this window; they are picked up by the next synchronization run. + ### Renewal When Command initiates a renewal, the plugin checks whether the existing certificate is within the configured renewal window. If it is, the prior order record is used as context for the new request. If it is outside the window (or the prior certificate cannot be located), the plugin falls back to issuing a new certificate. > **Note:** CERTInext does not have a dedicated certificate renewal endpoint. Both renewal and reissuance paths submit a new `GenerateOrderSSL` order. The distinction affects how Keyfactor Command tracks the certificate record, not what is sent to CERTInext. +> **Note:** If the prior-order lookup itself throws (rather than cleanly returning "not found" — e.g. a transient database error), the plugin falls back to issuing a new certificate rather than failing the enrollment. + ```mermaid flowchart TD A([Renewal requested]) --> B{Prior certificate\nserial number\nprovided?} @@ -169,6 +201,107 @@ flowchart TD C --> I ``` +### V2 API Path (UseV2Api = true) + +When `UseV2Api` is enabled, Ping, Enroll, GetSingleRecord, and Revoke route through the V2 REST API. Synchronize continues to call the V1 `GetOrderReport` endpoint until the V2 `/reports/orders` endpoint is available. + +#### DCV required (DV SSL) + +```mermaid +sequenceDiagram + participant CMD as Keyfactor Command + participant Plugin as CERTInext Plugin + participant API as CERTInext API (V2) + participant DNS as DNS Provider + + CMD->>Plugin: Request new certificate\n(CSR, subject, SANs, product code, requester details) + Plugin->>Plugin: Record enrollment intent in audit log + + Plugin->>API: POST /oauth/token\n(client_credentials grant) + API-->>Plugin: Bearer token (1-hour TTL) + + Plugin->>API: POST /ssl-certificates\n(X-Product-Code header · Idempotency-Key · JSON body) + API-->>Plugin: 201 Created — orderId assigned\nstatus: pending-dcv + + Plugin->>API: GET /ssl-certificates/{orderId}/dcv + API-->>Plugin: DCV challenge\n(fileNameContent = TXT value,\ndcvMethod = "2" for DNS-TXT) + + Plugin->>DNS: Publish TXT record\n_emudhra-challenge.{domain} → fileNameContent + Plugin->>Plugin: Wait for DNS propagation + + Plugin->>API: POST /ssl-certificates/{orderId}/dcv/verify\n(domain, method: "dns-txt") + API-->>Plugin: { "overallStatus": "VERIFIED" }\n(multi-perspective check) + + Plugin->>DNS: Remove TXT record + + loop Poll until status leaves pending-dcv\n(bounded by DcvTimeoutMinutes) + Plugin->>API: GET /ssl-certificates/{orderId} + API-->>Plugin: Current status + end + + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, ceiling 180 s) + Plugin->>API: GET /ssl-certificates/{orderId}\nGET /ssl-certificates/{orderId}/certificate + API-->>Plugin: Status · certificatePem · chainPem[] + end + + alt Certificate issued + Plugin->>Plugin: Assemble full chain\n(leaf + intermediates from chainPem[]) + Plugin-->>CMD: Certificate ready — PEM chain returned + else Still pending + Plugin-->>CMD: Pending — picked up by next sync + else Order rejected + Plugin-->>CMD: Enrollment failed — see gateway logs + end + + Plugin->>Plugin: Record enrollment outcome in audit log +``` + +#### No DCV required (OV/EV/Private PKI) + +```mermaid +sequenceDiagram + participant CMD as Keyfactor Command + participant Plugin as CERTInext Plugin + participant API as CERTInext API (V2) + + CMD->>Plugin: Request new certificate + Plugin->>Plugin: Record enrollment intent in audit log + + Plugin->>API: POST /oauth/token + API-->>Plugin: Bearer token + + Plugin->>API: POST /ssl-certificates\n(or /private-pki-certificates · /signature-certificates) + API-->>Plugin: 201 Created — orderId assigned\nstatus: pending-csr or pending-agreement + + loop Synchronous certificate pickup\n(PickupRetries × PickupDelay, ceiling 180 s) + Plugin->>API: GET /ssl-certificates/{orderId} + API-->>Plugin: Current status + end + + alt Certificate issued + Plugin->>API: GET /ssl-certificates/{orderId}/certificate + API-->>Plugin: certificatePem · chainPem[] + Plugin->>Plugin: Assemble full chain + Plugin-->>CMD: Certificate ready — PEM chain returned + else Still pending (OV/EV human review) + Plugin-->>CMD: Pending — picked up by next sync + else Order rejected + Plugin-->>CMD: Enrollment failed + end + + Plugin->>Plugin: Record enrollment outcome in audit log +``` + +**Token caching:** the Bearer token is cached for its 1-hour lifetime and shared across all V2 calls in the same