You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
3.0.0
* As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command, and will no longer use the SAN Entry Parameter. This version, we are removing the Entry Parameter "SAN" from the integration-manifest.json, but will still support previous versions of Command in the event the SAN Entry Parameter is passed. The next major version (4.0) will remove all support for the SAN Entry Parameter.
* Added WinADFS Store Type for rotating certificates in ADFS environments. Please note, only the service-communications certificate is rotated throughout your farm.
* Internal only: Added Integration Tests to aid in future development and testing.
* Improved messaging in the event an Entry Parameter is missing (or does not meet the casing requirements)
* Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags
* Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags
* Added SSL Flag validation to make sure the bit flag is correct. These are the valid bit flags for the version of
Windows:
### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5):
* 0 No SNI
* 1 Use SNI
* 2 Use Centralized SSL certificate store.
### Windows Server 2016 (IIS 10.0):
* 0 No SNI
* 1 Use SNI
* 4 Disable HTTP/2.
### Windows Server 2019 (IIS 10.0.17763)
* 0 No SNI
* 1 Use SNI
* 4 Disable HTTP/2.
* 8 Disable OCSP Stapling.
### Windows Server 2022+ (IIS 10.0.20348+)
* 0 No SNI
* 1 Use SNI
* 4 Disable HTTP/2.
* 8 Disable OCSP Stapling.
* 16 Disable QUIC.
* 32 Disable TLS 1.3 over TCP.
* 64 Disable Legacy TLS.
---------
Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com>
Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Fix problem only SQL Service was getting restarted while the other SQL Services would not restart.
* Update generated docs
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Update generated docs
* Delete local.runsettings
---------
Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com>
Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automates the customer's manual LDAPS certificate renewal workflow: staging
into the Personal store, then registering into the NTDS service certificate
store the LDAPS listener reads from. Each Domain Controller is managed as an
independent store (no ADFS-style fan-out), and both local-agent and remote
WinRM/JEA connections are supported since every operation stays local to the
target DC. Several NTDS-store mechanics (exact certutil syntax, JEA write
permissions, LDAPS pickup timing) are flagged as unverified pending lab
validation on a real Domain Controller - see docs/winldap-implementation-notes.md
and docs/winldap-ntds-validation.ps1.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Lab testing on a live DC showed removing only the NTDS registry entry
does not stop LDAPS from presenting the certificate, even after
restarting the NTDS service. Removing the Personal (My) store copy,
with no restart required, did stop it. Remove-KeyfactorLdapsCertificate
now removes from both locations, failing hard if the Personal-store
removal fails so the bug can't silently resurface. Also documents the
new shared-store caveat: this can now affect other services on the
same DC that reuse the same certificate.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Brings WinLDAP to parity with WinCert/IISU/WinSql. The shared
ClientPSCertStoreReEnrollment now imports the re-enrolled certificate
into the Personal store for WinLDAP (its NTDS\My store path isn't a
real Cert: provider path), then a new WinLdap binding case registers
it into the NTDS service store via the same eligibility-checked write
Add-KeyfactorLdapsCertificate uses. Matches WinSql's own ReEnrollment
precedent of not restarting the service or cleaning up a prior
certificate afterward.
Also adds docs/winldap-reset-test-state.ps1, a guided script for
resetting a lab DC's NTDS/Personal store state between test passes
without blindly clearing certificates that may be unrelated to testing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Set-NtdsServiceStoreCertificate was rewritten during the September 1
lab validation to take -Certificate <X509Certificate2> instead of
-RawCertificateBytes <byte[]>. Add-KeyfactorLdapsCertificate already
called it correctly; Register-KeyfactorLdapsCertificate was written
afterward against the stale signature, causing the first live ODKG
test to fail with "A parameter cannot be found that matches parameter
name 'RawCertificateBytes'." after CSR generation/signing/import into
Personal all succeeded.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds a new store type, WinNetSH, for managing SSL certificates bound to
HTTP.sys via `netsh http sslcert` (e.g. the WinRM HTTPS listener, or any
other HTTP.sys-hosted service without its own binding mechanism).
