diff --git a/CHANGELOG.md b/CHANGELOG.md
index e82d4d6..8c11607 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,15 @@
+v1.2.0
+- New/Renew/Reissue requests with a prior certificate are resolved from the SSL Store order expiry: reissued under the active order outside the renewal window (RenewalWindowDays, default 30), renewed inside it, ordered new once the order has expired. Supports shorter-lived (~200 day) certificates
+- Removed the 'cannot renew an expired cert' failure; an expired order is now ordered as a new certificate
+- Credentials and tokens (AuthToken, PartnerCode, Token, TokenCode, TokenID, passwords) are now masked in all Trace log output
+- Enrollments now return a unique CA request ID ({order id}|{partner order id}, so repeated reissues of one order don't collide on the gateway's unique CARequestID index) and are reported as pending (awaiting validation) so Command keeps and polls them; GetSingleRecord returns the certificate once the order is issued and accepts order-serial request IDs
+- SSL Store errors returned with HTTP 200 (for example the hourly API quota) are now reported as failures in sync, order status and GetSingleRecord instead of looking like a successful sync
+- Reissue/renew now stops early with a clear message when the prior order is still pending validation (SSL Store would reject it with -9033), and failed enrollments return a placeholder CA request ID so Command shows the real failure instead of 'Certificate with ID n was not found'
+- GetSingleRecord no longer overwrites an older certificate's gateway record with the order's current certificate after a reissue; an {order}-{serial} request only returns the certificate with that serial
+- Prior certificate serial numbers now match with or without the leading 00 sign byte, so renewals of certificates whose serial starts with 0x80 or higher are found
+- Added FlowLogger step diagrams to the Trace log for Enroll, Synchronize, Revoke, GetSingleRecord and Initialize
+- Hardening: clearer errors when the prior certificate or its order cannot be found, SSL Store calls surface the original exception, per-step failure reporting in the flow log
+
 v1.1.1
 - SSL Store Api Changed Encoding Rules, needed to fix integration to match
   
diff --git a/SampleConfig.json b/SampleConfig.json
index dcb3f97..ab47e41 100644
--- a/SampleConfig.json
+++ b/SampleConfig.json
@@ -27,6 +27,7 @@
 		"KeyfactorApiUserId": "SomeKeyfactorAPIUser",
 		"KeyfactorApiPassword": "SomeKeyfactorAPIPassword",
 		"PageSize": "25",
+		"RenewalWindowDays": "30",
 		"SampleRequest": {
 			"AuthRequest": {
 				"PartnerCode": {
diff --git a/SslStoreCaProxy/Client/KeyfactorClient.cs b/SslStoreCaProxy/Client/KeyfactorClient.cs
index 5528388..561cc34 100644
--- a/SslStoreCaProxy/Client/KeyfactorClient.cs
+++ b/SslStoreCaProxy/Client/KeyfactorClient.cs
@@ -84,12 +84,12 @@ public async Task<Template> SubmitUpdateTemplateAsync(Template templateRequest)
             Logger.Trace("SubmitUpdateTemplateAsync called.");
             try
             {
-                Logger.Trace($"SubmitUpdateTemplateAsync Request JSON: {JsonConvert.SerializeObject(templateRequest)}");
+                Logger.Trace($"SubmitUpdateTemplateAsync Request JSON: {LogRedactor.Json(templateRequest)}");
                 using (var resp = await RestClient.PutAsync("/KeyfactorApi/Templates", new StringContent(
                     JsonConvert.SerializeObject(templateRequest), Encoding.ASCII, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitUpdateTemplateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitUpdateTemplateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var templateResponse = JsonConvert.DeserializeObject<Template>(responseBody);
                     if (templateResponse == null)
diff --git a/SslStoreCaProxy/Client/SslStoreClient.cs b/SslStoreCaProxy/Client/SslStoreClient.cs
index 9d61acf..3499347 100644
--- a/SslStoreCaProxy/Client/SslStoreClient.cs
+++ b/SslStoreCaProxy/Client/SslStoreClient.cs
@@ -55,12 +55,12 @@ public async Task<NewOrderResponse> SubmitNewOrderRequestAsync(NewOrderRequest n
             Logger.Trace("SubmitNewOrderRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitNewOrderRequestAsync Request JSON: {JsonConvert.SerializeObject(newOrderRequest)}");
+                Logger.Trace($"SubmitNewOrderRequestAsync Request JSON: {LogRedactor.Json(newOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/neworder", new StringContent(
                     JsonConvert.SerializeObject(newOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitNewOrderRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitNewOrderRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -82,12 +82,12 @@ public async Task<EmailApproverResponse> SubmitEmailApproverRequestAsync(EmailAp
             Logger.Trace("SubmitEmailApproverRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitEmailApproverRequestAsync Request JSON: {JsonConvert.SerializeObject(newApproverRequest)}");
+                Logger.Trace($"SubmitEmailApproverRequestAsync Request JSON: {LogRedactor.Json(newApproverRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/approverlist", new StringContent(
                     JsonConvert.SerializeObject(newApproverRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitEmailApproverRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitEmailApproverRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<EmailApproverResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -109,12 +109,12 @@ public async Task<NewOrderResponse> SubmitReIssueRequestAsync(ReIssueRequest reI
             Logger.Trace("SubmitReIssueRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitReIssueRequestAsync Request JSON: {JsonConvert.SerializeObject(reIssueOrderRequest)}");
+                Logger.Trace($"SubmitReIssueRequestAsync Request JSON: {LogRedactor.Json(reIssueOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/reissue", new StringContent(
                     JsonConvert.SerializeObject(reIssueOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitReIssueRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitReIssueRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var orderStatusResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (orderStatusResponse == null)
@@ -136,12 +136,12 @@ public async Task<NewOrderResponse> SubmitRenewRequestAsync(NewOrderRequest rene
             Logger.Trace("SubmitRenewRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitRenewRequestAsync Request JSON: {JsonConvert.SerializeObject(renewOrderRequest)}");
+                Logger.Trace($"SubmitRenewRequestAsync Request JSON: {LogRedactor.Json(renewOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/neworder", new StringContent(
                     JsonConvert.SerializeObject(renewOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitRenewRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitRenewRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -165,12 +165,12 @@ public async Task<IDownloadCertificateResponse> SubmitDownloadCertificateAsync(
             Logger.Trace("SubmitDownloadCertificateAsync called.");
             try
             {
-                Logger.Trace($"SubmitDownloadCertificateAsync Request JSON: {JsonConvert.SerializeObject(downloadOrderRequest)}");
+                Logger.Trace($"SubmitDownloadCertificateAsync Request JSON: {LogRedactor.Json(downloadOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/download", new StringContent(
                     JsonConvert.SerializeObject(downloadOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitDownloadCertificateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitDownloadCertificateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var downloadOrderResponse = JsonConvert.DeserializeObject<DownloadCertificateResponse>(responseBody);
                     if (downloadOrderResponse == null)
@@ -234,7 +234,7 @@ public async Task SubmitQueryOrderRequestAsync(BlockingCollection<INewOrderRespo
                             break;
                         }
 
-                        Logger.Trace($"Order List JSON {JsonConvert.SerializeObject(batchResponse)}");
+                        Logger.Trace($"Order List JSON {LogRedactor.Json(batchResponse)}");
 
