You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+58-12Lines changed: 58 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,29 @@
1
1
# IIS Orchestrator
2
-
## Orchestrator
3
2
4
3
The IIS Orchestrator treats the certificates bound (actively in use) on a Microsoft Internet Information Server (IIS) as a Keyfactor certificate store. Inventory and Management functions are supported. The orchestrator replaces the IIS orchestrator that ships with Keyfactor Command (which did not support binding.)
5
4
6
-
<!-- add integration specific information below -->
7
-
***
8
-
**IIS Binding Orchestrator Configuration**
5
+
#### Integration status: Production - Ready for use in production environments.
6
+
7
+
## About the Keyfactor Universal Orchestrator Capability
8
+
9
+
This repository contains a Universal Orchestrator Capability which is a plugin to the Keyfactor Universal Orchestrator. Within the Keyfactor Platform, Orchestrators are used to manage “certificate stores” — collections of certificates and roots of trust that are found within and used by various applications.
10
+
11
+
The Universal Orchestrator is part of the Keyfactor software distribution and is available via the Keyfactor customer portal. For general instructions on installing Capabilities, see the “Keyfactor Command Orchestrator Installation and Configuration Guide” section of the Keyfactor documentation. For configuration details of this specific Capability, see below in this readme.
12
+
13
+
The Universal Orchestrator is the successor to the Windows Orchestrator. This Capability plugin only works with the Universal Orchestrator and does not work with the Windows Orchestrator.
14
+
15
+
---
16
+
17
+
18
+
19
+
20
+
---
21
+
22
+
**IIS Orchestrator Configuration**
9
23
10
24
**Overview**
11
25
12
-
The IIS Binding Orchestrator remotely manages certificates in a Windows Server local machine certificate store.
26
+
The IIS Orchestrator remotely manages certificates in a Windows Server local machine certificate store.
13
27
The "Personal" (My) and "Web Hosting" Stores are supported.
14
28
Only certificates that are bound to an IIS web site are managed.
15
29
Unbound certificates are ignored.
@@ -19,15 +33,17 @@ This agent implements three job types – Inventory, Management Add, and Managem
19
33
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow
20
34
the server running the orchestrator to manage the server running IIS.
21
35
22
-
**1. Create the New Certificate Store Type for the IIS Binding Orchestrator**
36
+
**Note if you are upgrading from version 1.1.2 you must run the IISWBin 1.1.3 upgrade script.sql SQL Script**
37
+
38
+
**1. Create the New Certificate Store Type for the IIS Orchestrator**
23
39
24
40
In Keyfactor Command create a new Certificate Store Type similar to the one below:
25
41
26
42
#### STORE TYPE CONFIGURATION
27
43
CONFIG ELEMENT | DESCRIPTION
28
44
------------------|------------------
29
45
Name |Descriptive name for the Store Type
30
-
Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISBinding
46
+
Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISWBin
31
47
Custom Capability|Store type name orchestrator will register with. Must be "IISBindings".
32
48
Needs Server |Must be checked
33
49
Blueprint Allowed |Unchecked
@@ -44,7 +60,7 @@ Job Types |Inventory, Add, and Remove are the supported job types.
44
60
45
61
46
62
**Advanced Settings:**
47
-
-**Custom Alias** – Can make Required, Optional or Forbidden based on the client preference
63
+
-**Custom Alias** – Forbidden
48
64
-**Private Key Handling** – Required
49
65
50
66
@@ -53,9 +69,11 @@ Job Types |Inventory, Add, and Remove are the supported job types.
53
69
54
70
-**SPN With Port** – Defaults to false but some customers need for remote PowerShell Access
spnwithport|SPN With Port?|Boolean|false|No|An SPN is the name by which a client uniquely identifies an instance of a service
75
+
WinRm Protocol|WinRm Protocol|Multiple Choice|http|Yes|Protocol that WinRM Runs on
76
+
WinRm Port|WinRm Port|String|5985|Yes|Port that WinRM Runs on
59
77
60
78
61
79
@@ -66,7 +84,7 @@ This section must be configured with binding fields. The parameters will be popu
66
84
-**IP Address** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The IP address for the web site being bound to. Default is "\*" for all IP Addresses.
67
85
-**Port** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The port for the web site being bound to. Default is "443".
68
86
-**Host Name** – Optional. The host name for the web site being bound to.
