bhillkeyfactor · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,15 @@
+v1.2.0
+- New/Renew/Reissue requests with a prior certificate are resolved from the SSL Store order expiry: reissued under the active order outside the renewal window (RenewalWindowDays, default 30), renewed inside it, ordered new once the order has expired. Supports shorter-lived (~200 day) certificates
+- Removed the 'cannot renew an expired cert' failure; an expired order is now ordered as a new certificate
+- Credentials and tokens (AuthToken, PartnerCode, Token, TokenCode, TokenID, passwords) are now masked in all Trace log output
+- Enrollments now return a unique CA request ID ({order id}|{partner order id}, so repeated reissues of one order don't collide on the gateway's unique CARequestID index) and are reported as pending (awaiting validation) so Command keeps and polls them; GetSingleRecord returns the certificate once the order is issued and accepts order-serial request IDs
+- SSL Store errors returned with HTTP 200 (for example the hourly API quota) are now reported as failures in sync, order status and GetSingleRecord instead of looking like a successful sync
+- Reissue/renew now stops early with a clear message when the prior order is still pending validation (SSL Store would reject it with -9033), and failed enrollments return a placeholder CA request ID so Command shows the real failure instead of 'Certificate with ID n was not found'
+- GetSingleRecord no longer overwrites an older certificate's gateway record with the order's current certificate after a reissue; an {order}-{serial} request only returns the certificate with that serial
+- Prior certificate serial numbers now match with or without the leading 00 sign byte, so renewals of certificates whose serial starts with 0x80 or higher are found
+- Added FlowLogger step diagrams to the Trace log for Enroll, Synchronize, Revoke, GetSingleRecord and Initialize
+- Hardening: clearer errors when the prior certificate or its order cannot be found, SSL Store calls surface the original exception, per-step failure reporting in the flow log
+
 v1.1.1
 - SSL Store Api Changed Encoding Rules, needed to fix integration to match
 

diff --git a/SampleConfig.json b/SampleConfig.json
@@ -27,6 +27,7 @@
 		"KeyfactorApiUserId": "SomeKeyfactorAPIUser",
 		"KeyfactorApiPassword": "SomeKeyfactorAPIPassword",
 		"PageSize": "25",
+		"RenewalWindowDays": "30",
 		"SampleRequest": {
 			"AuthRequest": {
 				"PartnerCode": {

diff --git a/SslStoreCaProxy/Client/KeyfactorClient.cs b/SslStoreCaProxy/Client/KeyfactorClient.cs
@@ -84,12 +84,12 @@ public async Task<Template> SubmitUpdateTemplateAsync(Template templateRequest)
             Logger.Trace("SubmitUpdateTemplateAsync called.");
             try
             {
-                Logger.Trace($"SubmitUpdateTemplateAsync Request JSON: {JsonConvert.SerializeObject(templateRequest)}");
+                Logger.Trace($"SubmitUpdateTemplateAsync Request JSON: {LogRedactor.Json(templateRequest)}");
                 using (var resp = await RestClient.PutAsync("/KeyfactorApi/Templates", new StringContent(
                     JsonConvert.SerializeObject(templateRequest), Encoding.ASCII, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitUpdateTemplateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitUpdateTemplateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var templateResponse = JsonConvert.DeserializeObject<Template>(responseBody);
                     if (templateResponse == null)

diff --git a/SslStoreCaProxy/Client/SslStoreClient.cs b/SslStoreCaProxy/Client/SslStoreClient.cs
@@ -55,12 +55,12 @@ public async Task<NewOrderResponse> SubmitNewOrderRequestAsync(NewOrderRequest n
             Logger.Trace("SubmitNewOrderRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitNewOrderRequestAsync Request JSON: {JsonConvert.SerializeObject(newOrderRequest)}");
+                Logger.Trace($"SubmitNewOrderRequestAsync Request JSON: {LogRedactor.Json(newOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/neworder", new StringContent(
                     JsonConvert.SerializeObject(newOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitNewOrderRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitNewOrderRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -82,12 +82,12 @@ public async Task<EmailApproverResponse> SubmitEmailApproverRequestAsync(EmailAp
             Logger.Trace("SubmitEmailApproverRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitEmailApproverRequestAsync Request JSON: {JsonConvert.SerializeObject(newApproverRequest)}");
+                Logger.Trace($"SubmitEmailApproverRequestAsync Request JSON: {LogRedactor.Json(newApproverRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/approverlist", new StringContent(
                     JsonConvert.SerializeObject(newApproverRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitEmailApproverRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitEmailApproverRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<EmailApproverResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -109,12 +109,12 @@ public async Task<NewOrderResponse> SubmitReIssueRequestAsync(ReIssueRequest reI
             Logger.Trace("SubmitReIssueRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitReIssueRequestAsync Request JSON: {JsonConvert.SerializeObject(reIssueOrderRequest)}");
+                Logger.Trace($"SubmitReIssueRequestAsync Request JSON: {LogRedactor.Json(reIssueOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/reissue", new StringContent(
                     JsonConvert.SerializeObject(reIssueOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitReIssueRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitReIssueRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var orderStatusResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (orderStatusResponse == null)
@@ -136,12 +136,12 @@ public async Task<NewOrderResponse> SubmitRenewRequestAsync(NewOrderRequest rene
             Logger.Trace("SubmitRenewRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitRenewRequestAsync Request JSON: {JsonConvert.SerializeObject(renewOrderRequest)}");
+                Logger.Trace($"SubmitRenewRequestAsync Request JSON: {LogRedactor.Json(renewOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/neworder", new StringContent(
                     JsonConvert.SerializeObject(renewOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitRenewRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitRenewRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var enrollmentResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (enrollmentResponse == null)
@@ -165,12 +165,12 @@ public async Task<IDownloadCertificateResponse> SubmitDownloadCertificateAsync(
             Logger.Trace("SubmitDownloadCertificateAsync called.");
             try
             {
-                Logger.Trace($"SubmitDownloadCertificateAsync Request JSON: {JsonConvert.SerializeObject(downloadOrderRequest)}");
+                Logger.Trace($"SubmitDownloadCertificateAsync Request JSON: {LogRedactor.Json(downloadOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/download", new StringContent(
                     JsonConvert.SerializeObject(downloadOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitDownloadCertificateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitDownloadCertificateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     resp.EnsureSuccessStatusCode();
                     var downloadOrderResponse = JsonConvert.DeserializeObject<DownloadCertificateResponse>(responseBody);
                     if (downloadOrderResponse == null)
@@ -234,7 +234,7 @@ public async Task SubmitQueryOrderRequestAsync(BlockingCollection<INewOrderRespo
                             break;
                         }
 
