Skip to content

Commit 5e15a5d

Browse files
spbsolublespbsoluble
authored
Merge pull request #30 from Keyfactor/release-2.1
Release 2.1.0
2 parents 8c9572e + b2bc4a3 commit 5e15a5d

17 files changed

Lines changed: 1056 additions & 140 deletions

‎.github/workflows/keyfactor-bootstrap-workflow.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,9 @@ on:
1111

1212
jobs:
1313
call-starter-workflow:
14-
uses: keyfactor/actions/.github/workflows/starter.yml@v2
14+
uses: keyfactor/actions/.github/workflows/starter.yml@v4
1515
secrets:
1616
token: ${{ secrets.V2BUILDTOKEN}}
17-
APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
17+
scan_token: ${{ secrets.SAST_TOKEN }}
1818
gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
1919
gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}

‎CHANGELOG.md‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
1-
### 2.0.0
2-
* Initial Public Release
1+
### 2.0.0
2+
* Initial Public Release
33

4-
### 2.0.1
5-
* Add configuration fields to support sync filtering
6-
* Bug fixes around SAN processing
4+
### 2.0.1
5+
* Add configuration fields to support sync filtering
6+
* Bug fixes around SAN processing
7+
8+
### 2.1.0
9+
* Add support for enrolling for client certs
10+
* Option to filter sync by division ID
11+
* Option to provide division ID for enrollment
12+
* Add support for secure_email_* SMIME product types

‎README.md‎

Lines changed: 99 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,125 @@
1+
<h1 align="center" style="border-bottom: none">
2+
DigiCert CertCentral Gateway AnyCA Gateway REST Plugin
3+
</h1>
4+
5+
<p align="center">
6+
<!-- Badges -->
7+
<img src="https://img.shields.io/badge/integration_status-production-3D1973?style=flat-square" alt="Integration Status: production" />
8+
<a href="https://github.com/Keyfactor/digicert-certcentral-caplugin/releases"><img src="https://img.shields.io/github/v/release/Keyfactor/digicert-certcentral-caplugin?style=flat-square" alt="Release" /></a>
9+
<img src="https://img.shields.io/github/issues/Keyfactor/digicert-certcentral-caplugin?style=flat-square" alt="Issues" />
10+
<img src="https://img.shields.io/github/downloads/Keyfactor/digicert-certcentral-caplugin/total?style=flat-square&label=downloads&color=28B905" alt="GitHub Downloads (all assets, all releases)" />
11+
</p>
12+
13+
<p align="center">
14+
<!-- TOC -->
15+
<a href="#support">
16+
<b>Support</b>
17+
</a>
18+
·
19+
<a href="#requirements">
20+
<b>Requirements</b>
21+
</a>
22+
·
23+
<a href="#installation">
24+
<b>Installation</b>
25+
</a>
26+
·
27+
<a href="#license">
28+
<b>License</b>
29+
</a>
30+
·
31+
<a href="https://github.com/orgs/Keyfactor/repositories?q=anycagateway">
32+
<b>Related Integrations</b>
33+
</a>
34+
</p>
35+
36+
37+
The Digicert CertCentral AnyCA REST plugin extends the capabilities of Digicert's CertCentral product to Keyfactor Command via the Keyfactor AnyCA Gateway REST. The plugin represents a fully featured AnyCA REST Plugin with the following capabilies:
38+
* SSL Certificate Synchronization
39+
* SSL Certificate Enrollment
40+
* SSL Certificate Revocation
41+
42+
## Compatibility
43+
44+
The DigiCert CertCentral Gateway AnyCA Gateway REST plugin is compatible with the Keyfactor AnyCA Gateway REST 24.2.0 and later.
45+
46+
## Support
47+
The DigiCert CertCentral Gateway AnyCA Gateway REST plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket with your Keyfactor representative. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com.
48+
49+
> To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
50+
51+
## Requirements
52+
53+
An API Key within your Digicert account that has the necessary permissions to enroll, approve, and revoke certificates.
154

2-
# DigiCert CertCentral AnyCA REST Gateway Plugin
3-
4-
DigiCert CertCentral plugin for the AnyCA REST Gateway framework
5-
6-
#### Integration status: Production - Ready for use in production environments.
7-
8-
## About the Keyfactor
9-
10-
11-
12-
## Support for DigiCert CertCentral AnyCA REST Gateway Plugin
55+
## Installation
1356

