Skip to content

Commit c22225c

Browse files
indroradgaleyKeyfactorspbsoluble
authored
Merge to main (#53)
* fix for smime profile type * template parameter to include client auth eku * Update generated docs * changelog and logging * check for duplicate PEMs * change default start sync date for first incremental sync * removing caching of product type list * change default incremental sync range * version * changelog * shorten incremental sync if it is too long * add duplicate support * Update generated docs * feat: release v2.2.0 * add duplicate support * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * treat needs_approval the same as pending on enrollments and don't return failure code * Update generated docs * Dev 2.2 (#47) * add duplicate support * Update generated docs * treat needs_approval the same as pending on enrollments and don't return failure code * Update generated docs --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * add option for kdc/smartcardlogon eku, fix template validation * Update generated docs * changelog --------- Co-authored-by: David Galey <dgaley@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Dave Galey <89407235+dgaley@users.noreply.github.com> Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com>
1 parent 66a1c20 commit c22225c

5 files changed

Lines changed: 54 additions & 10 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,3 +27,6 @@
2727

2828
### 2.2.1
2929
* Properly mark 'needs_approval' status as Pending rather than Failed
30+
31+
### 2.3.0
32+
* Add configuration flag to support adding KDC/SmartCardLogon EKU to ssl cert requests

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,8 @@ An API Key within your Digicert account that has the necessary permissions to en
106106
* **Organization-Name** - OPTIONAL: For requests that will not have a subject (such as ACME) you can use this field to provide the organization name. Value supplied here will override any CSR values, so do not include this field if you want the organization from the CSR to be used.
107107
* **RenewalWindowDays** - OPTIONAL: The number of days from certificate expiration that the gateway should do a renewal rather than a reissue. If not provided, default is 90.
108108
* **CertType** - OPTIONAL: The type of cert to enroll for. Valid values are 'ssl' and 'client'. The value provided here must be consistant with the ProductID. If not provided, default is 'ssl'. Ignored for secure_email_* product types.
109-
* **IncludeClientAuthEKU** - OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in May 2026.
109+
* **IncludeClientAuthEKU** - OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in March 2027.
110+
* **IncludeKDCSmartCardLogonEKU** - OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the KDC/SmartCardLogon EKU added to the request.
110111
* **EnrollDivisionId** - OPTIONAL: The division (container) ID to use for enrollments against this template.
111112
* **CommonNameIndicator** - Required for secure_email_sponsor and secure_email_organization products, ignored otherwise. Defines the source of the common name. Valid values are: email_address, given_name_surname, pseudonym, organization_name
112113
* **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.

‎digicert-certcentral-caplugin/CertCentralCAPlugin.cs‎

Lines changed: 43 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -299,10 +299,23 @@ public async Task<EnrollmentResult> Enroll(string csr, string subject, Dictionar
299299
string priorCertSnString = null;
300300
string priorCertReqID = null;
301301

302-
if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
302+
if (typeOfCert.Equals("ssl"))
303303
{
304-
orderRequest.Certificate.ProfileOption = "server_client_auth_eku";
305-
_logger.LogWarning($"{CertCentralConstants.Config.INCLUDE_CLIENT_AUTH}: Ability to include client auth EKU in SSL certs is currently planned to cease in May 2026. Make sure any workflows that depend on this feature are updated before then to avoid interruptions.");
304+
bool clientAuth = Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]);
305+
bool kdc = Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_KDC]);
306+
if (clientAuth && kdc)
307+
{
308+
throw new Exception($"Cannot enroll for cert with both Client Auth and KDC/SmartCardLogon EKU set to 'true'");
309+
}
310+
if (clientAuth)
311+
{
312+
orderRequest.Certificate.ProfileOption = "server_client_auth_eku";
313+
_logger.LogWarning($"{CertCentralConstants.Config.INCLUDE_CLIENT_AUTH}: Ability to include client auth EKU in SSL certs is currently planned to cease in March 2027. Make sure any workflows that depend on this feature are updated before then to avoid interruptions.");
314+
}
315+
else if (kdc)
316+
{
317+
orderRequest.Certificate.ProfileOption = "kdc_smart_card";
318+
}
306319
}
307320

