# keyfactor/acme-provider-caplugin architecture

> Architecture diagram of the GitHub repository keyfactor/acme-provider-caplugin, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-12). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/keyfactor/acme-provider-caplugin
- Repository: https://github.com/keyfactor/acme-provider-caplugin

## Overview

This is a Keyfactor AnyCA Gateway plugin for enrollment-only certificate issuance through ACME. The documented workflow accepts a CSR and SANs, creates an ACME order, publishes DNS-01 challenge records, waits for propagation and validation, finalizes the order, and returns the PEM certificate. Configuration and account signing/storage support that flow; the README also documents multiple DNS integrations, though the supplied source excerpts show implementations only for Google Cloud DNS and Cloudflare. Relationships not demonstrated by excerpts or README documentation are omitted.

Main entry points: [`AcmeCaPlugin/AcmeCaPlugin.cs`](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeCaPlugin.cs) (Plugin operations), [`AcmeCaPlugin/Clients/Acme/AcmeClient.cs`](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AcmeClient.cs) (ACME order and challenge operations), [`AcmeCaPlugin/Clients/Acme/AccountManager.cs`](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AccountManager.cs) (Account persistence), [`AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs`](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs) (DNS provider selection)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_gateway["Gateway integration"]
  node_plugin["Plugin operations<br/>[AcmeCaPlugin.cs]"]
  node_plugin_config["Plugin configuration"]
  node_client_config["ACME and DNS settings"]
  node_csr["CSR and SANs"]
end

subgraph group_acme["ACME enrollment"]
  node_acme_manager["ACME client manager"]
  node_acme_client["ACME order and challenge operations<br/>[AcmeClient.cs]"]
  node_acme_ca(("ACME certificate authority"))
  node_certificate["PEM certificate"]
end

subgraph group_dns["DNS challenges"]
  node_dns_factory["DNS provider selection"]
  node_dns_providers["DNS provider implementations"]
  node_dns_verify["DNS propagation verification"]
  node_dns_network(("DNS resolvers and authoritative servers"))
end

subgraph group_account["Account security"]
  node_account_manager["Account persistence<br/>[AccountManager.cs]"]
  node_account["ACME account<br/>[Account.cs]"]
  node_signer["Account signer<br/>[AccountSigner.cs]"]
end

node_gateway_user(("Keyfactor Gateway"))

node_gateway_user -->|"submits enrollment"| node_plugin
node_plugin -->|"initializes client"| node_acme_manager
node_plugin -->|"runs enrollment"| node_acme_client
node_plugin -->|"selects provider"| node_dns_factory
node_plugin -->|"checks propagation"| node_dns_verify
node_plugin_config -->|"configures"| node_client_config
node_gateway_user -->|"provides CSR"| node_csr
node_acme_client -->|"creates orders and validates"| node_acme_ca
node_acme_client -->|"requests challenge records"| node_dns_factory
node_dns_factory -->|"creates configured provider"| node_dns_providers
node_dns_providers -->|"publishes TXT records"| node_dns_network
node_dns_verify -->|"queries DNS"| node_dns_network
node_acme_client -->|"finalizes CSR order"| node_acme_ca
node_acme_ca -->|"issues certificate"| node_certificate
node_plugin -->|"returns PEM"| node_certificate
node_acme_manager -->|"loads or stores account"| node_account_manager
node_account_manager -->|"persists account"| node_account
node_account_manager -->|"creates and persists signer"| node_signer
node_account -->|"holds signer"| node_signer
node_acme_client -->|"authenticates requests"| node_account