14-
DigiCert CertCentral AnyCA REST Gateway Plugin is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com
57+
1. Install the AnyCA Gateway REST per the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/InstallIntroduction.htm).
1558

16-
###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
59+
2. On the server hosting the AnyCA Gateway REST, download and unzip the latest [DigiCert CertCentral Gateway AnyCA Gateway REST plugin](https://github.com/Keyfactor/digicert-certcentral-caplugin/releases/latest) from GitHub.
1760

18-
---
61+
3. Copy the unzipped directory (usually called `net6.0` or `net8.0`) to the Extensions directory:
1962

2063

21-
---
64+
```shell
65+
Depending on your AnyCA Gateway REST version, copy the unzipped directory to one of the following locations:
66+
Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions
67+
Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net8.0\Extensions
68+
```
2269

70+
> The directory containing the DigiCert CertCentral Gateway AnyCA Gateway REST plugin DLLs (`net6.0` or `net8.0`) can be named anything, as long as it is unique within the `Extensions` directory.
2371

72+
4. Restart the AnyCA Gateway REST service.
2473

25-

26-
# Introduction
74+
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the DigiCert CertCentral Gateway plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal.
2775

28-
This AnyCA REST Gateway plug-in enables issuance, revocation, and synchronization of certificates from DigiCert's CertCentral offering.
29-
# Prerequisites
76+
## Configuration
3077

31-
## Prerequisite: Certificate Chain
78+
1. Follow the [official AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm) to define a new Certificate Authority, and use the notes below to configure the **Gateway Registration** and **CA Connection** tabs:
3279

33-
In order to request certificates from the Keyfactor AnyGateway, the Keyfactor Command server must trust the certificate chain of trust. To ensure trust is established, download your Root and/or Subordinate CA certificates from DigiCert and import them into the appropriate local certificate stores on the Keyfactor AnyGateway and Command servers. More information can be found in the [AnyCA Gateway REST Install Guide](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/Preparing.htm)
80+
* **Gateway Registration**
3481

35-
## Installation
36-
1. Download latest successful build from [GitHub Releases](../../releases/latest)
82+
In order to enroll for certificates the Keyfactor Command server must trust the trust chain. Once you identify your Root and/or Subordinate CA in your Digicert account, make sure to download and import the certificate chain into the Command Server certificate store
3783

38-
2. Extract the .zip file, and from it, copy DigicertCAPlugin.dll and DigicertCAPlugin.deps.json to the 'C:\Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions' directory
84+
* **CA Connection**
3985

40-
3. Within the 'C:\Program Files\Keyfactor\AnyCA Gateway\AnyGatewayREST\net6.0\Extensions\Connectors' folder, update the manifest.json file to contain the following:
86+
Populate using the configuration fields collected in the [requirements](#requirements) section.
4187

42-
```json
43-
{
44-
"extensions": {
45-
"Keyfactor.AnyGateway.Extensions.IAnyCAPlugin": {
46-
"CertCentralCAPlugin": {
47-
"assemblypath": "../DigicertCAPlugin.dll",
48-
"TypeFullName": "Keyfactor.Extensions.CAPlugin.DigiCert.CertCentralCAPlugin"
49-
}
50-
}
51-
}
52-
}
53-
```
88+
* **APIKey** - API Key for connecting to DigiCert
89+
* **DivisionId** - Division ID to use for retrieving product details (only if account is configured with per-divison product settings)
90+
* **Region** - The geographic region that your DigiCert CertCentral account is in. Valid options are US and EU.
91+
* **RevokeCertificateOnly** - Default DigiCert behavior on revocation requests is to revoke the entire order. If this value is changed to 'true', revocation requests will instead just revoke the individual certificate.
92+
* **SyncCAFilter** - If you list one or more CA IDs here (comma-separated), the sync process will only sync records from those CAs. If you want to sync all CA IDs, leave this field empty.
93+
* **SyncDivisionFilter** - If you list one or more Divison IDs (also known as Container IDs) here (comma-separated), the sync process will filter records to only return orders from those divisions. If you want to sync all divisions, leave this field empty. Note that this has no relationship to the value of the DivisionId config field.
94+
* **FilterExpiredOrders** - If set to 'true', syncing will apply a filter to not return orders that are expired for longer than specified in SyncExpirationDays.
95+
* **SyncExpirationDays** - If FilterExpiredOrders is set to true, this setting determines how many days in the past to still return expired orders. For example, a value of 30 means the sync will return any certs that expired within the past 30 days. A value of 0 means the sync will not return any certs that expired before the current day. This value is ignored if FilterExpiredOrders is false.
96+
* **Enabled** - Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available.
5497

