Skip to content

Commit 0d6001d

Browse files
fiddlermikeyfiddlermikey
authored
Merge pull request #18 from Keyfactor/revokebug
Revokebug fixes ab#58448
2 parents 024085c + 1eca766 commit 0d6001d

File tree

4 files changed

+132
-49
lines changed

4 files changed

+132
-49
lines changed

‎CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
v1.1.1
2+
- Fix Revoke Serial Number Mismatch KF 10.1 and 22.1.0 GW combination
3+
- Only Syncing and GetSingleRecord on End Entity Cert to prevent errors.
14

25
v1.1.0
36
- Add Support for CNAME Domain Validation

‎CscGlobalCaProxy/CscGlobalCaProxy.cs

Lines changed: 107 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -34,24 +34,34 @@ public CscGlobalCaProxy()
3434
public override int Revoke(string caRequestId, string hexSerialNumber, uint revocationReason)
3535
{
3636

37-
Logger.Trace($"Staring Revoke Method");
38-
var revokeResponse =
39-
Task.Run(async () =>
40-
await CscGlobalClient.SubmitRevokeCertificateAsync(caRequestId.Substring(0, 36)))
41-
.Result; //todo fix to use pipe delimiter
37+
try
38+
{
39+
Logger.Trace($"Staring Revoke Method");
40+
var revokeResponse =
41+
Task.Run(async () =>
42+
await CscGlobalClient.SubmitRevokeCertificateAsync(caRequestId.Substring(0, 36)))
43+
.Result; //todo fix to use pipe delimiter
4244

43-
Logger.Trace($"Revoke Response JSON: {JsonConvert.SerializeObject(revokeResponse)}");
44-
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
45+
Logger.Trace($"Revoke Response JSON: {JsonConvert.SerializeObject(revokeResponse)}");
46+
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
47+
48+
var revokeResult = _requestManager.GetRevokeResult(revokeResponse);
4549

46-
var revokeResult = _requestManager.GetRevokeResult(revokeResponse);
50+
if (revokeResult == Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED))
51+
{
52+
if (!string.IsNullOrEmpty(revokeResponse?.RegistrationError?.Description))
53+
{
54+
throw new UnsuccessfulRequestException($"Revoke Failed with message {revokeResponse?.RegistrationError?.Description}", 30);
55+
}
56+
}
4757

48-
if (revokeResult == Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED))
58+
return revokeResult;
59+
}
60+
catch(Exception e)
4961
{
50-
return -1;
62+
throw new Exception($"Revoke Failed with message {e?.Message}");
5163
}
5264

53-
return revokeResult;
54-
5565
}
5666

5767
[Obsolete]
@@ -96,27 +106,24 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
96106

97107
if (fileContent.Length > 0)
98108
{
109+
Logger.Trace($"File Content {fileContent}");
99110
var certData = fileContent.Replace("\r\n", string.Empty);
100-
var splitCerts =
101-
certData.Split(new[] { "-----END CERTIFICATE-----", "-----BEGIN CERTIFICATE-----" },
102-
StringSplitOptions.RemoveEmptyEntries);
103-
foreach (var cert in splitCerts)
104-
if (!cert.Contains(".crt"))
111+
var certString = GetEndEntityCertificate(certData);
112+
var currentCert = new X509Certificate2(Encoding.ASCII.GetBytes(certString));
113+
114+
if (certString.Length > 0)
115+
{
116+
blockingBuffer.Add(new CAConnectorCertificate
105117
{
106-
Logger.Trace($"Split Cert Value: {cert}");
107-
108-
var currentCert = new X509Certificate2(Encoding.ASCII.GetBytes(cert));
109-
blockingBuffer.Add(new CAConnectorCertificate
110-
{
111-
CARequestID = $"{currentResponseItem?.Uuid}",
112-
Certificate = cert,
113-
SubmissionDate = currentResponseItem?.OrderDate == null
114-
? Convert.ToDateTime(currentCert.NotBefore)
115-
: Convert.ToDateTime(currentResponseItem.OrderDate),
116-
Status = certStatus,
117-
ProductID = productId
118-
}, cancelToken);
119-
}
118+
CARequestID = $"{currentResponseItem?.Uuid}",
119+
Certificate = certString,
120+
SubmissionDate = currentResponseItem?.OrderDate == null
121+
? Convert.ToDateTime(currentCert.NotBefore)
122+
: Convert.ToDateTime(currentResponseItem.OrderDate),
123+
Status = certStatus,
124+
ProductID = productId
125+
}, cancelToken);
126+
}
120127
}
121128
}
122129
}
@@ -134,6 +141,41 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
134141
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
135142
}
136143

