Skip to content

Commit b9f61bc

Browse files
rcpokornyrcpokorny
authored
Merge 98bc604 into eb1f50d 
2 parents eb1f50d + 98bc604 commit b9f61bc

File tree

37 files changed

+858
-100
lines changed

37 files changed

+858
-100
lines changed

‎CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1+
2.6.4
2+
* Fixed an issue with SSL Flags greater than 3 were not being applied correctly to newer IIS servers.
3+
* Fixed an issue when formatting private RSA keys when connecting using the ssh protocol.
4+
* When using ssh protocol in containers, the SQL ACL on private keys was not being updating correctly. This has been fixed.
5+
16
2.6.3
27
* Fixed re-enrollment or ODKG job when RDN Components contained escaped commas.
38
* Updated renewal job for IIS Certs to delete the old cert if not bound or used by other web sites.

‎IISU/PSHelper.cs‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -635,9 +635,10 @@ private string createPrivateKeyFile()
635635

636636
private static string formatPrivateKey(string privateKey)
637637
{
638-
String keyType = privateKey.Contains("OPENSSH PRIVATE KEY") ? "OPENSSH" : "RSA";
638+
string header = privateKey.Substring(0, privateKey.IndexOf("KEY-----") + 8);
639+
string footer = privateKey.Substring(privateKey.IndexOf("-----END"));
639640

640-
return privateKey.Replace($" {keyType} PRIVATE ", "^^^").Replace(" ", System.Environment.NewLine).Replace("^^^", $" {keyType} PRIVATE ") + System.Environment.NewLine;
641+
return privateKey.Replace(header, "HEADER").Replace(footer, "FOOTER").Replace(" ", Environment.NewLine).Replace("HEADER", header).Replace("FOOTER", footer) + Environment.NewLine;
641642
}
642643
}
643644
}

‎IISU/PowerShellScripts/WinCertScripts.ps1‎

Lines changed: 603 additions & 94 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 247 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -280,6 +280,57 @@ the Keyfactor Command Portal
280280

281281
![WinCert Custom Fields Tab](docsource/images/WinCert-custom-fields-store-type-dialog.png)
282282

283+
284+
###### SPN With Port
285+
Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
286+
287+
![WinCert Custom Field - spnwithport](docsource/images/WinCert-custom-field-spnwithport-dialog.png)
288+
289+
290+
291+
###### WinRM Protocol
292+
Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment.
293+
294+
![WinCert Custom Field - WinRM Protocol](docsource/images/WinCert-custom-field-WinRM Protocol-dialog.png)
295+
296+
297+
298+
###### WinRM Port
299+
String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22.
300+
301+
![WinCert Custom Field - WinRM Port](docsource/images/WinCert-custom-field-WinRM Port-dialog.png)
302+
303+
304+
305+
###### Server Username
306+
Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
307+
308+
309+
> [!IMPORTANT]
310+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
311+
312+
313+
314+
315+
###### Server Password
316+
Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key.
317+
318+
319+
> [!IMPORTANT]
320+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
321+
322+
323+
324+
325+
###### Use SSL
326+
Determine whether the server uses SSL or not (This field is automatically created)
327+
328+
![WinCert Custom Field - ServerUseSsl](docsource/images/WinCert-custom-field-ServerUseSsl-dialog.png)
329+
330+
331+
332+
333+
283334
##### Entry Parameters Tab
284335

285336
| Name | Display Name | Description | Type | Default Value | Entry has a private key | Adding an entry | Removing an entry | Reenrolling an entry |
@@ -291,6 +342,20 @@ the Keyfactor Command Portal
291342

292343
![WinCert Entry Parameters Tab](docsource/images/WinCert-entry-parameters-store-type-dialog.png)
293344

345+
346+
##### Crypto Provider Name
347+
Name of the Windows cryptographic service provider to use when generating and storing private keys. For more information, refer to the section 'Using Crypto Service Providers'
348+
349+
![WinCert Entry Parameter - ProviderName](docsource/images/WinCert-entry-parameters-store-type-dialog-ProviderName.png)
350+
351+
352+
##### SAN
353+
String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs. Can be made optional if RFC 2818 is disabled on the CA.
354+
355+
![WinCert Entry Parameter - SAN](docsource/images/WinCert-entry-parameters-store-type-dialog-SAN.png)
356+
357+
358+
294359
</details>
295360
</details>
296361