gateway process. A new token is fetched automatically 60 seconds before expiry. + +**Idempotency:** every unsafe V2 POST carries a unique `Idempotency-Key` UUID. If the gateway retries the same request (for example after a timeout), CERTInext returns the original response without creating a duplicate order. + +**Full certificate chain:** the V2 `/certificate` endpoint returns the leaf certificate in `certificatePem` and any intermediate certificates in `chainPem[]`. The plugin concatenates these into a single PEM before returning to Command. + +**Order IDs:** V2 order IDs are opaque strings (e.g. `ord_abc123`). They are stored as the `CARequestID` in Command alongside V1 numeric IDs — both coexist in the database. + +**Synchronize stays on V1:** the V2 `/reports/orders` endpoint returns 501 Not Implemented. Synchronization always calls the V1 `GetOrderReport` endpoint regardless of `UseV2Api`. A warning is logged when `UseV2Api = true` to make this visible. A follow-up update will switch sync to V2 once the endpoint ships. + --- ## Revocation @@ -233,6 +366,8 @@ flowchart TD The table below maps each Keyfactor Command operation to the CERTInext API endpoint it calls. +**V1 endpoints (default)** + | Operation | CERTInext API endpoint | |---|---| | Test connection / verify credentials | `POST ValidateCredentials` | @@ -243,3 +378,20 @@ The table below maps each Keyfactor Command operation to the CERTInext API endpo | Synchronize inventory | `POST GetOrderReport` (paginated) | | List available product codes | `POST GetProductDetails` | | Attach CSR to draft order | `POST SubmitCSR` | + +**V2 endpoints (UseV2Api = true)** + +| Operation | V2 endpoint | +|---|---| +| Obtain Bearer token | `POST /oauth/token` | +| Test connection | `GET /api/certinext/v2/auth/me` | +| Issue / renew certificate | `POST /api/certinext/v2/{family}-certificates` | +| Check order status | `GET /api/certinext/v2/{family}-certificates/{orderId}` | +| Get DCV challenge (DV SSL) | `GET /api/certinext/v2/ssl-certificates/{orderId}/dcv` | +| Verify DCV | `POST /api/certinext/v2/ssl-certificates/{orderId}/dcv/verify` | +| Download certificate | `GET /api/certinext/v2/{family}-certificates/{orderId}/certificate` | +| Revoke certificate | `POST /api/certinext/v2/{family}-certificates/{orderId}/revoke` | +| List available products | `GET /api/certinext/v2/catalog/products` | +| Synchronize inventory | `POST GetOrderReport` (V1 — V2 /reports/orders not yet available) | + +`{family}` is `ssl-certificates`, `private-pki-certificates`, or `signature-certificates`. diff --git a/docsource/configuration.md b/docsource/configuration.md index 41c872e..3e066c5 100644 --- a/docsource/configuration.md +++ b/docsource/configuration.md @@ -9,6 +9,7 @@ The CERTInext AnyCA Gateway REST plugin extends the certificate lifecycle capabi * New certificate enrollment (new keys and certificate). * Certificate renewal — submits a new `GenerateOrderSSL` order when the prior certificate is within the configured renewal window (CERTInext has no dedicated renewal endpoint; the renewal-window check governs how Command tracks old→new, not which API is called). * Certificate reissuance (new keys with the same or updated subject/SANs) when outside the renewal window or no prior certificate is found. + * Synchronous certificate pickup — a fast-issuing order (DV, or already-approved) can return the certificate in the same enrollment call instead of always waiting for the next sync, via `PickupRetries`/`PickupDelay`. * Certificate Revocation: * Request revocation of a previously issued certificate using any RFC 5280 CRL reason code. * Supported authentication modes for calls to the CERTInext API: @@ -91,7 +92,9 @@ Before enrolling certificates, the Keyfactor Command server must trust the CERTI ## CA Configuration -The following fields are presented in the Keyfactor Command Management Portal when creating or editing the CERTInext CA connector. All fields marked **Required** must be provided before the connector can be saved in an enabled state. +The following fields are presented in the Keyfactor Command Management Portal when creating or editing the CERTInext CA connector. + +> Note: the connector's own save-time validation only enforces `ApiUrl`, `AccountNumber`, and the credential fields for the selected `AuthMode`. Other fields marked **Required** below are required by CERTInext for a successful order — the connector will save without them, but