Skip to content

Commit 6d5721f

Browse files
fiddlermikeyKeyfactorbhillkeyfactorMichael Henderson
authored
Release 1.1 to main (#19)
* Update generated README * Add CName support (#15) * Newrel (#5) * Update SampleConfig.json * Update CreateTemplate.ps1 * Cname (#7) * Fix Meta Data Sync Issue * Syncfixes (#10) * Fixed Sync Issue that Impacts all clients * Update CHANGELOG.md * Sync Troubleshooting * Simplified Syncing process * New Templates Added * Update SampleConfig.json * Update readme_source.md * Update generated README * Update readme_source.md * Update generated README * Update readme_source.md * Update generated README * Sample Workflow * Update README.md * Update generated README * Update CHANGELOG.md * Update CHANGELOG.md * Update CHANGELOG.md --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Jsonupdates (#11) * Template Install Updates for New Templates * Update generated README * Update generated README * Fix issue with CSC CNAME auto validation, have to add headers to CSR. (#13) * Fix issue with CSC CNAME auto validation, have to add headers to CSR. * Update Change Log * update to bootstrap workflow * Update generated README * Update changelog --------- Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Michael Henderson <mhenderson@keyfactor.com> * Fix for Revoke Issue, get end entity cert only. * Update generated README * Fixed Revoke Issues * Update CHANGELOG.md * Update CHANGELOG.md * Update generated README --------- Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Brian Hill <76450501+bhillkeyfactor@users.noreply.github.com> Co-authored-by: Michael Henderson <mhenderson@keyfactor.com> Co-authored-by: Brian Hill <bhill@keyfactor.com>
1 parent b49906e commit 6d5721f

File tree

4 files changed

+128
-49
lines changed

4 files changed

+128
-49
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
v1.1.1
2+
- Fix Revoke Serial Number Mismatch KF 10.1 and 22.1.0 GW combination
3+
- Only Syncing and GetSingleRecord on End Entity Cert to prevent errors.
14

25
v1.1.0
36
- Add Support for CNAME Domain Validation

‎CscGlobalCaProxy/CscGlobalCaProxy.cs‎

Lines changed: 107 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -34,24 +34,34 @@ public CscGlobalCaProxy()
3434
public override int Revoke(string caRequestId, string hexSerialNumber, uint revocationReason)
3535
{
3636

37-
Logger.Trace($"Staring Revoke Method");
38-
var revokeResponse =
39-
Task.Run(async () =>
40-
await CscGlobalClient.SubmitRevokeCertificateAsync(caRequestId.Substring(0, 36)))
41-
.Result; //todo fix to use pipe delimiter
37+
try
38+
{
39+
Logger.Trace($"Staring Revoke Method");
40+
var revokeResponse =
41+
Task.Run(async () =>
42+
await CscGlobalClient.SubmitRevokeCertificateAsync(caRequestId.Substring(0, 36)))
43+
.Result; //todo fix to use pipe delimiter
4244

43-
Logger.Trace($"Revoke Response JSON: {JsonConvert.SerializeObject(revokeResponse)}");
44-
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
45+
Logger.Trace($"Revoke Response JSON: {JsonConvert.SerializeObject(revokeResponse)}");
46+
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
47+
48+
var revokeResult = _requestManager.GetRevokeResult(revokeResponse);
4549

46-
var revokeResult = _requestManager.GetRevokeResult(revokeResponse);
50+
if (revokeResult == Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED))
51+
{
52+
if (!string.IsNullOrEmpty(revokeResponse?.RegistrationError?.Description))
53+
{
54+
throw new UnsuccessfulRequestException($"Revoke Failed with message {revokeResponse?.RegistrationError?.Description}", 30);
55+
}
56+
}
4757

48-
if (revokeResult == Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED))
58+
return revokeResult;
59+
}
60+
catch(Exception e)
4961
{
50-
return -1;
62+
throw new Exception($"Revoke Failed with message {e?.Message}");
5163
}
5264

53-
return revokeResult;
54-
5565
}
5666

5767
[Obsolete]
@@ -96,27 +106,24 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
96106