                         var batchCount = batchResponse.Count;
                         Logger.Trace($"Processing {batchCount} items in batch (page {pageCounter})");
@@ -317,12 +317,12 @@ public async Task<IOrderStatusResponse> SubmitRevokeCertificateAsync(RevokeOrder
             Logger.Trace("SubmitRevokeCertificateAsync called.");
             try
             {
-                Logger.Trace($"SubmitRevokeCertificateAsync Request JSON: {JsonConvert.SerializeObject(revokeOrderRequest)}");
+                Logger.Trace($"SubmitRevokeCertificateAsync Request JSON: {LogRedactor.Json(revokeOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/refundrequest", new StringContent(
                     JsonConvert.SerializeObject(revokeOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitRevokeCertificateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitRevokeCertificateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var revocationResponse = JsonConvert.DeserializeObject<OrderStatusResponse>(responseBody);
                     if (revocationResponse == null)
                         Logger.Warn("SubmitRevokeCertificateAsync: Deserialized response is null.");
@@ -343,12 +343,12 @@ public async Task<INewOrderResponse> SubmitOrderStatusRequestAsync(OrderStatusRe
             Logger.Trace("SubmitOrderStatusRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitOrderStatusRequestAsync Request JSON: {JsonConvert.SerializeObject(orderStatusRequest)}");
+                Logger.Trace($"SubmitOrderStatusRequestAsync Request JSON: {LogRedactor.Json(orderStatusRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/status", new StringContent(
                     JsonConvert.SerializeObject(orderStatusRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitOrderStatusRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitOrderStatusRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var orderStatusResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (orderStatusResponse == null)
                         Logger.Warn("SubmitOrderStatusRequestAsync: Deserialized response is null.");
@@ -369,12 +369,12 @@ public async Task<IOrganizationResponse> SubmitOrganizationListAsync(Organizatio
             Logger.Trace("SubmitOrganizationListAsync called.");
             try
             {
-                Logger.Trace($"SubmitOrganizationListAsync Request JSON: {JsonConvert.SerializeObject(organizationListRequest)}");
+                Logger.Trace($"SubmitOrganizationListAsync Request JSON: {LogRedactor.Json(organizationListRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/digicert/organizationlist", new StringContent(
                     JsonConvert.SerializeObject(organizationListRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitOrganizationListAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitOrganizationListAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var organizationListResponse = JsonConvert.DeserializeObject<OrganizationResponse>(responseBody);
                     if (organizationListResponse == null)
                         Logger.Warn("SubmitOrganizationListAsync: Deserialized response is null.");
diff --git a/SslStoreCaProxy/Constants.cs b/SslStoreCaProxy/Constants.cs
index cddd657..1064022 100644
--- a/SslStoreCaProxy/Constants.cs
+++ b/SslStoreCaProxy/Constants.cs
@@ -6,9 +6,11 @@ internal class Constants
         public static string PartnerCode = "PartnerCode";
         public static string AuthToken = "AuthToken";
         public static string PageSize = "PageSize";
+        public static string RenewalWindowDays = "RenewalWindowDays";
         public static string KeyfactorApiUrl = "KeyfactorApiUrl";
         public static string KeyfactorApiUserId = "KeyfactorApiUserId";
         public static string KeyfactorApiPassword = "KeyfactorApiPassword";
         public static int DefaultPageSize = 100;
+        public static int DefaultRenewalWindowDays = 30;
     }
 }
\ No newline at end of file
diff --git a/SslStoreCaProxy/FlowLogger.cs b/SslStoreCaProxy/FlowLogger.cs
new file mode 100644
index 0000000..8572957
--- /dev/null
+++ b/SslStoreCaProxy/FlowLogger.cs
@@ -0,0 +1,225 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics;
+using System.Linq;
+using System.Text;
+
+namespace Keyfactor.AnyGateway.SslStore
+{
+    public enum FlowStepStatus
+    {
+        Success,
+        Failed,
+        Skipped,
+        InProgress
+    }
+
+    public class FlowStep
+    {
+        public string Name { get; set; }
+        public FlowStepStatus Status { get; set; }
+        public string Detail { get; set; }
+        public long ElapsedMs { get; set; }
+        public List<FlowStep> Children { get; } = new List<FlowStep>();
+    }
+
+    /// <summary>
+    ///     Tracks the high-level flow of an operation and renders a step diagram to the Trace log when disposed.
+    ///     Steps should only carry non-sensitive detail (IDs, counts, decisions), never CSRs, keys or contact data.
+    ///     Usage:
+    ///       using (var flow = new FlowLogger(m => Logger.Trace(m), "Enroll-New"))
+    ///       {
+    ///           flow.Step("ValidateInput");
+    ///           var result = flow.Step("SubmitRegistration", () => client.Submit(...));
+    ///           flow.Fail("CreateOrder", "API returned 400");
+    ///       }
+    /// </summary>
+    public sealed class FlowLogger : IDisposable
+    {
+        private readonly Action<string> _log;
+        private readonly string _flowName;
+        private readonly Stopwatch _totalTimer;
+        private readonly List<FlowStep> _steps = new List<FlowStep>();
+        private FlowStep _currentParent;
+        private bool _disposed;
+
+        public FlowLogger(Action<string> log, string flowName)
+        {
+            _log = log ?? (_ => { });
+            _flowName = flowName;
+            _totalTimer = Stopwatch.StartNew();
+            Write($"===== FLOW START: {_flowName} =====");
+        }
+
+        /// <summary>True if any recorded step failed.</summary>
+        public bool HasFailures => _steps.Any(s => s.Status == FlowStepStatus.Failed ||
+                                                   s.Children.Any(c => c.Status == FlowStepStatus.Failed));
+
+        /// <summary>Record a completed step.</summary>
+        public FlowLogger Step(string name, string detail = null)
+        {
+            AddStep(new FlowStep { Name = name, Status = FlowStepStatus.Success, Detail = detail });
+            Write($"  [{_flowName}] {name} ... OK{(detail != null ? $" ({detail})" : "")}");
+            return this;
+        }
+
+        /// <summary>Run an action as a timed step. Failures are recorded and rethrown.</summary>
+        public FlowLogger Step(string name, Action action, string detail = null)
+        {
+            Step<object>(name, () =>
+            {
+                action();
+                return null;
+            }, detail);
+            return this;
+        }
+
+        /// <summary>Run a function as a timed step and return its result. Failures are recorded and rethrown.</summary>
+        public T Step<T>(string name, Func<T> func, string detail = null)
+        {
+            var sw = Stopwatch.StartNew();
+            var step = new FlowStep { Name = name, Detail = detail };
+            try
+            {
+                Write($"  [{_flowName}] {name} ...");
+                var result = func();
+                sw.Stop();
+                step.Status = FlowStepStatus.Success;
+                step.ElapsedMs = sw.ElapsedMilliseconds;
+                AddStep(step);
+                Write($"  [{_flowName}] {name} ... OK ({sw.ElapsedMilliseconds}ms){(detail != null ? $" {detail}" : "")}");
+                return result;
+            }
+            catch (Exception ex)
+            {
+                sw.Stop();
+                step.Status = FlowStepStatus.Failed;
+                step.ElapsedMs = sw.ElapsedMilliseconds;
+                step.Detail = ex.Message;
+                AddStep(step);
+                Write($"  [{_flowName}] {name} ... FAILED ({sw.ElapsedMilliseconds}ms): {ex.Message}");
+                throw;
+            }
+        }
+
+        /// <summary>Record a failed step without throwing.</summary>
+        public FlowLogger Fail(string name, string reason = null)
+        {
+            AddStep(new FlowStep { Name = name, Status = FlowStepStatus.Failed, Detail = reason });
+            Write($"  [{_flowName}] {name} ... FAILED{(reason != null ? $": {reason}" : "")}");
+            return this;
+        }
+
+        /// <summary>Record a skipped step.</summary>
+        public FlowLogger Skip(string name, string reason = null)
+        {
+            AddStep(new FlowStep { Name = name, Status = FlowStepStatus.Skipped, Detail = reason });
+            Write($"  [{_flowName}] {name} ... SKIPPED{(reason != null ? $": {reason}" : "")}");
+            return this;
+        }
+
+        /// <summary>Start a branch (group of child steps).</summary>
+        public FlowLogger Branch(string name)
+        {
+            var step = new FlowStep { Name = name, Status = FlowStepStatus.InProgress };
+            AddStep(step);
+            _currentParent = step;
+            Write($"  [{_flowName}] >> Branch: {name}");
+            return this;
+        }
+
+        /// <summary>End the current branch.</summary>
+        public FlowLogger EndBranch()
+        {
+            if (_currentParent != null && _currentParent.Status == FlowStepStatus.InProgress)
+                _currentParent.Status = _currentParent.Children.Any(c => c.Status == FlowStepStatus.Failed)
+                    ? FlowStepStatus.Failed
+                    : FlowStepStatus.Success;
+            _currentParent = null;
+            return this;
+        }
+
+        private void Write(string message)
+        {
+            try
+            {
+                _log(message);
+            }
+            catch
+            {
+                // Flow logging must never break the operation being logged.
+            }
+        }
+
+        private void AddStep(FlowStep step)
+        {
+            if (_currentParent != null)
+                _currentParent.Children.Add(step);
+            else
+                _steps.Add(step);
+        }
+
+        private string RenderFlow()
+        {
+            var sb = new StringBuilder();
+            sb.AppendLine();
+            sb.AppendLine($"  ===== FLOW: {_flowName} ({_totalTimer.ElapsedMilliseconds}ms total) =====");
+            sb.AppendLine();
+
+            for (var i = 0; i < _steps.Count; i++)
+            {
+                var step = _steps[i];
+                sb.AppendLine($"    {GetStatusIcon(step.Status)} {step.Name}{FormatTiming(step)}{FormatDetail(step)}");
+
+                foreach (var child in step.Children)
+                {
+                    sb.AppendLine("    |");
+                    sb.AppendLine($"    +-- {GetStatusIcon(child.Status)} {child.Name}{FormatTiming(child)}{FormatDetail(child)}");
+                }
+
+                if (i < _steps.Count - 1)
+                {
+                    sb.AppendLine("    |");
+                    sb.AppendLine("    v");
+                }
+            }
+
+            sb.AppendLine();
+            var finalStatus = _steps.Count > 0 && _steps.Last().Status == FlowStepStatus.Failed
+                ? "FAILED"
+                : HasFailures ? "PARTIAL FAILURE" : "SUCCESS";
+            sb.AppendLine($"  ===== FLOW RESULT: {finalStatus} =====");
+            return sb.ToString();
+        }
+
+        private static string FormatTiming(FlowStep step)
+        {
+            return step.ElapsedMs > 0 ? $" ({step.ElapsedMs}ms)" : "";
+        }
+
+        private static string FormatDetail(FlowStep step)
+        {
+            return !string.IsNullOrEmpty(step.Detail) ? $" [{step.Detail}]" : "";
+        }
+
+        private static string GetStatusIcon(FlowStepStatus status)
+        {
+            switch (status)
+            {
+                case FlowStepStatus.Success: return "[OK]";
+                case FlowStepStatus.Failed: return "[FAIL]";
+                case FlowStepStatus.Skipped: return "[SKIP]";
+                case FlowStepStatus.InProgress: return "[...]";
+                default: return "[?]";
+            }
+        }
+
+        public void Dispose()
+        {
+            if (_disposed) return;
+            _disposed = true;
+            _totalTimer.Stop();
+            Write(RenderFlow());
+        }
+    }
+}
diff --git a/SslStoreCaProxy/LogRedactor.cs b/SslStoreCaProxy/LogRedactor.cs
new file mode 100644
index 0000000..a607281
--- /dev/null
+++ b/SslStoreCaProxy/LogRedactor.cs
@@ -0,0 +1,30 @@
+using System.Text.RegularExpressions;
+using Newtonsoft.Json;
+
+namespace Keyfactor.AnyGateway.SslStore
+{
+    /// <summary>
+    ///     Masks credentials and tokens in JSON before it is written to the log.
+    /// </summary>
+    internal static class LogRedactor
+    {
+        private const string Mask = "***REDACTED***";
+
+        private static readonly Regex SensitiveValues = new Regex(
+            "(\"(?:AuthToken|PartnerCode|InvokingPartnerCode|ReplayToken|Token|TokenCode|TokenID|CustomerPassword|" +
+            "KeyfactorApiPassword|Password)\"\\s*:\\s*)\"(?:[^\"\\\\]|\\\\.)*\"",
+            RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+        /// <summary>Serializes an object to JSON with sensitive values masked.</summary>
+        public static string Json(object value)
+        {
+            return Redact(JsonConvert.SerializeObject(value));
+        }
+
+        /// <summary>Masks sensitive values in a JSON string.</summary>
+        public static string Redact(string json)
+        {
+            return string.IsNullOrEmpty(json) ? json : SensitiveValues.Replace(json, "$1\"" + Mask + "\"");
+        }
+    }
+}
diff --git a/SslStoreCaProxy/SslStoreCaProxy.cs b/SslStoreCaProxy/SslStoreCaProxy.cs
index 52e1520..2eb9d41 100644
--- a/SslStoreCaProxy/SslStoreCaProxy.cs
+++ b/SslStoreCaProxy/SslStoreCaProxy.cs
@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
+using System.Globalization;
 using System.Security.Cryptography.X509Certificates;
 using System.Text;
 using System.Threading;
@@ -22,6 +23,8 @@ namespace Keyfactor.AnyGateway.SslStore
 {
     public class SslStoreCaProxy : BaseCAConnector
     {
+        private const int FailedStatus = 30;
+
         private readonly RequestManager _requestManager;
 
