Merge to main

[indrora]

Merge dev-3.0 to main - Automated PR

[Copilot]

🟡 Changes recommended

A duplicate CheckDCV member prevents compilation, and automated validation has unresolved enrollment and error-handling issues.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This merge updates the DigiCert CertCentral plugin for AnyCA Gateway 26.2.0 with configurable DNS validation and updated framework dependencies.

Changes:

• Adds TXT/CNAME DNS validation support.
• Updates target frameworks, dependencies, and metadata.
• Updates configuration, documentation, and release notes.

File summaries

File	Description
README.md	Documents compatibility and DNS settings.
integration-manifest.json	Updates framework metadata and configuration descriptions.
digicert-certcentral-caplugin/digicert-certcentral-caplugin.csproj	Updates target frameworks and dependencies.
digicert-certcentral-caplugin/Constants.cs	Adds DNS configuration constants.
digicert-certcentral-caplugin/Client/CertCentralClient.cs	Adds DCV check client support.
digicert-certcentral-caplugin/CertCentralConfig.cs	Adds DNS configuration properties.
digicert-certcentral-caplugin/CertCentralCAPlugin.cs	Implements DNS validation and enrollment handling.
CHANGELOG.md	Records release notes.

Review details

Suppressed comments (5)

digicert-certcentral-caplugin/CertCentralCAPlugin.cs:1297

• This error string opens a parenthesized validation-type segment but never closes it, producing malformed log/status text. Add the closing ) before the newline.

									errors.Add($"Failed to resolve DNS provider plugin for '{dom}' (validation type '{validType}'\nError: {ex.Message}");

digicert-certcentral-caplugin/CertCentralCAPlugin.cs:1281

• When DnsValidationEnabled is true while DnsValidationMethod remains at the documented default email, every order that returns a DCV token reaches this branch and throws because only txt and cname are accepted for automation. The connector annotations do not reject this combination, so enabling the new flag with the default settings breaks enrollment; reject the combination up front or handle email as non-automated validation.

							string validType = "";
							if (string.Equals(dcvMethod, "dns-txt-token"))
								validType = "dns-01";
							else if (string.Equals(dcvMethod, "dns-cname-token"))
								validType = "cname";
							else
								throw new Exception($"For automated DNS validation, validation type must be either 'txt' or 'cname'");

digicert-certcentral-caplugin/CertCentralCAPlugin.cs:536

• The connector UI description has the same mismatch: it promises TXT-based requests while the code supports CNAME and fails for the default email when automation is enabled. Clarify that automated validation requires txt or cname and uses the configured method.

					Comments = "Enable automated DNS (TXT or CNAME) domain control validation. When enabled, the plugin " +
							   "requests TXT-based validation from DigiCert and publishes the returned record via the " +
							   "DNS provider plugin resolved by the AnyCA Gateway. Requires a DNS provider plugin (e.g. Azure, " +

digicert-certcentral-caplugin/CertCentralCAPlugin.cs:1315

• When StageValidation reports a provider failure, this code returns EXTERNALVALIDATION, but automated mode does not put the token in EnrollmentContext; the sync path only reads DigiCert status and never retries StageValidation. A transient DNS-provider failure can therefore leave the order pending indefinitely. Preserve a retryable validation context or add a retry path before returning.

								if (result == null || !result.Success)
								{
									var msg = result?.ErrorMessage ?? "unknown error";
									errors.Add($"Failed to publish DNS validation record for '{dom}': {msg}");
								}

digicert-certcentral-caplugin/CertCentralCAPlugin.cs:1324

• DVCheckDCVResponse carries the actual dcv_status and order_status, but this condition only tests the transport-level Status (which is successful for a successful JSON response). A pending DCV check can therefore take the else path, attempt to download a certificate, and fail instead of returning EXTERNALVALIDATION; branch on the response status fields before retrieving the chain.

							var dcvcheck = client.DVCheckDCV(new DVCheckDCVRequest((int)orderID));
							if (dcvcheck.Status == CertCentralBaseResponse.StatusType.ERROR)
							{

• Files reviewed: 8/8 changed files
• Comments generated: 6
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Unresolved critical enrollment-status handling and additional configuration/order-management issues remain.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 3 · 6

Open (11)

• Use DCV payload status before downloading the certificate · New
• This adds a second CheckDCV(DVCheckDCVRequest) method; the class already contains the same…
• Validate DNS automation configuration before creating orders · New
• Use DigiCert's actual DCV method for reissues · New
• Unlike the existing certificate-download paths, this ignores certChain.Status before…
• Document the configured DNS validation method · New
• Fix malformed validation type diagnostic · New
• The manifest repeats the same misleading claim that automation requests TXT validation even though…
• The target list now drops net6.0 and adds net10.0, but the installation instructions still tell…
• The warning contains the typo Unexpeted, which is exposed in gateway logs. Please correct it to…
• This documentation says enabling automation requests TXT validation, but the implementation honors…