2.0 release (#5) (#13)

Initial Public Release * Change status codes to EndEntityStatus codes * If digicert returns multiple identical certs (same order/cert ID pair), only return one of them * Renew/reissue check added, parameter data types specified * Don't throw exceptions when unable to retreive product IDs * Prevent duplicate certs from syncing * Allows for creating the CA prior to having config info available, creating with Enabled = false skips config validation. * Port sync CA filter from DCOM gateway Co-authored-by: Dave Galey <[email protected]>
Keyfactor · Jun 12, 2024 · b282e19 · b282e19
1 parent 382cf67
commit b282e19
Show file tree

Hide file tree

Showing 43 changed files with 608 additions and 275 deletions.
diff --git a/.github/workflows/keyfactor-bootstrap-workflow.yml b/.github/workflows/keyfactor-bootstrap-workflow.yml
@@ -0,0 +1,19 @@
+name: Keyfactor Bootstrap Workflow
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, closed, synchronize, edited, reopened]
+  push:
+  create:
+    branches:
+      - 'release-*.*'
+
+jobs:
+  call-starter-workflow:
+    uses: keyfactor/actions/.github/workflows/starter.yml@v2
+    secrets:
+      token: ${{ secrets.V2BUILDTOKEN}}
+      APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
+      gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
+      gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}
diff --git a/.github/workflows/keyfactor-integrations-workflow.yml b/.github/workflows/keyfactor-integrations-workflow.yml
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,2 @@
+### 2.0.0
+* Initial Public Release
diff --git a/README.md b/README.md
@@ -1,67 +1,87 @@
-# digicert-certcentral-anycagateway
 
-DigiCert CertCentral plugin for the AnyCA Gateway framework
+# DigiCert CertCentral AnyCA REST Gateway Plugin
 
-#### Integration status: Prototype - Demonstration quality. Not for use in customer environments.
+DigiCert CertCentral plugin for the AnyCA REST Gateway framework
 
+#### Integration status: Production - Ready for use in production environments.
 
-## About the Keyfactor AnyGateway CA Connector
+## About the Keyfactor 
 
-This repository contains an AnyGateway CA Connector, which is a plugin to the Keyfactor AnyGateway. AnyGateway CA Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
 
 
+## Support for DigiCert CertCentral AnyCA REST Gateway Plugin
 
-
-## Support for digicert-certcentral-anycagateway
-
-digicert-certcentral-anycagateway is open source and community supported, meaning that there is **no SLA** applicable for these tools.
+DigiCert CertCentral AnyCA REST Gateway Plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com
 
 ###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
 
+---
 
 
 ---
 
 
 
+
+# Introduction
 
+This AnyCA REST Gateway plug-in enables issuance, revocation, and synchronization of certificates from DigiCert's CertCentral offering.  
+# Prerequisites
 
+## Prerequisite: Certificate Chain
 
-## Keyfactor AnyGateway Framework Supported
+In order to request certificates from the Keyfactor AnyGateway, the Keyfactor Command server must trust the certificate chain of trust. To ensure trust is established, download your Root and/or Subordinate CA certificates from DigiCert and import them into the appropriate local certificate stores on the Keyfactor AnyGateway and Command servers. More information can be found in the [AnyCA Gateway REST Install Guide](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/Preparing.htm)
 
-This gateway was compiled against version 1.0.0 of the AnyGateway Framework.  You will need at least this version of the AnyGateway Framework Installed.  If you have a later AnyGateway Framework Installed you will probably need to add binding redirects in the CAProxyServer.exe.config file to make things work properly.
+## Installation
+1. Download latest successful build from [GitHub Releases](../../releases/latest)
 
+2. Extract the .zip file, and from it, copy DigicertCAPlugin.dll and DigicertCAPlugin.deps.json to the 'C:\Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions' directory
 
+3. Within the 'C:\Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions\Connectors' folder, update the manifest.json file to contain the following:
 
----
+```json
+{  
+    "extensions": {  
+        "Keyfactor.AnyGateway.Extensions.IAnyCAPlugin": {  
+            "CertCentralCAPlugin": {  
+                "assemblypath": "../DigicertCAPlugin.dll",  
+                "TypeFullName": "Keyfactor.Extensions.CAPlugin.DigiCert.CertCentralCAPlugin"  
+            }  
+        }  
+    }  
+}
+```
 
+NOTE: If the Connectors folder and/or the manifest.json file do not exist, they must be manually created
 
-# Introduction
-This AnyGateway plug-in enables issuance, revocation, and synchronization of certificates from DigiCert's CertCentral offering.  
-# Prerequisites
+4. Restart the AnyCA Gateway service
 
-## Certificate Chain
+5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the DigiCert plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal. CAPlugin Type should now be listed as CertCentralCA.
 
