[spbsoluble]

Problem

The V1 client never downloads a revoked certificate's body: CERTInext refuses it ("Invalid request status."), and IsCertificateDownloadable excludes status 22. So Synchronize and GetSingleRecord emit every revoked order with no certificate.

That's safe when the gateway already stores the certificate. When it doesn't (the order was revoked at CERTInext before the gateway recorded it as issued), the gateway saves a row with RevocationDate set and no certificate, and never clears that date. Its revoked-certificate search (POST .../v2/certificate/search) then fails with m_safeCertContext is an invalid handle at CertificateV2Controller.CertificateSearch. Every Command scan of the CA fails from then on, not just the affected record.

This ports the V2 fix for issue 0049 to the V1 code path.

Fix

Before emitting a revoked record with no certificate, the plugin asks the gateway whether it already stores the certificate (ICertificateDataReader.GetExpirationDateByRequestId):

Gateway state	Sync	GetSingleRecord
Holds the certificate (returns a date)	emit REVOKED unchanged (out-of-band revokes still propagate)	REVOKED
Row exists, no certificate (returns null)	emit FAILED, no RevocationDate/Reason	FAILED
No row (ArgumentException), other error, or no reader	skip	FAILED

The sync summary log now includes FailedFromBodylessRevoked and BodylessRevokedSkipped.

Not covered

• Rows already broken. The gateway never clears RevocationDate, so the plugin can't repair rows that are already bad. They need a one-time DB repair: set Status = 11 and RevocationDate = NULL on rows with a RevocationDate and no certificate. The repair was tested end to end on a 25.5.0 lab gateway.
• Upgrading the gateway doesn't help. AnyGateway 26.2.1 has the same revoked-search query and controller loop (decompiled), so this guard is still needed after a gateway upgrade.
• Enroll. The pickup poll can still return a REVOKED result with no certificate if an order is revoked during pickup. That's left for a follow-up.

Testing

• 11 new unit tests (BodylessRevokedGuardTests) cover each row of the table above, plus a failed refetch and a revoked record that has a body. 8 of them fail against the 1.0.1 code. Full suite: 524/524 pass.
• Release build: no new code warnings.
• Opt-in, read-only live probe (RevokedDownloadProbeTests, CERTINEXT_PROBE_REVOKED_DOWNLOAD=1): sandbox V1 download of a revoked order was refused, confirming there's no certificate to backfill.

---

Incremental sync refetches every order placed that day (0093)

Problem

The V1 order report filters only by calendar day (orderDateFrom is sent as yyyy-MM-dd), so every incremental pass re-lists every order placed that day. The listing has no certificate, so each issued or revoked order then costs a TrackOrder plus a DownloadCertificate, one after another, even when the gateway already holds it unchanged.

Seen in a customer log on 2026-11-10: about 380 orders were placed in CERTInext outside the gateway, and from then on every 10-minute pass processed about 225 orders and made 451 calls (about 8.5 minutes per pass). When CERTInext latency rose that afternoon (1.2 s to 47.6 s average), passes overran the interval and ran back to back. This is not a 1.0.1 regression: the date filter and per-order refetch date from the initial implementation.

Fix

Same rule as the Entrust ECS, HashiCorp Vault and Nexus plugins. On incremental passes only, an order listed as GENERATED or REVOKED is skipped when ICertificateDataReader.GetStatusByRequestID returns the same status and GetExpirationDateByRequestId shows a stored certificate.

Processed as before: no gateway row (new order), a status change (pending to issued, issued to revoked), a row with no certificate, no reader, or a reader error. Pending orders and full sync are unchanged. The sync summary log now includes UnchangedInGateway.

Not changed: a pass still lists the whole day's orders, because the order report has no time or modified-since filter. The cost per issued order drops from two CERTInext calls to two gateway DB lookups.

Testing

• 10 new unit tests (IncrementalSyncUnchangedTests): unchanged issued and revoked orders skipped, new order, both status changes, row without a certificate, reader error, no reader, pending order, and full sync.
• Full suite: 534/534 pass. A first run had 2 failures in unrelated WireMock-based tests (TracePayloadGuardTests, ValidityResolutionTests); both pass alone and on a second full run.
• Release build: no code warnings (only NU1801, the GitHub package feed was unreachable from the build machine).
• Not yet run against live CERTInext or a gateway.

Docs: change of issuing CA after eMudhra's exit from public TLS

eMudhra is withdrawing from public SSL/TLS, and the emSign G1 root is being phased out: Chrome and Firefox won't trust G1 certificates logged after 2026-11-16, and Apple removes the root on 2026-11-30. CERTInext public TLS certificates move to another CA (SSL.com for InCommon members; eMudhra offers Sectigo).

docsource/configuration.md and docsource/overview.md now say the plugin needs no change, because it stores only the end-entity certificate and never reads the issuer. They list the operator steps: import the new chain on Command, the gateway and orchestrators; update the Gateway Registration CA certificate; replace G1 certificates before Apple's removal date; and confirm product codes with CERTInext. The README is regenerated from docsource.