Pending ("CREATED") orders map to INITIALIZED instead of EXTERNALVALIDATION, causing AnyGatewayREST to report a hard enrollment failure #2

Summary

Enrollment against a MarkMonitor SSL product (tested with SSL_DV_GEOTRUST) that requires domain validation succeeds in creating a real order at MarkMonitor (confirmed via a real CARequestID returned), but the gateway surfaces it to Command as an outright failure:

Enrollment Failure: 'MarkMonitor order status: CREATED'.

instead of a pending/[pending] response.

Root cause

MarkMonitorClient.MarkMonitorCertificateStatusToCAStatus (Client/MarkMonitorClient.cs, around line 1101-1110) maps the MarkMonitor CREATED order status to EndEntityStatus.INITIALIZED:

if (
    order.Status.Equals(OrderStatus.Created.GetDescription(), StringComparison.OrdinalIgnoreCase)
)
{
    _logger.LogInformation("MarkMonitor order {OrderId} status 'INITIALIZED'", order.Id);
    _logger.LogInformation(
        "MarkMonitor order {OrderId} may still be in process and/or require manual intervention", order.Id);
    _logger.MethodExit();
    return (int)EndEntityStatus.INITIALIZED;
}

INITIALIZED (value 20) is not the status the AnyGatewayREST framework treats as "accepted, still pending" — that's EXTERNALVALIDATION (value 90), which is exactly what the sibling certinext-caplugin returns for its own async/pending CA responses (see its CERTInextCAPlugin.cs, e.g. if (status == (int)EndEntityStatus.EXTERNALVALIDATION)), and which Command's own docs/lab notes confirm produces a [pending] result instead of a hard failure.

Verified directly: submitting a CSR with a full Subject DN (CN, O, OU, L, ST, C — MarkMonitor's DV product appears to require these despite being nominally domain-validated) against the gateway creates a real MarkMonitor order (CARequestID populated, confirmed in the gateway's own Certificates table), but the Enroll() call still surfaces it as a failure because of this status mapping, not because the order itself failed.

Suggested fix

Change the Created branch in MarkMonitorCertificateStatusToCAStatus to return EndEntityStatus.EXTERNALVALIDATION instead of EndEntityStatus.INITIALIZED:

return (int)EndEntityStatus.EXTERNALVALIDATION;

(Log message may also want updating to say "EXTERNAL VALIDATION" / pending rather than "INITIALIZED" for clarity.)

Related, separate finding (not part of this issue)

While diagnosing this, also found that Command's default PFX enrollment for these templates only submits CN=... in the Subject DN — no O/OU/L/ST/C — which MarkMonitor's SSL_DV_GEOTRUST product rejects with a misleading cert.csr: field.invalidFormat error (nothing to do with actual CSR encoding — a byte-for-byte PemUtilities.DERToPEM round-trip audit confirmed the PEM output is correct). That's an enrollment-time/Portal usage note on the kfclab side (filling in a full Subject DN when enrolling), not a plugin bug, so not filed here.