55-
NOTE: If the Connectors folder and/or the manifest.json file do not exist, they must be manually created
98+
2. Note for SMIME product types (Secure Email types): The template configuration fields provided for those are not required to be filled out in the gateway config. Many of those values would change on a per-enrollment basis. The way to handle that is to create Enrollment fields in Command with the same name (for example: CommonNameIndicator) and then any values populated in those fields will override any static values provided in the configuration.
5699

57-
4. Restart the AnyCA Gateway service
100+
3. Follow the [official Keyfactor documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Keyfactor.htm) to add each defined Certificate Authority to Keyfactor Command and import the newly defined Certificate Templates.
58101

59-
5. Navigate to the AnyCA Gateway REST portal and verify that the Gateway recognizes the DigiCert plugin by hovering over the ⓘ symbol to the right of the Gateway on the top left of the portal. CAPlugin Type should now be listed as CertCentralCA.
102+
4. In Keyfactor Command (v12.3+), for each imported Certificate Template, follow the [official documentation](https://software.keyfactor.com/Core-OnPrem/Current/Content/ReferenceGuide/Configuring%20Template%20Options.htm) to define enrollment fields for each of the following parameters:
60103

104+
* **LifetimeDays** - OPTIONAL: The number of days of validity to use when requesting certs. If not provided, default is 365.
105+
* **CACertId** - OPTIONAL: ID of issuing CA to use by DigiCert. If not provided, the default for your account will be used.
106+
* **Organization-Name** - OPTIONAL: For requests that will not have a subject (such as ACME) you can use this field to provide the organization name. Value supplied here will override any CSR values, so do not include this field if you want the organization from the CSR to be used.
107+
* **RenewalWindowDays** - OPTIONAL: The number of days from certificate expiration that the gateway should do a renewal rather than a reissue. If not provided, default is 90.
108+
* **CertType** - OPTIONAL: The type of cert to enroll for. Valid values are 'ssl' and 'client'. The value provided here must be consistant with the ProductID. If not provided, default is 'ssl'. Ignored for secure_email_* product types.
109+
* **EnrollDivisionId** - OPTIONAL: The division (container) ID to use for enrollments against this template.
110+
* **CommonNameIndicator** - Required for secure_email_sponsor and secure_email_organization products, ignored otherwise. Defines the source of the common name. Valid values are: email_address, given_name_surname, pseudonym, organization_name
111+
* **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Default value is strict.
112+
* **FirstName** - Required for secure_email_* types if CommonNameIndicator is given_name_surname, ignored otherwise.
113+
* **LastName** - Required for secure_email_* types if CommonNameIndicator is given_name_surname, ignored otherwise.
114+
* **Pseudonym** - Required for secure_email_* types if CommonNameIndicator is pseudonym, ignored otherwise.
115+
* **UsageDesignation** - Required for secure_email_* types, ignored otherwise. The primary usage of the certificate. Valid values are: signing, key_management, dual_use
61116

62-
## Configuration
63-
64-
1. Follow the [official Keyfactor AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCA-Gateway.htm#Add_or_Edit_a_Certificate_Authority) to define a new Certificate Authority, using the following information to configure the CA Connection section:
65117

66-
SETTING | REQUIRED? | DESCRIPTION
67-
--|--|--
68-
Enabled | Yes | Enables the DigiCert gateway functionality. Should almost always be set to 'true'
69-
APIKey | Yes | The API key the Gateway should use to communicate with the DigiCert API. Can be generated from the DigiCert portal.
70-
Region | No | The geographic region associated with your DigiCert account. Valid values are US and EU. Default if not provided is US.
71-
DivisionId | No | If your CertCentral account has multiple divisions AND uses any custom per-division product settings, provide a division ID for the gateway to use for product type lookups.
72-
RevokeCertificateOnly | No | If set to 'true', revoke operations will only revoke the individual certificate in question rather than the entire DigiCert order. Default if not provided is 'false'.
73-
SyncCAFilter | No | If you list one or more DigiCert issuing CA IDs here (comma-separated if more than one), the sync process will only return certs issued by one of those CAs. Leave this option empty to sync all certs from all CAs.
74-
FilterExpiredOrders | No | If set to 'true', syncing will not return certs that are expired more than a specified number of days. The number of days is specified by the SyncExpirationDays config option. Default value is 'false'.
75-
SyncExpirationDays | No | Only used if FilterExpiredOrders is 'true', otherwise ignored. Sets the number of days a cert has to be expired for the sync process to no longer sync it. For example, a value of 30 means sync will continue to return certs that have expired within the past 30 days, but not ones older than that. Default value is 0, meaning sync would not return any certs expired before the current day.
76118

