From ae8fd97bee8ded8454284de8b3c69f43f2ff1838 Mon Sep 17 00:00:00 2001 From: Pichatorn-A4K Date: Fri, 11 Sep 2026 02:18:28 +0700 Subject: [PATCH] Guard Intermediates[0] and keep nulls out of the duplicate-PEM check Two small problems in GetAllConnectorCertsForOrder that both drop certificates from a synchronization with only a warning. Intermediates[0] is indexed with no bounds check, unlike the equivalent in GetSingleRecord() a few hundred lines up which does check Count > 0. A certificate whose chain comes back empty therefore raised IndexOutOfRangeException, which the per-certificate catch swallowed, so the certificate silently vanished from the sync. Now it fails with a message that names the certificate and order. Separately, 'certificate' is null for any status that is neither issued nor revoked, and that null was added to pemList - so the *second* pending certificate in the same order matched pemList.Contains(null) and was skipped as a 'duplicate PEM'. --- digicert-certcentral-caplugin/CertCentralCAPlugin.cs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/digicert-certcentral-caplugin/CertCentralCAPlugin.cs b/digicert-certcentral-caplugin/CertCentralCAPlugin.cs index 176c2bd..89d13af 100644 --- a/digicert-certcentral-caplugin/CertCentralCAPlugin.cs +++ b/digicert-certcentral-caplugin/CertCentralCAPlugin.cs @@ -1719,6 +1719,10 @@ private List GetAllConnectorCertsForOrder(string caReque CertificateChainResponse certificateChainResponse = client.GetCertificateChain(new CertificateChainRequest($"{cert.certificate_id}")); if (certificateChainResponse.Status == CertCentralBaseResponse.StatusType.SUCCESS) { + if (certificateChainResponse.Intermediates == null || certificateChainResponse.Intermediates.Count == 0) + { + throw new Exception($"DigiCert returned an empty certificate chain for certificate {cert.certificate_id} on order {orderId}."); + } certificate = certificateChainResponse.Intermediates[0].PEM; } else @@ -1727,12 +1731,15 @@ private List GetAllConnectorCertsForOrder(string caReque } } //Another check for duplicate PEMs to get arround issue with DigiCert API returning incorrect data sometimes on reissued/duplicate certs - if (pemList.Contains(certificate)) + if (certificate != null && pemList.Contains(certificate)) { _logger.LogWarning($"Found duplicate PEM for ID {caReqId}. Skipping..."); continue; } - pemList.Add(certificate); + if (certificate != null) + { + pemList.Add(certificate); + } var connCert = new AnyCAPluginCertificate { CARequestID = caReqId,