click node_plugin "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeCaPlugin.cs"
click node_plugin_config "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeCaPluginConfig.cs"
click node_client_config "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeClientConfig.cs"
click node_acme_manager "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs"
click node_acme_client "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AcmeClient.cs"
click node_dns_factory "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs"
click node_dns_providers "https://github.com/keyfactor/acme-provider-caplugin/tree/main/AcmeCaPlugin/Clients/DNS"
click node_dns_verify "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs"
click node_account_manager "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AccountManager.cs"
click node_account "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/Account.cs"
click node_signer "https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AccountSigner.cs"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_plugin,node_plugin_config,node_client_config,node_csr toneBlue
class node_acme_manager,node_acme_client,node_acme_ca,node_certificate toneAmber
class node_dns_factory,node_dns_providers,node_dns_verify,node_dns_network toneMint
class node_account_manager,node_account,node_signer toneRose
class node_gateway_user toneIndigo
```

## Components

### Gateway integration

- [Plugin operations](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeCaPlugin.cs): `AcmeCaPlugin/AcmeCaPlugin.cs`
- [Plugin configuration](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeCaPluginConfig.cs): `AcmeCaPlugin/AcmeCaPluginConfig.cs`
- [ACME and DNS settings](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/AcmeClientConfig.cs): `AcmeCaPlugin/AcmeClientConfig.cs`
- **CSR and SANs**

### ACME enrollment

- [ACME client manager](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs): `AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs`
- [ACME order and challenge operations](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AcmeClient.cs): `AcmeCaPlugin/Clients/Acme/AcmeClient.cs`
- **ACME certificate authority**
- **PEM certificate**

### DNS challenges

- [DNS provider selection](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs): `AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs`
- [DNS provider implementations](https://github.com/keyfactor/acme-provider-caplugin/tree/main/AcmeCaPlugin/Clients/DNS): `AcmeCaPlugin/Clients/DNS`
- [DNS propagation verification](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs): `AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs`
- **DNS resolvers and authoritative servers**

### Account security

- [Account persistence](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AccountManager.cs): `AcmeCaPlugin/Clients/Acme/AccountManager.cs`
- [ACME account](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/Account.cs): `AcmeCaPlugin/Clients/Acme/Account.cs`
- [Account signer](https://github.com/keyfactor/acme-provider-caplugin/blob/main/AcmeCaPlugin/Clients/Acme/AccountSigner.cs): `AcmeCaPlugin/Clients/Acme/AccountSigner.cs`

### Other components

- **Keyfactor Gateway**

## Connections

- Keyfactor Gateway → Plugin operations: submits enrollment (evidence: `README.md`)
- Plugin operations → ACME client manager: initializes client (evidence: `AcmeCaPlugin/AcmeCaPlugin.cs`)
- Plugin operations → ACME order and challenge operations: runs enrollment (evidence: `README.md`)
- Plugin operations → DNS provider selection: selects provider (evidence: `AcmeCaPlugin/AcmeCaPlugin.cs`)
- Plugin operations → DNS propagation verification: checks propagation (evidence: `AcmeCaPlugin/AcmeCaPlugin.cs`)
- Plugin configuration → ACME and DNS settings: configures (evidence: `AcmeCaPlugin/AcmeCaPluginConfig.cs`)
- Keyfactor Gateway → CSR and SANs: provides CSR (evidence: `README.md`)
- ACME order and challenge operations → ACME certificate authority: creates orders and validates (evidence: `README.md`)
- ACME order and challenge operations → DNS provider selection: requests challenge records (evidence: `README.md`)
- DNS provider selection → DNS provider implementations: creates configured provider (evidence: `AcmeCaPlugin/Clients/DNS/DnsProviderFactory.cs`)
- DNS provider implementations → DNS resolvers and authoritative servers: publishes TXT records (evidence: `README.md`)
- DNS propagation verification → DNS resolvers and authoritative servers: queries DNS (evidence: `AcmeCaPlugin/Clients/DNS/DnsVerificationHelper.cs`)
- ACME order and challenge operations → ACME certificate authority: finalizes CSR order (evidence: `README.md`)
- ACME certificate authority → PEM certificate: issues certificate (evidence: `README.md`)
- Plugin operations → PEM certificate: returns PEM (evidence: `README.md`)
- ACME client manager → Account persistence: loads or stores account (evidence: `AcmeCaPlugin/Clients/Acme/AcmeClientManager.cs`)
- Account persistence → ACME account: persists account (evidence: `AcmeCaPlugin/Clients/Acme/AccountManager.cs`)
- Account persistence → Account signer: creates and persists signer (evidence: `AcmeCaPlugin/Clients/Acme/AccountManager.cs`)
- ACME account → Account signer: holds signer (evidence: `AcmeCaPlugin/Clients/Acme/Account.cs`)
- ACME order and challenge operations → ACME account: authenticates requests (evidence: `AcmeCaPlugin/Clients/Acme/AcmeClient.cs`)