Skip to content

Commit 294bf45

Browse files
dgaleydgaley
authored
Merge a07a6dd into 0aa1cb3 
2 parents 0aa1cb3 + a07a6dd commit 294bf45

11 files changed

Lines changed: 104 additions & 28 deletions

‎.github/workflows/keyfactor-starter-workflow.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
call-starter-workflow:
1414
uses: keyfactor/actions/.github/workflows/starter.yml@v2
1515
secrets:
16-
token: ${{ secrets.V2BUILDTOKEN}}
17-
APPROVE_README_PUSH: ${{ secrets.APPROVE_README_PUSH}}
16+
token: ${{ secrets.V2BUILDTOKEN }}
17+
APPROVE_README_PUSH: ${{ secrets.V2BUILDTOKEN }}
1818
gpg_key: ${{ secrets.KF_GPG_PRIVATE_KEY }}
1919
gpg_pass: ${{ secrets.KF_GPG_PASSPHRASE }}

‎CHANGELOG.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,9 @@ Hotfixes for BaseOption flag for Renewal workflow
3131
Hotfix for domain lookup
3232

3333
1.1.2
34-
Hotfix for renewal workflow
34+
Hotfix for renewal workflow
35+
36+
1.2.0
37+
Add SyncProducts config to filter certificate sync by product ID
38+
Add ability to manually specify MSSLProfileID per template to use for domain lookup
39+
Bugfix: Treat SANs that match the base domain of a wildcard CN as identical for the purpose of removing duplicates

‎README.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -94,15 +94,18 @@ The following sections will breakdown the required configurations for the AnyGat
9494
## Templates
9595
The Template section will map the CA's SSL profile to an AD template. The Lifetime parameter is required and represents the certificate duration in months.
9696
* ```ContactName```
97-
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
97+
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
98+
* ```MSSLProfileID```
99+
OPTIONAL: If specified, enrollments will use that profile ID for domain lookups. If not provided, domain lookup will be done based on the Common Name or first DNS SAN. Useful if your GlobalSign account has multiple domain objects with the same domain string, or subdomains (e.g. sub.test.com vs test.com).
98100

99101
```json
100102
"Templates": {
101103
"WebServer": {
102104
"ProductID": "PV_SHA2",
103105
"Parameters": {
104106
"Lifetime":"12",
105-
"ContactName":"John Doe"
107+
"ContactName":"John Doe",
108+
"MSSLProfileID":"123456"
106109
}
107110
}
108111
}
@@ -194,14 +197,19 @@ This is the password that will be used to connect to the GlobalSign API
194197
OPTIONAL: If provided, full syncs will start at the specified date.
195198
* ```SyncIntervalDays```
196199
OPTIONAL: Required if SyncStartDate is used. Specifies how to page the certificate sync. Should be a value such that no interval of that length contains > 500 certificate enrollments.
200+
* ```SyncProducts```
201+
OPTIONAL: If provided as a comma-separated list of product IDs, will limit the certificate sync to only certificates of those products. If blank or not provided, will sync all certs.
197202

198203
```json
199204
"CAConnection": {
200205
"IsTest":"false",
201206
"PickupRetries":5,
202207
"PickupDelay":150,
203208
"Username":"PAR12344_apiuser",
204-
"Password":"password"
209+
"Password":"password",
210+
"SyncStartDate":"2020-01-01",
211+
"SyncIntervalDays":30,
212+
"SyncProducts":"PV_SHA2, PEV_SHA2"
205213
},
206214
```
207215
## GatewayRegistration

‎globalsign-mssl-cagateway.sln‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

22
Microsoft Visual Studio Solution File, Format Version 12.00
3-
# Visual Studio Version 16
4-
VisualStudioVersion = 16.0.31129.286
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.10.35122.118
55
MinimumVisualStudioVersion = 10.0.40219.1
66
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GlobalSignCAProxy", "src\GlobalSignCAProxy\GlobalSignCAProxy.csproj", "{8A26FA6A-22CC-4BD0-9AAC-CDF95A85011D}"
77
EndProject
@@ -13,8 +13,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Solution Items", "Solution
1313
ProjectSection(SolutionItems) = preProject
1414
CHANGELOG.md = CHANGELOG.md
1515
integration-manifest.json = integration-manifest.json
16-
.github\workflows\keyfactor-extension-generate-readme.yml = .github\workflows\keyfactor-extension-generate-readme.yml
17-
.github\workflows\keyfactor-extension-release.yml = .github\workflows\keyfactor-extension-release.yml
16+
.github\workflows\keyfactor-starter-workflow.yml = .github\workflows\keyfactor-starter-workflow.yml
1817
README.md.tpl = README.md.tpl
1918
readme_source.md = readme_source.md
2019
EndProjectSection

‎integration-manifest.json‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@
55
"status": "production",
66
"update_catalog": true,
77
"link_github": true,
8-
"release_dir": "src\\GlobalSignCAProxy\\bin\\Release",
8+
"release_dir": "src/GlobalSignCAProxy/bin/Release",
9+
"release_project": "src/GlobalSignCAProxy/GlobalSignCAProxy.csproj",
910
"support_level": "kf-supported",
1011
"description": "This integration allows for the Synchronization, Enrollment, and Revocation of TLS Certificates from the GlobalSign Certificate Center."
1112
}

‎readme_source.md‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -52,15 +52,18 @@ The following sections will breakdown the required configurations for the AnyGat
5252
## Templates
5353
The Template section will map the CA's SSL profile to an AD template. The Lifetime parameter is required and represents the certificate duration in months.
5454
* ```ContactName```
55-
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
55+
The name to pass to GlobalSign as the contact name for enrollments. OPTIONAL if Active Directory authentication is used in Keyfactor Command, in that case it can look up the name of the requesting user. Value provided in this config field overrides AD lookups.
56+
* ```MSSLProfileID```
57+
OPTIONAL: If specified, enrollments will use that profile ID for domain lookups. If not provided, domain lookup will be done based on the Common Name or first DNS SAN. Useful if your GlobalSign account has multiple domain objects with the same domain string, or subdomains (e.g. sub.test.com vs test.com).
5658

5759
```json
5860
"Templates": {
5961
"WebServer": {
6062
"ProductID": "PV_SHA2",
6163
"Parameters": {
6264
"Lifetime":"12",
63-
"ContactName":"John Doe"
65+
"ContactName":"John Doe",
66+
"MSSLProfileID":"123456"
6467
}
6568
}
6669
}
@@ -152,14 +155,19 @@ This is the password that will be used to connect to the GlobalSign API
152155
OPTIONAL: If provided, full syncs will start at the specified date.
153156
* ```SyncIntervalDays```
154157
OPTIONAL: Required if SyncStartDate is used. Specifies how to page the certificate sync. Should be a value such that no interval of that length contains > 500 certificate enrollments.
158+
* ```SyncProducts```
159+
OPTIONAL: If provided as a comma-separated list of product IDs, will limit the certificate sync to only certificates of those products. If blank or not provided, will sync all certs.
155160

