Closes Top-10 fix#2 of the 2026-05-03 issuer-coverage audit (see
cowork/issuer-coverage-audit-2026-05-03/RESULTS.md). Pre-fix,
vault.Config.Token and digicert.Config.APIKey were plain string
fields. Practical impact:
1. GET /api/v1/issuers responses marshalled the credential into
the JSON body. An acquirer's procurement engineer running
'curl /api/v1/issuers | jq' saw the token / API key in plain
text on screen.
2. DEBUG-level HTTP request logging printed the credential
header verbatim.
3. A heap dump of the running server contained the credential
as readable bytes for the lifetime of the process.
Bundle I from the 2026-05-01 audit closed this for AWSACMPCA,
EJBCA, GlobalSign, Sectigo (Phase 1+2). Vault and DigiCert were
left out. This commit ports the same migration onto them.
Mechanics:
- Config.Token / Config.APIKey type changed from 'string' to
'*secret.Ref'. UnmarshalJSON of a JSON string populates the
Ref via NewRefFromString — operator config files are
unchanged.
- Every header-write call site routed through Ref.Use, with the
byte buffer zeroed after the callback returns. Vault: 3 sites
(IssueCertificate, RevokeCertificate, GetCACertPEM). DigiCert:
5 sites (ValidateConfig, IssueCertificate, RevokeCertificate,
pollOrderOnce, downloadCertificate).
- ValidateConfig nil-checks switch from 'cfg.Token == ""' to
'cfg.Token.IsEmpty()' (mirrors Sectigo's existing pattern).
- Tests migrated: every Config{Token:"..."} →
Config{Token: secret.NewRefFromString("...")}. The
'json.Marshal(config) → ValidateConfig(rawConfig)' round-trip
pattern in DigiCert's ValidateConfig_Success test is now
broken by the redact-on-marshal contract — switched that one
to construct the rawConfig as a JSON literal (mirrors
Sectigo's existing test pattern).
- Two new tests pin the redact-on-marshal contract:
- TestVault_Config_TokenMarshalsAsRedacted (vault_redact_test.go)
- TestDigiCert_Config_APIKeyMarshalsAsRedacted (digicert_redact_test.go)
Both assert the marshaled JSON contains '"[redacted]"' and
does NOT contain the plaintext bytes.
Operator-visible: GET /api/v1/issuers responses for type=vault
and type=digicert now show the credential as '[redacted]'.
Existing config files keep working — the Ref unmarshal accepts
strings.
CHANGELOG note: certctl/CHANGELOG.md is intentionally not
hand-edited; release notes are auto-generated from commit
messages between consecutive tags. This commit's message body is
the release-note artifact.
Verified locally:
- gofmt clean across the repo.
- go vet ./... clean across the repo.
- go test -race -count=1 -short
./internal/connector/issuer/vault/...
./internal/connector/issuer/digicert/...
./internal/secret/... green.
Audit reference: cowork/issuer-coverage-audit-2026-05-03/
RESULTS.md Top-10 fix#2.
Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 71b2245) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.
Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.
The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.
Closes M-001 partially; M-002, M-003, and CI threshold raise #2 deferred.
Stubs coverage shipped across 8 issuer connectors via per-connector
<conn>_stubs_test.go (~50 LoC each) pinning the not-supported
issuer.Connector interface methods (GenerateCRL, SignOCSPResponse,
GetCACertPEM, GetRenewalInfo). Most CAs delegate CRL/OCSP/CA-cert
distribution to managed services, so these are documented stubs that
return errors. Pinning them ensures the stubs aren't silently replaced
with no-ops in a future refactor.
Coverage delta:
digicert: 79.3% -> 81.0% (+1.7pp)
ejbca: 75.8% -> 76.5% (+0.7pp)
entrust: 70.8% -> 70.8% (stubs already covered)
sectigo: 78.0% -> 79.4% (+1.4pp)
vault: 81.0% -> 84.1% (+3.1pp)
openssl: 76.9% -> 78.0% (+1.1pp)
googlecas: 81.0% -> 83.4% (+2.4pp)
globalsign: 75.9% -> 78.2% (+2.3pp)
(awsacmpca not included; its 0%-coverage hotspots are stubClient methods
structurally different from the others' interface stubs. Already at 83.5%.)
Why the gates aren't yet met: the stub functions are tiny (1-2 lines
each, mostly 'return nil, fmt.Errorf("not supported")'). Lifting each
connector to >=85% requires per-connector failure-mode test files
mirroring Bundle J's ACME pattern (httptest.Server + canned 401/403/
429+Retry-After/5xx/malformed responses against the actual API methods).
That's ~200-300 LoC x 9 connectors = ~2000-2700 LoC of bespoke per-CA
mock work; exceeds this session's budget. Tracked as follow-on
Bundle N.A-extended / N.B-extended.
Deferred sub-batches:
N.C (M-002 + M-003): internal/service (70.5%) + internal/api/handler
(79.4%) round-out NOT YET STARTED. Tracked as Bundle N.C-extended.
N.CI (CI threshold raise #2): prescribed raises require underlying
coverage at proposed floors first. Premature raise would fail CI
immediately. Tracked as Bundle N.CI-extended.
Verification:
go vet ./internal/connector/issuer/{8-pkgs}/... clean
gofmt -l clean
go test -short -count=1 PASS for all 8
Audit deliverables:
gap-backlog.md: M-001 partial-strikethrough with per-connector table
+ Bundle N closure-log entry covering all 4 sub-batch statuses
closure-plan.md: Bundle N [~] with per-sub-batch status breakdown
CHANGELOG.md: [unreleased] Bundle N entry
Enforce certificate profile crypto constraints across all 5 issuance paths
(renewal, agent CSR, EST, SCEP). ValidateCSRAgainstProfile() rejects CSRs
with key algorithm/size that don't match profile rules. MaxTTL enforcement
caps certificate validity per issuer connector (Local CA, Vault, step-ca
enforce directly; ACME/DigiCert/Sectigo pass through). Key algorithm and
size are now persisted in certificate_versions for audit compliance.
16 new tests (12 service-layer + 4 Local CA connector). Removes hardcoded
version number from GUI sidebar. Documentation updated across architecture,
features, connectors, and README.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Convert `switch { case r.URL.Path == ... }` to `switch r.URL.Path { ... }`
in Vault and DigiCert connector tests to pass golangci-lint CI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
shankar0123