         public SslStoreCaProxy()
@@ -35,8 +38,59 @@ public SslStoreCaProxy()
         public string PartnerCode { get; set; }
         public string AuthenticationToken { get; set; }
         public int PageSize { get; set; }
+        private int RenewalWindowDays { get; set; } = Constants.DefaultRenewalWindowDays;
+
+        //CA request IDs are {order id}, {order id}-{serial}, or {order id}|{partner order id} from older gateway versions
+        private static readonly char[] CaRequestIdSeparators = {'-', '|'};
+
+        private static string GetOrderId(string caRequestId)
+        {
+            return caRequestId.Split(CaRequestIdSeparators)[0];
+        }
+
+        //SSL Store answers HTTP 200 with AuthResponse.isError for problems such as the hourly API quota
+        private static string GetApiError(IAuthResponse authResponse)
+        {
+            if (authResponse == null || !authResponse.IsError) return null;
+            return authResponse.Message != null && authResponse.Message.Count > 0
+                ? authResponse.Message[0]
+                : "(no error message)";
+        }
+
+        private FlowLogger NewFlow(string name)
+        {
+            return new FlowLogger(message => Logger.Trace(message), name);
+        }
+
+        private static T RunSync<T>(Func<Task<T>> operation)
+        {
+            //GetAwaiter().GetResult() surfaces the real exception instead of an AggregateException
+            return Task.Run(operation).GetAwaiter().GetResult();
+        }
+
+        //A failed enrollment with no CARequestID leaves a gateway row Command cannot look up ("Certificate with ID n was
+        //not found"), which hides the real reason. Give every failure a unique placeholder id instead.
+        private const string FailedRequestPrefix = "FAILED|";
+
+        private static EnrollmentResult Failure(string message)
+        {
+            return new EnrollmentResult
+            {
+                Status = FailedStatus,
+                CARequestID = FailedRequestPrefix + Guid.NewGuid().ToString("N"),
+                StatusMessage = message
+            };
+        }
 
         public override int Revoke(string caRequestId, string hexSerialNumber, uint revocationReason)
+        {
+            using (var flow = NewFlow("Revoke"))
+            {
+                return RevokeInternal(flow, caRequestId, hexSerialNumber, revocationReason);
+            }
+        }
+
+        private int RevokeInternal(FlowLogger flow, string caRequestId, string hexSerialNumber, uint revocationReason)
         {
             Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
             Logger.Trace($"Entering Revoke Method: caRequestId={caRequestId ?? "(null)"}, hexSerialNumber={hexSerialNumber ?? "(null)"}, revocationReason={revocationReason}");
@@ -45,23 +99,26 @@ public override int Revoke(string caRequestId, string hexSerialNumber, uint revo
                 if (string.IsNullOrEmpty(caRequestId))
                 {
                     Logger.Error("Revoke called with null or empty caRequestId.");
+                    flow.Fail("ValidateInput", "caRequestId is null or empty");
                     return Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED);
                 }
 
-                var caRequestIdParts = caRequestId.Split('-');
+                var caRequestIdParts = caRequestId.Split(CaRequestIdSeparators);
                 Logger.Trace($"Revoke caRequestId split into {caRequestIdParts.Length} parts, using first part: {caRequestIdParts[0]}");
 
+                flow.Step("ValidateInput", $"order={caRequestIdParts[0]}, reason={revocationReason}");
                 var revokeOrderRequest = _requestManager.GetRevokeOrderRequest(caRequestIdParts[0]);
-                Logger.Trace($"Revoke Request JSON {JsonConvert.SerializeObject(revokeOrderRequest)}");
+                Logger.Trace($"Revoke Request JSON {LogRedactor.Json(revokeOrderRequest)}");
 
-                var requestResponse =
-                    Task.Run(async () => await SslStoreClient.SubmitRevokeCertificateAsync(revokeOrderRequest)).Result;
+                var requestResponse = flow.Step("SubmitRevokeToSslStore",
+                    () => RunSync(() => SslStoreClient.SubmitRevokeCertificateAsync(revokeOrderRequest)));
 
-                Logger.Trace($"Revoke Response JSON {JsonConvert.SerializeObject(requestResponse)}");
+                Logger.Trace($"Revoke Response JSON {LogRedactor.Json(requestResponse)}");
 
                 if (requestResponse == null)
                 {
                     Logger.Error("Revoke response is null.");
+                    flow.Fail("EvaluateResponse", "response is null");
                     Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
                     return Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED);
                 }
@@ -69,17 +126,20 @@ public override int Revoke(string caRequestId, string hexSerialNumber, uint revo
                 if (requestResponse.AuthResponse == null)
                 {
                     Logger.Error("Revoke response AuthResponse is null.");
+                    flow.Fail("EvaluateResponse", "AuthResponse is null");
                     Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
                     return Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED);
                 }
 
                 if (requestResponse.AuthResponse.IsError)
                 {
-                    Logger.Error($"Revoke Error Occurred: {JsonConvert.SerializeObject(requestResponse.AuthResponse)}");
+                    Logger.Error($"Revoke Error Occurred: {LogRedactor.Json(requestResponse.AuthResponse)}");
+                    flow.Fail("EvaluateResponse", "SSL Store returned an error");
                     Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
                     return Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.FAILED);
                 }
 
+                flow.Step("EvaluateResponse", "revoked");
                 Logger.Trace("Revoke completed successfully.");
                 Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
 
@@ -87,6 +147,7 @@ public override int Revoke(string caRequestId, string hexSerialNumber, uint revo
             }
             catch (Exception e)
             {
+                flow.Fail("Revoke", e.Message);
                 Logger.Error($"An Error has occurred during the revoke process: {e.Message}\n{e.StackTrace}");
                 if (e.InnerException != null)
                     Logger.Error($"Inner exception: {e.InnerException.Message}\n{e.InnerException.StackTrace}");
@@ -109,226 +170,366 @@ public override EnrollmentResult Enroll(ICertificateDataReader certificateDataRe
             Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
             Logger.Trace($"Enroll called: enrollmentType={enrollmentType}, subject={subject ?? "(null)"}, ProductID={productInfo?.ProductID ?? "(null)"}");
 
-            try
+            using (var flow = NewFlow($"Enroll-{enrollmentType}"))
             {
-                if (productInfo == null)
+                try
                 {
-                    Logger.Error("Enroll called with null productInfo.");
-                    return new EnrollmentResult { Status = 30, StatusMessage = "Product info is null." };
+                    return EnrollInternal(flow, certificateDataReader, csr, productInfo, enrollmentType);
                 }
-
-                if (productInfo.ProductParameters == null)
+                catch (Exception ex)
                 {
-                    Logger.Error("Enroll called with null ProductParameters.");
-                    return new EnrollmentResult { Status = 30, StatusMessage = "Product parameters are null." };
+                    flow.Fail("Enroll", ex.Message);
+                    Logger.Error($"Enroll failed with exception: {ex.Message}\n{ex.StackTrace}");
+                    if (ex.InnerException != null)
+                        Logger.Error($"Inner exception: {ex.InnerException.Message}\n{ex.InnerException.StackTrace}");
+                    return Failure($"Enrollment failed: {ex.Message}");
                 }
-
-                Logger.Trace($"Enroll ProductParameters keys: {string.Join(", ", productInfo.ProductParameters.Keys)}");
-
-                INewOrderResponse enrollmentResponse = null;
-                NewOrderRequest enrollmentRequest;
-                ReIssueRequest reIssueRequest;
-                CAConnectorCertificate priorCert;
-                OrderStatusRequest orderStatusRequest;
-                INewOrderResponse orderStatusResponse;
-
-                switch (enrollmentType)
+                finally
                 {
-                    case RequestUtilities.EnrollmentType.New:
-                        Logger.Trace("Entering New Enrollment");
-                        //If they renewed an expired cert it gets here and this will not be supported
-                        if (!productInfo.ProductParameters.ContainsKey("PriorCertSN"))
-                        {
-                            string[] arrayProducts = Array.Empty<string>();
-                            string[] arrayApproverEmails = Array.Empty<string>();
-
-                            if (productInfo.ProductParameters.ContainsKey("DNS Names Comma Separated"))
-                            {
-                                Logger.Trace($"DNS Comma Separated {productInfo.ProductParameters["DNS Names Comma Separated"]}");
-                                arrayProducts = productInfo.ProductParameters["DNS Names Comma Separated"].Split(new char[] { ',' });
-                            }
-                            if (productInfo.ProductParameters.ContainsKey("Approver Email"))
-                            {
-                                Logger.Trace($"Approver Email {productInfo.ProductParameters["Approver Email"]}");
-                                arrayApproverEmails = productInfo.ProductParameters["Approver Email"].Split(new char[] { ',' });
-                            }
-
-                            Logger.Trace($"New Enrollment: {arrayProducts.Length} DNS products, {arrayApproverEmails.Length} approver emails");
+                    Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
+                }
+            }
+        }
 
