feat(dcv): DNS domain control validation via IDomainValidatorFactory

[spbsoluble]

Summary

• Add DNS-based Domain Control Validation (DCV) support via IDomainValidatorFactory constructor injection, enabling the gateway's installed DNS provider plugins (e.g. azure-azuredns-dnsplugin, aws-route53-dnsplugin) to handle TXT record publishing during enrollment
• Add GetDcv / VerifyDcv API client methods and corresponding request/response DTOs
• Add DcvEnabled, DcvTxtRecordTemplate, and DcvPropagationDelaySeconds connector config fields (opt-in; default off)
• Bump Keyfactor.AnyGateway.IAnyCAPlugin to 3.3.0-PRERELEASE-78770-979f582005 (required for IDomainValidatorFactory)

Changes

Commit	Description
4181e4b	feat(constants) — Constants.Dcv (method codes, status codes, default TXT template) and Config DCV key names
94bc2d7	feat(api) — GetDcvRequest, VerifyDcvRequest, GetDcvResponse, VerifyDcvResponse, TrackOrderDomainVerification DTOs
ea1fdd2	feat(client) — GetDcvAsync and VerifyDcvAsync in ICERTInextClient / CERTInextClient
b2ea1c3	feat(config) — DcvEnabled, DcvTxtRecordTemplate, DcvPropagationDelaySeconds in CERTInextConfig and CA connector annotations
ef4c728	feat(enroll) — IDomainValidatorFactory constructor injection; PerformDcvIfNeededAsync; EnrollNewAsync DCV path
ef692b2	test(client) — 7 WireMock unit tests for GetDcvAsync / VerifyDcvAsync
1251258	chore(scripts) — scripts/get-dcv.sh, scripts/verify-dcv.sh, make get-dcv / make verify-dcv targets

DCV flow

PlaceOrder
  └─ TrackOrder → read domainVerification entries
       └─ for each domain where dcvStatus=0 and dcvMethod=1:
            ├─ GetDcv          → fetch TXT token from CERTInext
            ├─ ResolveDomainValidator(domain, "dns-01")
            ├─ StageValidation(hostname, token)
            └─ [propagation delay]
                 ├─ VerifyDcv  → ask CERTInext to check the record
                 └─ CleanupValidation(hostname)  ← always, in finally
  └─ GetCertificate → return post-DCV result

Key invariant: DCV is skipped entirely when the order is already in a terminal (issued/revoked) state. A completed order never triggers DNS validation.

Test plan

• dotnet build — 0 errors, 0 warnings on both CERTInext and CERTInext.Tests
• dotnet test — 111/111 passing (7 new DCV tests)
• SOX/SOC2 compliance audit completed; 7 of 8 findings remediated (shell injection prevention, CancellationToken threading, FQDN input validation, audit log completeness)
• Manual DV SSL order smoke test against sandbox (blocked — no live DV order available; DCV path exercised via WireMock)

🤖 Generated with Claude Code