Merge to main by indrora · Pull Request #44 · Keyfactor/digicert-certcentral-caplugin

indrora · 2026-02-12T12:47:41Z

Merge dev-2.2 to main - Automated PR

Hotfix

…ntral-caplugin into hotfix

Hotfix

Dev 2.1

check for duplicate PEMs

change default start sync date for first incremental sync

removing caching of product type list

change default incremental sync range

shorten incremental sync if it is too long

Dev 2.1

add duplicate support

Copilot

Pull request overview

Merge of dev-2.2 into main, adding support for DigiCert certificate duplication and additional enrollment/sync behaviors.

Changes:

Add “Duplicate” renewal behavior and client auth EKU option for SSL enrollments.
Adjust SMIME profile type defaults and tighten incremental sync date range behavior.
Update documentation/manifest and bump assembly/file versions.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
integration-manifest.json	Adds `IncludeClientAuthEKU` param and updates `ProfileType` description.
docsource/configuration.md	Documents how to enable “Duplicate” behavior via enrollment fields.
digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj	Adds explicit `AssemblyVersion`/`FileVersion`.
digicert-certcentral-caplugin/Models/CertCentralCertType.cs	Removes cached cert type lookups; always retrieves from API.
digicert-certcentral-caplugin/Constants.cs	Adds config keys for `Duplicate` and `IncludeClientAuthEKU`.
digicert-certcentral-caplugin/Client/CertCentralClient.cs	Adds client method to call DigiCert “duplicate” endpoint.
digicert-certcentral-caplugin/CertCentralCAPlugin.cs	Implements duplicate flow, client auth EKU option, sync window logic, and SMIME profile handling.
digicert-certcentral-caplugin/API/OrderCertificate.cs	Adds `profile_option` field to certificate request model.
digicert-certcentral-caplugin/API/Duplicate.cs	Introduces request/response models for duplication calls.
README.md	Documents `IncludeClientAuthEKU` and “Certificate Duplicates”.
CHANGELOG.md	Adds entries through 2.2.0 describing the new features/fixes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-12T12:50:29Z

digicert-certcentral-caplugin/CertCentralCAPlugin.cs

+			if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
+			{


productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH] is accessed without checking the key exists, which can throw KeyNotFoundException when the flag isn’t provided. Consider guarding with ContainsKey and parsing via bool.TryParse (or using a safe default of false) so missing/invalid values don’t crash enrollment.

Suggested change

if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))

{

bool includeClientAuth = false;

if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.INCLUDE_CLIENT_AUTH))

{

var includeClientAuthRaw = productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH];

if (!bool.TryParse(Convert.ToString(includeClientAuthRaw), out includeClientAuth))

{

_logger.LogWarning($"Could not parse '{CertCentralConstants.Config.INCLUDE_CLIENT_AUTH}' field as true or false. Treating as false. Value: {includeClientAuthRaw}");

includeClientAuth = false;

}

}

if (typeOfCert.Equals("ssl") && includeClientAuth)

{

Copilot · 2026-02-12T12:50:30Z

digicert-certcentral-caplugin/Client/CertCentralClient.cs

+		public OrderResponse DuplicateCertificate(DuplicateRequest request)
+		{
+			string jsonRequest = JsonConvert.SerializeObject(request, Formatting.None, new JsonSerializerSettings { NullValueHandling = NullValueHandling.Ignore });
+			Logger.LogTrace($"Duplicate request:\n{jsonRequest}");


Logging the full serialized duplicate request can leak sensitive material (notably the CSR and potentially subject/SANs) into logs. Recommend redacting/omitting sensitive fields (e.g., certificate.csr) or logging only non-sensitive identifiers (order id, product id, CN) at trace level.

Suggested change

Logger.LogTrace($"Duplicate request:\n{jsonRequest}");

Logger.LogTrace("Duplicate certificate request initiated.");

Copilot · 2026-02-12T12:50:30Z

digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj

+    <AssemblyVersion>2.1.2</AssemblyVersion>
+    <FileVersion>2.1.2</FileVersion>


The assembly/file version is set to 2.1.2, but the changelog in this PR includes 2.2.0 with the new duplicate feature. Align the project’s versioning with the release being merged (and consider setting Version/PackageVersion as well if this is packed/published), to avoid shipping 2.2.0 behavior under a 2.1.2 assembly version.

Suggested change

<AssemblyVersion>2.1.2</AssemblyVersion>

<FileVersion>2.1.2</FileVersion>

<AssemblyVersion>2.2.0</AssemblyVersion>

<FileVersion>2.2.0</FileVersion>

<Version>2.2.0</Version>

<PackageVersion>2.2.0</PackageVersion>

Copilot · 2026-02-12T12:50:30Z

digicert-certcentral-caplugin/CertCentralCAPlugin.cs

 			_logger.MethodEntry(LogLevel.Trace);

-			lastSync = lastSync.HasValue ? lastSync.Value.AddHours(-7) : DateTime.MinValue; // DigiCert issue with treating the timezone as mountain time. -7 to accomodate DST
+			// DigiCert issue with treating the timezone as mountain time. -7 hours to accomodate DST


Correct spelling in comment: “accomodate” → “accommodate”.

Suggested change

// DigiCert issue with treating the timezone as mountain time. -7 hours to accomodate DST

// DigiCert issue with treating the timezone as mountain time. -7 hours to accommodate DST

Copilot · 2026-02-12T12:50:30Z

digicert-certcentral-caplugin/CertCentralCAPlugin.cs

 							throw new Exception($"Unexpected error downloading certificate {certId} for order {orderId}: {certificateChainResponse.Errors.FirstOrDefault()?.message}");
 						}
 					}
+					//Another check for duplicate PEMs to get arround issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs


Correct spelling in comment: “arround” → “around”.

