Update CHANGELOG.md

AcmeCaPlugin/AcmeCaPlugin.cs

@@ -685,21 +685,38 @@ private async Task ProcessAuthorizations(AcmeClient acmeClient, OrderDetails ord
                         async () => await cnameResolver.ResolveChallengeTargetAsync(validation.DnsRecordName),
                         detail: $"from {validation.DnsRecordName}");
 
+                    // Decide which name to resolve the DNS provider plugin against. The framework
+                    // matches validators against the (wildcard) domain patterns configured per
+                    // provider, keyed on the certificate/zone name (e.g. *.keyfactor.ssl4saas.com)
+                    // -- NOT the _acme-challenge record name. So:
+                    //   * No delegation  -> resolve on the cert domain (www.example.com), exactly
+                    //                       as before delegation support existed.
+                    //   * CNAME delegated -> resolve on the terminal target (host.validation-zone),
+                    //                       so the provider that owns the delegation zone is chosen.
+                    // Note the resolver returns the original name unchanged when no CNAME exists,
+                    // and that original name still carries the _acme-challenge prefix, which would
+                    // not match the configured wildcard -- hence the explicit branch here.
+                    bool isDelegated = !string.Equals(
+                        recordName?.TrimEnd('.'),
+                        validation.DnsRecordName?.TrimEnd('.'),
+                        StringComparison.OrdinalIgnoreCase);
+                    var validatorLookupName = isDelegated ? recordName : domain;
+
                     var domainValidator = flow.Step($"ResolveValidator:{domain}",
                         () =>
                         {
-                            var v = _validatorFactory.ResolveDomainValidator(recordName, DNS_CHALLENGE_TYPE);
+                            var v = _validatorFactory.ResolveDomainValidator(validatorLookupName, DNS_CHALLENGE_TYPE);
                             if (v == null)
                             {
                                 throw new InvalidOperationException(
-                                    $"Failed to resolve domain validator for '{recordName}' (challenge for '{domain}'). " +
+                                    $"Failed to resolve domain validator for '{validatorLookupName}' (challenge for '{domain}'). " +
                                     "Ensure the appropriate DNS provider plugin is deployed and configured for the zone that hosts the (possibly CNAME-delegated) challenge record.");
                             }
                             return v;
                         });
 
-                    _logger.LogInformation("Using domain validator: {ValidatorType} for record: {RecordName} (domain: {Domain})",
-                        domainValidator.GetType().Name, recordName, domain);
+                    _logger.LogInformation("Using domain validator: {ValidatorType} resolved on {LookupName} (record: {RecordName}, domain: {Domain}, delegated: {Delegated})",
+                        domainValidator.GetType().Name, validatorLookupName, recordName, domain, isDelegated);
 
                     await flow.StepAsync($"StageValidation:{domain}",
                         async () =>

AcmeCaPlugin/AcmeCaPlugin.csproj

@@ -1,6 +1,6 @@
 <Project Sdk="Microsoft.NET.Sdk">
     <PropertyGroup>
-        <TargetFrameworks>net8.0;net10.0</TargetFrameworks>
+        <TargetFrameworks>net10.0</TargetFrameworks>
         <ImplicitUsings>disable</ImplicitUsings>
         <Nullable>disable</Nullable>
         <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>
@@ -22,32 +22,8 @@
         <PackageReference Include="System.Drawing.Common" Version="10.0.2" />
         <PackageReference Include="System.Net.Http.WinHttpHandler" Version="9.0.5" />
         <PackageReference Include="System.Security.Cryptography.ProtectedData" Version="9.0.5" />
-
-        <!-- DNS Provider dependencies - REMOVE THESE after migrating all providers to plugins -->
-        <!-- TODO: These should be removed once all DNS providers are moved to separate plugin projects -->
-        <!-- Google DNS - MIGRATED to Keyfactor.DnsProvider.Google plugin -->
-        <!-- <PackageReference Include="Google.Apis.Dns.v1" Version="1.69.0.3753" /> -->
-
-        <!-- AWS Route53 - TODO: Migrate to plugin -->
-        <PackageReference Include="AWSSDK.Core" Version="4.0.3.11" />
-        <PackageReference Include="AWSSDK.Route53" Version="4.0.8.8" />
-
-        <!-- Azure DNS - TODO: Migrate to plugin -->
-        <PackageReference Include="Azure.Identity" Version="1.14.0" />
-        <PackageReference Include="Azure.ResourceManager.Cdn" Version="1.4.0" />
-        <PackageReference Include="Azure.ResourceManager.Dns" Version="1.1.1" />
-
-        <!-- RFC2136 - TODO: Migrate to plugin -->
-        <PackageReference Include="ARSoft.Tools.Net" Version="3.6.0" />
-
-        <!-- Cloudflare - TODO: Migrate to plugin (uses standard HTTP client) -->
-
-        <!-- NS1 - TODO: Migrate to plugin (uses standard HTTP client) -->
-
-        <!-- Infoblox - TODO: Migrate to plugin (uses standard HTTP client) -->
-
-        <!-- Public Suffix - TODO: Evaluate if needed in core or per-provider -->
-        <PackageReference Include="Nager.PublicSuffix" Version="3.5.0" />
+        <!-- DnsClient (above) is used for CNAME delegation resolution and TXT propagation checks.
+             DNS provider SDKs now live in their own externalized DNS provider plugins. -->
     </ItemGroup>
     <ItemGroup>
         <None Update="manifest.json">

CHANGELOG.md

@@ -1,4 +1,4 @@
-# v1.4.0
+# v2.0.0
 * Dns Plugin Support
 * Cname Proxy Support