test(dcv): classify CA rejection — unsupported algorithm vs out-of-credits

First live run of the algorithm matrix skipped all 10: the supported algos
(RSA 2048/3072/4096, ECC P-256/P-384) failed on 'Insufficient Credits' while
the rest returned 'Invalid key size' / 'Something went Wrong'. The old Skip text
called every rejection 'likely an unsupported key algorithm', which is wrong for
the credit-blocked supported ones. Add KeyAlgorithms.ClassifyRejection so the
Skip reason distinguishes an unsupported algorithm from an account/credit
limitation, and report the CA's verbatim message either way.

Author: spbsoluble

CERTInext.IntegrationTests/AlgorithmMatrixTests.cs

@@ -161,13 +161,12 @@ public async Task Enroll_AcceptsKeyAlgorithm(string tag)
             }
             catch (Exception ex)
             {
-                // Per agreed scope: a CA-side rejection (algorithm not supported, or other
-                // account/provisioning gap) becomes an explicit Skip carrying the CA's message,
-                // so the matrix documents real CERTInext support without a hard failure.
-                _output.WriteLine($"[SKIP] {tag}: CERTInext rejected submission — {ex.Message}");
-                Skip.If(true,
-                    $"CERTInext did not accept a {tag} order. This may be an unsupported key algorithm " +
-                    $"or an account/provisioning limitation. CA message: {ex.Message}");
+                // Per agreed scope: a CA-side rejection becomes an explicit Skip carrying the CA's
+                // message (classified so an unsupported algorithm isn't confused with a credit/
+                // account limitation), so the matrix documents real CERTInext support honestly.
+                string reason = KeyAlgorithms.ClassifyRejection(ex.Message);
+                _output.WriteLine($"[SKIP] {tag}: {reason} — {ex.Message}");
+                Skip.If(true, $"CERTInext did not accept a {tag} order: {reason}. CA message: {ex.Message}");
             }
 
             enrollResult.Should().NotBeNull($"{tag}: Enroll must return a non-null result when accepted");

CERTInext.IntegrationTests/DcvLifecycleTests.cs

@@ -415,8 +415,9 @@ public async Task EnrollWithDcvOn_IssuesPerKeyAlgorithm(string tag)
             }
             catch (Exception ex)
             {
-                _output.WriteLine($"[SKIP] {tag}: CERTInext rejected the DV order at submission — {ex.Message}");
-                Skip.If(true, $"CERTInext did not accept a {tag} DV order (likely an unsupported key algorithm). CA message: {ex.Message}");
+                string reason = KeyAlgorithms.ClassifyRejection(ex.Message);
+                _output.WriteLine($"[SKIP] {tag}: {reason} — {ex.Message}");
+                Skip.If(true, $"CERTInext did not issue a {tag} cert: {reason}. CA message: {ex.Message}");
                 return; // unreachable — Skip throws
             }
 

CERTInext.IntegrationTests/KeyAlgorithms.cs

@@ -115,5 +115,23 @@ public static byte[] DerFromPem(string pem)
 
         /// <summary>A filesystem/DNS-safe slug for a tag, e.g. "ECDSA-P256" → "ecdsap256".</summary>
         public static string Slug(string tag) => tag.ToLowerInvariant().Replace("-", string.Empty);
+
+        /// <summary>
+        /// Classifies a CERTInext order-rejection message so the algorithm matrix doesn't
+        /// conflate "this key algorithm is unsupported" with "the account can't place orders
+        /// right now". CERTInext's live envelope (observed): RSA 2048/3072/4096 + ECC P-256/P-384
+        /// are accepted; larger RSA, P-521, and the Ed* curves return "Invalid key size" /
+        /// "Something went Wrong". A credit shortfall returns "Insufficient Credits" regardless
+        /// of algorithm.
+        /// </summary>
+        public static string ClassifyRejection(string caMessage)
+        {
+            caMessage ??= string.Empty;
+            if (caMessage.IndexOf("Invalid key size", StringComparison.OrdinalIgnoreCase) >= 0)
+                return "key algorithm/size not supported by CERTInext";
+            if (caMessage.IndexOf("Insufficient Credits", StringComparison.OrdinalIgnoreCase) >= 0)
+                return "CERTInext account is out of credits — algorithm support was not exercised";
+            return "rejected by CERTInext";
+        }
     }
 }