Renew

CHANGELOG.md

@@ -0,0 +1,7 @@
+1.0.0  
+* Initial Release  
+
+1.1.0  
+* Added support for renew/reissue  
+* Made CARequestID more consistent for pending/external validation certs  
+* Allow for the specifying of custom lifetimes for certs, and comparing the provided value to the allowed values  

README.md

@@ -99,6 +99,7 @@ TODO Requirements is a required section
 
     * **OrganizationId** - If you know your organization's ID in nameshield, you can supply that here and that will be used as the organization regardless of what values exist in the request or the Organization field 
     * **Organization** - If OrganizationId is empty, and an organization name is provided here, the Nameshield gateway will use that name to do organization lookups when enrolling. If neither OrganizationId nor Organization is supplied, the gateway will use whatever is in the O= field of the request subject. 
+    * **Lifetime** - REQUIRED:The lifetime of the certificate to be issued. This should be a string in the format recognized by Nameshield (e.g. 1 year, etc.) 
 
 
 

integration-manifest.json

@@ -34,6 +34,10 @@
                 {
                     "name": "Organization",
                     "description": "If OrganizationId is empty, and an organization name is provided here, the Nameshield gateway will use that name to do organization lookups when enrolling. If neither OrganizationId nor Organization is supplied, the gateway will use whatever is in the O= field of the request subject."
+                },
+                {
+                    "name": "Lifetime",
+                    "description": "REQUIRED:The lifetime of the certificate to be issued. This should be a string in the format recognized by Nameshield (e.g. 1 year, etc.)"
                 }
             ]
         }

nameshield-caplugin/Constants.cs

@@ -20,6 +20,7 @@ public class Template
 			{
 				public const string ORGANIZATION_ID = "OrganizationId";
 				public const string ORGANIZATION = "Organization";
+				public const string LIFETIME = "Lifetime";
 			}
 		}
 	}

nameshield-caplugin/Models/Certificate.cs

@@ -44,6 +44,9 @@ public class Certificate
 		[JsonPropertyName("attributes")]
 		[JsonProperty("attributes")]
 		public CertificateAttributes Attributes { get; set; }
+		[JsonPropertyName("relationships")]
+		[JsonProperty("relationships")]
+		public CertificateRelationships Relationships { get; set; }
 	}
 
 	public class CertificateAttributes
@@ -60,4 +63,18 @@ public class CertificateAttributes
 		[JsonProperty("pem")]
 		public string Pem { get; set; }
 	}
+
+	public class CertificateRelationships
+	{
+		[JsonPropertyName("current-order")]
+		[JsonProperty("current-order")]
+		public CertOrderRelationship Order { get; set; }
+	}
+
+	public class CertOrderRelationship
+	{
+		[JsonPropertyName("data")]
+		[JsonProperty("data")]
+		public RelationshipData Data { get; set; }
+	}
 }

nameshield-caplugin/Models/Order.cs

@@ -36,6 +36,9 @@ public class OrderAttributes
 		[JsonPropertyName("status")]
 		[JsonProperty("status")]
 		public string Status { get; set; }
+		[JsonPropertyName("can_renew_at")]
+		[JsonProperty("can_renew_at")]
+		public string CanRenewAt { get; set; }
 	}
 
 	public class OrderRelationships

nameshield-caplugin/NameshieldCAPlugin.cs

@@ -1,6 +1,7 @@
 using Keyfactor.AnyGateway.Extensions;
 using Keyfactor.Extensions.CAPlugin.Nameshield.API;
 using Keyfactor.Extensions.CAPlugin.Nameshield.Client;
+using Keyfactor.Extensions.CAPlugin.Nameshield.Models;
 using Keyfactor.Logging;
 using Keyfactor.PKI.Enums.EJBCA;
 
@@ -36,7 +37,7 @@ public void Initialize(IAnyCAPluginConfigProvider configProvider, ICertificateDa
 			_config = JsonConvert.DeserializeObject<NameshieldConfig>(rawConfig);
 		}
 
