Dev 3.0

.github/workflows/keyfactor-bootstrap-workflow.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@v4
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
     secrets:
       token: ${{ secrets.V2BUILDTOKEN}}
       scan_token: ${{ secrets.SAST_TOKEN }}

CHANGELOG.md

@@ -39,3 +39,15 @@
 
 ### 2.4.1  
 * Fix for missing parameter errors  
+
+### 2.5.0  
+* Fix for checking if product is a DV cert to ignore organization checks  
+* Performance enhancements to reduce API calls  
+* Added null checks/error handling to catch bad certs on sync  
+* Improved rate limiting handling based on DigiCert guidance  
+* Improved handling of API error responses  
+* Fixes for sync filtering  
+* Incremental sync fix  
+
+### 3.0.0  
+* Add support for automated domain validation via DNS gateway plugins.  

digicert-certcentral-caplugin/CertCentralConfig.cs

@@ -52,5 +52,7 @@ public List<string> SyncProducts
 		public bool? FilterExpiredOrders { get; set; }
 		public int? SyncExpirationDays { get; set; }
 		public string SyncDivisionFilter { get; set; }
+		public bool DnsValidationEnabled { get; set; }
+		public string DnsValidationMethod { get; set; }
 	}
 }

digicert-certcentral-caplugin/Constants.cs

@@ -44,6 +44,8 @@ public class Config
 			public const string LAST_NAME = "LastName";
 			public const string PSEUDONYM = "Pseudonym";
 			public const string SMIME_USAGE = "UsageDesignation";
+			public const string DNS_VALIDATION_METHOD = "DnsValidationMethod";
+			public const string DNS_VALIDATION_ENABLED = "DnsValidationEnabled";
 		}
 
 		public class RequestAttributes

digicert-certcentral-caplugin/Models/Error.cs

@@ -15,6 +15,13 @@ public class Error
 
         [JsonProperty("message")]
         public string message { get; set; }
+
+		public override string ToString()
+		{
+			if (string.IsNullOrEmpty(code)) return message ?? string.Empty;
+			if (string.IsNullOrEmpty(message)) return code;
+			return $"{code}: {message}";
+		}
     }
 
     public class Errors

digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj

@@ -1,21 +1,19 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFrameworks>net6.0;net8.0</TargetFrameworks>
+    <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
     <RootNamespace>Keyfactor.Extensions.CAPlugin.DigiCert</RootNamespace>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>disable</Nullable>
     <AssemblyName>DigicertCAPlugin</AssemblyName>
-    <AssemblyVersion>2.1.2</AssemblyVersion>
-    <FileVersion>2.1.2</FileVersion>
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="2.0.0" />
-    <PackageReference Include="Keyfactor.Common" Version="2.5.0" />
-    <PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
-    <PackageReference Include="Keyfactor.PKI" Version="5.5.0" />
-    <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+    <PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.3.0" />
+    <PackageReference Include="Keyfactor.Common" Version="2.11.0" />
+    <PackageReference Include="Keyfactor.Logging" Version="1.3.0" />
+    <PackageReference Include="Keyfactor.PKI" Version="8.3.1" />
+    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
   </ItemGroup>
 
   <ItemGroup>

docsource/configuration.md

@@ -14,6 +14,15 @@ An API Key within your Digicert account that has the necessary permissions to en
 
 In order to enroll for certificates the Keyfactor Command server must trust the trust chain. Once you identify your Root and/or Subordinate CA in your Digicert account, make sure to download and import the certificate chain into the Command Server certificate store
 
+### Automated DNS Domain Validation
+
+This plugin integrates with the AnyCA Gateway **DNS provider plugin framework** (`KeyfactorAnyGateway.IAnyCAPlugin` 3.3.0+). DNS provider plugins (Azure DNS, AWS Route53, Cloudflare, Google Cloud DNS, etc.) are deployed and configured **separately** on the gateway; this CA plugin does not bundle any DNS provider SDKs. The gateway injects an `IDomainValidatorFactory` that resolves the correct provider for each domain at enrollment time.
+
+DigiCert supports both **TXT** and **CNAME** records for DNS validation, the choice of which is provided by the appropriate configuration field. **TXT** records are the preferred method.
+
+`DnsValidationMethod` defines whether you wish to use TXT, CNAME, or email validation. Only TXT or CNAME will work with the automated validation.
+`DnsValidationEnabled` determines whether to use the automated validation. Make sure you have the necessary DNS plugins installed and configured before enabling. If `DnsValidationMethod` is set to either TXT or CNAME but `DnsValidationEnabled` is false, then unvalidated enrollment requests will get a status of External Validation, and the necessary TXT or CNAME token will be instead returned to the enrollment caller to be used to manually update the DNS record.
+
 ## Certificate Template Creation Step
 
 Note for SMIME product types (Secure Email types): The template configuration fields provided for those are not required to be filled out in the gateway config. Many of those values would change on a per-enrollment basis. The way to handle that is to create Enrollment fields in Command with the same name (for example: CommonNameIndicator) and then any values populated in those fields will override any static values provided in the configuration.

integration-manifest.json

@@ -7,7 +7,7 @@
     "link_github": true,
     "update_catalog": true,
     "description": "DigiCert CertCentral plugin for the AnyCA REST Gateway framework",
-    "gateway_framework": "24.2.0",
+    "gateway_framework": "26.2.0",
     "release_dir": "digicert-certcentral-caplugin/bin/Release",
     "release_project": "digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj",
     "about": {
@@ -50,6 +50,14 @@
                     "name": "SyncExpirationDays",
                     "description": "If FilterExpiredOrders is set to true, this setting determines how many days in the past to still return expired orders. For example, a value of 30 means the sync will return any certs that expired within the past 30 days. A value of 0 means the sync will not return any certs that expired before the current day. This value is ignored if FilterExpiredOrders is false."
                 },
+                {
+                    "name": "DnsValidationMethod",
+                    "description": "The DNS validation method to use. Default value is 'email'. Other valid values are 'txt' and 'cname' If using automated DNS validation, 'txt' is the preferred method."
+                },
+                {
+                    "name": "DnsValidationEnabled",
+                    "description": "Enable automated DNS (TXT or CNAME) domain control validation. When enabled, the plugin requests TXT-based validation from DigiCert and publishes the returned record via the DNS provider plugin resolved by the AnyCA Gateway. Requires a DNS provider plugin (e.g. Azure, Cloudflare, etc) to be deployed and configured on the gateway. When disabled, requests that require validation will be flagged as External Validation, and the validation token, if needed depending on the DNS Validation method, will be returned."
+                },
                 {
                     "name": "Enabled",
                     "description": "Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available."