PKI Connectors

A "PKI Connector" is a configuration piece that allows to establish the communication with any supported PKI. Additionally, it enables to map a specific certificate profile within the connected PKI.

To grant "Horizon" proper access to a given PKI, three categories of requirements must be gathered:

Some PKIs cannot return a certificate within Horizon’s synchronous request timeout, typically because they require an extended validation (manual review, email or phone confirmation, …​). Connectors that support asynchronous issuance let Horizon return a non-final request status, then resume the lifecycle in the background.

When a request has been submitted, but no certificate has yet been delivered, it is In Progress. The request is polled periodically by a background process until the certificate is available or the order is canceled. As the requester, an in_progress request can be canceled. As an approver, it can be denied. Either action cancels the underlying order on the PKI.

At enrollment time, Horizon first performs a short synchronous polling cycle within the connector’s configured timeout. If a certificate is returned during that window, the request completes as usual. Otherwise, the request is switched to in_progress and a background process takes over.

Once a request is in_progress, a background actor polls the PKI on the schedule defined by horizon.async-poll.interval (default: every 5 minutes). Retry intervals grow in 5-minute increments up to one hour. A successful poll updates the certificate; a transient error logs an event and reschedules the next poll; a fatal error switches the request to failed.

To accommodate the gap between order lifetime (typically one year) and the reduced certificate lifetime imposed by the CA/Browser Forum (200 days, decreasing toward 47 days), public PKI connectors that support it now reissue a certificate on the same order during renewal instead of creating a new order, as long as the order is still valid.

The behavior is automatic and transparent:

This guarantees that the certificate issued by a renewal is never already in its renewal period, and that subscriptions are consumed through to their end.