-		public async Task<EnrollmentResult> Enroll(string csr, string subject, Dictionary<string, string[]> san, EnrollmentProductInfo productInfo, RequestFormat requestFormat, EnrollmentType enrollmnentType)
+		public async Task<EnrollmentResult> Enroll(string csr, string subject, Dictionary<string, string[]> san, EnrollmentProductInfo productInfo, RequestFormat requestFormat, EnrollmentType enrollmentType)
 		{
 			_logger.MethodEntry(LogLevel.Debug);
 			NameshieldClient client = NameshieldClient.InitializeClient(_config);
@@ -93,12 +94,42 @@ public async Task<EnrollmentResult> Enroll(string csr, string subject, Dictionar
 			{
 				throw new Exception($"No organization provided in attributes or subject that matches an organization in the Nameshield account");
 			}
+			var lifetime = productInfo.ProductParameters[Constants.Config.Template.LIFETIME];
+
+			string orderAction = "create";
+
+			// Determine if we should do a renew or a reissue
+			if (enrollmentType == EnrollmentType.RenewOrReissue)
+			{
+				string priorCertSnString = productInfo.ProductParameters["PriorCertSN"];
+				var priorCertReqID = await _certificateDataReader.GetRequestIDBySerialNumber(priorCertSnString);
+				if (string.IsNullOrEmpty(priorCertReqID))
+				{
+					throw new Exception($"Cannot find prior certificate with serial number {priorCertSnString}.");
+				}
+
+				string orderId = priorCertReqID.Split('-')[0];
+
+				var orderResponse = Task.Run(async () => await client.GetOrderDetails(orderId)).Result;
+				if (orderResponse.Order.Attributes.CanRenewAt != null)
+				{
+					DateTime canRenewDT = DateTime.Parse(orderResponse.Order.Attributes.CanRenewAt);
+					if (canRenewDT < DateTime.UtcNow)
+					{
+						orderAction = "renew";
+					}
+					else
+					{
+						orderAction = "reissue";
+					}
+				}
+			}
 
 			CertificateRequest request = new CertificateRequest();
 			request.data.type = "order";
-			request.data.attributes.action = "create";
+			request.data.attributes.action = orderAction;
 			request.data.attributes.csr = csr;
-			request.data.attributes.duration = "1 year";
+			request.data.attributes.duration = lifetime;
 			request.data.relationships.product.data.type = "product";
 			request.data.relationships.product.data.id = productId;
 			request.data.relationships.organization.data.type = "organization";
@@ -135,11 +166,12 @@ public async Task<EnrollmentResult> Enroll(string csr, string subject, Dictionar
 			}
 			_logger.LogTrace($"Certificate enrolled successfully");
 
-			var cert = GetSingleRecord(response.Order.Relationships.Certificate.Data.id).Result;
-
+			var reqId = $"{response.Order.Id}-{response.Order.Relationships.Certificate.Data.id}";
+			var cert = GetSingleRecord(reqId).Result;
+
 			return new EnrollmentResult
 			{
-				CARequestID = cert.CARequestID,
+				CARequestID = reqId,
 				Certificate = cert.Certificate,
 				Status = cert.Status,
 				StatusMessage = $"Successfully enrolled for certificate {subject}"
@@ -191,11 +223,17 @@ public List<string> GetProductIds()
 		public async Task<AnyCAPluginCertificate> GetSingleRecord(string caRequestID)
 		{
 			NameshieldClient client = NameshieldClient.InitializeClient(_config);
+			var idParts = caRequestID.Split('-').ToList();
+			if (idParts.Count == 1)
+			{
+				_logger.LogWarning($"Order {caRequestID} is still awaiting delivery.");
+				throw new Exception($"Unable to retrieve certificate for order {caRequestID} as it is still awaiting delivery. The certificate will be picked up by a future sync once it is issued.");
+			}
+			string certId = idParts[1];
+			var cert = Task.Run(async () => await client.GetCertificate(certId)).Result;
+			var certProduct = Task.Run(async () => await client.GetCertificateProduct(certId)).Result;
 