69
-
-*Protocol* - Required (Adding an entry, Removing an entry, Reenrolling an entry)
87
+
-**Protocol** - Required (Adding an entry, Removing an entry, Reenrolling an entry)
70
88
- https
71
89
- http
72
90
-**Sni Flag** – Optional. Set the SNI flag associated with the binding being created. Default is "0". Acceptable values are:
@@ -94,13 +112,41 @@ See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your
94
112
In Keyfactor Command create a new Certificate Store similar to the one below, selecting IIS With Binding as the Category and the parameters as described in "Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent".
95
113
96
114
115
+
97
116
98
117
#### STORE CONFIGURATION
99
118
CONFIG ELEMENT |DESCRIPTION
100
119
----------------|---------------
101
120
Category |The type of certificate store to be configured. Select category based on the display name configured above.
102
121
Container |This is a logical grouping of like stores. This configuration is optional and does not impact the functionality of the store.
103
122
Client Machine |The hostname of the server to be managed. The Change Credentials option must be clicked to provide a username and password. This account will be used to manage the remote server via PowerShell.
123
+
Credentials |Local or domain admin account that has permissions to manage iis (Has to be admin)
104
124
Store Path |My or WebHosting
125
+
WinRm Protocol|http or https
126
+
WinRm Port |Port to run WinRm on Default for http is 5985
105
127
Orchestrator |This is the orchestrator server registered with the appropriate capabilities to manage this certificate store type.
106
128
Inventory Schedule |The interval that the system will use to report on what certificates are currently in the store.
129
+
130
+
131
+
#### TEST CASES
132
+
Case Number|Case Name|Enrollment Params|Expected Results|Passed|Screenshot
1 |New Cert Enrollment To New Binding|**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsite.com<br/>**Sni Flag:** 0 - No SNI<br/>**Protocol:** https|New Binding Created with Enrollment Params specified|True|
135
+
2 |New Cert Enrollment To Existing Binding|**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsite.com<br/>**Sni Flag:** 0 - No SNI<br/>**Protocol:** https|Existing Binding From Case 1 Updated with New Cert|True|
136
+
3 |New Cert Enrollment To Existing Binding Enable SNI |**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsite.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Will Update Site In Case 2 to Have Sni Enabled|True|
137
+
4 |New Cert Enrollment New IP Address|**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.firstsite.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|New Binding Created With New IP and New SNI on Same Port|True|
138
+
5 |New Cert Enrollment New Host Name|**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.newhostname.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|New Binding Created With different host on Same Port and IP Address|True|
139
+
6 |New Cert Enrollment Same Site New Port |**Site Name:** FirstSite<br/>**Port:** 4443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.newhostname.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|New Binding on different port will be created with new cert enrolled|True|
140
+
7 |Remove Cert and Binding From Test Case 6|**Site Name:** FirstSite<br/>**Port:** 4443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.newhostname.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert and Binding From Test Case 6 Removed|True|
141
+
8 |Renew Same Cert on 2 Different Sites|`SITE 1`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsite.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https<br/>`SITE 2`<br/>**First Site**<br/>**Site Name:** SecondSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:** cstiis04.cstpki.int<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert will be renewed on both sites because it has the same thrumbprint|True|
142
+
9 |Renew Same Cert on Same Site Same Binding Settings Different Hostname|`BINDING 1`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https<br/>`BINDING 2`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsitebinding2.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert will be renewed on both bindings because it has the same thrumbprint|True|
143
+
10 |Renew Single Cert on Same Site Same Binding Settings Different Hostname Different Certs|`BINDING 1`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https<br/>`BINDING 2`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`*`<br/>**Host Name:**www.firstsitebinding2.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert will be renewed on only one binding because the other binding does not match thrumbprint|True|
144
+
11 |Renew Same Cert on Same Site Same Binding Settings Different IPs|`BINDING 1`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https<br/>`BINDING 2`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`192.168.58.160`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert will be renewed on both bindings because it has the same thrumbprint|True|
145
+
12 |Renew Same Cert on Same Site Same Binding Settings Different Ports|`BINDING 1`<br/>**Site Name:** FirstSite<br/>**Port:** 443<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https<br/>`BINDING 2`<br/>**Site Name:** FirstSite<br/>**Port:** 543<br/>**IP Address:**`192.168.58.162`<br/>**Host Name:**www.firstsitebinding1.com<br/>**Sni Flag:** 1 - SNI Enabled<br/>**Protocol:** https|Cert will be renewed on both bindings because it has the same thrumbprint|True|
0 commit comments