Add support for EV, OV Wildcard, and DV Wildcard multi-name certificate products - #18
Open
bhillkeyfactor wants to merge 11 commits into
Open
bhillkeyfactor wants to merge 11 commits into
bhillkeyfactor wants to merge 11 commits into
Conversation
…te products CSC TrustedSecure EV, Multiple Names (7), CSC TrustedSecure OV Wildcard, Multiple Names (8), and CSC TrustedSecure DV Wildcard, Multiple Names (9) per CSC's certificate type table. Type 7 requires both EvCertificateDetails and SubjectAlternativeNames since it is EV plus multi-name; 8 and 9 only need SubjectAlternativeNames.
Introduce a step-oriented FlowLogger for tracing Enroll, Revoke, and Synchronize pipelines end to end, and add logging throughout RequestManager (previously had none) and CscGlobalClient (missing error/warning branches, wrong logger category on CscGlobalClient).
…s unset Only look up the optional additional-SAN-emails field when the domain control validation method is EMAIL, and use TryGetValue instead of the indexer so a missing/blank value no longer throws.
…no 'dnsname' key UC certificate enrollments with zero SANs supplied threw KeyNotFoundException from the sans["dnsname"] indexer. Use TryGetValue and treat a missing key as no SANs instead of throwing.
Registration/Renewal/Reissue/Revoke calls only handled CSC Global's 400 error-body case; any other failure status (e.g. 404) fell through to deserializing an empty/unexpected body, leaving Result and RegistrationError both null and causing a downstream NullReferenceException in RequestManager instead of a clear error.
Add null and bounds guards throughout the enrollment, revoke, and sync paths: CSC Global responses (Result/RegistrationError/Status may be null even on a 200), optional ProductParameters lookups that were using the strict indexer, CARequestID substring truncation, and config/dictionary lookups in Initialize and the CscGlobalClient constructor. Replaces silent NREs with clear, logged failures.
…/Keyfactor/cscglobal-caplugin into feature/ev-ov-dv-multiname-certs
Previously the CSC Global list request filtered to status=in=(ACTIVE,REVOKED) and SyncCertificates only forwarded GENERATED/REVOKED records, so any pending or failed request was never reported back to Command on any sync cycle. Command eventually treats a request it hasn't seen in recent syncs as outdated and tries to prune it, which can trigger an internal Command cleanup bug for requests with no staged private key. Now every request CSC Global returns is forwarded to Command each sync, with certificate content attached only when actually issued or revoked.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Test plan