@@ -409,6 +474,57 @@ the Keyfactor Command Portal
409474

410475
![IISU Custom Fields Tab](docsource/images/IISU-custom-fields-store-type-dialog.png)
411476

477+
478+
###### SPN With Port
479+
Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
480+
481+
![IISU Custom Field - spnwithport](docsource/images/IISU-custom-field-spnwithport-dialog.png)
482+
483+
484+
485+
###### WinRM Protocol
486+
Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment.
487+
488+
![IISU Custom Field - WinRM Protocol](docsource/images/IISU-custom-field-WinRM Protocol-dialog.png)
489+
490+
491+
492+
###### WinRM Port
493+
String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22.
494+
495+
![IISU Custom Field - WinRM Port](docsource/images/IISU-custom-field-WinRM Port-dialog.png)
496+
497+
498+
499+
###### Server Username
500+
Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
501+
502+
503+
> [!IMPORTANT]
504+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
505+
506+
507+
508+
509+
###### Server Password
510+
Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key.
511+
512+
513+
> [!IMPORTANT]
514+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
515+
516+
517+
518+
519+
###### Use SSL
520+
Determine whether the server uses SSL or not (This field is automatically created)
521+
522+
![IISU Custom Field - ServerUseSsl](docsource/images/IISU-custom-field-ServerUseSsl-dialog.png)
523+
524+
525+
526+
527+
412528
##### Entry Parameters Tab
413529

414530
| Name | Display Name | Description | Type | Default Value | Entry has a private key | Adding an entry | Removing an entry | Reenrolling an entry |
@@ -426,6 +542,56 @@ the Keyfactor Command Portal
426542

427543
![IISU Entry Parameters Tab](docsource/images/IISU-entry-parameters-store-type-dialog.png)
428544

545+
546+
##### Port
547+
String value specifying the IP port to bind the certificate to for the IIS site. Example: '443' for HTTPS.
548+
549+
![IISU Entry Parameter - Port](docsource/images/IISU-entry-parameters-store-type-dialog-Port.png)
550+
551+
552+
##### IP Address
553+
String value specifying the IP address to bind the certificate to for the IIS site. Example: '*' for all IP addresses or '192.168.1.1' for a specific IP address.
554+
555+
![IISU Entry Parameter - IPAddress](docsource/images/IISU-entry-parameters-store-type-dialog-IPAddress.png)
556+
557+
558+
##### Host Name
559+
String value specifying the host name (host header) to bind the certificate to for the IIS site. Leave blank for all host names or enter a specific hostname such as 'www.example.com'.
560+
561+
![IISU Entry Parameter - HostName](docsource/images/IISU-entry-parameters-store-type-dialog-HostName.png)
562+
563+
564+
##### IIS Site Name
565+
String value specifying the name of the IIS web site to bind the certificate to. Example: 'Default Web Site' or any custom site name such as 'MyWebsite'.
566+
567+
![IISU Entry Parameter - SiteName](docsource/images/IISU-entry-parameters-store-type-dialog-SiteName.png)
568+
569+
570+
##### SSL Flags
571+
A 128-Bit Flag that determines what type of SSL settings you wish to use. The default is 0, meaning No SNI. For more information, check IIS documentation for the appropriate bit setting.)
572+
573+
![IISU Entry Parameter - SniFlag](docsource/images/IISU-entry-parameters-store-type-dialog-SniFlag.png)
574+
575+
576+
##### Protocol
577+
Multiple choice value specifying the protocol to bind to. Example: 'https' for secure communication.
578+
579+
![IISU Entry Parameter - Protocol](docsource/images/IISU-entry-parameters-store-type-dialog-Protocol.png)
580+
581+
582+
##### Crypto Provider Name
583+
Name of the Windows cryptographic service provider to use when generating and storing private keys. For more information, refer to the section 'Using Crypto Service Providers'
584+
585+
![IISU Entry Parameter - ProviderName](docsource/images/IISU-entry-parameters-store-type-dialog-ProviderName.png)
586+
587+
588+
##### SAN
589+
String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs. Can be made optional if RFC 2818 is disabled on the CA.
590+
591+
![IISU Entry Parameter - SAN](docsource/images/IISU-entry-parameters-store-type-dialog-SAN.png)
592+
593+
594+
429595
</details>
430596
</details>
431597

