You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+26-12Lines changed: 26 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -56,7 +56,13 @@ This agent implements four job types – Inventory, Management Add, Remove and R
56
56
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow
57
57
the server running the orchestrator to manage the server running IIS.
58
58
59
-
**Note if you are upgrading from version 1.1.2 you must run the IISWBin 1.1.3 upgrade script.sql SQL Script**
59
+
**Note:**
60
+
In version 2.0 of the IIS Orchestrator, the certificate store type has been renamed and additional parameters have been added. Prior to 2.0 the certificate store type was called “IISBin” and as of 2.0 it is called “IISU”. If you have existing certificate stores of type “IISBin”, you have three options:
61
+
1. Leave them as is and continue to manage them with a pre 2.0 IIS Orchestrator Extension. Create the new IISU certificate store type and create any new IIS stores using the new type.
62
+
1. Delete existing IIS stores. Delete the IISBin store type. Create the new IISU store type. Recreate the IIS stores using the new IISU store type.
63
+
1. Convert existing IISBin certificate stores to IISU certificate stores. There is not currently a way to do this via the Keyfactor API, so direct updates to the underlying Keyfactor SQL database is required. A SQL script (IIS-Conversion.sql) is available in the repository to do this. Hosted customers, which do not have access to the underlying database, will need to work Keyfactor support to run the conversion. On-premises customers can run the script themselves, but are strongly encouraged to ensure that a SQL backup is taken prior running the script (and also be confident that they have a tested database restoration process.)
64
+
65
+
**Note: There is an additional certificate store type of “IIS” that ships with the Keyfactor platform. Migration of certificate stores from the “IIS” type to either the “IISBin” or “IISU” types is not currently supported.**
60
66
61
67
**1. Create the New Certificate Store Type for the IIS Orchestrator**
62
68
@@ -66,8 +72,8 @@ In Keyfactor Command create a new Certificate Store Type similar to the one belo
66
72
CONFIG ELEMENT | DESCRIPTION
67
73
------------------|------------------
68
74
Name |Descriptive name for the Store Type
69
-
Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISWBin
70
-
Custom Capability|Store type name orchestrator will register with. Must be "IISBindings".
75
+
Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISU
76
+
Custom Capability|Store type name orchestrator will register with. Must be "IISU".
71
77
Needs Server |Must be checked
72
78
Blueprint Allowed |Unchecked
73
79
Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked.
@@ -80,7 +86,7 @@ Private Keys |This determines if Keyfactor can send the private key associated w
80
86
PFX Password Style |This determines how the platform generate passwords to protect a PFX enrollment job that is delivered to the store. This can be either Default (system generated) or Custom (user determined).
81
87
Job Types |Inventory, Add, and Remove are the supported job types.
spnwithport|SPN With Port?|Boolean|false|No|An SPN is the name by which a client uniquely identifies an instance of a service
98
104
WinRm Protocol|WinRm Protocol|Multiple Choice|http|Yes|Protocol that WinRM Runs on
99
105
WinRm Port|WinRm Port|String|5985|Yes|Port that WinRM Runs on
106
+
ServerUsername|Server Username|Secret||No|The username to log into the IIS Server
107
+
ServerPassword|Server Password|Secret||No|The password that matches the username to log into the IIS Server
108
+
ServerUseSsl|Use SSL|Bool|True|Yes|Determine whether the server uses SSL or not
109
+
100
110
101
-
111
+
102
112
103
113
**Entry Parameters:**
104
114
This section must be configured with binding fields. The parameters will be populated with the appropriate data when creating a new certificate store.<br/>
@@ -115,7 +125,7 @@ This section must be configured with binding fields. The parameters will be popu
115
125
- 1 - SNI Enabled
116
126
- 2 - Non SNI Binding
117
127
- 3 - SNI Binding
118
-
-**Prover Name** - Optional. To get a list of Crypto Providers, open PowerShell and issue the 'certutil -csplist' command. If no Provider Name is provided, the 'Microsoft Strong Cryptographic Provider' will be used.
128
+
-**Provider Name** - Optional. To get a list of Crypto Providers, open PowerShell and issue the 'certutil -csplist' command. If no Provider Name is provided, the 'Microsoft Strong Cryptographic Provider' will be used.
119
129
-**SAN** - Required. The SAN must have one entry that matches the Subject Name when using ReEnrollment. Multiple SANs maybe chained together using '&'. Example: dns=www.mysite.com&dns=www.mysite2.com.
**2. Register the IIS Binding Orchestrator with Keyfactor**
144
+
**2. Register the IIS Universal Orchestrator with Keyfactor**
135
145
See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your Keyfactor contact/representative.
136
146
137
147
**3. Create an IIS Binding Certificate Store within Keyfactor Command**
138
148
139
-
In Keyfactor Command create a new Certificate Store similar to the one below, selecting IIS With Binding as the Category and the parameters as described in "Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent".
149
+
In Keyfactor Command create a new Certificate Store similar to the one below, selecting "IISU" as the Category and the parameters as described in "Create the New Certificate Store Type for the New IIS AnyAgent".<br>
140
150
141
-
142
-
151
+
143
152
144
153
#### STORE CONFIGURATION
145
154
CONFIG ELEMENT |DESCRIPTION
@@ -149,9 +158,14 @@ Container |This is a logical grouping of like stores. This configuration is opti
149
158
Client Machine |The hostname of the server to be managed. The Change Credentials option must be clicked to provide a username and password. This account will be used to manage the remote server via PowerShell.
150
159
Credentials |Local or domain admin account that has permissions to manage iis (Has to be admin)
151
160
Store Path |My or WebHosting
161
+
Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type.
162
+
SPN with Port?|
152
163
WinRm Protocol|http or https
153
164
WinRm Port |Port to run WinRm on Default for http is 5985
154
-
Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type.
165
+
Server Username|Username to log into the IIS Server
166
+
Server Password|Password for the username required to log into the IIS Server
167
+
Use SSL|Determines whether SSL is used ot not
168
+
155
169
Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store.
0 commit comments