97107
if (fileContent.Length > 0)
98108
{
109+
Logger.Trace($"File Content {fileContent}");
99110
var certData = fileContent.Replace("\r\n", string.Empty);
100-
var splitCerts =
101-
certData.Split(new[] { "-----END CERTIFICATE-----", "-----BEGIN CERTIFICATE-----" },
102-
StringSplitOptions.RemoveEmptyEntries);
103-
foreach (var cert in splitCerts)
104-
if (!cert.Contains(".crt"))
111+
var certString = GetEndEntityCertificate(certData);
112+
var currentCert = new X509Certificate2(Encoding.ASCII.GetBytes(certString));
113+
114+
if (certString.Length > 0)
115+
{
116+
blockingBuffer.Add(new CAConnectorCertificate
105117
{
106-
Logger.Trace($"Split Cert Value: {cert}");
107-
108-
var currentCert = new X509Certificate2(Encoding.ASCII.GetBytes(cert));
109-
blockingBuffer.Add(new CAConnectorCertificate
110-
{
111-
CARequestID = $"{currentResponseItem?.Uuid}",
112-
Certificate = cert,
113-
SubmissionDate = currentResponseItem?.OrderDate == null
114-
? Convert.ToDateTime(currentCert.NotBefore)
115-
: Convert.ToDateTime(currentResponseItem.OrderDate),
116-
Status = certStatus,
117-
ProductID = productId
118-
}, cancelToken);
119-
}
118+
CARequestID = $"{currentResponseItem?.Uuid}",
119+
Certificate = certString,
120+
SubmissionDate = currentResponseItem?.OrderDate == null
121+
? Convert.ToDateTime(currentCert.NotBefore)
122+
: Convert.ToDateTime(currentResponseItem.OrderDate),
123+
Status = certStatus,
124+
ProductID = productId
125+
}, cancelToken);
126+
}
120127
}
121128
}
122129
}
@@ -134,6 +141,41 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
134141
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
135142
}
136143

144+
private string GetEndEntityCertificate(string certData)
145+
{
146+
var splitCerts =
147+
certData.Split(new[] {"-----END CERTIFICATE-----", "-----BEGIN CERTIFICATE-----"},
148+
StringSplitOptions.RemoveEmptyEntries);
149+
150+
X509Certificate2Collection col = new X509Certificate2Collection();
151+
foreach (var cert in splitCerts)
152+
{
153+
Logger.Trace($"Split Cert Value: {cert}");
154+
155+
//skip these headers that came with the split function
156+
if (!cert.Contains(".crt"))
157+
{
158+
col.Import(Encoding.UTF8.GetBytes(cert));
159+
}
160+
}
161+
162+
Logger.Trace("Getting End Entity Certificate");
163+
var currentCert = CSS.PKI.X509.X509Utilities.GetEndEntityCertificate(col);
164+
Logger.Trace("Converting to Byte Array");
165+
var byteArray = currentCert?.Export(X509ContentType.Cert);
166+
Logger.Trace("Initializing empty string");
167+
168+
var certString = string.Empty;
169+
if (byteArray != null)
170+
{
171+
certString = Convert.ToBase64String(byteArray);
172+
}
173+
174+
Logger.Trace($"Got certificate {certString}");
175+
176+
return certString;
177+
}
178+
137179
[Obsolete]
138180
public override EnrollmentResult Enroll(string csr, string subject, Dictionary<string, string[]> san,
139181
EnrollmentProductInfo productInfo,
@@ -239,22 +281,42 @@ public override EnrollmentResult Enroll(ICertificateDataReader certificateDataRe
239281

240282
public override CAConnectorCertificate GetSingleRecord(string caRequestId)
241283
{
242-
Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
243-
var keyfactorCaId = caRequestId.Substring(0, 36); //todo fix to use pipe delimiter
244-
Logger.Trace($"Keyfactor Ca Id: {keyfactorCaId}");
245-
var certificateResponse =
246-
Task.Run(async () => await CscGlobalClient.SubmitGetCertificateAsync(keyfactorCaId))
247-
.Result;
284+
try
285+
{
286+
Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
287+
var keyfactorCaId = caRequestId?.Substring(0, 36); //todo fix to use pipe delimiter
288+
Logger.Trace($"Keyfactor Ca Id: {keyfactorCaId}");
289+
var certificateResponse =
290+
Task.Run(async () => await CscGlobalClient.SubmitGetCertificateAsync(keyfactorCaId))
291+
.Result;
292+
293+
Logger.Trace($"Single Cert JSON: {JsonConvert.SerializeObject(certificateResponse)}");
294+
295+
var fileContent =
296+
Encoding.ASCII.GetString(
297+
Convert.FromBase64String(certificateResponse?.Certificate ?? string.Empty));
298+
299+
Logger.Trace($"File Content {fileContent}");
300+
var certData = fileContent?.Replace("\r\n", string.Empty);
301+
var certString = String.Empty;
302+
if (!string.IsNullOrEmpty(certData))
303+
certString = GetEndEntityCertificate(certData);
304+
Logger.Trace($"Cert String Content {certString}");
248305