-                            var count = 1;
-                            foreach (var product in arrayProducts)
-                            {
-                                Logger.Trace($"Validating email approver for product domain '{product}' (#{count})...");
-                                var emailApproverRequest = _requestManager.GetEmailApproverListRequest(productInfo.ProductID, product);
-                                Logger.Trace($"Email Approver Request JSON {JsonConvert.SerializeObject(emailApproverRequest)}");
+        private EnrollmentResult EnrollInternal(FlowLogger flow, ICertificateDataReader certificateDataReader,
+            string csr, EnrollmentProductInfo productInfo, RequestUtilities.EnrollmentType requestedType)
+        {
+            if (productInfo == null)
+            {
+                flow.Fail("ValidateInput", "productInfo is null");
+                return Failure("Product info is null.");
+            }
 
-                                var emailApproverResponse = Task.Run(async () =>
-                                    await SslStoreClient.SubmitEmailApproverRequestAsync(emailApproverRequest));
+            if (productInfo.ProductParameters == null)
+            {
+                flow.Fail("ValidateInput", "ProductParameters is null");
+                return Failure("Product parameters are null.");
+            }
 
-                                Logger.Trace($"Email Approver Response JSON {JsonConvert.SerializeObject(emailApproverResponse)}");
+            var hasPriorCert = productInfo.ProductParameters.TryGetValue("PriorCertSN", out var priorCertSn) &&
+                               !string.IsNullOrWhiteSpace(priorCertSn);
+            flow.Step("ValidateInput", $"product={productInfo.ProductID}, hasPriorCert={hasPriorCert}");
+            Logger.Trace($"Enroll ProductParameters keys: {string.Join(", ", productInfo.ProductParameters.Keys)}");
 
-                                var emailValidation = ValidateEmails(emailApproverResponse, arrayApproverEmails, productInfo, count);
+            if (requestedType != RequestUtilities.EnrollmentType.New &&
+                requestedType != RequestUtilities.EnrollmentType.Renew &&
+                requestedType != RequestUtilities.EnrollmentType.Reissue)
+            {
+                flow.Fail("SelectPath", $"unsupported enrollment type {requestedType}");
+                return Failure($"Unknown enrollment type: {requestedType}");
+            }
 
-                                Logger.Trace($"Email Validation Result {emailValidation}");
+            if (!hasPriorCert && requestedType != RequestUtilities.EnrollmentType.New)
+            {
+                flow.Fail("ValidateInput", $"{requestedType} requires PriorCertSN");
+                return Failure($"PriorCertSN is required for {requestedType.ToString().ToLowerInvariant()}.");
+            }
 
-                                if (emailValidation.Length > 0)
-                                {
-                                    Logger.Warn($"Email validation failed: {emailValidation}");
-                                    return new EnrollmentResult
-                                    {
-                                        Status = 30, //failure
-                                        StatusMessage = emailValidation
-                                    };
-                                }
-                                count++;
-                            }
+            // New, Renew and Reissue requests that carry a prior certificate are resolved from the prior certificate's
+            // order, not from what Command asked for, so shorter-lived (~200 day) certs under an active order are
+            // reissued instead of renewed (and an expired order is simply ordered again).
+            INewOrderResponse priorOrder = null;
+            var enrollmentType = requestedType;
+            if (hasPriorCert)
+            {
+                priorOrder = GetPriorOrder(flow, certificateDataReader, priorCertSn);
+                enrollmentType = ResolveEnrollmentType(flow, priorOrder, requestedType);
+            }
+            else
+            {
+                flow.Skip("EvaluateOrderValidity", "no PriorCertSN");
+            }
 
+            flow.Step("EnrollmentDecision", $"requested={requestedType}, resolved={enrollmentType}");
 
-                            Logger.Trace("Building enrollment request...");
-                            enrollmentRequest =
-                                _requestManager.GetEnrollmentRequest(csr, productInfo, ConfigManager, false);
+            //SSL Store rejects a reissue or renewal (-9033, certificate is not active) while the order is still waiting
+            //on validation, for example right after an earlier reissue
+            var priorMajorStatus = priorOrder?.OrderStatus?.MajorStatus;
+            if (enrollmentType != RequestUtilities.EnrollmentType.New &&
+                string.Equals(priorMajorStatus, "Pending", StringComparison.OrdinalIgnoreCase))
+            {
+                var pendingMessage = $"Order {priorOrder.TheSslStoreOrderId} is still pending validation " +
+                                     $"({priorOrder.OrderStatus.MinorStatus ?? "pending"}). Approve the pending request " +
+                                     "(approver email or DCV) before reissuing or renewing this certificate.";
+                flow.Fail("CheckPriorOrderActive", pendingMessage);
+                return Failure(pendingMessage);
+            }
 
-                            Logger.Trace($"enrollmentRequest JSON {JsonConvert.SerializeObject(enrollmentRequest)}");
+            INewOrderResponse enrollmentResponse;
+            switch (enrollmentType)
+            {
+                case RequestUtilities.EnrollmentType.New:
+                    if (hasPriorCert)
+                        flow.Step("PriorCertNotReused", "ordering as a new certificate");
+                    var newOrderFailure = SubmitNewOrder(flow, csr, productInfo, out enrollmentResponse);
+                    if (newOrderFailure != null) return newOrderFailure;
+                    break;
+                case RequestUtilities.EnrollmentType.Renew:
+                    var renewRequest = flow.Step("BuildRenewalRequest",
+                        () => _requestManager.GetRenewalRequest(priorOrder, csr));
+                    Logger.Trace($"renewRequest JSON {LogRedactor.Json(renewRequest)}");
+                    enrollmentResponse = flow.Step("SubmitRenewalToSslStore",
+                        () => RunSync(() => SslStoreClient.SubmitRenewRequestAsync(renewRequest)));
+                    break;
+                default:
+                    var reIssueRequest = flow.Step("BuildReissueRequest",
+                        () => _requestManager.GetReIssueRequest(priorOrder, csr, false));
+                    Logger.Trace($"reIssueRequest JSON {LogRedactor.Json(reIssueRequest)}");
+                    enrollmentResponse = flow.Step("SubmitReissueToSslStore",
+                        () => RunSync(() => SslStoreClient.SubmitReIssueRequestAsync(reIssueRequest)));
+                    break;
+            }
 
-                            Logger.Trace("Submitting new order request...");
-                            enrollmentResponse =
-                                Task.Run(async () => await SslStoreClient.SubmitNewOrderRequestAsync(enrollmentRequest))
-                                    .Result;
+            Logger.Trace($"enrollmentResponse JSON {LogRedactor.Json(enrollmentResponse)}");
 
-                            Logger.Trace($"enrollmentResponse JSON {JsonConvert.SerializeObject(enrollmentResponse)}");
-                        }
-                        else
-                        {
-                            Logger.Warn("Enrollment rejected: PriorCertSN present in New enrollment (expired cert renewal not supported).");
-                            return new EnrollmentResult
-                            {
-                                Status = 30, //failure
-                                StatusMessage = "You cannot renew and expired cert please perform an new enrollment."
-                            };
-                        }
+            var result = GetEnrollmentResult(enrollmentResponse);
+            if (result.Status == FailedStatus)
+                flow.Fail("MapEnrollmentResult", $"SSL Store rejected the request: {result.StatusMessage}");
+            else
+                flow.Step("MapEnrollmentResult", $"status={result.Status}");
+            return result;
+        }
 
-                        break;
-                    case RequestUtilities.EnrollmentType.Renew:
-                        Logger.Trace("Entering Renew Enrollment");
+        /// <summary>
+        ///     Validates approver emails and submits a brand new order. Returns a failure result, or null on success.
+        /// </summary>
+        private EnrollmentResult SubmitNewOrder(FlowLogger flow, string csr, EnrollmentProductInfo productInfo,
+            out INewOrderResponse enrollmentResponse)
+        {
+            enrollmentResponse = null;
+            var arrayProducts = Array.Empty<string>();
+            var arrayApproverEmails = Array.Empty<string>();
 
-                        if (!productInfo.ProductParameters.ContainsKey("PriorCertSN"))
-                        {
-                            Logger.Error("Renew enrollment missing required PriorCertSN parameter.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "PriorCertSN is required for renewal." };
-                        }
+            if (productInfo.ProductParameters.ContainsKey("DNS Names Comma Separated"))
+            {
+                Logger.Trace($"DNS Comma Separated {productInfo.ProductParameters["DNS Names Comma Separated"]}");
+                arrayProducts = productInfo.ProductParameters["DNS Names Comma Separated"].Split(',');
+            }
 