enrollment will fail or the order will be parked pending until they're set. | Field | Required / Optional | Description | Where to find it | Example | |---|---|---|---|---| @@ -108,15 +111,43 @@ The following fields are presented in the Keyfactor Command Management Portal wh | `RequestorMobileNumber` | Optional | Requestor mobile number (digits only, no country code). Included in the `requestorInformation` block. | N/A | `5551234567` | | `SignerPlace` | Required | City or location of the person accepting the subscriber agreement on behalf of your organization. Required by CERTInext for all orders. | Use the physical city where the signer is located. | `Austin` | | `SignerIp` | Required | Public IP address of the host accepting the subscriber agreement. Required by CERTInext for all orders. | Use the outbound IP of the AnyCA Gateway host, or the IP of the workstation from which the agreement was accepted. | `203.0.113.10` | -| `GroupNumber` | Optional | CERTInext group (delegation) number. When set, it is passed in the `productDetails.groupNumber` field of `GetProductDetails` requests. Some sandbox accounts return an empty product list from `GetProductDetails` unless this field is included. Available in the CERTInext portal under **Delegation → Groups**. | Portal → **Delegation → Groups**. | `2345678901` | -| `DefaultProductCode` | Optional | Default numeric product code to use when no product code is set on the certificate template. If omitted and the template also has no product code, enrollment will fail. Product codes are provisioned per account by eMudhra — contact your eMudhra account representative to obtain the numeric codes available to your account. | Call `GetProductDetails` against your account/environment (see product code table below). | `842` | +| `GroupNumber` | Optional | CERTInext group (delegation) number. When set, it is passed in the `productDetails.groupNumber` field of `GetProductDetails` requests *and* in `delegationInformation.groupNumber` on every SSL order. Some sandbox accounts return an empty product list from `GetProductDetails` unless this field is included. Available in the CERTInext portal under **Delegation → Groups**. | Portal → **Delegation → Groups**. | `2345678901` | +| `OrganizationNumber` | Optional, strongly recommended for OV/EV and faster DV | Numeric CERTInext organization number for a pre-vetted organization. When set, every SSL order is submitted with `organizationDetails.preVetting="1"` and this number, telling CERTInext to skip its manual organization-vetting queue. Without it, orders may sit in `Pending System RA` for extended manual review (observed: tens of hours). | Portal → **Organizations → Pre-vetted Organizations**. | `1234567` | +| `TechnicalContactName` / `TechnicalContactEmail` / `TechnicalContactIsdCode` / `TechnicalContactMobileNumber` | Optional | Populate `technicalPointOfContact` on every SSL order. Each defaults to the corresponding `Requestor*` field when blank. Some product configurations require a technical point of contact to be present; omitting it can cause CERTInext to park orders awaiting manual completion of the field. | N/A | *(defaults to Requestor fields)* | +| `AccountingModel` | Optional | CERTInext billing model sent in `orderDetails.accountingModel`. `2` = credit-based (most accounts). `1` = cash model. Default: `2`. | N/A | `2` | +| `EmailNotifications` | Optional | Whether CERTInext sends lifecycle-event emails to the requestor. `1` = enabled, `0` = silent (recommended for gateway-driven orders). Default: `0`. | N/A | `0` | +| `SubscriptionValidityYears` | Optional | Connector-level default validity in years for SSL orders (`1`, `2`, or `3`). Overridden per template by the `ValidityYears` enrollment parameter. Default: `1`. | N/A | `1` | +| `SubscriptionAutoRenew` | Optional | Whether CERTInext should auto-renew certificates issued through this connector. `0` = disabled (recommended — renewal is driven by Keyfactor Command), `1` = enabled. Default: `0`. | N/A | `0` | +| `SubscriptionRenewCriteriaDays` | Optional | Days before expiry at which CERTInext auto-renews. Only honored when `SubscriptionAutoRenew` is `1`. Default: `30`. | N/A | `30` | +| `AutoSecureWww` | Optional | If `1`, CERTInext automatically adds the `www.