Fix for the ARN not getting attached to enrollment request.

mkachk · mkachk · commit 57f1c9e7416a · 2026-06-16T18:36:03.000-04:00
diff --git a/.gitignore b/.gitignore
@@ -361,3 +361,5 @@ MigrationBackup/
 
 # Fody - auto-generated XML schema
 FodyWeavers.xsd
+/.claude
+/issue.txt
diff --git a/README.md b/README.md
@@ -1,13 +1,13 @@
 <h1 align="center" style="border-bottom: none">
-    AWSPCA CA  Gateway AnyCA Gateway REST Plugin
+    AWSPCA CAPlugin AnyCA Gateway REST Plugin
 </h1>
 
 <p align="center">
   <!-- Badges -->
 <img src="https://img.shields.io/badge/integration_status-pilot-3D1973?style=flat-square" alt="Integration Status: pilot" />
-<a href="https://github.com/Keyfactor/aws-pca-caplugin/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/aws-pca-caplugin?style=flat-square" alt="Release" /></a>
-<img src="https://img.shields.io/github/issues/Keyfactor/aws-pca-caplugin?style=flat-square" alt="Issues" />
-<img src="https://img.shields.io/github/downloads/Keyfactor/aws-pca-caplugin/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" />
+<a href="https://github.com/Keyfactor/aws-pca-caplugin-dev/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/aws-pca-caplugin-dev?style=flat-square" alt="Release" /></a>
+<img src="https://img.shields.io/github/issues/Keyfactor/aws-pca-caplugin-dev?style=flat-square" alt="Issues" />
+<img src="https://img.shields.io/github/downloads/Keyfactor/aws-pca-caplugin-dev/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" />
 </p>
 
 <p align="center">
@@ -38,10 +38,10 @@ This integration allows for the Synchronization, Enrollment, and Revocation of c
 
 ## Compatibility
 
-The AWSPCA CA  Gateway AnyCA Gateway REST plugin is compatible with the Keyfactor AnyCA Gateway REST 25.4.0 and later.
+The AWSPCA CAPlugin AnyCA Gateway REST plugin is compatible with the Keyfactor AnyCA Gateway REST 25.4.0 and later.
 
 ## Support
-The AWSPCA CA  Gateway AnyCA Gateway REST plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com. 
+The AWSPCA CAPlugin AnyCA Gateway REST plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com. 
 
 > To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
 
@@ -53,7 +53,7 @@ This integration is tested and confirmed as working for Anygateway REST 24.4 and
 
 1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm).
 
-2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [AWSPCA CA  Gateway AnyCA Gateway REST plugin](https://github.com/Keyfactor/aws-pca-caplugin/releases/latest) from GitHub.
+2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [AWSPCA CAPlugin AnyCA Gateway REST plugin](https://github.com/Keyfactor/aws-pca-caplugin-dev/releases/latest) from GitHub.
 
 3. Copy the unzipped directory (usually called `net6.0` or `net8.0`) to the Extensions directory:
 
@@ -64,11 +64,11 @@ This integration is tested and confirmed as working for Anygateway REST 24.4 and
     Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net8.0\Extensions
     ```
 
-    > The directory containing the AWSPCA CA  Gateway AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
+    > The directory containing the AWSPCA CAPlugin AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
 
 4. Restart the AnyCA Gateway REST service.
 
-5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the AWSPCA CA  Gateway plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
+5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the AWSPCA CAPlugin plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
 
 ## Configuration
 
@@ -100,11 +100,12 @@ This integration is tested and confirmed as working for Anygateway REST 24.4 and
         * **ExternalId** - Optional sts:ExternalId to supply on AssumeRole calls. 
         * **Enabled** - Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available. 
 
-2. Define [Certificate Profiles](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm) and [Certificate Templates](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) for the Certificate Authority as required. One Certificate Profile must be defined per Certificate Template. It's recommended that each Certificate Profile be named after the Product ID. The AWSPCA CA  Gateway plugin supports the following product IDs:
+2. Define [Certificate Profiles](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm) and [Certificate Templates](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) for the Certificate Authority as required. One Certificate Profile must be defined per Certificate Template. It's recommended that each Certificate Profile be named after the Product ID. The AWSPCA CAPlugin plugin supports the following product IDs:
 
     * **EndEntity**
     * **EndEntityClientAuth**
     * **EndEntityServerAuth**
+    * **CodeSigning**
 
 3. Follow the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Keyfactor.htm) to add each defined Certificate Authority to Keyfactor Command and import the newly defined Certificate Templates.
 