156161
```json
157162
"CAConnection": {
158163
"IsTest":"false",
159164
"PickupRetries":5,
160165
"PickupDelay":150,
161166
"Username":"PAR12344_apiuser",
162-
"Password":"password"
167+
"Password":"password",
168+
"SyncStartDate":"2020-01-01",
169+
"SyncIntervalDays":30,
170+
"SyncProducts":"PV_SHA2, PEV_SHA2"
163171
},
164172
```
165173
## GatewayRegistration

‎src/GlobalSignCAProxy/Api/GlobalSignEnrollRequest.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,12 @@ public BmV2PvOrderRequest Request
9090
Logger.Info($"SAN Entry {item} matches CN, removing from request");
9191
continue;
9292
}
93+
if (string.Equals(item, $"*.{CommonName}", System.StringComparison.OrdinalIgnoreCase)
94+
|| string.Equals($"*.{item}", CommonName, System.StringComparison.OrdinalIgnoreCase))
95+
{
96+
Logger.Info($"SAN Entry {item} is equivalent to CN ignoring wildcards, removing from request");
97+
continue;
98+
}
9399
SANEntry entry = new SANEntry();
94100
entry.SubjectAltName = item;
95101
StringBuilder sb = new StringBuilder();

‎src/GlobalSignCAProxy/Api/GlobalSignRenewRequest.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,12 @@ public GlobalSignRenewRequest(GlobalSignCAConfig config) : base(config) { }
4444
Logger.Info($"SAN Entry {item} matches CN, removing from request");
4545
continue;
4646
}
47+
if (string.Equals(item, $"*.{CommonName}", System.StringComparison.OrdinalIgnoreCase)
48+
|| string.Equals($"*.{item}", CommonName, System.StringComparison.OrdinalIgnoreCase))
49+
{
50+
Logger.Info($"SAN Entry {item} is the same base domain as the wildcard CN, removing from request");
51+
continue;
52+
}
4753
SANEntry entry = new SANEntry();
4854
entry.SubjectAltName = item;
4955
StringBuilder sb = new StringBuilder();

‎src/GlobalSignCAProxy/Client/GlobalSignApiClient.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ public EnrollmentResult Enroll(GlobalSignEnrollRequest enrollRequest)
298298
{
299299
Logger.Trace($"Order Base Option: {rawRequest.OrderRequestParameter.BaseOption}");
300300
}
301-
var response = OrderService.PVOrder(enrollRequest.Request);
301+
var response = OrderService.PVOrder(rawRequest);
302302
if (response.OrderResponseHeader.SuccessCode == 0)
303303
{
304304
Logger.Debug($"Enrollment request successfully submitted");
@@ -365,7 +365,7 @@ public EnrollmentResult Renew(GlobalSignRenewRequest renewRequest)
365365
Logger.Trace($"Order Base Option: {rawRequest.OrderRequestParameter.BaseOption}");
366366
}
367367
Logger.Trace($"Renewal Target: {rawRequest.OrderRequestParameter.RenewalTargetOrderID}");
368-
var response = OrderService.PVOrder(renewRequest.Request);
368+
var response = OrderService.PVOrder(rawRequest);
369369
if (response.OrderResponseHeader.SuccessCode == 0)
370370
{
371371
Logger.Debug($"Renewal request successfully submitted");

‎src/GlobalSignCAProxy/GlobalSignCAConfig.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ public class GlobalSignCAConfig
2525

2626
public string SyncStartDate { get; set; }
2727
public int SyncIntervalDays { get; set; }
28+
public string SyncProducts { get; set; }
2829

2930
public string GetUrl(GlobalSignServiceType queryType)
3031
{

0 commit comments

Comments
 (0)