V2 enrollment silently drops template ValidityDays (no warning) #34

Scope

V2 enrollment path (feat/certinextv2 / v2.x). V1 maps ValidityDays to whole years; V2 ignores it. Found while live-testing a 45-day request (see PR #20 discussion).

Symptom

A template with ValidityDays=45 (or any value) and no ValidityYears places a V2 order with subscription.validityYears from the connector's SubscriptionValidityYears (default 1). Nothing is logged and the order succeeds, so an administrator who set ValidityDays gets no signal that it was ignored.

Evidence

• EnrollV2Async reads only ep.ValidityYears, then SubscriptionValidityYears, then 1 (CERTInextCAPlugin.cs:2202 on feat/certinextv2).
• Live sandbox: template ValidityDays=45 produced a wire body with "validityYears":1 only, identical to the ValidityYears=1 control (V2ValidityProbeTests, variant A).
• The V2 branch manifest already describes ValidityDays as "V1 only", so the docs are right; only the runtime signal is missing.

Related finding

CERTInext's V2 API has no way to request a certificate lifetime (validityYears only moves the subscription end date; the sandbox issued 90-day DV certificates for every variant). So ValidityDays cannot do anything useful on V2 today. See Finding 25 in the CERTInext support questions.

Suggested fix

Log a Warning when ep.ValidityDays > 0 on the V2 path, stating it is ignored and that the CA fixes the certificate lifetime. Add a unit test for the warning. Revisit if CERTInext adds a lifetime field.