This document covers local development, testing, and live API smoke-testing for the CERTInext AnyCA Gateway REST plugin. For production deployment and CA connector configuration, see configuration.md.

• .NET SDK 8.0 or later
• just (command runner used for build/test/API targets)
• python3 (used for HMAC computation in justfile API targets)
• jq (used for JSON pretty-printing in justfile API targets)
• ~/.env_certinext populated with credentials (see below)

Create ~/.env_certinext with the following variables. This file is never committed — add it to your global .gitignore or keep it only in $HOME.

CERTINEXT_API_URL=https://api.certinext.io/emSignHub-API   # or sandbox URL
CERTINEXT_ACCESS_KEY=<your access key from Integrations → APIs>
CERTINEXT_ACCOUNT_NUMBER=<your numeric account ID from account profile>
CERTINEXT_GROUP_NUMBER=<group number from Integrations → APIs credential row>
CERTINEXT_ORG_NUMBER=<org ID from Organizations page>
CERTINEXT_PRODUCT_CODE=838                                  # default product used by generate-order
CERTINEXT_REQUESTOR_EMAIL=<email associated with your CERTInext account>
CERTINEXT_REQUESTOR_NAME=<name of the requestor or automation account>
CERTINEXT_REQUESTOR_MOBILE=<digits only, no country code>
# Public IP of the machine running generate-order. Leave blank to auto-detect via api.ipify.org.
CERTINEXT_SIGNER_IP=

Note: CERTINEXT_GROUP_NUMBER and CERTINEXT_ORG_NUMBER are distinct. The group number is the delegation unit (cost center/department) used in every order request. The org number is the validated organization record used for OV and EV orders.

The plugin builds against two Keyfactor.AnyGateway.IAnyCAPlugin contracts from a single codebase, selected by the DcvSupport MSBuild property. The plugin's AnyCAPluginCertificate records must match the gateway host's IAnyCAPlugin version to persist, so the build must target the host (see issue 0003).

The default is the no-DCV / 3.2.0 build — it is the GA artifact that loads and persists on the current GA gateway (25.5.x) and depends only on a stable package, so it is what CI ships. Build the DCV variant explicitly with -p:DcvSupport=true for 26.x hosts. The one property drives the package version, the SUPPORTS_DCV compile constant, and DCV test-file inclusion across all three projects, so the two host targets are a build flag rather than a maintained fork.

All API targets source ~/.env_certinext, compute the HMAC authKey (SHA256(accessKey + ts + txn)), and call the live CERTInext API via curl. All JSON responses are piped through jq.

Start here when setting up a new environment:

just ping       # should return {"meta": {"status": "1", ...}}
just products   # lists product codes for your account
just orders     # lists recent orders — useful to find an ORDER_NUMBER to test with

Note: TrackOrder and GetCertificate require a formal orderNumber, which is only assigned after a draft order is submitted and approved. Draft orders (created with saveAndHold:"1") have a requestNumber but no orderNumber until that point.

Setting SAVE_AND_HOLD=1 (the default) on just generate-order places an order in "On Hold" state without triggering billing, DCV, or CA issuance. This is useful for validating that an order payload is accepted by the API.

Draft orders behave as follows:

• Assigned a requestNumber immediately on creation.
• Do not receive an orderNumber until the draft is formally submitted and approved.
• Appear in GetOrderReport and are included in gateway synchronization runs.
• Cannot be passed to TrackOrder or GetCertificate — those endpoints require an orderNumber.

The gateway does not use saveAndHold in normal enrollment flows. It is strictly a developer testing mechanism for validating order payloads against the live API.

The CERTInext.IntegrationTests/ project contains live API tests that run against the production India instance (api.certinext.io). All tests use [SkippableFact] and skip automatically when ~/.env_certinext is absent or incomplete.

Run them with:

just integration-test

See CERTInext.IntegrationTests/INTEGRATION_TESTING.md for a full description of each test, what it validates, and the expected API state.

The table below records live draft-order results against the Production — India instance. Orders were placed with saveAndHold:"1" so no billing, DCV, or CA issuance was triggered. Tests are in CERTInext.IntegrationTests/DraftOrderTests.cs.

Products returning EMS-1162 require special provisioning by eMudhra that is not included on a standard SSL/TLS account. The plugin code supports submitting orders for any product code; whether the order is accepted depends on what is provisioned for your account.