Skip to content

Commit 8cb7713

Browse files
author
Bob Pokorny
committed
Initial doc change. Checking layout and format.
1 parent c3d8ddb commit 8cb7713

File tree

4 files changed

+93
-43
lines changed

4 files changed

+93
-43
lines changed

‎WindowsCertStore.sln‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{630203
2323
images\IISUCertStoreBasic.png = images\IISUCertStoreBasic.png
2424
images\IISUCustomFields.png = images\IISUCustomFields.png
2525
images\IISUEntryParams.png = images\IISUEntryParams.png
26+
images\orchestrator-agent.png = images\orchestrator-agent.png
2627
images\ReEnrollment1.png = images\ReEnrollment1.png
2728
images\ReEnrollment1a.png = images\ReEnrollment1a.png
2829
images\ReEnrollment1b.png = images\ReEnrollment1b.png
@@ -36,6 +37,30 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{630203
3637
EndProject
3738
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "WinCertTestConsole", "WinCertTestConsole\WinCertTestConsole.csproj", "{D0F4A3CC-5236-4393-9C97-AE55ACE319F2}"
3839
EndProject
40+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "docsource", "docsource", "{CFCAC7FE-C9E1-4822-A1B5-45F16E62F5FF}"
41+
ProjectSection(SolutionItems) = preProject
42+
docsource\content.md = docsource\content.md
43+
docsource\iisu.md = docsource\iisu.md
44+
docsource\wincert.md = docsource\wincert.md
45+
docsource\winsql.md = docsource\winsql.md
46+
EndProjectSection
47+
EndProject
48+
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "images", "images", "{60C10FF8-54FC-4C18-A2EA-F3580ABF0405}"
49+
ProjectSection(SolutionItems) = preProject
50+
docsource\images\IISU-advanced-store-type-dialog.png = docsource\images\IISU-advanced-store-type-dialog.png
51+
docsource\images\IISU-basic-store-type-dialog.png = docsource\images\IISU-basic-store-type-dialog.png
52+
docsource\images\IISU-custom-fields-store-type-dialog.png = docsource\images\IISU-custom-fields-store-type-dialog.png
53+
docsource\images\IISU-entry-parameters-store-type-dialog.png = docsource\images\IISU-entry-parameters-store-type-dialog.png
54+
docsource\images\WinCert-advanced-store-type-dialog.png = docsource\images\WinCert-advanced-store-type-dialog.png
55+
docsource\images\WinCert-basic-store-type-dialog.png = docsource\images\WinCert-basic-store-type-dialog.png
56+
docsource\images\WinCert-custom-fields-store-type-dialog.png = docsource\images\WinCert-custom-fields-store-type-dialog.png
57+
docsource\images\WinCert-entry-parameters-store-type-dialog.png = docsource\images\WinCert-entry-parameters-store-type-dialog.png
58+
docsource\images\WinSql-advanced-store-type-dialog.png = docsource\images\WinSql-advanced-store-type-dialog.png
59+
docsource\images\WinSql-basic-store-type-dialog.png = docsource\images\WinSql-basic-store-type-dialog.png
60+
docsource\images\WinSql-custom-fields-store-type-dialog.png = docsource\images\WinSql-custom-fields-store-type-dialog.png
61+
docsource\images\WinSql-entry-parameters-store-type-dialog.png = docsource\images\WinSql-entry-parameters-store-type-dialog.png
62+
EndProjectSection
63+
EndProject
3964
Global
4065
GlobalSection(SolutionConfigurationPlatforms) = preSolution
4166
Debug|Any CPU = Debug|Any CPU
@@ -65,6 +90,8 @@ Global
6590
EndGlobalSection
6691
GlobalSection(NestedProjects) = preSolution
6792
{6302034E-DF8C-4B65-AC36-CED24C068999} = {1A6C93E7-24FD-47FD-883D-EDABF5CEE4C6}
93+
{CFCAC7FE-C9E1-4822-A1B5-45F16E62F5FF} = {1A6C93E7-24FD-47FD-883D-EDABF5CEE4C6}
94+
{60C10FF8-54FC-4C18-A2EA-F3580ABF0405} = {CFCAC7FE-C9E1-4822-A1B5-45F16E62F5FF}
6895
EndGlobalSection
6996
GlobalSection(ExtensibilityGlobals) = postSolution
7097
SolutionGuid = {E0FA12DA-6B82-4E64-928A-BB9965E636C1}