-In order to enroll for certificates the Keyfactor Command server must trust the trust chain. Once you create your Root and/or Subordinate CA, make sure to import the certificate chain into the AnyGateway and Command Server certificate store
 
+## Configuration
 
-# Install
-* Download latest successful build from [GitHub Releases](../../releases/latest)
+1. Follow the [official Keyfactor AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm#Add_or_Edit_a_Certificate_Authority) to define a new Certificate Authority, using the following information to configure the CA Connection section:
 
-* Copy DigiCertCAGateway.dll and DigiCertCAGateway.deps.json to the Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions directory
+SETTING | REQUIRED? | DESCRIPTION
+--|--|--
+Enabled | Yes | Enables the DigiCert gateway functionality. Should almost always be set to 'true'
+APIKey | Yes | The API key the Gateway should use to communicate with the DigiCert API. Can be generated from the DigiCert portal.
+Region | No | The geographic region associated with your DigiCert account. Valid values are US and EU. Default if not provided is US.
+DivisionId | No | If your CertCentral account has multiple divisions AND uses any custom per-division product settings, provide a division ID for the gateway to use for product type lookups.
+RevokeCertificateOnly | No | If set to 'true', revoke operations will only revoke the individual certificate in question rather than the entire DigiCert order. Default if not provided is 'false'.
+SyncCAFilter | No | If you list one or more DigiCert issuing CA IDs here (comma-separated if more than one), the sync process will only return certs issued by one of those CAs. Leave this option empty to sync all certs from all CAs.
+FilterExpiredOrders | No | If set to 'true', syncing will not return certs that are expired more than a specified number of days. The number of days is specified by the SyncExpirationDays config option. Default value is 'false'.
+SyncExpirationDays | No | Only used if FilterExpiredOrders is 'true', otherwise ignored. Sets the number of days a cert has to be expired for the sync process to no longer sync it. For example, a value of 30 means sync will continue to return certs that have expired within the past 30 days, but not ones older than that. Default value is 0, meaning sync would not return any certs expired before the current day.
+
+2. After saving the CA configuration, Follow the [official AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm#Certificate_Profile) to define one or more Certificate Profiles.
+3. Edit your newly configured CA, and you should now be able to modify the Templates tab. You need at least one template for each product type you wish to be able to enroll for. It is recommended to include the product type in the template name to make them easier to identify. Use the following information to configure the parameters for each template:
+
+SETTING | REQUIRED? | DESCRIPTION
+--|--|--
+LifetimeDays | No | The number of days of validity to use when requesting certs. Default if not provided is 365. NOTE FOR RENEWALS: If the value of LifetimeDays is evenly divisible by 365, the expiration day and month of the new cert will be set to the same values as the old cert if possible, to avoid renewal date drift.
+CACertId | No | The ID of the issuing CA to be used by DigiCert. If not specified, the default for your account will be used.
+Organization-Name | No | If specified, this value will override any organization name provided in the subject of the cert request on enrollment. Useful for requests (such as ACME) that contain no subject.
+RenewalWindowDays | No | The number of days from expiration that the gateway should do a reissue rather than a renewal. Default if not provided is 90, meaning any renewal request for certs that expire in more than 90 days will be treated as a reissue request.
 