Suggested change

//Another check for duplicate PEMs to get arround issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs

//Another check for duplicate PEMs to get around issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs

Copilot · 2026-02-12T12:50:31Z

digicert-certcentral-caplugin/CertCentralCAPlugin.cs

 			List<AnyCAPluginCertificate> certList = new List<AnyCAPluginCertificate>();
+			List<string> pemList = new List<string>();


pemList.Contains(...) inside the loop makes duplicate detection O(n²) as the number of certs grows. Use a HashSet<string> for pemList to get O(1) lookups and simplify the “contains then add” logic.

Copilot · 2026-02-12T12:50:31Z

digicert-certcentral-caplugin/CertCentralCAPlugin.cs

+					//Another check for duplicate PEMs to get arround issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs
+					if (pemList.Contains(certificate))
+					{
+						_logger.LogWarning($"Found duplicate PEM for ID {caReqId}. Skipping...");
+						continue;
+					}
+					pemList.Add(certificate);


pemList.Contains(...) inside the loop makes duplicate detection O(n²) as the number of certs grows. Use a HashSet<string> for pemList to get O(1) lookups and simplify the “contains then add” logic.

Copilot · 2026-02-12T12:50:31Z

digicert-certcentral-caplugin/API/Duplicate.cs

+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;


This new file includes unused using directives (System.Linq, System.Text, System.Threading.Tasks aren’t used in the shown code). Removing them reduces clutter and avoids warnings (especially if warnings are treated as errors in CI).

Suggested change

using System.Linq;

using System.Text;

using System.Threading.Tasks;

dgaley and others added 24 commits October 8, 2025 11:29

fix for smime profile type

52eee75

template parameter to include client auth eku

70fe240

Update generated docs

f9e1564

Merge pull request #31 from Keyfactor/hotfix

516d230

Hotfix

changelog and logging

844a7e1

Merge branch 'hotfix' of https://github.com/Keyfactor/digicert-certce…

b0819c4

…ntral-caplugin into hotfix

Merge pull request #34 from Keyfactor/hotfix

db730d5

Hotfix

Merge pull request #32 from Keyfactor/dev-2.1

aceca2d

Dev 2.1

check for duplicate PEMs

a4dfbe2

Merge pull request #36 from Keyfactor/hotfix

d0e5a80

check for duplicate PEMs

change default start sync date for first incremental sync

cd8fd90

Merge pull request #38 from Keyfactor/hotfix

19fae71

change default start sync date for first incremental sync

removing caching of product type list

fe7e05d

Merge pull request #39 from Keyfactor/prodtypecache

8850680

removing caching of product type list

change default incremental sync range

d195faf

version

1b14604

changelog

a64934c

Merge pull request #40 from Keyfactor/hotfix

03a5fa5

change default incremental sync range

shorten incremental sync if it is too long

208fece

Merge pull request #41 from Keyfactor/hotfix

509ad46

shorten incremental sync if it is too long

Merge pull request #37 from Keyfactor/dev-2.1

c3a719f

Dev 2.1

add duplicate support

880f85a

Update generated docs

1d8ade4

Merge pull request #42 from Keyfactor/duplicates

c01f0ce

add duplicate support

Copilot AI review requested due to automatic review settings February 12, 2026 12:47

Copilot AI reviewed Feb 12, 2026

View reviewed changes

indrora closed this Feb 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge to main#44

Merge to main#44
indrora wants to merge 24 commits intomainfrom
dev-2.2

indrora commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Copilot AI Feb 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
		{

-			if (typeOfCert.Equals("ssl") && Convert.ToBoolean(productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH]))
-			{
+			bool includeClientAuth = false;
+			if (productInfo.ProductParameters.ContainsKey(CertCentralConstants.Config.INCLUDE_CLIENT_AUTH))
+			{
+				var includeClientAuthRaw = productInfo.ProductParameters[CertCentralConstants.Config.INCLUDE_CLIENT_AUTH];
+				if (!bool.TryParse(Convert.ToString(includeClientAuthRaw), out includeClientAuth))
+				{
+					_logger.LogWarning($"Could not parse '{CertCentralConstants.Config.INCLUDE_CLIENT_AUTH}' field as true or false. Treating as false. Value: {includeClientAuthRaw}");
+					includeClientAuth = false;
+				}
+			}
+			if (typeOfCert.Equals("ssl") && includeClientAuth)
+			{

	Logger.LogTrace($"Duplicate request:\n{jsonRequest}");
	Logger.LogTrace("Duplicate certificate request initiated.");

		<AssemblyVersion>2.1.2</AssemblyVersion>
		<FileVersion>2.1.2</FileVersion>

-    <AssemblyVersion>2.1.2</AssemblyVersion>
-    <FileVersion>2.1.2</FileVersion>
+    <AssemblyVersion>2.2.0</AssemblyVersion>
+    <FileVersion>2.2.0</FileVersion>
+    <Version>2.2.0</Version>
+    <PackageVersion>2.2.0</PackageVersion>

	// DigiCert issue with treating the timezone as mountain time. -7 hours to accomodate DST
	// DigiCert issue with treating the timezone as mountain time. -7 hours to accommodate DST

	//Another check for duplicate PEMs to get arround issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs
	//Another check for duplicate PEMs to get around issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs

		List<AnyCAPluginCertificate> certList = new List<AnyCAPluginCertificate>();
		List<string> pemList = new List<string>();

	using System.Linq;
	using System.Text;
	using System.Threading.Tasks;

Conversation

indrora commented Feb 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants