Skip to content

Commit 331bbe6

Browse files
dgaleyspbsolubleKeyfactor
authored
Release: 1.2
--------- Co-authored-by: Sean <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
1 parent 0aa1cb3 commit 331bbe6

File tree

11 files changed

+153
-38
lines changed

11 files changed

+153
-38
lines changed

‎.github/workflows/keyfactor-starter-workflow.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
call-starter-workflow:
1414
uses: keyfactor/actions/.github/workflows/starter.yml@v2
1515
secrets:
16-
token: ${{ secrets.V2BUILDTOKEN}}
17-
APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
16+
token: ${{ secrets.V2BUILDTOKEN }}
17+
APPROVE_README_PUSH: ${{ secrets.V2BUILDTOKEN }}
1818
gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
1919
gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}

‎CHANGELOG.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,9 @@ Hotfixes for BaseOption flag for Renewal workflow
3131
Hotfix for domain lookup
3232

3333
1.1.2
34-
Hotfix for renewal workflow
34+
Hotfix for renewal workflow
35+
36+
1.2.0
37+
Add SyncProducts config to filter certificate sync by product ID
38+
Add ability to manually specify MSSLProfileID per template to use for domain lookup
39+
Bugfix: Treat SANs that match the base domain of a wildcard CN as identical for the purpose of removing duplicates

‎README.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,15 +94,18 @@ The following sections will breakdown the required configurations for the AnyGat
9494
## Templates
9595
The Template section will map the CA's SSL profile to an AD template. The Lifetime parameter is required and represents the certificate duration in months.
9696
* ```ContactName```
97-
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
97+
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
98+
* ```MSSLProfileID```
99+
OPTIONAL: If specified, enrollments will use that profile ID for domain lookups. If not provided, domain lookup will be done based on the Common Name or first DNS SAN. Useful if your GlobalSign account has multiple domain objects with the same domain string, or subdomains (e.g. sub.test.com vs test.com).
98100

99101
```json
100102
"Templates": {
101103
"WebServer": {
102104
"ProductID": "PV_SHA2",
103105
"Parameters": {
104106
"Lifetime":"12",
105-
"ContactName":"John Doe"
107+
"ContactName":"John Doe",
108+
"MSSLProfileID":"123456"
106109
}
107110
}
108111
}
@@ -194,14 +197,19 @@ This is the password that will be used to connect to the GlobalSign API
194197
OPTIONAL: If provided, full syncs will start at the specified date.
195198
* ```SyncIntervalDays```
196199
OPTIONAL: Required if SyncStartDate is used. Specifies how to page the certificate sync. Should be a value such that no interval of that length contains > 500 certificate enrollments.
200+
* ```SyncProducts```
201+
OPTIONAL: If provided as a comma-separated list of product IDs, will limit the certificate sync to only certificates of those products. If blank or not provided, will sync all certs.
197202

198203
```json
199204
"CAConnection": {
200205
"IsTest":"false",
201206
"PickupRetries":5,
202207
"PickupDelay":150,
203208
"Username":"PAR12344_apiuser",
204-
"Password":"password"
209+
"Password":"password",
210+
"SyncStartDate":"2020-01-01",
211+
"SyncIntervalDays":30,
212+
"SyncProducts":"PV_SHA2, PEV_SHA2"
205213
},
206214
```
207215
## GatewayRegistration

‎globalsign-mssl-cagateway.sln‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
Microsoft Visual Studio Solution File, Format Version 12.00
3-
# Visual Studio Version 16
4-
VisualStudioVersion = 16.0.31129.286
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.10.35122.118
55
MinimumVisualStudioVersion = 10.0.40219.1
66
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GlobalSignCAProxy", "src\GlobalSignCAProxy\GlobalSignCAProxy.csproj", "{8A26FA6A-22CC-4BD0-9AAC-CDF95A85011D}"
77
EndProject
@@ -13,8 +13,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
1313
ProjectSection(SolutionItems) = preProject
1414
CHANGELOG.md = CHANGELOG.md
1515
integration-manifest.json = integration-manifest.json
16-
.github\workflows\keyfactor-extension-generate-readme.yml = .github\workflows\keyfactor-extension-generate-readme.yml
17-
.github\workflows\keyfactor-extension-release.yml = .github\workflows\keyfactor-extension-release.yml
16+
.github\workflows\keyfactor-starter-workflow.yml = .github\workflows\keyfactor-starter-workflow.yml
1817
README.md.tpl = README.md.tpl
1918
readme_source.md = readme_source.md
2019
EndProjectSection

‎integration-manifest.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"status": "production",
66
"update_catalog": true,
77
"link_github": true,
8-
"release_dir": "src\\GlobalSignCAProxy\\bin\\Release",
8+
"release_dir": "src/GlobalSignCAProxy/bin/Release",
9+
"release_project": "src/GlobalSignCAProxy/GlobalSignCAProxy.csproj",
910
"support_level": "kf-supported",
1011
"description": "This integration allows for the Synchronization, Enrollment, and Revocation of TLS Certificates from the GlobalSign Certificate Center."
1112
}

‎readme_source.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,18 @@ The following sections will breakdown the required configurations for the AnyGat
5252
## Templates
5353
The Template section will map the CA's SSL profile to an AD template. The Lifetime parameter is required and represents the certificate duration in months.
5454
* ```ContactName```
55-
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
55+
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
56+
* ```MSSLProfileID```
57+
OPTIONAL: If specified, enrollments will use that profile ID for domain lookups. If not provided, domain lookup will be done based on the Common Name or first DNS SAN. Useful if your GlobalSign account has multiple domain objects with the same domain string, or subdomains (e.g. sub.test.com vs test.com).
5658

5759
```json
5860
"Templates": {
5961
"WebServer": {
6062
"ProductID": "PV_SHA2",
6163
"Parameters": {
6264
"Lifetime":"12",
63-
"ContactName":"John Doe"
65+
"ContactName":"John Doe",
66+
"MSSLProfileID":"123456"
6467
}
6568
}
6669
}
@@ -152,14 +155,19 @@ This is the password that will be used to connect to the GlobalSign API
152155
OPTIONAL: If provided, full syncs will start at the specified date.
153156
* ```SyncIntervalDays```
154157
OPTIONAL: Required if SyncStartDate is used. Specifies how to page the certificate sync. Should be a value such that no interval of that length contains > 500 certificate enrollments.
158+
* ```SyncProducts```
159+
OPTIONAL: If provided as a comma-separated list of product IDs, will limit the certificate sync to only certificates of those products. If blank or not provided, will sync all certs.
155160

156161
```json
157162
"CAConnection": {
158163
"IsTest":"false",
159164
"PickupRetries":5,
160165
"PickupDelay":150,
161166
"Username":"PAR12344_apiuser",
162-
"Password":"password"
167+
"Password":"password",
168+
"SyncStartDate":"2020-01-01",
169+
"SyncIntervalDays":30,
170+
"SyncProducts":"PV_SHA2, PEV_SHA2"
163171
},
164172
```
165173
## GatewayRegistration

‎src/GlobalSignCAProxy/Api/GlobalSignEnrollRequest.cs‎

Lines changed: 36 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -7,18 +7,18 @@
77

88
using CSS.Common.Logging;
99

10-
using Keyfactor.Extensions.AnyGateway.GlobalSign.Services.Order;
10+
using Keyfactor.Extensions.AnyGateway.GlobalSign.Services.Order;
1111

12-
using System.Collections.Generic;
12+
using System.Collections.Generic;
1313
using System.Linq;
14-
using System.Text;
15-
16-
namespace Keyfactor.Extensions.AnyGateway.GlobalSign.Api
17-
{
14+
using System.Text;
15+
16+
namespace Keyfactor.Extensions.AnyGateway.GlobalSign.Api
17+
{
1818
public class GlobalSignEnrollRequest : LoggingClientBase
1919
{
2020
internal GlobalSignCAConfig Config;
21-
21+
2222
public GlobalSignEnrollRequest(GlobalSignCAConfig config)
2323
{
2424
Config = config;
@@ -90,6 +90,29 @@ public BmV2PvOrderRequest Request
9090
Logger.Info($"SAN Entry {item} matches CN, removing from request");
9191
continue;
9292
}
93+
string trimCN = CommonName, trimItem = item;
94+
if (CommonName.StartsWith("*."))
95+
{
96+
trimCN = CommonName.Substring(2).ToLower();
97+
trimItem = item.ToLower();
98+
List<string> equivs = new List<string> { $"*.{trimCN}", $"www.{trimCN}", $"{trimCN}" };
99+
if (equivs.Contains(trimItem))
100+
{
101+
Logger.Info($"SAN Entry {item} is equivalent to CN ignoring wildcards or www prefix, removing from request");
102+
continue;
103+
}
104+
}
105+
else if (CommonName.StartsWith("www."))
106+
{
107+
trimCN = CommonName.Substring(4).ToLower();
108+
trimItem = item.ToLower();
109+
List<string> equivs = new List<string> { $"www.{trimCN}", $"{trimCN}" };
110+
if (equivs.Contains(trimItem))
111+
{
112+
Logger.Info($"SAN Entry {item} is equivalent to CN ignoring wildcards or www prefix, removing from request");
113+
continue;
114+
}
115+
}
93116
SANEntry entry = new SANEntry();
94117
entry.SubjectAltName = item;
95118
StringBuilder sb = new StringBuilder();
@@ -134,9 +157,12 @@ public BmV2PvOrderRequest Request
134157
{
135158
request.OrderRequestParameter.BaseOption = BaseOption;
136159
}
137-
160+
138161
return request;
139162
}
140163
}
141-
}
142-
}
164+
165+
}
166+
}
167+
168+

‎src/GlobalSignCAProxy/Api/GlobalSignRenewRequest.cs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,28 @@ public GlobalSignRenewRequest(GlobalSignCAConfig config) : base(config) { }
4444
Logger.Info($"SAN Entry {item} matches CN, removing from request");
4545
continue;
4646
}
47+
string trimCN = CommonName, trimItem = item;
48+
if (trimCN.StartsWith("*."))
49+
{
50+
trimCN = trimCN.Substring(2);
51+
}
52+
else if (trimCN.StartsWith("www."))
53+
{
54+
trimCN = trimCN.Substring(4);
55+
}
56+
if (trimItem.StartsWith("*."))
57+
{
58+
trimItem = trimItem.Substring(2);
59+
}
60+
else if (trimItem.StartsWith("www."))
61+
{
62+
trimItem = trimItem.Substring(4);
63+
}
64+
if (string.Equals(trimCN, trimItem, System.StringComparison.OrdinalIgnoreCase))
65+
{
66+
Logger.Info($"SAN Entry {item} is equivalent to CN ignoring wildcards or www prefix, removing from request");
67+
continue;
68+
}
4769
SANEntry entry = new SANEntry();
4870
entry.SubjectAltName = item;
4971
StringBuilder sb = new StringBuilder();

‎src/GlobalSignCAProxy/Client/GlobalSignApiClient.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ public EnrollmentResult Enroll(GlobalSignEnrollRequest enrollRequest)
298298
{
299299
Logger.Trace($"Order Base Option: {rawRequest.OrderRequestParameter.BaseOption}");
300300
}
301-
var response = OrderService.PVOrder(enrollRequest.Request);
301+
var response = OrderService.PVOrder(rawRequest);
302302
if (response.OrderResponseHeader.SuccessCode == 0)
303303
{
304304
Logger.Debug($"Enrollment request successfully submitted");
@@ -365,7 +365,7 @@ public EnrollmentResult Renew(GlobalSignRenewRequest renewRequest)
365365
Logger.Trace($"Order Base Option: {rawRequest.OrderRequestParameter.BaseOption}");
366366
}
367367
Logger.Trace($"Renewal Target: {rawRequest.OrderRequestParameter.RenewalTargetOrderID}");
368-
var response = OrderService.PVOrder(renewRequest.Request);
368+
var response = OrderService.PVOrder(rawRequest);
369369
if (response.OrderResponseHeader.SuccessCode == 0)
370370
{
371371
Logger.Debug($"Renewal request successfully submitted");

‎src/GlobalSignCAProxy/GlobalSignCAConfig.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ public class GlobalSignCAConfig
2525

2626
public string SyncStartDate { get; set; }
2727
public int SyncIntervalDays { get; set; }
28+
public string SyncProducts { get; set; }
2829

2930
public string GetUrl(GlobalSignServiceType queryType)
3031
{

0 commit comments

Comments
 (0)