Dev 2.1 by dgaley · Pull Request #32 · Keyfactor/digicert-certcentral-caplugin

dgaley · 2025-10-08T18:22:01Z

No description provided.

Hotfix

Copilot

Pull Request Overview

Introduce v2.1.1 changes to the DigiCert CertCentral CA plugin, adding an option to include the Client Auth EKU for SSL requests and refining S/MIME profile handling.

Add IncludeClientAuthEKU template parameter and map it to DigiCert profile_option for SSL orders
For S/MIME, only set ProfileType when provided; otherwise rely on product default
Version bump to 2.1.1, minor data type conversion fix, and documentation updates

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
integration-manifest.json	Adds IncludeClientAuthEKU parameter and updates ProfileType description to clarify defaults and multipurpose use.
digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj	Bumps AssemblyVersion/FileVersion to 2.1.1.
digicert-certcentral-caplugin/Constants.cs	Adds constant for IncludeClientAuthEKU.
digicert-certcentral-caplugin/CertCentralCAPlugin.cs	Implements IncludeClientAuthEKU behavior, refines S/MIME profile handling, and improves division ID parsing.
digicert-certcentral-caplugin/API/OrderCertificate.cs	Adds ProfileOption field serialized as profile_option.
README.md	Documents IncludeClientAuthEKU and updates ProfileType guidance.
CHANGELOG.md	Adds 2.1.1 entry describing new flag, S/MIME default behavior, and hotfix.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-15T16:00:55Z

+			if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
+			{


This indexer will throw if the INCLUDE_CLIENT_AUTH key is not present in ProductParameters, and the comparison to 'ssl' is case-sensitive. Guard the lookup and use a case-insensitive comparison, e.g., string.Equals(typeOfCert, "ssl", StringComparison.OrdinalIgnoreCase) and compute includeClientAuth via TryGetValue/Convert.ToBoolean with a false default.

Suggested change

if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))

{

bool includeClientAuth = false;

if (productInfo.ProductParameters.TryGetValue(CertCentralConstants.Config.INCLUDE_CLIENT_AUTH, out var includeClientAuthValue) && !string.IsNullOrEmpty(includeClientAuthValue))

{

includeClientAuth = Convert.ToBoolean(includeClientAuthValue);

}

if (string.Equals(typeOfCert, "ssl", StringComparison.OrdinalIgnoreCase) && includeClientAuth)

{

Copilot · 2025-10-15T16:00:56Z


+			if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
+			{
+				orderRequest.Certificate.ProfileOption = "server_client_auth_eku";


Avoid the magic string for the profile option; define a named constant (e.g., CertCentralConstants.ProfileOptions.ServerClientAuthEku) to prevent typos and ease reuse.

Suggested change

orderRequest.Certificate.ProfileOption = "server_client_auth_eku";

orderRequest.Certificate.ProfileOption = CertCentralConstants.ProfileOptions.ServerClientAuthEku;

Copilot · 2025-10-15T16:00:56Z

 				[CertCentralConstants.Config.PROFILE_TYPE] = new PropertyConfigInfo()
 				{
-					Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Default value is strict.",
+					Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.",


Standardize vendor capitalization to 'DigiCert'.

Suggested change

Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.",

Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within DigiCert portal.",

Copilot · 2025-10-15T16:00:56Z

    * **EnrollDivisionId** - OPTIONAL: The division (container) ID to use for enrollments against this template. 
    * **CommonNameIndicator** - Required for secure_email_sponsor and secure_email_organization products, ignored otherwise. Defines the source of the common name. Valid values are: email_address, given_name_surname, pseudonym, organization_name 
-    * **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Default value is strict. 
+    * **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal. 


Standardize vendor capitalization to 'DigiCert'.

Suggested change

* **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.

* **ProfileType** - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within DigiCert portal.

Copilot · 2025-10-15T16:00:57Z

+
+### 2.1.1  
+* Add configuration flag to support adding client auth EKU to ssl cert requests  
+	* NOTE: This is a temporary feature which is planned for loss of support by Digicert in May 2026   


Standardize vendor capitalization to 'DigiCert'.

Suggested change

* NOTE: This is a temporary feature which is planned for loss of support by Digicert in May 2026

* NOTE: This is a temporary feature which is planned for loss of support by DigiCert in May 2026

dgaley and others added 7 commits October 8, 2025 11:29

fix for smime profile type

52eee75

template parameter to include client auth eku

70fe240

Update generated docs

f9e1564

Merge pull request #31 from Keyfactor/hotfix

516d230

Hotfix

changelog and logging

844a7e1

Merge branch 'hotfix' of https://github.com/Keyfactor/digicert-certce…

b0819c4

…ntral-caplugin into hotfix

Merge pull request #34 from Keyfactor/hotfix

db730d5

Hotfix

spbsoluble requested a review from Copilot October 15, 2025 15:58

Copilot AI reviewed Oct 15, 2025

View reviewed changes

spbsoluble merged commit aceca2d into release-2.1 Oct 20, 2025
53 of 56 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Dev 2.1#32

Dev 2.1#32
spbsoluble merged 7 commits into
release-2.1from
dev-2.1

dgaley commented Oct 8, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Oct 15, 2025

Uh oh!

Copilot AI Oct 15, 2025

Uh oh!

Copilot AI Oct 15, 2025

Uh oh!

Copilot AI Oct 15, 2025

Uh oh!

Copilot AI Oct 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
		{

-			if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
-			{
+			bool includeClientAuth = false;
+			if (productInfo.ProductParameters.TryGetValue(CertCentralConstants.Config.INCLUDE_CLIENT_AUTH, out var includeClientAuthValue) && !string.IsNullOrEmpty(includeClientAuthValue))
+			{
+				includeClientAuth = Convert.ToBoolean(includeClientAuthValue);
+			}
+			if (string.Equals(typeOfCert, "ssl", StringComparison.OrdinalIgnoreCase) && includeClientAuth)
+			{

	orderRequest.Certificate.ProfileOption = "server_client_auth_eku";
	orderRequest.Certificate.ProfileOption = CertCentralConstants.ProfileOptions.ServerClientAuthEku;

	Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.",
	Comments = "Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within DigiCert portal.",

	* ProfileType - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within Digicert portal.
	* ProfileType - Optional for secure_email_* types, ignored otherwise. Valid values are: strict, multipurpose. Use 'multipurpose' if your cert includes any additional EKUs such as client auth. Default if not provided is dependent on product configuration within DigiCert portal.

	* NOTE: This is a temporary feature which is planned for loss of support by Digicert in May 2026
	* NOTE: This is a temporary feature which is planned for loss of support by DigiCert in May 2026

Conversation

dgaley commented Oct 8, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants