Closes Top-10 fix#2 of the 2026-05-03 issuer-coverage audit (see
cowork/issuer-coverage-audit-2026-05-03/RESULTS.md). Pre-fix,
vault.Config.Token and digicert.Config.APIKey were plain string
fields. Practical impact:
1. GET /api/v1/issuers responses marshalled the credential into
the JSON body. An acquirer's procurement engineer running
'curl /api/v1/issuers | jq' saw the token / API key in plain
text on screen.
2. DEBUG-level HTTP request logging printed the credential
header verbatim.
3. A heap dump of the running server contained the credential
as readable bytes for the lifetime of the process.
Bundle I from the 2026-05-01 audit closed this for AWSACMPCA,
EJBCA, GlobalSign, Sectigo (Phase 1+2). Vault and DigiCert were
left out. This commit ports the same migration onto them.
Mechanics:
- Config.Token / Config.APIKey type changed from 'string' to
'*secret.Ref'. UnmarshalJSON of a JSON string populates the
Ref via NewRefFromString — operator config files are
unchanged.
- Every header-write call site routed through Ref.Use, with the
byte buffer zeroed after the callback returns. Vault: 3 sites
(IssueCertificate, RevokeCertificate, GetCACertPEM). DigiCert:
5 sites (ValidateConfig, IssueCertificate, RevokeCertificate,
pollOrderOnce, downloadCertificate).
- ValidateConfig nil-checks switch from 'cfg.Token == ""' to
'cfg.Token.IsEmpty()' (mirrors Sectigo's existing pattern).
- Tests migrated: every Config{Token:"..."} →
Config{Token: secret.NewRefFromString("...")}. The
'json.Marshal(config) → ValidateConfig(rawConfig)' round-trip
pattern in DigiCert's ValidateConfig_Success test is now
broken by the redact-on-marshal contract — switched that one
to construct the rawConfig as a JSON literal (mirrors
Sectigo's existing test pattern).
- Two new tests pin the redact-on-marshal contract:
- TestVault_Config_TokenMarshalsAsRedacted (vault_redact_test.go)
- TestDigiCert_Config_APIKeyMarshalsAsRedacted (digicert_redact_test.go)
Both assert the marshaled JSON contains '"[redacted]"' and
does NOT contain the plaintext bytes.
Operator-visible: GET /api/v1/issuers responses for type=vault
and type=digicert now show the credential as '[redacted]'.
Existing config files keep working — the Ref unmarshal accepts
strings.
CHANGELOG note: certctl/CHANGELOG.md is intentionally not
hand-edited; release notes are auto-generated from commit
messages between consecutive tags. This commit's message body is
the release-note artifact.
Verified locally:
- gofmt clean across the repo.
- go vet ./... clean across the repo.
- go test -race -count=1 -short
./internal/connector/issuer/vault/...
./internal/connector/issuer/digicert/...
./internal/secret/... green.
Audit reference: cowork/issuer-coverage-audit-2026-05-03/
RESULTS.md Top-10 fix#2.
Phase 1 of the #5 acquisition-readiness fix from the 2026-05-01 issuer
coverage audit. Pre-fix, four async-CA connectors (DigiCert, Sectigo,
Entrust, GlobalSign) had GetOrderStatus paths that polled the upstream
on every scheduler tick with no exponential backoff, no max-retry cap,
and no deadline. The scheduler's tick rate (typically 30s) was the
only throttle — an unready order got hit every 30s indefinitely, and
a 429 from a rate-limited upstream produced "retry on the next tick"
which re-fanned-out the same call.
This commit ships the shared infrastructure (asyncpoll package) and
refactors DigiCert as the reference. Sectigo / Entrust / GlobalSign
follow the same mechanical pattern; they land in Phase 2.
Phase 1 (this commit):
- internal/connector/issuer/asyncpoll/asyncpoll.go: shared Poller
with exponential backoff (5s → 15s → 45s → 2m → 5m capped),
±20% jitter, configurable MaxWait deadline (default 10m), and
ctx-aware cancellation.
- Result enum: StillPending / Done / Failed. PollFunc returns
(Result, err); Poll handles the wait loop, deadline check, and
ctx propagation.
- ErrMaxWait sentinel for callers that want to distinguish
"deadline exhausted" from "fn errored".
- asyncpoll_test.go: 11 tests covering happy path, transient error
keep-polling, Failed terminates immediately, MaxWait timeout,
MaxWait+lastErr wrap, ctx cancel, multiplicative backoff, jitter
bounds (statistical), pct=0 deterministic, defaults applied.
- DigiCert refactor: GetOrderStatus now wraps pollOrderOnce in
asyncpoll.Poll. Status-code triage:
2xx + parse + status="issued" → Done with cert
2xx + parse + status="pending" → StillPending
2xx + parse + status="rejected"/"denied" → Done with status="failed"
2xx + parse fail → Failed (permanent)
4xx (not 429) → Failed (404 = order
doesn't exist)
429 / 5xx / network → StillPending
- Config.PollMaxWaitSeconds (env: CERTCTL_DIGICERT_POLL_MAX_WAIT_SECONDS)
exposes the per-call deadline knob; default 600 (10m).
- Test helper buildDigicertConnector + GetOrderStatus_Pending test
set PollMaxWaitSeconds=1 so async-pending tests don't block 10
minutes on the production default.
Phase 2 (separate follow-up commit, not in this PR):
- Sectigo refactor (collectNotReady sentinel maps to StillPending).
- Entrust refactor (approval-pending → longer per-issuer MaxWait).
- GlobalSign refactor (serial-tracking; same Poller).
- Per-connector cadence integration tests against fake HTTP servers.
- docs/async-polling.md + docs/connectors.md updates.
Audit reference: cowork/issuer-coverage-audit-2026-05-01/RESULTS.md
Top-10 fix#5 — Phase 1.
Mechanical reformat. The new 'gofmt drift' CI step (added in
ci-pipeline-cleanup Phase 4, commit 71b2245) surfaced 111 files
with accumulated gofmt drift across cmd/, internal/, and deploy/test/.
Each file's diff is gofmt-standard: whitespace adjustments, intra-
group import sorting (alphabetical by import path within blank-line-
separated groups), and struct-tag column alignment. No semantic
changes — verified via 'git diff --ignore-all-space' which shows only
the line-position deltas from import reordering.
The gate stays in place after this commit. Going forward it catches
gofmt drift at PR time.
shankar0123