-* Update the manifest.json file located in Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions\Connectors
-  * If the manifest.json file or the Connectors folder do not exist, create them.
-  ```json
-{  
-	"extensions": {  
-		"Keyfactor.AnyGateway.Extensions.ICAConnector": {  
-			"DigiCertCAConnector": {  
-				"assemblypath": "../DigiCertCAGateway.dll",  
-				"TypeFullName": "Keyfactor.Extensions.CAGateway.DigiCert.CertCentralCAConnector"  
-			}  
-		}  
-	}  
-}
-  ```
 
diff --git a/digicert-certcentral-anycagateway/digicert-certcentral-anycagateway.csproj b/digicert-certcentral-anycagateway/digicert-certcentral-anycagateway.csproj
diff --git a/digicert-certcentral-anycagateway.sln → digicert-certcentral-caplugin.sln b/digicert-certcentral-anycagateway.sln → digicert-certcentral-caplugin.sln
@@ -3,7 +3,14 @@ Microsoft Visual Studio Solution File, Format Version 12.00
 # Visual Studio Version 17
 VisualStudioVersion = 17.6.33815.320
 MinimumVisualStudioVersion = 10.0.40219.1
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "digicert-certcentral-anycagateway", "digicert-certcentral-anycagateway\digicert-certcentral-anycagateway.csproj", "{434D1E74-8EE7-4CC6-BAEC-62D224022F5F}"
+Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "digicert-certcentral-caplugin", "digicert-certcentral-caplugin\digicert-certcentral-caplugin.csproj", "{434D1E74-8EE7-4CC6-BAEC-62D224022F5F}"
+EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{A6058317-1B5E-4E7C-9669-B3A6C0E605BB}"
+	ProjectSection(SolutionItems) = preProject
+		CHANGELOG.md = CHANGELOG.md
+		integration-manifest.json = integration-manifest.json
+		readme_source.md = readme_source.md
+	EndProjectSection
 EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

diff --git a/...al-anycagateway/API/CertCentralAPIBase.cs → ...entral-caplugin/API/CertCentralAPIBase.cs b/...al-anycagateway/API/CertCentralAPIBase.cs → ...entral-caplugin/API/CertCentralAPIBase.cs
@@ -1,4 +1,4 @@
-using Keyfactor.Extensions.CAGateway.DigiCert.Models;
+using Keyfactor.Extensions.CAPlugin.DigiCert.Models;
 using Newtonsoft.Json;
 
 using System;
@@ -7,7 +7,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
     public abstract class CertCentralBaseResponse
 	{

diff --git a/...tral-anycagateway/API/CertificateChain.cs → ...tcentral-caplugin/API/CertificateChain.cs b/...tral-anycagateway/API/CertificateChain.cs → ...tcentral-caplugin/API/CertificateChain.cs
@@ -6,7 +6,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class CertificateChainRequest : CertCentralBaseRequest
 	{

diff --git a/...nycagateway/API/CertificateTypeDetails.cs → ...al-caplugin/API/CertificateTypeDetails.cs b/...nycagateway/API/CertificateTypeDetails.cs → ...al-caplugin/API/CertificateTypeDetails.cs
@@ -7,7 +7,7 @@
 using System.Threading.Tasks;
 using System.Web;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	/// <summary>
 	/// Request to get the details for a specific certificate type.

diff --git a/...tral-anycagateway/API/CertificateTypes.cs → ...tcentral-caplugin/API/CertificateTypes.cs b/...tral-anycagateway/API/CertificateTypes.cs → ...tcentral-caplugin/API/CertificateTypes.cs
@@ -6,7 +6,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	/// <summary>
 	/// Request to get a certificate type.

diff --git a/...-certcentral-anycagateway/API/CheckDCV.cs → ...cert-certcentral-caplugin/API/CheckDCV.cs b/...-certcentral-anycagateway/API/CheckDCV.cs → ...cert-certcentral-caplugin/API/CheckDCV.cs
@@ -6,7 +6,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class DVCheckDCVRequest : CertCentralBaseRequest
 	{

diff --git a/...ateway/API/DownloadCertificateByFormat.cs → ...plugin/API/DownloadCertificateByFormat.cs b/...ateway/API/DownloadCertificateByFormat.cs → ...plugin/API/DownloadCertificateByFormat.cs
@@ -4,7 +4,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class DownloadCertificateByFormatRequest : CertCentralBaseRequest
 	{

diff --git a/...anycagateway/API/ListCertificateOrders.cs → ...ral-caplugin/API/ListCertificateOrders.cs b/...anycagateway/API/ListCertificateOrders.cs → ...ral-caplugin/API/ListCertificateOrders.cs
@@ -1,4 +1,4 @@
-using Keyfactor.Extensions.CAGateway.DigiCert.Models;
+using Keyfactor.Extensions.CAPlugin.DigiCert.Models;
 using Newtonsoft.Json;
 