‎docsource/content.md‎

Lines changed: 27 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,29 @@
11
## Overview
2+
The Windows Certificate Orchestrator Extension is a multi-purpose integration that can remotely manage certificates on a Windows Server's Local Machine Store. This extension currently manages certificates for the current store types:
3+
* WinCert - Certificates defined by path set for the Certificate Store
4+
* WinIIS - IIS Bound certificates
5+
* WinSQL - Certificates that are bound to the specified SQL Instances
26

3-
The WinCertStore Orchestrator remotely manages certificates in a Windows Server local machine certificate store. Users are able to determine which store they wish to place certificates in by entering the correct store path. For a complete list of local machine cert stores you can execute the PowerShell command:
7+
By default, most certificates are stored in the “Personal” (My) and “Web Hosting” (WebHosting) stores.
8+
For a complete list of local machine cert stores you can execute the PowerShell command:
49

510
Get-ChildItem Cert:\LocalMachine
611

712
The returned list will contain the actual certificate store name to be used when entering store location.
813

9-
By default, most certificates are stored in the “Personal” (My) and “Web Hosting” (WebHosting) stores.
10-
1114
This extension implements four job types: Inventory, Management Add/Remove, and Reenrollment.
1215

16+
The Keyfactor Universal Orchestrator (UO) and WinCert Extension can be installed on either Windows or Linux operating systems. A UO service managing certificates on remote servers is considered to be acting as an Orchestrator, while a UO Service managing local certificates on the same server running the service is considered an Agent. When acting as an Orchestrator, connectivity from the orchestrator server hosting the WinCert extension to the orchestrated server hosting the certificate stores(s) being managed is achieved via either an SSH (for Linux orchestrated servers) or WinRM (for Windows orchestrated servers) connection. When acting as an agent (Windows only), WinRM may still be used, OR the certificate store can be configured to bypass a WinRM connection and instead directly access the orchestrator server's certificate stores.
17+
18+
![](images/orchestrator-agent.png)
19+
20+
Please refer to the READMEs for each supported store type for more information on proper configuration and setup for these different stores. The supported configurations of Universal Orchestrator hosts and managed orchestrated servers are detailed below:
21+
22+
| | UO Installed on Windows | UO Installed on Linux |
23+
|-----|-----|------|
24+
|Orchestrated Server hosting certificate store(s) on remote Windows server|WinRM connection | SSH connection |
25+
|Certificate store(s) on same server as orchestrator service (Agent)| WinRM connection or local file system | Not Supported |
26+
1327
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow the orchestrator on the server to manage the certificates. Setting up WinRM is not in the scope of this document.
1428

1529
**Note:**
@@ -24,6 +38,14 @@ In version 2.0 of the IIS Orchestrator, the certificate store type has been rena
2438

2539
## Requirements
2640

41+
<details>
42+
<summary><b>Using the WinCert Extension on Linux:</b></summary>
43+
</details>
44+
45+
<details>
46+
<summary><b>Using the WinCert Extension on Windows servers:</b></summary>
47+
</details>
48+
2749
### Security and Permission Considerations
2850

2951
From an official support point of view, Local Administrator permissions are required on the target server. Some customers have been successful with using other accounts and granting rights to the underlying certificate and private key stores. Due to complexities with the interactions between Group Policy, WinRM, User Account Control, and other unpredictable customer environmental factors, Keyfactor cannot provide assistance with using accounts other than the local administrator account.
@@ -46,7 +68,8 @@ For customers wishing to use something other than the local administrator accoun
4668
- Access any Cryptographic Service Provider (CSP) referenced in re-enrollment jobs.
4769
- Read and Write values in the registry (HKLM:\SOFTWARE\Microsoft\Microsoft SQL Server) when performing SQL Server certificate binding.
4870

49-
## Note Regarding Client Machine
71+
## Client Machine Instructions
72+
Prior to version 2.6, this extension would only run in the Windows environment. Version 2.6 and greater is capable of running on Linux, however, only the SSH protocol is supported.
5073

