You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docsource/content.md
+42-6Lines changed: 42 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,16 +1,30 @@
1
1
## Overview
2
+
The Windows Certificate Orchestrator Extension is a multi-purpose integration that can remotely manage certificates on a Windows Server's Local Machine Store. This extension currently manages certificates for the current store types:
3
+
* WinCert - Certificates defined by path set for the Certificate Store
4
+
* WinIIS - IIS Bound certificates
5
+
* WinSQL - Certificates that are bound to the specified SQL Instances
2
6
3
-
The WinCertStore Orchestrator remotely manages certificates in a Windows Server local machine certificate store. Users are able to determine which store they wish to place certificates in by entering the correct store path. For a complete list of local machine cert stores you can execute the PowerShell command:
7
+
By default, most certificates are stored in the “Personal” (My) and “Web Hosting” (WebHosting) stores.
8
+
For a complete list of local machine cert stores you can execute the PowerShell command:
4
9
5
10
Get-ChildItem Cert:\LocalMachine
6
11
7
12
The returned list will contain the actual certificate store name to be used when entering store location.
8
13
9
-
By default, most certificates are stored in the “Personal” (My) and “Web Hosting” (WebHosting) stores.
10
-
11
14
This extension implements four job types: Inventory, Management Add/Remove, and Reenrollment.
12
15
13
-
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow the orchestrator on the server to manage the certificates. Setting up WinRM is not in the scope of this document.
16
+
The Keyfactor Universal Orchestrator (UO) and WinCert Extension can be installed on either Windows or Linux operating systems. A UO service managing certificates on remote servers is considered to be acting as an Orchestrator, while a UO Service managing local certificates on the same server running the service is considered an Agent. When acting as an Orchestrator, connectivity from the orchestrator server hosting the WinCert extension to the orchestrated server hosting the certificate stores(s) being managed is achieved via either an SSH (for Linux orchestrated servers) or WinRM (for Windows orchestrated servers) connection. When acting as an agent (Windows only), WinRM may still be used, OR the certificate store can be configured to bypass a WinRM connection and instead directly access the orchestrator server's certificate stores.
17
+
18
+
19
+
20
+
Please refer to the READMEs for each supported store type for more information on proper configuration and setup for these different stores. The supported configurations of Universal Orchestrator hosts and managed orchestrated servers are detailed below:
21
+
22
+
|| UO Installed on Windows | UO Installed on Linux |
23
+
|-----|-----|------|
24
+
|Orchestrated Server hosting certificate store(s) on remote Windows server|WinRM connection | SSH connection |
25
+
|Certificate store(s) on same server as orchestrator service (Agent)| WinRM connection or local file system | Not Supported |
26
+
27
+
WinRM is used to remotely manage the certificate stores and IIS bindings on Windows machines only. WinRM must be properly configured to allow the orchestrator on the server to manage the certificates. Setting up WinRM is not in the scope of this document.
14
28
15
29
**Note:**
16
30
In version 2.0 of the IIS Orchestrator, the certificate store type has been renamed and additional parameters have been added. Prior to 2.0 the certificate store type was called “IISBin” and as of 2.0 it is called “IISU”. If you have existing certificate stores of type “IISBin”, you have three options:
@@ -24,6 +38,28 @@ In version 2.0 of the IIS Orchestrator, the certificate store type has been rena
24
38
25
39
## Requirements
26
40
41
+
<details>
42
+
<summary><b>Using the WinCert Extension on Linux servers:</b></summary>
43
+
44
+
1. General SSH Setup Information: PowerShell 6 or higher and SSH must be installed on all computers. Install SSH, including ssh server, that's appropriate for your platform. You also need to install PowerShell from GitHub to get the SSH remoting feature. The SSH server must be configured to create a SSH subsysten to host a PowerShell process on the remote computer. It is suggested to turn off password authentication as this extension uses key-based authentication.
45
+
46
+
2. SSH Authentication: When creating a Keyfactor certificate store for the WinCert orchestrator extension, the only protocol supported to communicate with Windows servers is ssh. When providing the user id and password, the connection is attempted by creating a temporary private key file using the contents in the Password textbox. Therefore, the password field must contain the full SSH Private key.