249-
Logger.Trace($"Single Cert JSON: {JsonConvert.SerializeObject(certificateResponse)}");
250-
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
251-
return new CAConnectorCertificate
306+
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
307+
308+
return new CAConnectorCertificate
309+
{
310+
CARequestID = keyfactorCaId,
311+
Certificate = certString,
312+
Status = _requestManager.MapReturnStatus(certificateResponse?.Status),
313+
SubmissionDate = Convert.ToDateTime(certificateResponse?.OrderDate)
314+
};
315+
}
316+
catch(Exception e)
252317
{
253-
CARequestID = keyfactorCaId,
254-
Certificate = certificateResponse.Certificate,
255-
Status = _requestManager.MapReturnStatus(certificateResponse.Status),
256-
SubmissionDate = Convert.ToDateTime(certificateResponse.OrderDate)
257-
};
318+
throw new Exception($"Error Occurred getting single cert {e.Message}");
319+
}
258320
}
259321

260322
public override void Initialize(ICAConnectorConfigProvider configProvider)

‎CscGlobalCaProxy/RequestManager.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,12 @@ private string GetCertificateType(string productId)
160160
return "2";
161161
case "CSC TrustedSecure Premium Wildcard Certificate":
162162
return "1";
163+
case "CSC Trusted Secure Domain Validated SSL":
164+
return "4";
165+
case "CSC Trusted Secure Domain Validated Wildcard SSL":
166+
return "5";
167+
case "CSC Trusted Secure Domain Validated UC Certificate":
168+
return "6";
163169
case "CSC TrustedSecure Domain Validated SSL":
164170
return "4";
165171
case "CSC TrustedSecure Domain Validated Wildcard SSL":

‎README.md‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ Csc Global operates a PKI as a service platform for customers around the globe.
55

66
#### Integration status: Production - Ready for use in production environments.
77

8-
## About the Keyfactor AnyGateway CA Connector
8+
## About the Keyfactor AnyCA Gateway DCOM Connector
99

10-
This repository contains an AnyGateway CA Connector, which is a plugin to the Keyfactor AnyGateway. AnyGateway CA Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
10+
This repository contains an AnyCA Gateway Connector, which is a plugin to the Keyfactor AnyGateway. AnyCA Gateway Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
1111

1212
## Support for CSC Global
1313

@@ -24,9 +24,16 @@ CSC Global is supported by Keyfactor for Keyfactor customers. If you have a supp
2424

2525

2626

27-
## Keyfactor AnyGateway Framework Supported
27+
## Keyfactor AnyCA Gateway Framework Supported
28+
The Keyfactor gateway framework implements common logic shared across various gateway implementations and handles communication with Keyfactor Command. The gateway framework hosts gateway implementations or plugins that understand how to communicate with specific CAs. This allows you to integrate your third-party CAs with Keyfactor Command such that they behave in a manner similar to the CAs natively supported by Keyfactor Command.
2829

29-
This gateway was compiled against version of the AnyGateway Framework. You will need at least this version of the AnyGateway Framework Installed. If you have a later AnyGateway Framework Installed you will probably need to add binding redirects in the CAProxyServer.exe.config file to make things work properly.
30+
31+
32+
33+
This gateway extension was compiled against version of the AnyCA Gateway DCOM Framework. You will need at least this version of the framework Installed. If you have a later AnyGateway Framework Installed you will probably need to add binding redirects in the CAProxyServer.exe.config file to make things work properly.
34+
35+
36+
[Keyfactor CAGateway Install Guide](https://software.keyfactor.com/Guides/AnyGateway_Generic/Content/AnyGateway/Introduction.htm)
3037

3138

3239

@@ -468,3 +475,4 @@ Set-KeyfactorGatewayConfig -LogicalName "CSCGlobal" -FilePath [path to json file
468475
### License
469476
[Apache](https://apache.org/licenses/LICENSE-2.0)
470477

478+

0 commit comments

Comments
 (0)