144+
private string GetEndEntityCertificate(string certData)
145+
{
146+
var splitCerts =
147+
certData.Split(new[] {"-----END CERTIFICATE-----", "-----BEGIN CERTIFICATE-----"},
148+
StringSplitOptions.RemoveEmptyEntries);
149+
150+
X509Certificate2Collection col = new X509Certificate2Collection();
151+
foreach (var cert in splitCerts)
152+
{
153+
Logger.Trace($"Split Cert Value: {cert}");
154+
155+
//skip these headers that came with the split function
156+
if (!cert.Contains(".crt"))
157+
{
158+
col.Import(Encoding.UTF8.GetBytes(cert));
159+
}
160+
}
161+
162+
Logger.Trace("Getting End Entity Certificate");
163+
var currentCert = CSS.PKI.X509.X509Utilities.GetEndEntityCertificate(col);
164+
Logger.Trace("Converting to Byte Array");
165+
var byteArray = currentCert?.Export(X509ContentType.Cert);
166+
Logger.Trace("Initializing empty string");
167+
168+
var certString = string.Empty;
169+
if (byteArray != null)
170+
{
171+
certString = Convert.ToBase64String(byteArray);
172+
}
173+
174+
Logger.Trace($"Got certificate {certString}");
175+
176+
return certString;
177+
}
178+
137179
[Obsolete]
138180
public override EnrollmentResult Enroll(string csr, string subject, Dictionary<string, string[]> san,
139181
EnrollmentProductInfo productInfo,
@@ -239,22 +281,42 @@ public override EnrollmentResult Enroll(ICertificateDataReader certificateDataRe
239281

240282
public override CAConnectorCertificate GetSingleRecord(string caRequestId)
241283
{
242-
Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
243-
var keyfactorCaId = caRequestId.Substring(0, 36); //todo fix to use pipe delimiter
244-
Logger.Trace($"Keyfactor Ca Id: {keyfactorCaId}");
245-
var certificateResponse =
246-
Task.Run(async () => await CscGlobalClient.SubmitGetCertificateAsync(keyfactorCaId))
247-
.Result;
284+
try
285+
{
286+
Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
287+
var keyfactorCaId = caRequestId?.Substring(0, 36); //todo fix to use pipe delimiter
288+
Logger.Trace($"Keyfactor Ca Id: {keyfactorCaId}");
289+
var certificateResponse =
290+
Task.Run(async () => await CscGlobalClient.SubmitGetCertificateAsync(keyfactorCaId))
291+
.Result;
292+
293+
Logger.Trace($"Single Cert JSON: {JsonConvert.SerializeObject(certificateResponse)}");
294+
295+
var fileContent =
296+
Encoding.ASCII.GetString(
297+
Convert.FromBase64String(certificateResponse?.Certificate ?? string.Empty));
298+
299+
Logger.Trace($"File Content {fileContent}");
300+
var certData = fileContent?.Replace("\r\n", string.Empty);
301+
var certString = String.Empty;
302+
if (!string.IsNullOrEmpty(certData))
303+
certString = GetEndEntityCertificate(certData);
304+
Logger.Trace($"Cert String Content {certString}");
248305

