Dev 1.1

CHANGELOG.md

@@ -5,5 +5,7 @@ v1.0
 Remove retry logic around reissue pickups  
 
 1.1.1  
-Change incremental sync to use GetModifiedOrders API call  
-Remove retry logic around reissue pickups
+Change incremental sync to use GetModifiedOrders API call   
+
+1.1.2  
+Add 30 day window from expiration for doing renewals instead of reissues  

README.md

@@ -133,12 +133,15 @@ This extension uses the contact information of the GCC Domain point of contact f
 GlobalSign supports specific combinations of SAN types with certain GlobalSign products. For example, a Private IP can only be used as a SAN with a `PV_INTRA` Certificate.  
 Please refer to the GlobalSign documentation for more information on SAN usage:  [GlobalSign MSSL API User Guide (Section 2.2.5)](https://www.globalsign.com/en/repository/globalsign-mssl-api-user-guide.pdf)
 
-## Enrollment Fields
+## Enrollment
 
 ### Required Enrollment Fields
 The following fields are required for enrollment on all certificate templates:
 - **ContactName**: Set Data Type to 'string' when creating the field. The name of the contact person for the certificate. This is required by the GlobalSign API.
 
+### Renewal vs Reissue
+Currently, the gateway determines whether to do a renew or reissue based on the expiration date of the certificate in question. If it is within 30 days of expiration, the gateway will do a renew; otherwise, it will do a reissue.
+
 ### PV_INTRA Specific Enrollment Fields
 The following fields are available for use in the enrollment of `PV_INTRA` Certificates:
 - **PrivateDomain**: Set Data Type to 'string' when creating the field. Set to `true` if enrolling a certificate for a private domain (e.g., `.local`, `.lab`, etc.).

docsource/configuration.md

@@ -24,12 +24,15 @@ GlobalSign supports specific combinations of SAN types with certain GlobalSign p
 Please refer to the GlobalSign documentation for more information on SAN usage:  [GlobalSign MSSL API User Guide (Section 2.2.5)](https://www.globalsign.com/en/repository/globalsign-mssl-api-user-guide.pdf)
 
 
-## Enrollment Fields
+## Enrollment
 
 ### Required Enrollment Fields
 The following fields are required for enrollment on all certificate templates:
 - **ContactName**: Set Data Type to 'string' when creating the field. The name of the contact person for the certificate. This is required by the GlobalSign API.
 
+### Renewal vs Reissue
+Currently, the gateway determines whether to do a renew or reissue based on the expiration date of the certificate in question. If it is within 30 days of expiration, the gateway will do a renew; otherwise, it will do a reissue.
+
 ### PV_INTRA Specific Enrollment Fields
 The following fields are available for use in the enrollment of `PV_INTRA` Certificates:
 - **PrivateDomain**: Set Data Type to 'string' when creating the field. Set to `true` if enrolling a certificate for a private domain (e.g., `.local`, `.lab`, etc.).

globalsign-mssl-caplugin/GlobalSignCAPlugin.cs

@@ -21,7 +21,7 @@
 public class GlobalSignCAPlugin : IAnyCAPlugin
 {
     private ICertificateDataReader? _certificateDataReader; 
     private ILogger Logger;
 
     private GlobalSignCAConfig Config { get; set; } = new();
     private bool _enabled = false;
@@ -100,7 +100,7 @@
                 Config.SyncIntervalDays);
 
 			bool productFilter = false;
 			List<string> products = null;
 			if (!string.IsNullOrEmpty(Config.SyncProducts))
 			{
 				products = Config.SyncProducts.Split(',').ToList();
@@ -113,7 +113,7 @@
 				if (productFilter)
 				{
 					bool prodMatch = false;
 					if (c.OrderInfo?.ProductCode != null && products.Contains(c.OrderInfo.ProductCode.ToUpper()))
 					{
 						prodMatch = true;
 					}
@@ -217,12 +217,12 @@
                 privateDomain = bool.TryParse(prD, out var parsedD) && parsedD;
                 if (privateDomain)
                 {
                     if (!productInfo.ProductParameters.TryGetValue("RequesterEmail", out requesterEmail) || string.IsNullOrWhiteSpace(requesterEmail))
                     {
                         Logger.LogWarning("The 'RequesterEmail' parameter is required when 'PrivateDomain' is true but was not provided or is empty.");
                         requesterEmail = string.Empty;
                     }
                     if (!productInfo.ProductParameters.TryGetValue("RequesterTel", out requesterTel) || string.IsNullOrWhiteSpace(requesterTel))
                     {
                         Logger.LogWarning("The 'RequesterTel' parameter is required when 'PrivateDomain' is true but was not provided or is empty.");
                         requesterTel = string.Empty;
@@ -334,7 +334,7 @@
 
                     }
                 };
                 domain.MSSLProfileID = fillProfile.MSSLProfileId;
 				matchedDomains = new List<GetDomainsDomainDetail> { domain };
             }
 
@@ -419,7 +419,7 @@
                 case EnrollmentType.RenewOrReissue:
                     //Determine whether this is a renewal or a reissue:
                     var renewal = false;
                     var order_id = await _certificateDataReader.GetRequestIDBySerialNumber(priorSn);
                     var expirationDate = _certificateDataReader.GetExpirationDateByRequestId(order_id);
                     if (expirationDate == null)
                     {
@@ -427,7 +427,7 @@
                         expirationDate = localcert.RevocationDate;
                     }
 
-                    if (expirationDate < DateTime.Now) renewal = true;
+                    if (expirationDate.Value.AddDays(-30) < DateTime.Now) renewal = true; // 30 day renewal window
                     if (renewal)
                     {
                         Logger.LogDebug(