308321
bool dupe = false;
@@ -620,7 +633,14 @@ public Dictionary<string, PropertyConfigInfo> GetTemplateParameterAnnotations()
620633
},
621634
[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH] = new PropertyConfigInfo()
622635
{
623-
Comments = "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in May 2026.",
636+
Comments = "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in March 2027.",
637+
Hidden = false,
638+
DefaultValue = false,
639+
Type = "Boolean"
640+
},
641+
[CertCentralConstants.Config.INCLUDE_KDC] = new PropertyConfigInfo()
642+
{
643+
Comments = "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the KDC/SmartCardLogon EKU added to the request.",
624644
Hidden = false,
625645
DefaultValue = false,
626646
Type = "Boolean"
@@ -1068,9 +1088,9 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction
10681088
CertificateTypeDetailsRequest detailsRequest = new CertificateTypeDetailsRequest(product.NameId);
10691089

10701090
detailsRequest.ContainerId = null;
1071-
if (connectionInfo.ContainsKey(CertCentralConstants.Config.DIVISION_ID))
1091+
if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.ENROLL_DIVISION_ID))
10721092
{
1073-
string div = connectionInfo[CertCentralConstants.Config.DIVISION_ID].ToString();
1093+
string div = productInfo.ProductParameters[CertCentralConstants.Config.ENROLL_DIVISION_ID].ToString();
10741094
if (!string.IsNullOrWhiteSpace(div))
10751095
{
10761096
if (int.TryParse($"{div}", out int divId))
@@ -1092,15 +1112,30 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction
10921112

10931113
if (!Constants.ProductTypes.SMIME_CERT.Contains(productInfo.ProductID, StringComparer.OrdinalIgnoreCase))
10941114
{
1095-
if (connectionInfo.ContainsKey(CertCentralConstants.Config.CERT_TYPE))
1115+
if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.CERT_TYPE))
10961116
{
1097-
var typeOfCert = (string)connectionInfo[CertCentralConstants.Config.CERT_TYPE];
1117+
var typeOfCert = (string)productInfo.ProductParameters[CertCentralConstants.Config.CERT_TYPE];
10981118
if (!(typeOfCert.Equals("ssl") || typeOfCert.Equals("client")))
10991119
{
11001120
throw new AnyCAValidationException("Invalid Cert Type specified. Valid options are 'ssl' or 'client'");
11011121
}
11021122
}
11031123
}
1124+
1125+
bool clientAuth = false, kdc = false;
1126+
if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.INCLUDE_CLIENT_AUTH))
1127+
{
1128+
clientAuth = Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]);
1129+
}
1130+
if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.INCLUDE_KDC))
1131+
{
1132+
kdc = Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_KDC]);
1133+
}
1134+
if (clientAuth && kdc)
1135+
{
1136+
throw new AnyCAValidationException($"Unable to use both {CertCentralConstants.Config.INCLUDE_CLIENT_AUTH} and {CertCentralConstants.Config.INCLUDE_KDC} in the same certificate.");
1137+
}
1138+
11041139
_logger.MethodExit(LogLevel.Trace);
11051140
}
11061141

‎digicert-certcentral-caplugin/Constants.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ public class Config
3434
public const string SYNC_EXPIRATION_DAYS = "SyncExpirationDays";
3535
public const string CERT_TYPE = "CertType";
3636
public const string INCLUDE_CLIENT_AUTH = "IncludeClientAuthEKU";
37+
public const string INCLUDE_KDC = "IncludeKDCSmartCardLogonEKU";
3738
public const string ENROLL_DIVISION_ID = "EnrollDivisionId";
3839
public const string COMMON_NAME_INDICATOR = "CommonNameIndicator";
3940
public const string PROFILE_TYPE = "ProfileType";

‎integration-manifest.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,11 @@
7474
},
7575
{
7676
"name": "IncludeClientAuthEKU",
77-
"description": "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in May 2026."
77+
"description": "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the Client Authentication EKU added to the request. NOTE: This feature is currently planned to be removed by DigiCert in March 2027."
78+
},
79+
{
80+
"name": "IncludeKDCSmartCardLogonEKU",
81+
"description": "OPTIONAL for SSL certs, ignored otherwise. If set to 'true', SSL certs enrolled under this template will have the KDC/SmartCardLogon EKU added to the request."
7882
},
7983
{
8084
"name": "EnrollDivisionId",

0 commit comments

Comments
 (0)