77-
2. After saving the CA configuration, Follow the [official AnyCA Gateway REST documentation](https://software.keyfactor.com/Guides/AnyCAGatewayREST/Content/AnyCAGatewayREST/AddCP-Gateway.htm#Certificate_Profile) to define one or more Certificate Profiles.
78-
3. Edit your newly configured CA, and you should now be able to modify the Templates tab. You need at least one template for each product type you wish to be able to enroll for. It is recommended to include the product type in the template name to make them easier to identify. Use the following information to configure the parameters for each template:
119+
## License
79120

80-
SETTING | REQUIRED? | DESCRIPTION
81-
--|--|--
82-
LifetimeDays | No | The number of days of validity to use when requesting certs. Default if not provided is 365. NOTE FOR RENEWALS: If the value of LifetimeDays is evenly divisible by 365, the expiration day and month of the new cert will be set to the same values as the old cert if possible, to avoid renewal date drift.
83-
CACertId | No | The ID of the issuing CA to be used by DigiCert. If not specified, the default for your account will be used.
84-
Organization-Name | No | If specified, this value will override any organization name provided in the subject of the cert request on enrollment. Useful for requests (such as ACME) that contain no subject.
85-
RenewalWindowDays | No | The number of days from expiration that the gateway should do a reissue rather than a renewal. Default if not provided is 90, meaning any renewal request for certs that expire in more than 90 days will be treated as a reissue request.
121+
Apache License 2.0, see [LICENSE](LICENSE).
86122

123+
## Related Integrations
87124

125+
See all [Keyfactor Any CA Gateways (REST)](https://github.com/orgs/Keyfactor/repositories?q=anycagateway).

‎digicert-certcentral-caplugin.sln‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,9 @@ EndProject
88
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution Items", "{A6058317-1B5E-4E7C-9669-B3A6C0E605BB}"
99
ProjectSection(SolutionItems) = preProject
1010
CHANGELOG.md = CHANGELOG.md
11+
docsource\configuration.md = docsource\configuration.md
1112
integration-manifest.json = integration-manifest.json
13+
.github\workflows\keyfactor-bootstrap-workflow.yml = .github\workflows\keyfactor-bootstrap-workflow.yml
1214
readme_source.md = readme_source.md
1315
EndProjectSection
1416
EndProject

‎digicert-certcentral-caplugin/API/ListCertificateOrders.cs‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ public ListCertificateOrdersRequest(bool ignoreExpired = false)
2929

3030
public bool ignoreExpired { get; set; }
3131
public int expiredWindow { get; set; } = 0;
32+
public string divID { get; set; } = string.Empty;
3233

3334
public new string BuildParameters()
3435
{
@@ -37,6 +38,10 @@ public ListCertificateOrdersRequest(bool ignoreExpired = false)
3738
sbParamters.Append("limit=").Append(this.limit.ToString());
3839
sbParamters.Append("&offset=").Append(HttpUtility.UrlEncode(this.offset.ToString()));
3940

41+
if (!string.IsNullOrEmpty(divID))
42+
{
43+
sbParamters.Append("&filters[container_id]=").Append(this.divID);
44+
}
4045
if (ignoreExpired)
4146
{
4247
DateTime cutoffDate = DateTime.Today.AddDays(-1 - expiredWindow);

‎digicert-certcentral-caplugin/API/OrderCertificate.cs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,9 @@ public class CertificateRequest
8484
[JsonProperty("dns_names")]
8585
public List<string> DNSNames { get; set; }
8686

87+
[JsonProperty("emails")]
88+
public List<String> Emails { get; set; }
89+
8790
[JsonProperty("csr")]
8891
public string CSR { get; set; }
8992

0 commit comments

Comments
 (0)