-			var cert = Task.Run(async () => await client.GetCertificate(caRequestID)).Result;
-			var certProduct = Task.Run(async () => await client.GetCertificateProduct(caRequestID)).Result;
-
-			int status = ConvertToKeyfactorStatus(cert.Certificate.Attributes.Status, caRequestID);
+			int status = ConvertToKeyfactorStatus(cert.Certificate.Attributes.Status, certId);
 
 			return new AnyCAPluginCertificate()
 			{
@@ -224,6 +262,13 @@ public Dictionary<string, PropertyConfigInfo> GetTemplateParameterAnnotations()
 					Hidden = false,
 					DefaultValue = "",
 					Type = "String"
+				},
+				[Constants.Config.Template.LIFETIME] = new PropertyConfigInfo()
+				{
+					Comments = "REQUIRED:The lifetime of the certificate to be issued. This should be a string in the format recognized by Nameshield (e.g. 1 year, etc.)",
+					Hidden = false,
+					DefaultValue = "1 year",
+					Type = "String"
 				}
 			};
 		}
@@ -271,11 +316,13 @@ public async Task Synchronize(BlockingCollection<AnyCAPluginCertificate> blockin
 
 			foreach (var cert in certs.Certificates)
 			{
+				var certObj = Task.Run(async () => await client.GetCertificate(cert.Id)).Result;
 				var certProduct = Task.Run(async () => await client.GetCertificateProduct(cert.Id)).Result;
 				int status = ConvertToKeyfactorStatus(cert.Attributes.Status, cert.Id);
 				var newCert = new AnyCAPluginCertificate()
 				{
-					CARequestID = cert.Id,
+					CARequestID = $"{certObj.Certificate.Relationships.Order.Data.id}-{cert.Id}",
+					OldCARequestID = certObj.Certificate.Relationships.Order.Data.id,
 					ProductID = certProduct.CertificateProduct.Attributes.Name,
 					Status = status,
 					Certificate = cert.Attributes.Pem,
@@ -310,20 +357,39 @@ public async Task ValidateProductInfo(EnrollmentProductInfo productInfo, Diction
 
 			var productList = Task.Run(async () => await localClient.ListProducts()).Result;
 
-			bool foundProduct = false;
+			Product foundProduct = null;
 			foreach (var product in productList.Products)
 			{
 				if (string.Equals(product.Attributes.Name, productInfo.ProductID, StringComparison.OrdinalIgnoreCase))
 				{
-					foundProduct = true;
+					foundProduct = product;
 					break;
 				}
 			}
 
-			if (!foundProduct)
+			if (foundProduct == null)
 			{
 				throw new Exception($"Product ID {productInfo.ProductID} was not found in the list of valid products.");
 			}
+			string lifetime = productInfo.ProductParameters[Constants.Config.Template.LIFETIME];
+			if (string.IsNullOrEmpty(lifetime))
+			{
+				throw new Exception($"Product ID {productInfo.ProductID} is missing a required lifetime value");
+			}
+
+			bool allowedDuration = false;
+			foreach (var duration in foundProduct.Attributes.Durations)
+			{
+				if (string.Equals(duration, lifetime, StringComparison.OrdinalIgnoreCase))
+				{
+					allowedDuration = true;
+					break;
+				}
+			}
+			if (!allowedDuration)
+			{
+				throw new Exception($"Product ID {productInfo.ProductID} has an invalid lifetime value {lifetime}. Valid values for this product are: {string.Join(',', foundProduct.Attributes.Durations)}");
+			}
 		}
 
 		private static string ValidateConfigurationKey(Dictionary<string, object> connectionInfo, string key)
@@ -336,7 +402,7 @@ private static string ValidateConfigurationKey(Dictionary<string, object> connec
 			return string.Empty;
 		}
 
-		private static int ConvertToKeyfactorStatus(string status, string sslId)
+		private static int ConvertToKeyfactorStatus(string status, string certId)
 		{
 			switch (status.ToUpper())
 			{
@@ -353,7 +419,7 @@ private static int ConvertToKeyfactorStatus(string status, string sslId)
 					return (int)EndEntityStatus.REVOKED;
 
 				default:
-					throw new Exception($"Request ID {sslId} has unknown status {status}");
+					throw new Exception($"Request ID {certId} has unknown status {status}");
 			}
 		}
 

nameshield-caplugin/nameshield-caplugin.csproj

@@ -17,7 +17,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.0.0" />
+    <PackageReference Include="Keyfactor.AnyGateway.IAnyCAPlugin" Version="3.2.0" />
     <PackageReference Include="Keyfactor.Common" Version="2.5.0" />
     <PackageReference Include="Keyfactor.Logging" Version="1.1.1" />
     <PackageReference Include="Keyfactor.PKI" Version="5.5.0" />