@@ -119,11 +120,6 @@ This integration is tested and confirmed as working for Anygateway REST 24.4 and
 The CAPlugin currently supports **one** authentication method: **AWS Access Key ID + Secret Access Key**.  
 **OAuth** and **Default SDK authentication** will be enabled in later updates. There is functionality present via the **Keyfactor AWS Authentication** library, but these alternate methods are currently ***untested***.
 
-### Known Issues
-
-At present, a fresh install of Keyfactor Command 24.4 used in conjuction with Keyfactor Gateway REST 25.4.0.0 is confirmed as working.  A fresh install of Command 25.3 used with REST 25.4.0.0 is also confirmed as working.
-Latest version of Command 25.4 may run into issues, investigation into compatibility issues is ongoing.
-
 ### What you need ready
 
 Before configuring the CAPlugin, have the following prepared:
diff --git a/aws-pca-caplugin/AWSPCACAPlugin.cs b/aws-pca-caplugin/AWSPCACAPlugin.cs
@@ -415,60 +415,60 @@ public async Task<EnrollmentResult> Enroll(
             switch (enrollmentType)
             {
                 case EnrollmentType.New:
-                    {
-                        return await IssueAndFetchAsync(
-                                csr,
-                                productInfo.ProductID,
-                                days,
-                                signingAlgorithm,
-                                "Certificate Issued")
-                            .ConfigureAwait(false);
-                    }
+                {
+                    return await IssueAndFetchAsync(
+                            csr,
+                            productInfo.ProductID,
+                            days,
+                            signingAlgorithm,
+                            "Certificate Issued")
+                        .ConfigureAwait(false);
+                }
 
                 case EnrollmentType.RenewOrReissue:
-                    {
-                        if (productInfo.ProductParameters == null ||
-                            !TryGetProductParam(productInfo.ProductParameters, "PriorCertSN", out var priorSn) ||
-                            string.IsNullOrWhiteSpace(priorSn))
-                            return new EnrollmentResult
-                            {
-                                Status = (int)EndEntityStatus.FAILED,
-                                StatusMessage =
-                                    "Renew/Reissue requires ProductParameters['PriorCertSN'] (hex serial number)."
-                            };
-
-                        string priorRequestId;
-                        try
-                        {
-                            priorRequestId = await _certificateDataReader
-                                .GetRequestIDBySerialNumber(priorSn)
-                                .ConfigureAwait(false);
-                        }
-                        catch (Exception ex)
+                {
+                    if (productInfo.ProductParameters == null ||
+                        !TryGetProductParam(productInfo.ProductParameters, "PriorCertSN", out var priorSn) ||
+                        string.IsNullOrWhiteSpace(priorSn))
+                        return new EnrollmentResult
                         {
-                            return new EnrollmentResult
-                            {
-                                Status = (int)EndEntityStatus.FAILED,
-                                StatusMessage = $"Could not resolve PriorCertSN to request id: {ex.Message}"
-                            };
-                        }
-
-                        var expiration = _certificateDataReader.GetExpirationDateByRequestId(priorRequestId);
-                        var isRenewal = expiration.HasValue && expiration.Value.ToUniversalTime() <= DateTime.UtcNow;
+                            Status = (int)EndEntityStatus.FAILED,
+                            StatusMessage =
+                                "Renew/Reissue requires ProductParameters['PriorCertSN'] (hex serial number)."
+                        };
 
-                        var msg = isRenewal ? "Certificate Renewed" : "Certificate Reissued";
-                        var token = BuildIdempotencyToken(isRenewal ? "renew" : "reissue", priorRequestId, csr);
-
-                        // Still "IssueCertificate" under the hood; PCA doesn't have first-class renew/reissue.
-                        return await IssueAndFetchAsync(
-                                csr,
-                                productInfo.ProductID,
-                                days,
-                                msg,
-                                // Optional: stable-ish idempotency (helps avoid duplicates if caller retries quickly)
-                                token)
+                    string priorRequestId;
+                    try
+                    {
+                        priorRequestId = await _certificateDataReader
+                            .GetRequestIDBySerialNumber(priorSn)
                             .ConfigureAwait(false);
                     }
+                    catch (Exception ex)
+                    {
+                        return new EnrollmentResult
+                        {
+                            Status = (int)EndEntityStatus.FAILED,
+                            StatusMessage = $"Could not resolve PriorCertSN to request id: {ex.Message}"
+                        };
+                    }
+
+                    var expiration = _certificateDataReader.GetExpirationDateByRequestId(priorRequestId);
+                    var isRenewal = expiration.HasValue && expiration.Value.ToUniversalTime() <= DateTime.UtcNow;
+
+                    var msg = isRenewal ? "Certificate Renewed" : "Certificate Reissued";
+                    var token = BuildIdempotencyToken(isRenewal ? "renew" : "reissue", priorRequestId, csr);
+
+                    // Still "IssueCertificate" under the hood; PCA doesn't have first-class renew/reissue.
+                    return await IssueAndFetchAsync(
+                            csr,
+                            productInfo.ProductID,
+                            days,
+                            msg,
+                            // Optional: stable-ish idempotency (helps avoid duplicates if caller retries quickly)
+                            token)
+                        .ConfigureAwait(false);
+                }
 
