How keyfactor/acme-provider-caplugin works
This is a Keyfactor AnyCA Gateway plugin for enrollment-only certificate issuance through ACME. The documented workflow accepts a CSR and SANs, creates an ACME order, publishes DNS-01 challenge records, waits for propagation and validation, finalizes the order, and returns the PEM certificate. Configuration and account signing/storage support that flow; the README also documents multiple DNS integrations, though the supplied source excerpts show implementations only for Google Cloud DNS and Cloudflare. Relationships not demonstrated by excerpts or README documentation are omitted.
Main entry points: AcmeCaPlugin.cs Plugin operations · AcmeClient.cs ACME order and challenge operations · AccountManager.cs Account persistence · DnsProviderFactory.cs DNS provider selection
Components 16
Gateway integration
- Plugin operations
AcmeCaPlugin/AcmeCaPlugin.cs - Plugin configuration
AcmeCaPlugin/AcmeCaPluginConfig.cs - ACME and DNS settings
AcmeCaPlugin/AcmeClientConfig.cs - CSR and SANs
ACME enrollment
- ACME client manager
AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs - ACME order and challenge operations
AcmeCaPlugin/Clients/Acme/AcmeClient.cs - ACME certificate authority
- PEM certificate
DNS challenges
- DNS provider selection
AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs - DNS provider implementations
AcmeCaPlugin/Clients/DNS - DNS propagation verification
AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs - DNS resolvers and authoritative servers
Account security
- Account persistence
AcmeCaPlugin/Clients/Acme/AccountManager.cs - ACME account
AcmeCaPlugin/Clients/Acme/Account.cs - Account signer
AcmeCaPlugin/Clients/Acme/AccountSigner.cs
Other components
- Keyfactor Gateway
Connections 20
- Keyfactor Gateway → Plugin operations: submits enrollment
README.md - Plugin operations → ACME client manager: initializes client
AcmeCaPlugin/AcmeCaPlugin.cs - Plugin operations → ACME order and challenge operations: runs enrollment
README.md - Plugin operations → DNS provider selection: selects provider
AcmeCaPlugin/AcmeCaPlugin.cs - Plugin operations → DNS propagation verification: checks propagation
AcmeCaPlugin/AcmeCaPlugin.cs - Plugin configuration → ACME and DNS settings: configures
AcmeCaPlugin/AcmeCaPluginConfig.cs - Keyfactor Gateway → CSR and SANs: provides CSR
README.md - ACME order and challenge operations → ACME certificate authority: creates orders and validates
README.md - ACME order and challenge operations → DNS provider selection: requests challenge records
README.md - DNS provider selection → DNS provider implementations: creates configured provider
AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs - DNS provider implementations → DNS resolvers and authoritative servers: publishes TXT records
README.md - DNS propagation verification → DNS resolvers and authoritative servers: queries DNS
AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs - ACME order and challenge operations → ACME certificate authority: finalizes CSR order
README.md - ACME certificate authority → PEM certificate: issues certificate
README.md - Plugin operations → PEM certificate: returns PEM
README.md - ACME client manager → Account persistence: loads or stores account
AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs - Account persistence → ACME account: persists account
AcmeCaPlugin/Clients/Acme/AccountManager.cs - Account persistence → Account signer: creates and persists signer
AcmeCaPlugin/Clients/Acme/AccountManager.cs - ACME account → Account signer: holds signer
AcmeCaPlugin/Clients/Acme/Account.cs - ACME order and challenge operations → ACME account: authenticates requests
AcmeCaPlugin/Clients/Acme/AcmeClient.cs