` variant of the primary domain as an additional SAN. Default: `0`. | N/A | `0` | +| `SubmitNonDnsSans` | Optional | If `true` (default), SANs that aren't DNS names (IP address, email, URI) are submitted to CERTInext instead of silently dropped. CERTInext can't validate them, so such an order won't issue until they're removed. Set to `false` to restore the pre-1.0.1 behavior of submitting DNS names only. Default: `true`. | N/A | `true` | +| `DefaultProductCode` | Optional, but effectively required if you use renewals | Numeric product code used for **renewals only** — CERTInext's `TrackOrder` doesn't return the prior order's product code, so the renewal path sends this value verbatim, ignoring the template's `ProductCode`/`ProfileId`. If left blank, renewals go out with an empty product code. Has **no effect on new enrollments** — the `ProductCode`/`ProfileId` template resolution never falls back to it. See [issue tracking this](https://github.com/Keyfactor/certinext-caplugin/issues/26). | Call `GetProductDetails` against your account/environment (see product code table below). | `842` | | `IgnoreExpired` | Optional | If `true`, expired certificates are skipped during synchronization and are not imported into Keyfactor Command. Default: `false`. | N/A | `false` | | `PageSize` | Optional | Number of orders to retrieve per page during synchronization. Default: `100`. Maximum: `500`. Reduce this value if synchronization requests time out. | N/A | `100` | | `Enabled` | Optional | Enables or disables the CA connector. Setting this to `false` allows the connector record to be created before all credentials are available, without triggering a live connectivity test. Default: `true`. | N/A | `true` | +| `PickupRetries` | Optional | Number of times `Enroll` polls CERTInext for the certificate after a successful order submission, before returning pending and leaving pickup to the next sync. Set to `0` to disable the wait entirely. OV/EV orders validate asynchronously (minutes to hours) and typically exhaust this wait regardless of the value. Default: `5`. | N/A | `5` | +| `PickupDelay` | Optional | Seconds between certificate-pickup retries. The total pickup budget is a fixed 5-second initial delay + (`PickupRetries` × `PickupDelay`), hard-capped at 180 seconds regardless of how the two values are set. Aim for well under ~90s total so the call doesn't run long enough to trip Command's own enrollment timeout. Default: `10` (a ~55s ceiling with default `PickupRetries`). | N/A | `10` | + +> **Pickup timing detail:** after a successful order placement, the plugin waits a fixed 5-second initial delay before the first poll attempt, then polls CERTInext every `PickupDelay` seconds up to `PickupRetries` times. Each poll calls `GetCertificate` to check whether the certificate has been issued. The total time budget is: **5s + (PickupRetries × PickupDelay) + API round-trip time per poll (~1s each)**. With defaults this is approximately 5 + (5 × 10) + 5 = **~60 seconds**. +> +> **Tuning for faster pickup:** if the CERTInext API typically issues certificates within a few seconds of order placement (as observed with DV and auto-approved orders), you can reduce per-enrollment wait time by lowering `PickupDelay` and raising `PickupRetries` to compensate — this polls more frequently without changing the total budget. For example: +> +> | Configuration | PickupRetries | PickupDelay | Total budget | Poll cadence | +> |---------------|:---:|:---:|---|---| +> | Default | `5` | `10` | ~55s | Every 10s | +> | Faster polling | `10` | `5` | ~55s | Every 5s | +> | Aggressive | `50` | `1` | ~55s | Every 1s | +> | Minimal wait | `0` | — | 0s | No polling; defers to sync | +> +> The 5-second initial delay before the first poll is not configurable. The 180-second hard ceiling applies regardless of configuration. | `DcvEnabled` | Optional | When `true`, the gateway performs DNS-based Domain Control Validation (DCV) during enrollment for orders that require it. Requires a DNS provider plugin (e.g. `azure-azuredns-dnsplugin`) to be deployed on the gateway. Default: `false`. | N/A | `false` | | `DcvTxtRecordTemplate` | Optional | Format string for the DNS TXT record hostname published during DCV. `{0}` is replaced with the domain being validated. Default: `_emsign-validation.{0}`. | N/A | `_emsign-validation.