-                        Logger.Trace($"PriorCertSN={productInfo.ProductParameters["PriorCertSN"]}");
-                        priorCert = certificateDataReader.GetCertificateRecord(
-                            DataConversion.HexToBytes(productInfo.ProductParameters["PriorCertSN"]));
+            if (productInfo.ProductParameters.ContainsKey("Approver Email"))
+            {
+                Logger.Trace($"Approver Email {productInfo.ProductParameters["Approver Email"]}");
+                arrayApproverEmails = productInfo.ProductParameters["Approver Email"].Split(',');
+            }
 
-                        if (priorCert == null)
-                        {
-                            Logger.Error($"Prior certificate not found for PriorCertSN={productInfo.ProductParameters["PriorCertSN"]}");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Prior certificate record not found." };
-                        }
+            Logger.Trace($"New Enrollment: {arrayProducts.Length} DNS products, {arrayApproverEmails.Length} approver emails");
 
-                        Logger.Trace($"Prior Cert CARequestID={priorCert.CARequestID ?? "(null)"}");
+            var count = 1;
+            foreach (var product in arrayProducts)
+            {
+                Logger.Trace($"Validating email approver for product domain '{product}' (#{count})...");
+                var emailApproverRequest = _requestManager.GetEmailApproverListRequest(productInfo.ProductID, product);
+                Logger.Trace($"Email Approver Request JSON {LogRedactor.Json(emailApproverRequest)}");
 
-                        if (string.IsNullOrEmpty(priorCert.CARequestID))
-                        {
-                            Logger.Error("Prior certificate has null/empty CARequestID.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Prior certificate has no CA Request ID." };
-                        }
+                var emailApproverResponse = Task.Run(async () =>
+                    await SslStoreClient.SubmitEmailApproverRequestAsync(emailApproverRequest));
 
-                        orderStatusRequest = _requestManager.GetOrderStatusRequest(priorCert.CARequestID.Split('-')[0]);
+                var emailValidation = ValidateEmails(emailApproverResponse, arrayApproverEmails, productInfo, count);
+                Logger.Trace($"Email Validation Result {emailValidation}");
 
-                        Logger.Trace($"orderStatusRequest JSON {JsonConvert.SerializeObject(orderStatusRequest)}");
+                if (emailValidation.Length > 0)
+                {
+                    Logger.Warn($"Email validation failed: {emailValidation}");
+                    flow.Fail("ValidateApproverEmails", emailValidation);
+                    return Failure(emailValidation);
+                }
 
-                        orderStatusResponse = Task.Run(async () =>
-                            await SslStoreClient.SubmitOrderStatusRequestAsync(orderStatusRequest)).Result;
+                count++;
+            }
 
-                        if (orderStatusResponse == null)
-                        {
-                            Logger.Error("Order status response is null during renewal.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Failed to retrieve order status for renewal." };
-                        }
+            flow.Step("ValidateApproverEmails", $"{arrayProducts.Length} domain(s)");
 
-                        Logger.Trace($"orderStatusResponse JSON {JsonConvert.SerializeObject(orderStatusResponse)}");
+            var enrollmentRequest = flow.Step("BuildNewOrderRequest",
+                () => _requestManager.GetEnrollmentRequest(csr, productInfo, ConfigManager, false));
+            Logger.Trace($"enrollmentRequest JSON {LogRedactor.Json(enrollmentRequest)}");
 
-                        var renewRequest = _requestManager.GetRenewalRequest(orderStatusResponse, csr);
+            enrollmentResponse = flow.Step("SubmitNewOrderToSslStore",
+                () => RunSync(() => SslStoreClient.SubmitNewOrderRequestAsync(enrollmentRequest)));
+            return null;
+        }
 
-                        Logger.Trace($"renewRequest JSON {JsonConvert.SerializeObject(renewRequest)}");
+        /// <summary>
+        ///     Looks up a certificate by serial number, tolerating the DER sign-padding byte. A serial whose first byte is
+        ///     0x80 or higher is stored with a leading 00 (for example 00B970...), but Command may send it without.
+        /// </summary>
+        private CAConnectorCertificate FindCertificateBySerial(FlowLogger flow,
+            ICertificateDataReader certificateDataReader, string hexSerial)
+        {
+            var candidates = GetSerialNumberCandidates(hexSerial);
+            foreach (var candidate in candidates)
+            {
+                var record = certificateDataReader.GetCertificateRecord(DataConversion.HexToBytes(candidate));
+                if (record == null) continue;
 
-                        Logger.Trace("Submitting renewal request...");
-                        enrollmentResponse =
-                            Task.Run(async () => await SslStoreClient.SubmitRenewRequestAsync(renewRequest)).Result;
+                if (candidate != candidates[0])
+                    flow.Step("SerialNumberNormalized", $"matched serial variant '{candidate}' (requested '{candidates[0]}')");
+                return record;
+            }
 
-                        Logger.Trace($"enrollmentResponse JSON {JsonConvert.SerializeObject(enrollmentResponse)}");
+            flow.Fail("LocatePriorCertificate", $"no certificate found for serial '{hexSerial}' or its leading-zero variants");
+            return null;
+        }
 
-                        break;
-                    case RequestUtilities.EnrollmentType.Reissue:
-                        Logger.Trace("Entering Reissue Enrollment");
+        private static List<string> GetSerialNumberCandidates(string hexSerial)
+        {
+            var candidates = new List<string>();
+            var serial = (hexSerial ?? string.Empty).Trim();
+            if (serial.StartsWith("0x", StringComparison.OrdinalIgnoreCase)) serial = serial.Substring(2);
+            serial = serial.Replace(" ", string.Empty).Replace(":", string.Empty).ToUpperInvariant();
+            if (serial.Length == 0) return candidates;
+            if (serial.Length % 2 != 0) serial = "0" + serial;
+            candidates.Add(serial);
+
+            var stripped = serial;
+            while (stripped.Length > 2 && stripped.StartsWith("00", StringComparison.Ordinal))
+                stripped = stripped.Substring(2);
+            if (!candidates.Contains(stripped)) candidates.Add(stripped);
+
+            if (Convert.ToInt32(stripped.Substring(0, 2), 16) >= 0x80 && !candidates.Contains("00" + stripped))
+                candidates.Add("00" + stripped);
+
+            return candidates;
+        }
 
-                        if (!productInfo.ProductParameters.ContainsKey("PriorCertSN"))
-                        {
-                            Logger.Error("Reissue enrollment missing required PriorCertSN parameter.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "PriorCertSN is required for reissue." };
-                        }
+        /// <summary>
+        ///     Finds the prior certificate in the gateway database and returns the current status of its SSL Store order.
+        /// </summary>
+        private INewOrderResponse GetPriorOrder(FlowLogger flow, ICertificateDataReader certificateDataReader,
+            string priorCertSn)
+        {
+            Logger.Trace($"PriorCertSN={priorCertSn}");
+            var priorCert = FindCertificateBySerial(flow, certificateDataReader, priorCertSn);
+            if (priorCert == null)
+            {
+                Logger.Error($"Prior certificate not found for PriorCertSN={priorCertSn}");
+                throw new InvalidOperationException($"Prior certificate record not found for serial number '{priorCertSn}'.");
+            }
 
-                        Logger.Trace($"PriorCertSN={productInfo.ProductParameters["PriorCertSN"]}");
-                        priorCert =
-                            certificateDataReader.GetCertificateRecord(
-                                DataConversion.HexToBytes(productInfo.ProductParameters["PriorCertSN"]));
+            Logger.Trace($"Prior Cert CARequestID={priorCert.CARequestID ?? "(null)"}");
+            if (string.IsNullOrEmpty(priorCert.CARequestID))
+            {
+                Logger.Error("Prior certificate has null/empty CARequestID.");
+                throw new InvalidOperationException("Prior certificate has no CA Request ID.");
+            }
 
-                        if (priorCert == null)
-                        {
-                            Logger.Error($"Prior certificate not found for PriorCertSN={productInfo.ProductParameters["PriorCertSN"]}");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Prior certificate record not found." };
-                        }
+            //CARequestID is {SSL Store order id}-{serial number}, several certificates can share an order
+            var orderId = GetOrderId(priorCert.CARequestID);
+            flow.Step("ResolvePriorCertificate", $"order={orderId}");
 
-                        Logger.Trace($"Prior Cert CARequestID={priorCert.CARequestID ?? "(null)"}");
+            var orderStatusRequest = _requestManager.GetOrderStatusRequest(orderId);
+            Logger.Trace($"orderStatusRequest JSON {LogRedactor.Json(orderStatusRequest)}");
 
-                        if (string.IsNullOrEmpty(priorCert.CARequestID))
-                        {
-                            Logger.Error("Prior certificate has null/empty CARequestID.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Prior certificate has no CA Request ID." };
-                        }
+            var orderStatusResponse = flow.Step("FetchPriorOrderStatus",
+                () => RunSync(() => SslStoreClient.SubmitOrderStatusRequestAsync(orderStatusRequest)), $"order={orderId}");
+            if (orderStatusResponse == null)
+            {
+                Logger.Error("Order status response is null for the prior order.");
+                throw new InvalidOperationException($"Failed to retrieve the status of prior order {orderId}.");
+            }
 
