CERTInext API client's 120s HTTP timeout is hardcoded, unconfigurable, and undocumented

[spbsoluble]

Symptom

Every CERTInext API call (enroll, sync, revoke) shares one RestClient instance
(CERTInext/Client/CERTInextClient.cs, constructor ~line 63) configured with a hardcoded
Timeout = TimeSpan.FromSeconds(120). This value:

• Is a literal constant, not backed by any CERTInextConfig property, connector setting, or
  environment variable — there is no way to tune it without editing the source and rebuilding.
• Is not mentioned anywhere in README.md, docsource/, or CHANGELOG.md. The only timeout
  documented today is DcvTimeoutMinutes, a distinct, DCV-specific wait budget unrelated to the
  HTTP client itself.

An operator or support engineer diagnosing a slow or hung CERTInext call has no way to discover
this ceiling exists, or to raise/lower it for their environment.

How this was found

While root-causing a support escalation (order taking ~100.6s against GenerateOrderSSL,
comfortably inside this 120s ceiling so not the cause of that incident), explaining why the
plugin's own call didn't hang indefinitely surfaced this constant, which had no visibility
anywhere.

Severity

Low — operational/observability gap, not a functional defect. Nothing has failed because of this
ceiling.

Fix

Not fixing/triaging in this issue. Current behavior is now documented in
docsource/configuration.md (new "HTTP Timeout" subsection). Making the value configurable is
left as a possible follow-up enhancement.

Files

• CERTInext/Client/CERTInextClient.cs:63
• docsource/configuration.md