-                        Logger.Trace($"Order List JSON {JsonConvert.SerializeObject(batchResponse)}");
+                        Logger.Trace($"Order List JSON {LogRedactor.Json(batchResponse)}");
 
                         var batchCount = batchResponse.Count;
                         Logger.Trace($"Processing {batchCount} items in batch (page {pageCounter})");
@@ -317,12 +317,12 @@ public async Task<IOrderStatusResponse> SubmitRevokeCertificateAsync(RevokeOrder
             Logger.Trace("SubmitRevokeCertificateAsync called.");
             try
             {
-                Logger.Trace($"SubmitRevokeCertificateAsync Request JSON: {JsonConvert.SerializeObject(revokeOrderRequest)}");
+                Logger.Trace($"SubmitRevokeCertificateAsync Request JSON: {LogRedactor.Json(revokeOrderRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/refundrequest", new StringContent(
                     JsonConvert.SerializeObject(revokeOrderRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitRevokeCertificateAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitRevokeCertificateAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var revocationResponse = JsonConvert.DeserializeObject<OrderStatusResponse>(responseBody);
                     if (revocationResponse == null)
                         Logger.Warn("SubmitRevokeCertificateAsync: Deserialized response is null.");
@@ -343,12 +343,12 @@ public async Task<INewOrderResponse> SubmitOrderStatusRequestAsync(OrderStatusRe
             Logger.Trace("SubmitOrderStatusRequestAsync called.");
             try
             {
-                Logger.Trace($"SubmitOrderStatusRequestAsync Request JSON: {JsonConvert.SerializeObject(orderStatusRequest)}");
+                Logger.Trace($"SubmitOrderStatusRequestAsync Request JSON: {LogRedactor.Json(orderStatusRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/order/status", new StringContent(
                     JsonConvert.SerializeObject(orderStatusRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitOrderStatusRequestAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitOrderStatusRequestAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var orderStatusResponse = JsonConvert.DeserializeObject<NewOrderResponse>(responseBody);
                     if (orderStatusResponse == null)
                         Logger.Warn("SubmitOrderStatusRequestAsync: Deserialized response is null.");
@@ -369,12 +369,12 @@ public async Task<IOrganizationResponse> SubmitOrganizationListAsync(Organizatio
             Logger.Trace("SubmitOrganizationListAsync called.");
             try
             {
-                Logger.Trace($"SubmitOrganizationListAsync Request JSON: {JsonConvert.SerializeObject(organizationListRequest)}");
+                Logger.Trace($"SubmitOrganizationListAsync Request JSON: {LogRedactor.Json(organizationListRequest)}");
                 using (var resp = await RestClient.PostAsync("/rest/digicert/organizationlist", new StringContent(
                     JsonConvert.SerializeObject(organizationListRequest), Encoding.UTF8, "application/json")))
                 {
                     var responseBody = await resp.Content.ReadAsStringAsync();
-                    Logger.Trace($"SubmitOrganizationListAsync Response StatusCode={resp.StatusCode}, Body={responseBody}");
+                    Logger.Trace($"SubmitOrganizationListAsync Response StatusCode={resp.StatusCode}, Body={LogRedactor.Redact(responseBody)}");
                     var organizationListResponse = JsonConvert.DeserializeObject<OrganizationResponse>(responseBody);
                     if (organizationListResponse == null)
                         Logger.Warn("SubmitOrganizationListAsync: Deserialized response is null.");

diff --git a/SslStoreCaProxy/Constants.cs b/SslStoreCaProxy/Constants.cs
@@ -6,9 +6,11 @@ internal class Constants
         public static string PartnerCode = "PartnerCode";
         public static string AuthToken = "AuthToken";
         public static string PageSize = "PageSize";
+        public static string RenewalWindowDays = "RenewalWindowDays";
         public static string KeyfactorApiUrl = "KeyfactorApiUrl";
         public static string KeyfactorApiUserId = "KeyfactorApiUserId";
         public static string KeyfactorApiPassword = "KeyfactorApiPassword";
         public static int DefaultPageSize = 100;
+        public static int DefaultRenewalWindowDays = 30;
     }
 }