47
+
48
+
</details>
49
+
50
+
<details>
51
+
<summary><b>Using the WinCert Extension on Windows servers:</b></summary>
52
+
53
+
1. When orchestrating management of external (and potentially local) certificate stores, the WinCert Orchestrator Extension makes use of WinRM to connect to external certificate store servers. The security context used is the user id entered in the Keyfactor Command certificate store. Make sure that WinRM is set up on the orchestrated server and that the WinRM port (by convention, 5585 for HTTP and 5586 for HTTPS) is part of the certificate store path when setting up your certificate stores jobs. If running as an agent, managing local certificate stores, local commands are run under the security context of the user account running the Keyfactor Universal Orchestrator Service.
54
+
55
+
</details>
56
+
57
+
Please consult with your company's system administrator for more information on configuring SSH or WinRM in your environment.
58
+
59
+
### PowerShell Requirements
60
+
PowerShell is extensively used to inventory and manage certificates across each Certificate Store Type. Windows Desktop and Server includes PowerShell 5.1 that is capable of running all or most PowerShell functions. If the Orchestrator is to run in a Linux environment using SSH as their communication protocol, PowerShell 6.1 or greater is required (7.4 or greater is recommended).
61
+
In addition to PowerShell, IISU requires additional PowerShell modules to be installed and available. These modules include: WebAdministration and IISAdministration, versions 1.1.
62
+
27
63
### Security and Permission Considerations
28
64
29
65
From an official support point of view, Local Administrator permissions are required on the target server. Some customers have been successful with using other accounts and granting rights to the underlying certificate and private key stores. Due to complexities with the interactions between Group Policy, WinRM, User Account Control, and other unpredictable customer environmental factors, Keyfactor cannot provide assistance with using accounts other than the local administrator account.
@@ -46,8 +82,8 @@ For customers wishing to use something other than the local administrator accoun
46
82
- Access any Cryptographic Service Provider (CSP) referenced in re-enrollment jobs.
47
83
- Read and Write values in the registry (HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server) when performing SQL Server certificate binding.
48
84
49
-
## Note Regarding Client Machine
85
+
## Client Machine Instructions
86
+
Prior to version 2.6, this extension would only run in the Windows environment. Version 2.6 and greater is capable of running on Linux, however, only the SSH protocol is supported.
50
87
51
88
If running as an agent (accessing stores on the server where the Universal Orchestrator Services is installed ONLY), the Client Machine can be entered, OR you can bypass a WinRM connection and access the local file system directly by adding "|LocalMachine" to the end of your value for Client Machine, for example "1.1.1.1|LocalMachine". In this instance the value to the left of the pipe (|) is ignored. It is important to make sure the values for Client Machine and Store Path together are unique for each certificate store created, as Keyfactor Command requires the Store Type you select, along with Client Machine, and Store Path together must be unique. To ensure this, it is good practice to put the full DNS or IP Address to the left of the | character when setting up a certificate store that will be accessed without a WinRM connection.
52
89
53
-
Here are the settings required for each Store Type previously configured.
Copy file name to clipboardExpand all lines: docsource/iisu.md
+2Lines changed: 2 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,6 +9,8 @@ The IISU store type represents the IIS servers and their certificate bindings. I
9
9
### Limitations and Areas of Confusion
10
10
11
11
-**Caveats:** It's important to ensure that the Windows Remote Management (WinRM) is properly configured on the target server. The orchestrator relies on WinRM to perform its tasks, such as manipulating the Windows Certificate Stores. Misconfiguration of WinRM may lead to connection and permission issues.
12
+
<br><br>When performing <b>Inventory</b>, all bound certificates <i>regardless</i> to their store location will be returned.
13
+
<br><br>When executing an Add or Renew Management job, the Store Location will be considered and place the certificate in that location.
12
14
13
15
-**Limitations:** Users should be aware that for this store type to function correctly, certain permissions are necessary. While some advanced users successfully use non-administrator accounts with specific permissions, it is officially supported only with Local Administrator permissions. Complexities with interactions between Group Policy, WinRM, User Account Control, and other environmental factors may impede operations if not properly configured.
0 commit comments