Supports Inventory, Add, Remove, and Reenrollment (ODKG), following the
same binding-based pattern as WinIIS, including local-agent, remote
WinRM/SSH, and JEA connections.
Since netsh has no native PowerShell cmdlet, Keyfactor.WinCert.NetSH
shells out to netsh.exe and parses its text output. netsh http add
sslcert requires an AppId; when the entry parameter is left blank, this
store type reuses an existing binding's AppId across a renewal (rather
than silently changing it) or generates a new one for a brand-new
binding, and reports back whichever value was actually used.
Adds xUnit coverage for NetSHBindingInfo (alias parsing, entry-parameter
construction) - the first automated test coverage any PowerShell-backed
store type in this repo has had. The local-agent path (Inventory, Add,
renewal-AppId-reuse, SNI binding, Remove) was validated end-to-end
against real netsh sslcert bindings; JEA support has not yet been lab
validated and is flagged as the main open item in
docs/winnetsh-implementation-notes.md.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
new file: azure-test-lab/README.md
new file: azure-test-lab/docs/01-prerequisites.md
new file: azure-test-lab/docs/02-phase1-deploy.md
new file: azure-test-lab/docs/03-manual-dns-cutover.md
new file: azure-test-lab/docs/04-phase2-deploy.md
new file: azure-test-lab/docs/05-adfs-farm-bootstrap.md
new file: azure-test-lab/docs/06-verification-runbook.md
new file: azure-test-lab/docs/07-teardown-and-redeploy.md
new file: azure-test-lab/modules/network.bicep
new file: azure-test-lab/modules/nsg.bicep
new file: azure-test-lab/modules/windows-vm.bicep
new file: azure-test-lab/phase1-foundation/main.bicep
new file: azure-test-lab/phase1-foundation/phase1.parameters.json
new file: azure-test-lab/phase1-foundation/scripts/New-ADForest.ps1
new file: azure-test-lab/phase2-member-servers/main.bicep
new file: azure-test-lab/phase2-member-servers/phase2.parameters.json
new file: azure-test-lab/phase2-member-servers/scripts/Bootstrap-AdfsPrimary.ps1
new file: azure-test-lab/phase2-member-servers/scripts/Bootstrap-AdfsSecondary.ps1
new file: azure-test-lab/phase2-member-servers/scripts/Confirm-SqlServerReady.ps1
new file: azure-test-lab/phase2-member-servers/scripts/Initialize-AdfsPrereqs.ps1
new file: azure-test-lab/phase2-member-servers/scripts/Install-DevBoxPrereqs.ps1
new file: azure-test-lab/phase2-member-servers/scripts/Install-IISRole.ps1
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Verified error-propagation, localization, rollback, concurrency, IPv6, and ADFS handoff defects can cause false success, outages, or failed deployments.
Adds WinLDAP and WinNetSH certificate store support for release 4.1, including inventory, management, reenrollment, JEA integration, documentation, and Azure test infrastructure.
Changes:
Implements LDAPS NTDS-store and HTTP.sys certificate management.
Extends reenrollment, manifests, packaging, and store-creation scripts.
Adds deployment documentation and an Azure validation lab.
USERDNSDOMAIN describes the executing user's domain, not the target computer's DNS suffix. It can be absent for LocalSystem/virtual-account execution or refer to a different trusted domain, causing valid DC certificates to fail both Add and Reenrollment. Obtain the machine's primary DNS suffix locally instead; this does not require an AD bind or double hop.
Exclude newlines when parsing multiple certificate SANs
Get-CertificateSAN uses Format(1), which renders multiple SAN entries on separate lines. This character class includes newlines, so two DNS entries become one captured name containing both lines. A valid certificate whose DC FQDN is in SAN but not CN is then rejected by Add and ReEnrollment. Exclude CR/LF from each captured DNS name.
Avoid errors for already-absent Personal-store certificates
The intended already-absent Personal-store case still fails the orchestrator job. Remove-KeyfactorCertificate writes to the error stream before throwing when the certificate is missing; catching that exception here does not remove the error record, and PSHelper.ExecutePowerShell throws when PS.HadErrors is true. Check for the certificate before calling the helper so this expected no-op does not emit an error.