-                        orderStatusRequest = _requestManager.GetOrderStatusRequest(priorCert.CARequestID.Split('-')[0]);
+            Logger.Trace($"orderStatusResponse JSON {LogRedactor.Json(orderStatusResponse)}");
 
-                        Logger.Trace($"orderStatusRequest JSON {JsonConvert.SerializeObject(orderStatusRequest)}");
+            //SSL Store answers 200 with isError for an unknown order, don't build a renewal from an empty response
+            if (orderStatusResponse.AuthResponse != null && orderStatusResponse.AuthResponse.IsError)
+            {
+                var reason = orderStatusResponse.AuthResponse.Message != null && orderStatusResponse.AuthResponse.Message.Count > 0
+                    ? orderStatusResponse.AuthResponse.Message[0]
+                    : "(no error message)";
+                flow.Fail("FetchPriorOrderStatus", reason);
+                throw new InvalidOperationException($"SSL Store could not return prior order '{orderId}' (CA request ID '{priorCert.CARequestID}'): {reason}");
+            }
 
-                        orderStatusResponse = Task.Run(async () =>
-                            await SslStoreClient.SubmitOrderStatusRequestAsync(orderStatusRequest)).Result;
+            return orderStatusResponse;
+        }
 
-                        if (orderStatusResponse == null)
-                        {
-                            Logger.Error("Order status response is null during reissue.");
-                            return new EnrollmentResult { Status = 30, StatusMessage = "Failed to retrieve order status for reissue." };
-                        }
+        /// <summary>
+        ///     Resolves New / Renew / Reissue from the prior certificate's order expiry rather than the certificate's own
+        ///     expiration, so shorter-lived certificates under an active order are reissued, not renewed.
+        ///       explicit Reissue                          -> Reissue
+        ///       order beyond the renewal window           -> Reissue (under the active order)
+        ///       order inside the window, not yet expired  -> Renew
+        ///       order expired                             -> New
+        ///     Falls back to the certificate's expiration when the order expiry is unavailable. If nothing can be
+        ///     evaluated the requested type is kept.
+        /// </summary>
+        private RequestUtilities.EnrollmentType ResolveEnrollmentType(FlowLogger flow, INewOrderResponse priorOrder,
+            RequestUtilities.EnrollmentType requested)
+        {
+            if (requested == RequestUtilities.EnrollmentType.Reissue)
+            {
+                flow.Skip("EvaluateOrderValidity", "explicit Reissue request");
+                return requested;
+            }
 
-                        Logger.Trace($"orderStatusResponse JSON {JsonConvert.SerializeObject(orderStatusResponse)}");
+            try
+            {
+                if (TryGetOrderExpiry(priorOrder, out var orderExpiry, out var source))
+                {
+                    var daysLeft = (orderExpiry - DateTime.UtcNow).TotalDays;
+                    var resolved = daysLeft > RenewalWindowDays ? RequestUtilities.EnrollmentType.Reissue
+                        : daysLeft >= 0 ? RequestUtilities.EnrollmentType.Renew
+                        : RequestUtilities.EnrollmentType.New;
+                    flow.Step("EvaluateOrderValidity",
+                        $"orderExpiry={orderExpiry:dd-MMM-yyyy} ({source}), daysLeft={(int) daysLeft}, window={RenewalWindowDays}, result={resolved}");
+                    return resolved;
+                }
 
-                        reIssueRequest = _requestManager.GetReIssueRequest(orderStatusResponse, csr, false);
+                if (TryParseSslStoreDate(priorOrder.CertificateEndDateInUtc, priorOrder.CertificateEndDate,
+                        out var certExpiry))
+                {
+                    var resolved = certExpiry >= DateTime.UtcNow ? RequestUtilities.EnrollmentType.Reissue : requested;
+                    flow.Step("EvaluateOrderValidity",
+                        $"order expiry unavailable, using certificate expiration {certExpiry:dd-MMM-yyyy}, result={resolved}");
+                    return resolved;
+                }
 
-                        Logger.Trace($"reIssueRequest JSON {JsonConvert.SerializeObject(reIssueRequest)}");
+                flow.Skip("EvaluateOrderValidity", "neither order expiry nor certificate expiration available");
+                return requested;
+            }
+            catch (Exception e)
+            {
+                flow.Fail("EvaluateOrderValidity", e.Message);
+                Logger.Warn($"Unable to evaluate the prior order, keeping requested type {requested}: {e.Message}");
+                return requested;
+            }
+        }
 
-                        Logger.Trace("Submitting reissue request...");
-                        enrollmentResponse =
-                            Task.Run(async () => await SslStoreClient.SubmitReIssueRequestAsync(reIssueRequest)).Result;
+        private static bool TryGetOrderExpiry(INewOrderResponse order, out DateTime expiryUtc, out string source)
+        {
+            if (TryParseSslStoreDate(order.OrderExpiryDateInUtc, order.OrderExpiryDate, out expiryUtc))
+            {
+                source = "OrderExpiryDate";
+                return true;
+            }
 
-                        Logger.Trace($"enrollmentResponse JSON {JsonConvert.SerializeObject(enrollmentResponse)}");
+            //No order expiry returned, the order runs for its validity (in months) from the purchase date
+            if (order.Validity > 0 && TryParseSslStoreDate(order.PurchaseDateInUtc, order.PurchaseDate, out var purchased))
+            {
+                expiryUtc = purchased.AddMonths(order.Validity);
+                source = $"PurchaseDate+{order.Validity}mo";
+                return true;
+            }
 
-                        break;
-                    default:
-                        Logger.Error($"Unknown enrollment type: {enrollmentType}");
-                        return new EnrollmentResult { Status = 30, StatusMessage = $"Unknown enrollment type: {enrollmentType}" };
-                }
+            source = null;
+            return false;
+        }
 
-                return GetEnrollmentResult(enrollmentResponse);
-            }
-            catch (Exception ex)
+        /// <summary>
+        ///     Parses a date as UTC, preferring the explicit UTC value. Culture-safe: tries invariant first.
+        /// </summary>
+        private static bool TryParseSslStoreDate(string utcValue, string localValue, out DateTime utc)
+        {
+            foreach (var value in new[] {utcValue, localValue})
             {
-                Logger.Error($"Enroll failed with exception: {ex.Message}\n{ex.StackTrace}");
-                if (ex.InnerException != null)
-                    Logger.Error($"Inner exception: {ex.InnerException.Message}\n{ex.InnerException.StackTrace}");
-                return new EnrollmentResult { Status = 30, StatusMessage = $"Enrollment failed: {ex.Message}" };
+                if (string.IsNullOrWhiteSpace(value)) continue;
+                const DateTimeStyles styles = DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal;
+                if (DateTime.TryParse(value, CultureInfo.InvariantCulture, styles, out utc) ||
+                    DateTime.TryParse(value, CultureInfo.CurrentCulture, styles, out utc))
+                    return true;
             }
+
+            utc = default(DateTime);
+            return false;
         }
 
         private EnrollmentResult GetEnrollmentResult(INewOrderResponse newOrderResponse)
@@ -339,11 +540,7 @@ private EnrollmentResult GetEnrollmentResult(INewOrderResponse newOrderResponse)
             {
                 Logger.Error("GetEnrollmentResult: newOrderResponse is null.");
                 Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
-                return new EnrollmentResult
-                {
-                    Status = 30,
-                    StatusMessage = "Enrollment response was null."
-                };
+                return Failure("Enrollment response was null.");
             }
 
             Logger.Trace($"GetEnrollmentResult: TheSslStoreOrderId={newOrderResponse.TheSslStoreOrderId ?? "(null)"}, AuthResponse is null={newOrderResponse.AuthResponse == null}");
@@ -357,24 +554,36 @@ private EnrollmentResult GetEnrollmentResult(INewOrderResponse newOrderResponse)
                 }
                 Logger.Error($"GetEnrollmentResult: Auth error: {errorMessage}");
                 Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
-                return new EnrollmentResult
-                {
-                    Status = 30, //failure
-                    StatusMessage = errorMessage
-                };
+                return Failure(errorMessage);
             }
 
             Logger.Trace($"GetEnrollmentResult: Success, OrderId={newOrderResponse.TheSslStoreOrderId ?? "(null)"}");
             Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
+            //Most orders wait on domain validation (approver email, CNAME), so no certificate comes back yet. Return an id
+            //so the gateway keeps the request and polls GetSingleRecord until it is issued. Reissues and renewals reuse the
+            //order id, and the gateway requires CARequestID to be unique, so the partner order id (new for every
+            //submission) is appended.
+            var caRequestId = string.IsNullOrWhiteSpace(newOrderResponse.PartnerOrderId)
+                ? newOrderResponse.TheSslStoreOrderId
+                : $"{newOrderResponse.TheSslStoreOrderId}|{newOrderResponse.PartnerOrderId}";
             return new EnrollmentResult
             {
-                Status = 9, //success
+                Status = Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.EXTERNAL_VALIDATION),
+                CARequestID = caRequestId,
                 StatusMessage = $"Order Successfully Created With Order Number {newOrderResponse.TheSslStoreOrderId}"
             };
         }
 
 
         public override CAConnectorCertificate GetSingleRecord(string caRequestId)
+        {
+            using (var flow = NewFlow("GetSingleRecord"))
+            {
+                return GetSingleRecordInternal(flow, caRequestId);
+            }
+        }
+
+        private CAConnectorCertificate GetSingleRecordInternal(FlowLogger flow, string caRequestId)
         {
             Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
             Logger.Trace($"GetSingleRecord called: caRequestId={caRequestId ?? "(null)"}");
@@ -384,6 +593,7 @@ public override CAConnectorCertificate GetSingleRecord(string caRequestId)
                 if (string.IsNullOrEmpty(caRequestId))
                 {
                     Logger.Error("GetSingleRecord called with null/empty caRequestId.");
+                    flow.Fail("ValidateInput", "caRequestId is null or empty");
                     Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
                     return new CAConnectorCertificate
                     {
@@ -394,29 +604,82 @@ public override CAConnectorCertificate GetSingleRecord(string caRequestId)
                     };
                 }
 
