Repository navigation
Resolve renew/reissue from order expiry for ~200 day certs - #13
Open
bhillkeyfactor wants to merge 9 commits into
Open
bhillkeyfactor wants to merge 9 commits into
bhillkeyfactor wants to merge 9 commits into
Conversation
Requests carrying a prior certificate are now resolved from the SSL Store order expiry instead of the certificate expiry: reissue under the active order outside RenewalWindowDays (default 30), renew inside it, and order new once the order has expired. Removes the expired-cert renewal rejection. Adds FlowLogger step diagrams to Enroll, Synchronize, Revoke, GetSingleRecord and Initialize, and tightens error handling on the enrollment path.
Request and response bodies are logged through LogRedactor, which masks AuthToken, PartnerCode, Token, TokenCode, TokenID and password values. The PartnerCode is no longer logged at Initialize.
Enroll results had no CARequestID, so orders waiting on domain validation left a row Command could not refresh (GetSingleRecord called with null). Return the order id with a pending status, accept order-serial IDs in GetSingleRecord, and return the certificate once the order is issued.
Older records carry CA request IDs like {order}|{partner order}. Parse the
order id on either separator for revoke, renew/reissue and GetSingleRecord.
Stop a renewal or reissue when SSL Store reports an error for the prior
order instead of building a request from an empty response.
SSL Store returns HTTP 200 with AuthResponse.isError for problems such as the hourly quota. Sync treated the error body as an order and logged SUCCESS. Count and log these as errors for the order query, per-order status and organization list, and flag them in GetSingleRecord.
Command sends PriorCertSN without the DER sign-padding byte, but the gateway stores serials such as 00A3B8... from sync. Try the serial as sent, stripped, and with a leading 00 so renewals of high-bit serials resolve their prior order.
A reissue of an order returns the same SSL Store order id, so using it as the CARequestID hit the unique index on the gateway Certificates table when a second reissue was submitted. Append the partner order id, which changes with every submission.
…equest ID SSL Store rejects a reissue or renewal with -9033 while the order awaits validation, so check the prior order status first and report it plainly. A failed enrollment also saved a gateway row with a null CARequestID, which Command reported as 'Certificate with ID n was not found' and hid the real reason, so failures now carry a unique placeholder id that GetSingleRecord answers as failed.
SSL Store only downloads the current certificate of an order. GetSingleRecord for an {order}-{serial} request id returned that certificate under the old id after a reissue, so the gateway replaced the older certificate's row with the new one and the prior serial could no longer be found for renewal. Only return the certificate when its serial matches the request id.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requests carrying a prior certificate are now resolved from the SSL Store order expiry instead of the certificate expiry: reissue under the active order outside RenewalWindowDays (default 30), renew inside it, and order new once the order has expired. Removes the expired-cert renewal rejection.
Adds FlowLogger step diagrams to Enroll, Synchronize, Revoke, GetSingleRecord and Initialize, and tightens error handling on the enrollment path.