{0}` | -| `DcvPropagationDelaySeconds` | Optional | Seconds to wait after publishing the DNS TXT record before asking CERTInext to verify it. Increase for zones with slow propagation. Default: `30`. | N/A | `30` | +| `DcvPropagationDelaySeconds` | Optional | Seconds to wait after publishing the DNS TXT record before asking CERTInext to verify it. Increase for zones with slow propagation. Applies only to the `Enroll()`-time DCV path — DCV driven during sync uses its own fixed 3-second delay. Default: `30`. | N/A | `30` | | `DcvTimeoutMinutes` | Optional | Maximum minutes to wait for the entire DCV flow (DNS publish + propagation + verify) before cancelling the enrollment. Can also be set via the `CERTINEXT_DCV_TIMEOUT_MINUTES` environment variable; the environment variable takes precedence when both are set. Default: `10`. | N/A | `10` | +| `DcvWaitForChallengeSeconds` | Optional | How long `Enroll()` waits for CERTInext to expose the DCV challenge after order placement, before giving up and deferring to the next sync. Set to `0` to disable the wait. Can also be set via `CERTINEXT_DCV_WAIT_FOR_CHALLENGE_SECONDS`. Default: `60`. | N/A | `60` | +| `DcvWaitForIssuanceSeconds` | Optional | How long `Enroll()` waits for CERTInext to finish generating the certificate after DCV verifies. Set to `0` to disable the wait. Can also be set via `CERTINEXT_DCV_WAIT_FOR_ISSUANCE_SECONDS`. Default: `60`. | N/A | `60` | +| `DcvSyncMaxOrderAgeHours` | Optional | During synchronization, only pending DV orders younger than this many hours are driven through DCV, so a large backlog of old/abandoned pending orders doesn't slow down every sync pass. Set to `0` to disable the age filter. Default: `24`. | N/A | `24` | +| `DcvSyncMaxPerPass` | Optional | Maximum number of pending DV orders driven through DCV in a single sync pass. Set to `0` to disable the cap. Default: `50`. | N/A | `50` | > Note: `AccountNumber` and group-level identifiers are distinct values. The `AccountNumber` is your top-level user account identifier. CERTInext groups (cost centers or departments) each have their own `groupNumber`, which is passed per-order and is separate from any organization number displayed on the Organizations page. @@ -130,11 +161,11 @@ In the Keyfactor Command Management Portal, navigate to **Certificate Templates* | Parameter | Required / Optional | Type | Description | Example / Default | |---|---|---|---|---| -| `ProductCode` | Optional | String | Override the numeric CERTInext product code for this template. Product codes are provisioned per account by eMudhra — obtain the correct code from `GetProductDetails` for your account. Set this explicitly when targeting the sandbox environment or when the connector `DefaultProductCode` should not apply to this template. See the [Product Codes](#product-codes) section for the sandbox/production lookup table. | DV SSL: `842` (sandbox) or `838` (production) | +| `ProductCode` | Optional | String | Override the numeric CERTInext product code for this template. Product codes are provisioned per account by eMudhra — obtain the correct code from `GetProductDetails` for your account. If omitted, the built-in default code for the selected product name is used (see [Product Codes](#product-codes)). Set this explicitly when targeting the sandbox environment or a non-standard code. | DV SSL: `842` (sandbox) or `838` (production) | | `ProfileId` | Deprecated | String | Legacy alias for `ProductCode`. Accepted for backward compatibility — if `ProductCode` is not set, `ProfileId` is used in its place. New templates should use `ProductCode`. | `838` | | `ValidityYears` | Optional | Number | Subscription validity period in years: `1`, `2`, or `3`. Default: `1`. CERTInext certificates are issued within a subscription term at up to 390 days per certificate, with free renewals within the term. | `1` | | `ValidityDays` | Deprecated | Number | Legacy validity field. If set, the value is divided by 365 and rounded up to derive a year count. New templates should use `ValidityYears`. | `365` | -| `AutoApprove` | Optional | Boolean | If `true`, the gateway will attempt automatic approval of certificates returned in a pending-approval state. Only set this if your CERTInext product is configured with automatic approval. Default: `false`. | `false` | +| `AutoApprove` | Optional | Boolean | **Currently has no effect** — reserved for future use. The plugin does not call any approval endpoint against CERTInext regardless of this setting. See [issue tracking this](https://github.com/Keyfactor/certinext-caplugin/issues/25). | `false` | | `RequesterName` | Optional | String | Per-template override for the requestor name. When set, overrides the connector-level `RequestorName` for orders using this template. | `Keyfactor Automation` | | `RequesterEmail` | Optional | String | Per-template override for the requestor email address. When set, overrides the connector-level `RequestorEmail` for orders using this template. | `pki-admin@example.com` | | `RenewalWindowDays` | Optional | Number | Number of days before certificate expiration within which a renewal is attempted instead of a reissue. Default: `90`. | `90` | @@ -226,6 +257,15 @@ authKey = SHA256(accessKey + requestTs + requestTxnId) Where `requestTs` is the ISO 8601 timestamp and `requestTxnId` is a unique transaction UUID generated per request. The raw access key is never transmitted — only the derived hash is sent. This computation happens automatically on every outbound call. When `AuthMode` is `OAuth`, the gateway obtains a bearer token via the configured client credentials flow and injects it into the `meta` block instead. +### HTTP Timeout + +Every CERTInext API call (enroll, sync, revoke) shares one HTTP client with a fixed 120-second +request timeout. This is hardcoded and is not exposed as a connector setting or environment +variable — it cannot be changed without modifying the plugin. If a call doesn't return within 120 +seconds, the plugin aborts it and the operation fails; a non-idempotent call (e.g. order placement) +is not retried afterward, since CERTInext may have already created the order — see +[Synchronization](#synchronization) to reconcile such orders on a later pass. + ### Enrollment Decision Logic When the gateway calls `Enroll`, the plugin selects between three paths based on the enrollment type and the age of the prior certificate: @@ -244,9 +284,10 @@ The `GenerateOrderSSL` API requires an `additionalInformation.remarks` field in CERTInext orders pass through several internal status stages before a certificate is issued. The plugin maps these to Keyfactor enrollment statuses as follows: -- **Issued** (status 9, 20) → certificate returned immediately. -- **Pending approval** (status 2, 8, 15, 24) → enrollment returns a pending status to Command. If `AutoApprove` is enabled on the template, the plugin attempts automatic approval before returning. -- **Rejected / cancelled** (status 4, 5, 13, 14) → enrollment fails with an error. +- **Issued** (status `7`, `9`, `12`, `15`, `20`, `23`) → certificate returned immediately (status `12`, expired, is retained in inventory as issued rather than treated as a failure). +- **Pending approval** (status `1`, `2`, `4`, `6`, `16`, `17`, `24`) → enrollment returns a pending status to Command. `Enroll()` polls briefly for the certificate (see `PickupRetries`/`PickupDelay`) before falling back to pending. +- **Revoked** (status `22`) → certificate marked revoked. +- **Rejected / cancelled** (status `3`, `5`, `8`, `13`, `14`, `18`, `19`, `21`, or any unrecognized code) → enrollment fails with an error. The gateway polls the `TrackOrder` endpoint during sync to pick up certificates that were approved after the initial enrollment call. @@ -266,4 +307,60 @@ When an enrollment request arrives, the numeric CERTInext product code is resolv If none of these yield a code, enrollment fails with a validation error. +## V2 API (Preview) + +The plugin includes an opt-in CERTInext V2 REST API code path that uses modern OAuth2 `client_credentials` authentication and a new order-centric resource model. V2 is disabled by default; V1 remains the active path unless `UseV2Api` is explicitly set to `true`. + +> **Synchronization note:** The V2 `/reports/orders` endpoint is not yet available (returns HTTP 501). When `UseV2Api` is `true`, synchronization continues to use the V1 `GetOrderReport` endpoint. V1 credentials (`ApiUrl`, `ApiKey`, `AccountNumber`) must remain configured even when V2 is enabled. + +### V2 CA Connector Fields + +| Field | Required / Optional | Description | Example | +|---|---|---|---| +| `UseV2Api` | Optional | Enable the V2 API code path for enrollment, revocation, and status checks. V1 is used for synchronization regardless. Default: `false`. | `false` | +| `ApiUrlV2` | Conditional | Base URL for the CERTInext V2 REST API (no trailing path suffix). Required when `UseV2Api` is `true`. | `https://sandbox-us-api.certinext.io` | +| `ClientId` | Conditional | OAuth2 client ID for V2 authentication. Required when `UseV2Api` is `true`. | `keyfactor-gateway` | +| `ClientSecret` | Conditional | OAuth2 client secret for V2 authentication. This field is