Preserve SSL policy settings during binding renewal
Recreating an existing binding with only these arguments resets all its other SSL settings to netsh defaults. A binding configured with clientcertnegotiation=enable, for example, loses that setting during certificate renewal, potentially breaking mutual-TLS clients. Preserve and reapply the existing binding's SSL policy settings, or use an in-place update on supported systems.
Check Chocolatey exit codes during prerequisite installation
Windows PowerShell's ErrorActionPreference = 'Stop' does not turn native executable exit codes into exceptions. If any Chocolatey installation fails, this script continues and reports that prerequisites were installed, so the deployment can succeed with an unusable dev box. Check each Chocolatey exit code and throw on installation failures, handling reboot-required codes explicitly.
Include action-on-unmanage in the Phase 1 deployment command
azure-test-lab/docs/02-phase1-deploy.md:36
The recommended stack deployment command omits the required --action-on-unmanage argument, so Azure CLI rejects it before deploying Phase 1. Specify the intended unmanaged-resource behavior explicitly.
Include action-on-unmanage in the Phase 2 deployment command
azure-test-lab/docs/04-phase2-deploy.md:37
The recommended stack deployment command also needs --action-on-unmanage; without it Azure CLI rejects the Phase 2 invocation. Include the resource-management action alongside the deny settings.
[P2] Treat an already-absent NTDS entry as a successful removal. Remove-KeyfactorLdapsCertificate deletes this entry before removing the Personal-store copy; if that second step fails, retrying immediately returns this error and never retries the remaining cleanup. Returning success for absence allows retries to complete, while terminating actual registry-access errors prevents them from being mistaken for absence.
[P2] Derive the DNS suffix from the target computer, not the logged-on user. USERDNSDOMAIN describes the execution identity's domain and can be unset for LocalSystem/JEA virtual accounts or differ from the DC's domain for a trusted-domain account. Valid certificates then fail both Add and ReEnrollment despite sufficient store permissions. Read the machine's primary DNS suffix locally, for example from TCP/IP configuration, without introducing a directory bind.
This issue also appears on line 65 of the same file.
Avoid errors for absent Personal-store certificates
[P2] Check for an absent Personal-store copy before calling the shared removal function. Remove-KeyfactorCertificate writes an error record before throwing its 'not found' exception; catching that exception here does not remove the record. PSHelper.ExecutePowerShell checks HadErrors, so this supposedly successful no-op still fails the job after deleting the NTDS entry. Avoid emitting an error for the already-absent case.
Normalize default HTTP.sys certificate store names
[P2] Include bindings that use HTTP.sys's default certificate store. When certstorename is omitted, HTTP.sys defaults to MY and netsh can report 'Certificate Store Name : (null)'. Comparing that literal value with 'My' excludes valid existing bindings from My inventory. Normalize the default/null representation to My before applying the store filter.
[P2] Account for the implicitly created OS disks in this cleanup procedure. windows-vm.bicep tags the VM but does not tag its managed OS disk or set its deleteOption to Delete. Deleting the VM therefore leaves an untagged detached disk that the second tag-filtered command cannot find, so this fallback leaves billable disks behind. Record and delete the VM disk IDs explicitly, or configure disk deletion with the VM.
In Windows PowerShell, ErrorActionPreference='Stop' does not make a nonzero Chocolatey exit code terminate the script. A failed Git installation therefore continues to the final success message and can leave deployment marked successful without Git. Check the native exit code explicitly.
Specify action-on-unmanage for Phase 1 deployment
azure-test-lab/docs/02-phase1-deploy.md:36
[P2] Supply the required action-on-unmanage option in this deployment-stack command. az stack group create requires it, so the recommended command exits with a missing-argument error instead of deploying Phase 1. Set it explicitly to the intended resource-management policy, consistent with the teardown instructions.
Specify action-on-unmanage for Phase 2 deployment
azure-test-lab/docs/04-phase2-deploy.md:37
[P2] Supply the required action-on-unmanage option in this deployment-stack command. az stack group create requires it, so the recommended command exits with a missing-argument error instead of deploying Phase 2. Set it explicitly to the intended resource-management policy, consistent with the teardown instructions.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
rcpokorny
left a comment
No description provided.