5174
If running as an agent (accessing stores on the server where the Universal Orchestrator Services is installed ONLY), the Client Machine can be entered, OR you can bypass a WinRM connection and access the local file system directly by adding "|LocalMachine" to the end of your value for Client Machine, for example "1.1.1.1|LocalMachine". In this instance the value to the left of the pipe (|) is ignored. It is important to make sure the values for Client Machine and Store Path together are unique for each certificate store created, as Keyfactor Command requires the Store Type you select, along with Client Machine, and Store Path together must be unique. To ensure this, it is good practice to put the full DNS or IP Address to the left of the | character when setting up a certificate store that will be accessed without a WinRM connection.
5275

‎images/orchestrator-agent.png‎

24.2 KB
Loading

‎integration-manifest.json‎

Lines changed: 39 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -55,24 +55,24 @@
5555
"Required": false,
5656
"Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations."
5757
},
58-
{
59-
"Name": "WinRM Protocol",
60-
"DisplayName": "WinRM Protocol",
61-
"Type": "MultipleChoice",
62-
"DependsOn": "",
63-
"DefaultValue": "https,http",
64-
"Required": true,
65-
"Description": "Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication."
66-
},
67-
{
68-
"Name": "WinRM Port",
69-
"DisplayName": "WinRM Port",
70-
"Type": "String",
71-
"DependsOn": "",
72-
"DefaultValue": "5986",
73-
"Required": true,
74-
"Description": "String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP."
75-
},
58+
{
59+
"Name": "WinRM Protocol",
60+
"DisplayName": "WinRM Protocol",
61+
"Type": "MultipleChoice",
62+
"DependsOn": "",
63+
"DefaultValue": "https,http,ssh",
64+
"Required": true,
65+
"Description": "Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment."
66+
},
67+
{
68+
"Name": "WinRM Port",
69+
"DisplayName": "WinRM Port",
70+
"Type": "String",
71+
"DependsOn": "",
72+
"DefaultValue": "5986",
73+
"Required": true,
74+
"Description": "String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22."
75+
},
7676
{
7777
"Name": "ServerUsername",
7878
"DisplayName": "Server Username",
@@ -174,9 +174,9 @@
174174
"DisplayName": "WinRM Protocol",
175175
"Type": "MultipleChoice",
176176
"DependsOn": "",
177-
"DefaultValue": "https,http",
177+
"DefaultValue": "https,http,ssh",
178178
"Required": true,
179-
"Description": "Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication."
179+
"Description": "Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment."
180180
},
181181
{
182182
"Name": "WinRM Port",
@@ -185,7 +185,7 @@
185185
"DependsOn": "",
186186
"DefaultValue": "5986",
187187
"Required": true,
188-
"Description": "String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP."
188+
"Description": "String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22."
189189
},
190190
{
191191
"Name": "ServerUsername",
@@ -373,24 +373,24 @@
373373
"Required": false,
374374
"Description": "Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations."
375375
},
376-
{
377-
"Name": "WinRM Protocol",
378-
"DisplayName": "WinRM Protocol",
379-
"Type": "MultipleChoice",
380-
"DependsOn": "",
381-
"DefaultValue": "https,http",
382-
"Required": true,
383-
"Description": "Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication."
384-
},
385-
{
386-
"Name": "WinRM Port",
387-
"DisplayName": "WinRM Port",
388-
"Type": "String",
389-
"DependsOn": "",
390-
"DefaultValue": "5986",
391-
"Required": true,
392-
"Description": "String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP."
393-
},
376+
{
377+
"Name": "WinRM Protocol",
378+
"DisplayName": "WinRM Protocol",
379+
"Type": "MultipleChoice",
380+
"DependsOn": "",
381+
"DefaultValue": "https,http,ssh",
382+
"Required": true,
383+
"Description": "Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment."
384+
},
385+
{
386+
"Name": "WinRM Port",
387+
"DisplayName": "WinRM Port",
388+
"Type": "String",
389+
"DependsOn": "",
390+
"DefaultValue": "5986",
391+
"Required": true,
392+
"Description": "String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22."
393+
},
394394
{
395395
"Name": "ServerUsername",
396396
"DisplayName": "Server Username",

0 commit comments

Comments
 (0)