masked in the UI. Required when `UseV2Api` is `true`. | *(generated, masked in UI)* | + +#### V2 OAuth2 Setup + +1. Log in to the CERTInext portal for your environment. +2. Navigate to **Integrations → APIs**. +3. Click **+ Create API Credentials** and select **Auth Type**: `OAuth2 (V2)`. +4. Note the **Client ID** and **Client Secret**. Enter them in `ClientId` and `ClientSecret`. +5. Set `UseV2Api` to `true` and enter the V2 base URL in `ApiUrlV2`. +6. Leave all V1 fields (`ApiUrl`, `ApiKey`, `AccountNumber`) configured — they are still used for synchronization. + +#### V2 Token Caching + +The plugin obtains a V2 bearer token via the standard OAuth2 `client_credentials` grant (`grant_type=client_credentials`, form-encoded) against `{ApiUrlV2}/oauth/token`. Tokens are cached in memory and reused until 60 seconds before expiry (minimum 30-second cache). Token refresh is thread-safe. + +### V2 Certificate Template Fields + +When `UseV2Api` is `true`, two additional enrollment parameters become relevant: + +| Parameter | Required / Optional | Type | Description | Example / Default | +|---|---|---|---|---| +| `ProductFamily` | Optional | String | CERTInext V2 product family. Accepted values: `ssl`, `private-pki`, `signature`. Default: `ssl`. | `ssl` | +| `ProductVariant` | Optional | String | Product variant within the family (e.g. `dv`, `ov`, `ev`). Default: `dv`. | `dv` | + +`ProductCode` continues to carry the numeric product code and is sent in the `X-Product-Code` header on V2 order placement. + +### V2 Order Lifecycle + +V2 orders are identified by an opaque string ID prefixed with `ord_` (e.g. `ord_a1b2c3d4`). This ID is returned by the V2 order placement endpoint and stored as the `CARequestID`. It is stable for the lifetime of the order and is used for all subsequent tracking, certificate download, and revocation calls. + +V2 status strings map to Keyfactor enrollment statuses as follows: + +| V2 Status | Keyfactor Status | Notes | +|---|---|---| +| `issued` | Issued | Certificate is immediately downloaded and returned to Command. | +| `pending-dcv` | Pending External Validation | Order is awaiting domain control validation. | +| `pending-csr` | Pending External Validation | Order is awaiting CSR submission or processing. | +| `pending-agreement` | Pending External Validation | Order requires subscriber agreement acceptance. | +| `revoked` | Revoked | Order has been revoked. | +| `cancelled` | Failed | Order was cancelled; a new enrollment is required. | + +Because V2 has no distinct renewal endpoint, all three enrollment types (New, Reissue, RenewOrReissue) place a fresh V2 order. + {% include 'architecture.md' %} diff --git a/docsource/development.md b/docsource/development.md index 14c6cff..2f7ab02 100644 --- a/docsource/development.md +++ b/docsource/development.md @@ -114,26 +114,12 @@ See `CERTInext.IntegrationTests/INTEGRATION_TESTING.md` for a full description o ## Product Integration Test Coverage -The table below records live draft-order results against the Production — India instance. Orders were placed with `saveAndHold:"1"` so no billing, DCV, or CA issuance was triggered. Tests are in `CERTInext.IntegrationTests/DraftOrderTests.cs`. +`DraftOrderTests.cs` (and `TrackOrderTests.cs`) previously recorded live draft-order results here, but both were removed: they asserted specific `requestNumber` values hardcoded from one developer's account, which don't exist on any other account and so failed everywhere else. Their intent — verifying draft-order and track-order semantics — is now covered by `LifecycleTests`, which creates its own order and asserts on it without relying on account-specific identifiers. -| Product | Code | Test Status | requestNumber | Notes | -|---|---|---|---|---| -| DV SSL | `838` | ✓ Tested | 4572531551 | Base domain; no extra fields required beyond base set | -| DV SSL Wildcard | `839` | ✓ Tested | 9149755266 | CSR CN must be `*.domain`; `domainName` must also use wildcard format | -| DV SSL UCC | `840` | ✓ Tested | 1611445122 | `certificateInformation.additionalDomains` array required | -| DV SSL Wildcard UCC | `841` | ✗ Blocked | — | EMS-918: "Additional Information cannot be empty" — required fields for this product not yet identified | -| OV SSL | `842` | ✓ Tested | 5546366498 | Requires `locality` and `postalCode` in `certificateInformation` | -| OV SSL Wildcard | `843` | ✗ Not tested | — | Draft order not yet placed | -| OV SSL UCC | `844` | ✗ Not tested | — | Draft order not yet placed | -| OV SSL Wildcard UCC | `845` | ✗ Blocked | — | EMS-918: "Additional Information cannot be empty" — required fields for this product not yet identified | -| EV SSL | `846` | ✓ Tested | 3932332114 | Requires `contractSignerInfo`, `certificateApproverInfo`, non-empty `streetAddress2`, `companyRegistrationNumber` | -| EV SSL UCC | `847` | ✗ Blocked | — | EMS-918: "Additional Information cannot be empty" — required fields for this product not yet identified | -| DV SSL 1 Month | N/A | ✗ Not supported | — | Visible in portal but not returned by `GetProductDetails` API; no product code available. Not supported by plugin. | -| DV SSL Wildcard 1 Month | N/A | ✗ Not supported | — | Visible in portal but not returned by `GetProductDetails` API; no product code available. Not supported by plugin. | -| emSign Intranet SSL | `100` | ✗ Not tested | — | EMS-1162: not provisioned on this account type | -| IGTF Host | `104` | ✗ Not tested | — | EMS-1162: not provisioned on this account type | -| S/MIME | `894` | ✗ Not tested | — | EMS-1162: not provisioned on this account type | -| Natural Person Doc Signer | `825` | ✗ Not tested | — | EMS-1162: not provisioned on this account type | -| Legal Entity Doc Signer | `819` | ✗ Not tested | — | EMS-1162: not provisioned on this account type | - -Products returning EMS-1162 require special provisioning by eMudhra that is not included on a standard SSL/TLS account. The plugin code supports submitting orders for any product code; whether the order is accepted depends on what is provisioned for your account. +Product codes are provisioned per account by eMudhra and are not portable across accounts (see the [Product Codes](configuration.md#product-codes) section in configuration.md). To discover which codes and required fields apply to *your* account: + +```bash +make probe-products +``` + +This places `saveAndHold=1` draft orders for all known SSL/TLS product codes and reports which return a `requestNumber` (valid/provisioned) versus an error (invalid or not provisioned). See `CERTInext.IntegrationTests/TESTING.md` for the current, account-specific findings and expected test results. diff --git a/issues/f3-v2-multi-san-limitation.md b/issues/f3-v2-multi-san-limitation.md new file mode 100644 index 0000000..f5928ad --- /dev/null +++ b/issues/f3-v2-multi-san-limitation.md @@ -0,0 +1,41 @@ +# F3 — V2 API does not support multi-SAN certificates + +**Severity:** Medium +**Affected path:** `EnrollV2Async` → `PlaceOrderV2Async` (`CERTInext/CERTInextCAPlugin.cs`) + +## Problem + +The V2 API (`/api/v2/ssl/...`) is single-domain only. `V2CreateSslOrderRequest.Certificate` +has `domain` (string) and `autoSecureWww` (bool). There is no `additionalDomains` or SAN +array. A CSR carrying SANs beyond `` and `www.` has no mechanism to submit +those names to the CA — they would either be silently dropped or trigger a CA-side error. + +The V1 path (`BuildOrderRequestFromLegacyEnrollRequest`) uses +`CertificateInformation.AdditionalDomains` (via `BuildAdditionalDomains`) and handles +multi-SAN CSRs correctly. + +## Immediate mitigation (applied in this PR) + +`EnrollV2Async` now parses DNS SANs from the CSR with BouncyCastle before calling +`PlaceOrderV2Async`. If SANs beyond the primary domain and its `www.` variant are +detected, enrollment is rejected immediately with a descriptive `FAILED` result rather +than letting the CA return an opaque error or silently issue a certificate missing names. + +## Full fix options + +1. **Route multi-SAN orders through V1**: detect the SAN count at `Enroll()` dispatch time + and fall back to V1 when the CSR contains more than one DNS SAN (or more than two + when `autoSecureWww=true`). Requires that the account still has V1 access. + +2. **V2 SAN support via wildcard/UCC product variant**: investigate whether any + CERTInext V2 product variant supports a SAN array in the order request. Not + documented in the current OpenAPI spec; would need CA vendor confirmation. + +3. **Gateway-layer refusal before V2 is attempted**: expose a `MaxSanCount` enrollment + parameter (default 1 for V2 product codes) so administrators can constrain templates + at the Command layer and avoid confusing enrollment failures at the CA level. + +## Related + +- `V2CertificateParams` — `CERTInext/API/V2/CertificateRequestV2.cs` +- `BuildAdditionalDomains` — `CERTInext/Client/CERTInextClient.cs` (V1 path)