249-
Logger.Trace($"Single Cert JSON: {JsonConvert.SerializeObject(certificateResponse)}");
250-
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
251-
return new CAConnectorCertificate
306+
Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
307+
308+
return new CAConnectorCertificate
309+
{
310+
CARequestID = keyfactorCaId,
311+
Certificate = certString,
312+
Status = _requestManager.MapReturnStatus(certificateResponse?.Status),
313+
SubmissionDate = Convert.ToDateTime(certificateResponse?.OrderDate)
314+
};
315+
}
316+
catch(Exception e)
252317
{
253-
CARequestID = keyfactorCaId,
254-
Certificate = certificateResponse.Certificate,
255-
Status = _requestManager.MapReturnStatus(certificateResponse.Status),
256-
SubmissionDate = Convert.ToDateTime(certificateResponse.OrderDate)
257-
};
318+
throw new Exception($"Error Occurred getting single cert {e.Message}");
319+
}
258320
}
259321

260322
public override void Initialize(ICAConnectorConfigProvider configProvider)

‎CscGlobalCaProxy/RequestManager.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,12 @@ private string GetCertificateType(string productId)
160160
return "2";
161161
case "CSC TrustedSecure Premium Wildcard Certificate":
162162
return "1";
163+
case "CSC Trusted Secure Domain Validated SSL":
164+
return "4";
165+
case "CSC Trusted Secure Domain Validated Wildcard SSL":
166+
return "5";
167+
case "CSC Trusted Secure Domain Validated UC Certificate":
168+
return "6";
163169
case "CSC TrustedSecure Domain Validated SSL":
164170
return "4";
165171
case "CSC TrustedSecure Domain Validated Wildcard SSL":

‎README.md

Lines changed: 16 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,39 @@
1+
12
# CSC Global
23

34
Csc Global operates a PKI as a service platform for customers around the globe. The AnyGateway solution for CscGlobal is designed to allow Keyfactor Command the ability to: - Sync certificates issued from the CA - Request new certificates from the CA - Revoke certificates directly from Keyfactor Command
45

56
#### Integration status: Production - Ready for use in production environments.
67

8+
## About the Keyfactor AnyCA Gateway DCOM Connector
79

8-
## About the Keyfactor AnyGateway CA Connector
9-
10-
This repository contains an AnyGateway CA Connector, which is a plugin to the Keyfactor AnyGateway. AnyGateway CA Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
11-
10+
This repository contains an AnyCA Gateway Connector, which is a plugin to the Keyfactor AnyGateway. AnyCA Gateway Connectors allow Keyfactor Command to be used for inventory, issuance, and revocation of certificates from a third-party certificate authority.
1211

1312
## Support for CSC Global
1413

1514
CSC Global is supported by Keyfactor for Keyfactor customers. If you have a support issue, please open a support ticket via the Keyfactor Support Portal at https://support.keyfactor.com
1615

1716
###### To report a problem or suggest a new feature, use the **[Issues](../../issues)** tab. If you want to contribute actual bug fixes or proposed enhancements, use the **[Pull requests](../../pulls)** tab.
1817

18+
---
19+
1920

2021
---
2122

2223

2324

2425

2526

27+
## Keyfactor AnyCA Gateway Framework Supported
28+
The Keyfactor gateway framework implements common logic shared across various gateway implementations and handles communication with Keyfactor Command. The gateway framework hosts gateway implementations or plugins that understand how to communicate with specific CAs. This allows you to integrate your third-party CAs with Keyfactor Command such that they behave in a manner similar to the CAs natively supported by Keyfactor Command.
29+
30+
31+
32+
33+
This gateway extension was compiled against version of the AnyCA Gateway DCOM Framework. You will need at least this version of the framework Installed. If you have a later AnyGateway Framework Installed you will probably need to add binding redirects in the CAProxyServer.exe.config file to make things work properly.
34+
35+
36+
[Keyfactor CAGateway Install Guide](https://software.keyfactor.com/Guides/AnyGateway_Generic/Content/AnyGateway/Introduction.htm)
2637

2738

2839

@@ -464,3 +475,4 @@ Set-KeyfactorGatewayConfig -LogicalName "CSCGlobal" -FilePath [path to json file
464475
### License
465476
[Apache](https://apache.org/licenses/LICENSE-2.0)
466477

478+

0 commit comments

Comments
 (0)