                 default:
                     return new EnrollmentResult
@@ -685,7 +685,7 @@ public Dictionary<string, PropertyConfigInfo> GetCAConnectorAnnotations()
                 DefaultValue = "",
                 Type = "String"
             },
-            [Constants.Enabled] = new()
+            [Constants.Enabled] = new ()
             {
                 Comments = "Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available.",
                 Hidden = false,
diff --git a/aws-pca-caplugin/AWSPCACAPlugin.csproj b/aws-pca-caplugin/AWSPCACAPlugin.csproj
@@ -13,14 +13,13 @@
 
 
 	<Target Name="CustomPostBuild" AfterTargets="PostBuildEvent">
-		<Exec Condition="'$(Configuration)'=='DebugAndPush'"
-		      Command="PowerShell -ExecutionPolicy Bypass -File &quot;C:\Users\mkachkaev\source\repos\scripts\SyncScriptAWS_GT.ps1&quot;&#xA;" />
+		<Exec Condition="'$(Configuration)'=='DebugAndPush'" Command="PowerShell -ExecutionPolicy Bypass -File &quot;C:\Users\mkachkaev\source\scripts\SyncScriptAWS_GT.ps1&quot;&#xA;" />
 	</Target>
 
 
 	<ItemGroup Condition="'$(TargetFramework)' == 'net8.0'">
-		<PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.1.0" />
-		<PackageReference Include="Keyfactor.PKI" Version="8.2.2" />
+		<PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.2.0" />
+		<PackageReference Include="Keyfactor.PKI" Version="8.3.1" />
 		<PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
 	</ItemGroup>
 
@@ -35,7 +34,7 @@
 		<PackageReference Include="AWSSDK.ACMPCA" Version="4.0.3.11" />
 		<PackageReference Include="AWSSDK.Core" Version="4.0.3.12" />
 		<PackageReference Include="AWSSDK.S3" Version="4.0.18.3" />
-		<PackageReference Include="Keyfactor.Common" Version="2.9.0" />
+		<PackageReference Include="Keyfactor.Common" Version="2.11.0" />
 		<PackageReference Include="Keyfactor.Extensions.Aws.Auth" Version="0.5.1" />
 		<PackageReference Include="Keyfactor.Logging" Version="1.3.0" />
 	</ItemGroup>
diff --git a/aws-pca-caplugin/Client/ACMPCAClient.cs b/aws-pca-caplugin/Client/ACMPCAClient.cs
@@ -39,6 +39,7 @@ public sealed class AwsPcaClient : IAwsPcaClient
     private const string ENHANCED_KEY_USAGE_OID = "2.5.29.37";
     private const string SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
     private const string CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
+    private const string CODE_SIGNING_OID = "1.3.6.1.5.5.7.3.3";
 
     private readonly SemaphoreSlim _caInfoLock = new(1, 1);
     private readonly AWSCredentials AwsCredentials;
@@ -60,7 +61,6 @@ public AwsPcaClient(IAnyCAPluginConfigProvider configProvider)
             throw new ArgumentNullException(nameof(configProvider),
                 "Config provider and CAConnectionData are required.");
 
-
         var enabled = bool.Parse(GetRequiredString(configProvider, "Enabled"));
         if (!enabled)
         {
@@ -145,12 +145,29 @@ public async Task<IssueCertificateResponse> SubmitIssueCertificateAsync(
             if (signingAlgoRes.Error != null)
                 return new IssueCertificateResponse { RegistrationError = signingAlgoRes.Error };
 
+            // Map the requested ProductId to its AWS PCA template ARN. Without this,
+            // PCA falls back to EndEntityCertificate/V1 and every cert gets the default
+            // Server+Client Auth EKU combination regardless of the selected product.
+            if (string.IsNullOrWhiteSpace(request.ProductId) ||
+                !Constants.TemplateARNs.TryGetValue(request.ProductId, out var templateArn))
+                return new IssueCertificateResponse
+                {
+                    RegistrationError = new RegistrationError
+                    {
+                        Description = string.IsNullOrWhiteSpace(request.ProductId)
+                            ? "ProductId is required to resolve the AWS PCA template ARN."
+                            : $"Unsupported ProductId '{request.ProductId}'. Supported: {string.Join(", ", Constants.TemplateARNs.Keys)}",
+                        ErrorCode = "InvalidRequest"
+                    }
+                };
+
             var signingAlgorithm = signingAlgoRes.Value!;
             var issueReq = new Amazon.ACMPCA.Model.IssueCertificateRequest
             {
                 CertificateAuthorityArn = CaArn,
                 Csr = new MemoryStream(Encoding.ASCII.GetBytes(csrBytes)),
                 SigningAlgorithm = signingAlgorithm,
+                TemplateArn = templateArn,
                 IdempotencyToken = request.IdempotencyToken ?? Guid.NewGuid().ToString("N"),
                 Validity = new Validity
                 {
@@ -554,14 +571,14 @@ private static string Wrap64(string b64)
 
     /// <summary>
     ///     Infers one of the supported template type keys:
-    ///     EndEntity, EndEntityClientAuth, EndEntityServerAuth.
+    ///     EndEntity, EndEntityClientAuth, EndEntityServerAuth, CodeSigning.
     ///     Returns "Unknown" if certificate parsing/inspection fails.
     /// </summary>
     public static string InferTemplateTypeKey(X509Certificate2 cert)
     {
         try
         {
-            bool server = false, client = false;
+            bool server = false, client = false, codeSigning = false;
 
             // Find EKU extension (do not rely on indexer throwing)
             var eku = cert.Extensions
@@ -574,8 +591,11 @@ public static string InferTemplateTypeKey(X509Certificate2 cert)
                         server = true;
                     else if (string.Equals(usage.Value, CLIENT_AUTH_OID, StringComparison.Ordinal))
                         client = true;
+                    else if (string.Equals(usage.Value, CODE_SIGNING_OID, StringComparison.Ordinal))
+                        codeSigning = true;
 
             // Map to your known keys
+            if (codeSigning && !server && !client) return "CodeSigning";
             if (server && !client) return "EndEntityServerAuth";
             if (client && !server) return "EndEntityClientAuth";
 
@@ -761,4 +781,4 @@ private static class ConfigKeys
         public const string Region = "Region";
         public const string S3Bucket = "S3Bucket";
     }
-}
+}
diff --git a/aws-pca-caplugin/Constants.cs b/aws-pca-caplugin/Constants.cs
@@ -22,6 +22,10 @@ public static class Constants
         {
             "EndEntityServerAuth",
             "arn:aws:acm-pca:::template/EndEntityServerAuthCertificate/V1"
+        },
+        {
+            "CodeSigning",
+            "arn:aws:acm-pca:::template/CodeSigningCertificate/V1"
         }
     };
 
diff --git a/docsource/configuration.md b/docsource/configuration.md
@@ -13,11 +13,6 @@ Download the **PCA root certificate** from AWS and have it ready to import into
 The CAPlugin currently supports **one** authentication method: **AWS Access Key ID + Secret Access Key**.  
 **OAuth** and **Default SDK authentication** will be enabled in later updates. There is functionality present via the **Keyfactor AWS Authentication** library, but these alternate methods are currently ***untested***.
 
-### Known Issues
-
-At present, a fresh install of Keyfactor Command 24.4 used in conjuction with Keyfactor Gateway REST 25.4.0.0 is confirmed as working.  A fresh install of Command 25.3 used with REST 25.4.0.0 is also confirmed as working.
-Latest version of Command 25.4 may run into issues, investigation into compatibility issues is ongoing. 
-
 ### What you need ready
 
 Before configuring the CAPlugin, have the following prepared:
diff --git a/integration-manifest.json b/integration-manifest.json
@@ -95,7 +95,8 @@
             "product_ids": [
                 "EndEntity",
                 "EndEntityClientAuth",
-                "EndEntityServerAuth"
+                "EndEntityServerAuth",
+                "CodeSigning"
             ]
         }
     }

Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,10 @@ public static class Constants`
`22`	`22`	`{`
`23`	`23`	`"EndEntityServerAuth",`
`24`	`24`	`"arn:aws:acm-pca:::template/EndEntityServerAuthCertificate/V1"`
	`25`	`+ },`
	`26`	`+ {`
	`27`	`+ "CodeSigning",`
	`28`	`+ "arn:aws:acm-pca:::template/CodeSigningCertificate/V1"`
`25`	`29`	`}`
`26`	`30`	`};`
`27`	`31`
Original file line number	Diff line number	Diff line change
`@@ -95,7 +95,8 @@`
`95`	`95`	`"product_ids": [`
`96`	`96`	`"EndEntity",`
`97`	`97`	`"EndEntityClientAuth",`
`98`		`- "EndEntityServerAuth"`
	`98`	`+ "EndEntityServerAuth",`
	`99`	`+ "CodeSigning"`
`99`	`100`	`]`
`100`	`101`	`}`
`101`	`102`	`}`