Merge 2.0.0 to main

.github/workflows/keyfactor-starter-workflow.yml

@@ -11,8 +11,7 @@ on:
 
 jobs:
   call-starter-workflow:
-    uses: keyfactor/actions/.github/workflows/starter.yml@port-update-catalog-to-v5
-
+    uses: keyfactor/actions/.github/workflows/starter.yml@v5
     with:
       command_token_url: ${{ vars.COMMAND_TOKEN_URL }}
       command_hostname: ${{ vars.COMMAND_HOSTNAME }}

CHANGELOG.md

@@ -1,3 +1,22 @@
+# v2.1.0
+* Added support for the generic DNS provider plugin framework (Keyfactor.AnyGateway.IAnyCAPlugin 3.3.0)
+* Automated DNS (CNAME) domain control validation: when enabled, the plugin requests CNAME-based
+  validation from SSL Store and publishes the returned record via the DNS provider plugin resolved
+  by the AnyCA Gateway (Azure, Route53, Cloudflare, Google, NS1, Infoblox, RFC2136, etc.)
+* Verifies public DNS propagation of the validation record before returning (configurable attempts/delay)
+* After publishing the CNAME, polls SSL Store for issuance up to `DcvPollTimeoutSeconds` and returns the
+  issued certificate directly from the enrollment call when it issues in time (ACME-style); otherwise
+  returns pending and the certificate is retrieved on the next CA sync
+* Best-effort cleanup of DNS validation records once an order is issued (GetSingleRecord/Synchronize)
+* New CA-connection settings: `DnsValidationEnabled`, `DnsVerificationServer`, `DnsPropagationMaxAttempts`, `DnsPropagationDelaySeconds`
+* CNAME is the intrinsic DCV method for SSL Store; the DNS record type is determined by the CNAME
+  validator you map to each domain in the gateway's Domain Validation configuration (no CA-connection knob)
+* Email approver validation remains the default when DNS validation is disabled
+* Revoked (Cancelled) orders now download and store the actual certificate; orders with no
+  downloadable certificate are skipped instead of storing empty cert bytes (which previously
+  crashed the gateway certificate search with "m_safeCertContext is an invalid handle")
+* Added FlowLogger step tracing and expanded operational logging across all plugin operations
+
 # v2.0.0
 * Converted from AnyCA Gateway (DB) to AnyCA Gateway REST plugin architecture
 * Migrated from CAProxy.AnyGateway (BaseCAConnector) to IAnyCAPlugin interface