-                var orderStatusRequest = _requestManager.GetOrderStatusRequest(caRequestId);
+                if (caRequestId.StartsWith(FailedRequestPrefix, StringComparison.Ordinal))
+                {
+                    flow.Skip("FetchOrderStatus", "placeholder id of a failed enrollment");
+                    Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
+                    return new CAConnectorCertificate
+                    {
+                        CARequestID = caRequestId,
+                        Certificate = string.Empty,
+                        CSR = string.Empty,
+                        Status = FailedStatus
+                    };
+                }
+
+                //CARequestID is {order id} for a new order that is still pending, {order id}-{serial} once synced
+                var orderId = GetOrderId(caRequestId);
+                flow.Step("ValidateInput", $"caRequestId={caRequestId}, order={orderId}");
+                var orderStatusRequest = _requestManager.GetOrderStatusRequest(orderId);
 
-                Logger.Trace($"orderStatusRequest JSON {JsonConvert.SerializeObject(orderStatusRequest)}");
+                Logger.Trace($"orderStatusRequest JSON {LogRedactor.Json(orderStatusRequest)}");
 
-                var certResponse = Task
-                    .Run(async () => await SslStoreClient.SubmitOrderStatusRequestAsync(orderStatusRequest)).Result;
+                var certResponse = flow.Step("FetchOrderStatus",
+                    () => RunSync(() => SslStoreClient.SubmitOrderStatusRequestAsync(orderStatusRequest)));
 
-                Logger.Trace($"certResponse JSON {JsonConvert.SerializeObject(certResponse)}");
+                Logger.Trace($"certResponse JSON {LogRedactor.Json(certResponse)}");
+
+                var statusApiError = GetApiError(certResponse?.AuthResponse);
+                if (statusApiError != null)
+                {
+                    flow.Fail("FetchOrderStatus", statusApiError);
+                    Logger.Error($"SSL Store rejected the order status request for order {orderId}: {statusApiError}");
+                }
 
                 var majorStatus = certResponse?.OrderStatus?.MajorStatus;
                 Logger.Trace($"GetSingleRecord: MajorStatus={majorStatus ?? "(null)"}");
+                var status = _requestManager.MapReturnStatus(majorStatus);
+                flow.Step("MapStatus", $"majorStatus={majorStatus ?? "(null)"}");
+
+                var certificate = string.Empty;
+                if (status == Convert.ToInt32(PKIConstants.Microsoft.RequestDisposition.ISSUED))
+                    certificate = flow.Step("DownloadCertificate",
+                        () => DownloadCertificateContent(orderId, certResponse.CommonName));
+                else
+                    flow.Skip("DownloadCertificate", "order is not issued yet (pending validation)");
+
+                //{order id}-{serial} identifies one certificate of the order. SSL Store only downloads the order's current
+                //certificate, so after a reissue handing it back under the old request id would overwrite the older
+                //certificate's gateway record with the new one.
+                var requestedSerial = GetRequestIdSerial(caRequestId);
+                if (requestedSerial != null && !string.IsNullOrEmpty(certificate) &&
+                    !CertificateHasSerial(certificate, requestedSerial))
+                {
+                    flow.Skip("ValidateCertificateSerial",
+                        $"order {orderId} now holds a different certificate than '{requestedSerial}'; record left unchanged");
+                    Logger.Warn($"GetSingleRecord: caRequestId={caRequestId} refers to an older certificate of order {orderId}; not returning the order's current certificate.");
+                    Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
+                    return null;
+                }
+
+                var purchaseDate = DateTime.UtcNow;
+                if (TryParseSslStoreDate(certResponse?.PurchaseDateInUtc, certResponse?.PurchaseDate, out var purchased))
+                    purchaseDate = purchased;
 
                 Logger.MethodExit(ILogExtensions.MethodLogLevel.Debug);
                 return new CAConnectorCertificate
                 {
                     CARequestID = caRequestId,
-                    Certificate = string.Empty,
+                    Certificate = certificate,
                     CSR = string.Empty,
-                    Status = _requestManager.MapReturnStatus(majorStatus)
+                    Status = status,
+                    SubmissionDate = purchaseDate,
+                    ProductID = certResponse?.ProductCode
                 };
             }
             catch (Exception ex)
             {
+                flow.Fail("GetSingleRecord", ex.Message);
                 Logger.Error($"GetSingleRecord failed for caRequestId={caRequestId}: {ex.Message}\n{ex.StackTrace}");
                 if (ex.InnerException != null)
                     Logger.Error($"Inner exception: {ex.InnerException.Message}\n{ex.InnerException.StackTrace}");
@@ -431,6 +694,46 @@ public override CAConnectorCertificate GetSingleRecord(string caRequestId)
             }
         }
 
+        //Returns the serial part of an {order id}-{serial} request id, or null when there is none
+        private static string GetRequestIdSerial(string caRequestId)
+        {
+            var separator = caRequestId.IndexOf('-');
+            if (separator < 0 || separator == caRequestId.Length - 1) return null;
+            return caRequestId.Substring(separator + 1);
+        }
+
+        private bool CertificateHasSerial(string certificate, string serial)
+        {
+            try
+            {
+                var cert = new X509Certificate2(Encoding.UTF8.GetBytes(certificate));
+                var actual = (cert.SerialNumber ?? string.Empty).TrimStart('0');
+                var expected = serial.TrimStart('0');
+                return string.Equals(actual, expected, StringComparison.OrdinalIgnoreCase);
+            }
+            catch (Exception ex)
+            {
+                Logger.Warn($"Could not read the serial number of the downloaded certificate: {ex.Message}");
+                return false;
+            }
+        }
+
+        /// <summary>
+        ///     Downloads the issued certificate for an order. Returns an empty string when SSL Store has none to give.
+        /// </summary>
+        private string DownloadCertificateContent(string orderId, string commonName)
+        {
+            var downloadRequest = _requestManager.GetCertificateRequest(orderId);
+            var response = RunSync(() => SslStoreClient.SubmitDownloadCertificateAsync(downloadRequest));
+            if (response?.AuthResponse == null || response.AuthResponse.IsError)
+            {
+                Logger.Warn($"Certificate download for order {orderId} returned no certificate: {LogRedactor.Json(response?.AuthResponse)}");
+                return string.Empty;
+            }
+
+            return _requestManager.GetCertificateContent(response.Certificates, commonName) ?? string.Empty;
+        }
+
         [Obsolete]
         public override void Synchronize(ICertificateDataReader certificateDataReader,
             BlockingCollection<CertificateRecord> blockingBuffer,
@@ -442,6 +745,16 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
         public override void Synchronize(ICertificateDataReader certificateDataReader,
             BlockingCollection<CAConnectorCertificate> blockingBuffer,
             CertificateAuthoritySyncInfo certificateAuthoritySyncInfo, CancellationToken cancelToken)
+        {
+            using (var flow = NewFlow("Synchronize"))
+            {
+                SynchronizeInternal(flow, certificateDataReader, blockingBuffer, certificateAuthoritySyncInfo, cancelToken);
+            }
+        }
+
+        private void SynchronizeInternal(FlowLogger flow, ICertificateDataReader certificateDataReader,
+            BlockingCollection<CAConnectorCertificate> blockingBuffer,
+            CertificateAuthoritySyncInfo certificateAuthoritySyncInfo, CancellationToken cancelToken)
         {
             Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
             Logger.Trace("Synchronize starting...");
@@ -453,22 +766,35 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
                 var templates=new BlockingCollection<ITemplate>(100);
                 KeyfactorClient.SubmitQueryTemplatesRequestAsync(templates, cancelToken, _requestManager);
                 Logger.Trace("Template query submitted.");
+                flow.Step("QueryTemplates", "template query submitted");
 
                 //Get a list of orgs from digicert via SslStore API
                 Logger.Trace("Getting organization list request...");
                 var organizationListRequest = _requestManager.GetOrganizationListRequest();
 
-                Logger.Trace($"organizationListRequest JSON {JsonConvert.SerializeObject(organizationListRequest)}");
+                Logger.Trace($"organizationListRequest JSON {LogRedactor.Json(organizationListRequest)}");
 
                 Logger.Trace("Submitting organization list request to SslStore...");
                 var orgListResponse = Task
                     .Run(async () => await SslStoreClient.SubmitOrganizationListAsync(organizationListRequest)).Result;
 
-                Logger.Trace($"orgListResponse JSON {JsonConvert.SerializeObject(orgListResponse)}");
+                Logger.Trace($"orgListResponse JSON {LogRedactor.Json(orgListResponse)}");
 
-                if (orgListResponse == null)
+                var orgListError = GetApiError(orgListResponse?.AuthResponse);
+                if (orgListError != null)
+                {
+                    Logger.Error($"Organization list request failed: {orgListError}");
+                    flow.Fail("FetchOrganizations", orgListError);
+                    orgListResponse = null;
+                }
+                else if (orgListResponse == null)
                 {
                     Logger.Warn("Organization list response is null. Skipping template organization updates.");
+                    flow.Fail("FetchOrganizations", "response is null, template organization updates skipped");
+                }
+                else
+                {
+                    flow.Step("FetchOrganizations", $"count={orgListResponse.OrganizationList?.Count ?? 0}");
                 }
 