 using System;
@@ -8,16 +8,17 @@
 using System.Threading.Tasks;
 using System.Web;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class ListCertificateOrdersRequest : CertCentralBaseRequest
 	{
-		public ListCertificateOrdersRequest()
+		public ListCertificateOrdersRequest(bool ignoreExpired = false)
 		{
 			this.Resource = "services/v2/order/certificate";
 			this.Method = "GET";
 			this.limit = 1000;
 			this.offset = 0;
+			this.ignoreExpired = ignoreExpired;
 		}
 
 		[JsonProperty("limit")]
@@ -26,13 +27,22 @@ public ListCertificateOrdersRequest()
 		[JsonProperty("offset")]
 		public int offset { get; set; }
 
+		public bool ignoreExpired { get; set; }
+		public int expiredWindow { get; set; } = 0;
+
 		public new string BuildParameters()
 		{
 			StringBuilder sbParamters = new StringBuilder();
 
 			sbParamters.Append("limit=").Append(this.limit.ToString());
 			sbParamters.Append("&offset=").Append(HttpUtility.UrlEncode(this.offset.ToString()));
 
+			if (ignoreExpired)
+			{
+				DateTime cutoffDate = DateTime.Today.AddDays(-1 - expiredWindow);
+				sbParamters.Append("&filters[valid_till]=>").Append(cutoffDate.ToString("yyyy-MM-dd"));
+			}
+
 			return sbParamters.ToString();
 		}
 	}

diff --git a/...entral-anycagateway/API/ListContainers.cs → ...ertcentral-caplugin/API/ListContainers.cs b/...entral-anycagateway/API/ListContainers.cs → ...ertcentral-caplugin/API/ListContainers.cs
@@ -6,7 +6,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	/// <summary>
 	/// Request to get the containers available.

diff --git a/...rtcentral-anycagateway/API/ListDomains.cs → ...t-certcentral-caplugin/API/ListDomains.cs b/...rtcentral-anycagateway/API/ListDomains.cs → ...t-certcentral-caplugin/API/ListDomains.cs
@@ -1,4 +1,4 @@
-using Keyfactor.Extensions.CAGateway.DigiCert.Models;
+using Keyfactor.Extensions.CAPlugin.DigiCert.Models;
 using Microsoft.VisualBasic;
 using Newtonsoft.Json;
 
@@ -9,7 +9,7 @@
 using System.Threading.Tasks;
 using System.Web;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
     public class ListDomainsRequest : CertCentralBaseRequest
 	{

diff --git a/...entral-anycagateway/API/ListDuplicates.cs → ...ertcentral-caplugin/API/ListDuplicates.cs b/...entral-anycagateway/API/ListDuplicates.cs → ...ertcentral-caplugin/API/ListDuplicates.cs
@@ -1,4 +1,4 @@
-using Keyfactor.Extensions.CAGateway.DigiCert.Models;
+using Keyfactor.Extensions.CAPlugin.DigiCert.Models;
 
 using Newtonsoft.Json;
 
@@ -8,7 +8,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class ListDuplicatesRequest : CertCentralBaseRequest
 	{

diff --git a/...tcentral-anycagateway/API/ListMetadata.cs → ...-certcentral-caplugin/API/ListMetadata.cs b/...tcentral-anycagateway/API/ListMetadata.cs → ...-certcentral-caplugin/API/ListMetadata.cs
@@ -6,7 +6,7 @@
 using System.Text;
 using System.Threading.Tasks;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	/// <summary>
 	/// Request to get the metadata fields available.

diff --git a/...ral-anycagateway/API/ListOrganizations.cs → ...central-caplugin/API/ListOrganizations.cs b/...ral-anycagateway/API/ListOrganizations.cs → ...central-caplugin/API/ListOrganizations.cs
@@ -7,7 +7,7 @@
 using System.Threading.Tasks;
 using System.Web;
 
-namespace Keyfactor.Extensions.CAGateway.DigiCert.API
+namespace Keyfactor.Extensions.CAPlugin.DigiCert.API
 {
 	public class ListOrganizationsRequest : CertCentralBaseRequest
 	{