                 Logger.Trace("Beginning template enumeration...");
@@ -551,7 +877,7 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
 
                             Logger.Trace($"Submitting template update for {currentTemplate.CommonName}...");
                             var updateOrgResponse = Task.Run(async () => await KeyfactorClient.SubmitUpdateTemplateAsync(currentTemplate)).Result;
-                            Logger.Trace($"Template update response for {currentTemplate.CommonName}: {JsonConvert.SerializeObject(updateOrgResponse)}");
+                            Logger.Trace($"Template update response for {currentTemplate.CommonName}: {LogRedactor.Json(updateOrgResponse)}");
                         }
                     }
                     catch (Exception ex)
@@ -563,6 +889,7 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
                 }
 
                 Logger.Trace("Template processing complete. Beginning certificate sync...");
+                flow.Step("ProcessTemplates");
                 var certs = new BlockingCollection<INewOrderResponse>(100);
                 SslStoreClient.SubmitQueryOrderRequestAsync(certs, cancelToken, _requestManager);
                 Logger.Trace("Certificate query submitted.");
@@ -588,6 +915,15 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
                             continue;
                         }
 
+                        var queryError = GetApiError(currentResponseItem.AuthResponse);
+                        if (queryError != null)
+                        {
+                            errorCount++;
+                            Logger.Error($"SSL Store rejected the order query: {queryError}");
+                            flow.Fail("QueryOrders", queryError);
+                            continue;
+                        }
+
                         var orderId = currentResponseItem.TheSslStoreOrderId ?? "(null)";
                         Logger.Trace($"Took Certificate ID {orderId} from Queue (item #{certCount})");
 
@@ -609,7 +945,15 @@ public override void Synchronize(ICertificateDataReader certificateDataReader,
                             continue;
                         }
 
-                        Logger.Trace($"Order status response for {orderId}: OrderStatus={JsonConvert.SerializeObject(orderStatusResponse.OrderStatus)}, CommonName={orderStatusResponse.CommonName ?? "(null)"}, ProductCode={orderStatusResponse.ProductCode ?? "(null)"}");
+                        var statusError = GetApiError(orderStatusResponse.AuthResponse);
+                        if (statusError != null)
+                        {
+                            errorCount++;
+                            Logger.Error($"SSL Store rejected the order status request for order {orderId}: {statusError}");
+                            continue;
+                        }
+
+                        Logger.Trace($"Order status response for {orderId}: OrderStatus={LogRedactor.Json(orderStatusResponse.OrderStatus)}, CommonName={orderStatusResponse.CommonName ?? "(null)"}, ProductCode={orderStatusResponse.ProductCode ?? "(null)"}");
 
                         if (orderStatusResponse.OrderStatus == null)
                         {
@@ -654,7 +998,7 @@ await SslStoreClient.SubmitDownloadCertificateAsync(
                                 }
                                 else
                                 {
-                                    Logger.Warn($"Certificate download returned error for order {orderId}: {JsonConvert.SerializeObject(certResponse.AuthResponse)}");
+                                    Logger.Warn($"Certificate download returned error for order {orderId}: {LogRedactor.Json(certResponse.AuthResponse)}");
                                 }
                             }
                             catch (Exception dlEx)
@@ -722,10 +1066,14 @@ await SslStoreClient.SubmitDownloadCertificateAsync(
                 }
 
                 Logger.Trace($"Synchronize certificate processing complete. Total processed={certCount}, Added to buffer={addedCount}, Errors={errorCount}");
+                var syncSummary = $"processed={certCount}, added={addedCount}, errors={errorCount}";
+                if (errorCount > 0) flow.Fail("SyncCertificates", syncSummary);
+                else flow.Step("SyncCertificates", syncSummary);
             }
             catch (AggregateException aggEx)
             {
                 var flatEx = aggEx.Flatten();
+                flow.Fail("Synchronize", flatEx.Message);
                 Logger.Error($"SslStore Synchronize Task failed! {flatEx.Message}");
                 foreach (var innerEx in flatEx.InnerExceptions)
                 {
@@ -736,6 +1084,7 @@ await SslStoreClient.SubmitDownloadCertificateAsync(
             }
             catch (Exception ex)
             {
+                flow.Fail("Synchronize", ex.Message);
                 Logger.Error($"SslStore Synchronize unexpected error: {ex.Message}\n{ex.StackTrace}");
                 if (ex.InnerException != null)
                     Logger.Error($"Inner exception: {ex.InnerException.Message}\n{ex.InnerException.StackTrace}");
@@ -748,6 +1097,14 @@ await SslStoreClient.SubmitDownloadCertificateAsync(
 
 
         public override void Initialize(ICAConnectorConfigProvider configProvider)
+        {
+            using (var flow = NewFlow("Initialize"))
+            {
+                InitializeInternal(flow, configProvider);
+            }
+        }
+
+        private void InitializeInternal(FlowLogger flow, ICAConnectorConfigProvider configProvider)
         {
             Logger.MethodEntry(ILogExtensions.MethodLogLevel.Debug);
             Logger.Trace("Initialize called.");
@@ -780,8 +1137,9 @@ public override void Initialize(ICAConnectorConfigProvider configProvider)
                     throw new InvalidOperationException($"Missing required config key '{Constants.AuthToken}'.");
                 }
 
+                flow.Step("ValidateConfig", "required keys present");
                 PartnerCode = configProvider.CAConnectionData[Constants.PartnerCode]?.ToString();
-                Logger.Trace($"Initialize: PartnerCode={PartnerCode ?? "(null)"}");
+                Logger.Trace($"Initialize: PartnerCode {(string.IsNullOrEmpty(PartnerCode) ? "is empty" : "set (value masked)")}.");
 
                 AuthenticationToken = configProvider.CAConnectionData[Constants.AuthToken]?.ToString();
                 Logger.Trace("Initialize: AuthenticationToken set (value masked).");
@@ -796,12 +1154,31 @@ public override void Initialize(ICAConnectorConfigProvider configProvider)
                 PageSize = _requestManager.GetClientPageSize(configProvider);
                 Logger.Trace($"Initialize: PageSize={PageSize}");
 
+                flow.Step("CreateClients", $"pageSize={PageSize}");
+
+                RenewalWindowDays = Constants.DefaultRenewalWindowDays;
+                if (configProvider.CAConnectionData.TryGetValue(Constants.RenewalWindowDays, out var renewalWindow))
+                {
+                    if (int.TryParse(renewalWindow?.ToString(), out var renewalWindowDays) && renewalWindowDays > 0)
+                    {
+                        RenewalWindowDays = renewalWindowDays;
+                    }
+                    else
+                    {
+                        Logger.Warn($"{Constants.RenewalWindowDays} value '{renewalWindow}' could not be parsed or was <= 0, using default {Constants.DefaultRenewalWindowDays}.");
+                        flow.Fail("ReadRenewalWindowDays", $"invalid value, using default {Constants.DefaultRenewalWindowDays}");
+                    }
+                }
+
+                flow.Step("ReadRenewalWindowDays", $"days={RenewalWindowDays}");
+
                 ConfigManager = configProvider;
 
                 Logger.Trace("Initialize complete.");
             }
             catch (Exception ex)
             {
+                flow.Fail("Initialize", ex.Message);
                 Logger.Error($"Initialize failed: {ex.Message}\n{ex.StackTrace}");
                 throw;
             }
diff --git a/SslStoreCaProxy/SslStoreCaProxy.csproj b/SslStoreCaProxy/SslStoreCaProxy.csproj
index bb919cd..61a17c9 100644
--- a/SslStoreCaProxy/SslStoreCaProxy.csproj
+++ b/SslStoreCaProxy/SslStoreCaProxy.csproj
@@ -147,6 +147,8 @@
     <Compile Include="Client\Models\TechnicalContact.cs" />
     <Compile Include="Client\SslStoreClient.cs" />
     <Compile Include="Constants.cs" />
+    <Compile Include="FlowLogger.cs" />
+    <Compile Include="LogRedactor.cs" />
     <Compile Include="Interfaces\ISslStoreClient.cs" />
     <Compile Include="Interfaces\IRequestManager.cs" />
     <Compile Include="RequestManager.cs" />
diff --git a/readme_source.md b/readme_source.md
index d30820f..2dfb211 100644
--- a/readme_source.md
+++ b/readme_source.md
@@ -137,6 +137,7 @@ the CA.  Without the imported configuration, the service will fail to start.
       "ADMINISTRATOR": "Allow"
     }
 ```
+- *Renewal window* (optional `RenewalWindowDays` in `CAConnection`, default 30): when a renewal or reissue is requested for an existing certificate, the gateway looks at the expiry of the SSL Store **order**, not the certificate. More than `RenewalWindowDays` left on the order -> reissue under the active order; inside the window -> renewal; order expired -> new order (which needs the full enrollment fields). This keeps certificates that are shorter than the order term (for example 200 day certs) from being renewed (and charged) every time.
 - *SSLStore Environment Settings* (Modify these with the keys and Urls obtained from SSLStore)
 ```
   "CAConnection": {
@@ -147,6 +148,7 @@ the CA.  Without the imported configuration, the service will fail to start.
     "KeyfactorApiUserId": "SomeKeyfactorAPIUser",
     "KeyfactorApiPassword": "SomeKeyfactorAPIPassword",
     "PageSize": "25",
+    "RenewalWindowDays": "30",
     "SampleRequest": {
       "AuthRequest": {
         "PartnerCode": {