@@ -537,6 +703,64 @@ the Keyfactor Command Portal
537703

538704
![WinSql Custom Fields Tab](docsource/images/WinSql-custom-fields-store-type-dialog.png)
539705

706+
707+
###### SPN With Port
708+
Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
709+
710+
![WinSql Custom Field - spnwithport](docsource/images/WinSql-custom-field-spnwithport-dialog.png)
711+
712+
713+
714+
###### WinRM Protocol
715+
Multiple choice value specifying which protocol to use. Protocols https or http use WinRM to connect from Windows to Windows Servers. Using ssh is only supported when running the orchestrator in a Linux environment.
716+
717+
![WinSql Custom Field - WinRM Protocol](docsource/images/WinSql-custom-field-WinRM Protocol-dialog.png)
718+
719+
720+
721+
###### WinRM Port
722+
String value specifying the port number that the Windows target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP. By default, when using ssh in a Linux environment, the default port number is 22.
723+
724+
![WinSql Custom Field - WinRM Port](docsource/images/WinSql-custom-field-WinRM Port-dialog.png)
725+
726+
727+
728+
###### Server Username
729+
Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
730+
731+
732+
> [!IMPORTANT]
733+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
734+
735+
736+
737+
738+
###### Server Password
739+
Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key.
740+
741+
742+
> [!IMPORTANT]
743+
> This field is created by the `Needs Server` on the Basic tab, do not create this field manually.
744+
745+
746+
747+
748+
###### Use SSL
749+
Determine whether the server uses SSL or not (This field is automatically created)
750+
751+
![WinSql Custom Field - ServerUseSsl](docsource/images/WinSql-custom-field-ServerUseSsl-dialog.png)
752+
753+
754+
755+
###### Restart SQL Service After Cert Installed
756+
Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation.
757+
758+
![WinSql Custom Field - RestartService](docsource/images/WinSql-custom-field-RestartService-dialog.png)
759+
760+
761+
762+
763+
540764
##### Entry Parameters Tab
541765

542766
| Name | Display Name | Description | Type | Default Value | Entry has a private key | Adding an entry | Removing an entry | Reenrolling an entry |
@@ -549,6 +773,26 @@ the Keyfactor Command Portal
549773

550774
![WinSql Entry Parameters Tab](docsource/images/WinSql-entry-parameters-store-type-dialog.png)
551775

776+
777+
##### Instance Name
778+
String value specifying the SQL Server instance name to bind the certificate to. Example: 'MSSQLServer' for the default instance or 'Instance1' for a named instance.
779+
780+
![WinSql Entry Parameter - InstanceName](docsource/images/WinSql-entry-parameters-store-type-dialog-InstanceName.png)
781+
782+
783+
##### Crypto Provider Name
784+
Name of the Windows cryptographic service provider to use when generating and storing private keys. For more information, refer to the section 'Using Crypto Service Providers'
785+
786+
![WinSql Entry Parameter - ProviderName](docsource/images/WinSql-entry-parameters-store-type-dialog-ProviderName.png)
787+
788+
789+
##### SAN
790+
String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs.
791+
792+
![WinSql Entry Parameter - SAN](docsource/images/WinSql-entry-parameters-store-type-dialog-SAN.png)
793+
794+
795+
552796
</details>
553797
</details>
554798

@@ -557,15 +801,14 @@ the Keyfactor Command Portal
557801

558802
1. **Download the latest Windows Certificate Universal Orchestrator extension from GitHub.**
559803

560-
Navigate to the [Windows Certificate Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/iis-orchestrator/releases/latest). Refer to the compatibility matrix below to determine whether the `net6.0` or `net8.0` asset should be downloaded. Then, click the corresponding asset to download the zip archive.
804+
Navigate to the [Windows Certificate Universal Orchestrator extension GitHub version page](https://github.com/Keyfactor/iis-orchestrator/releases/latest). Refer to the compatibility matrix below to determine the asset should be downloaded. Then, click the corresponding asset to download the zip archive.
561805

562806
| Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `iis-orchestrator` .NET version to download |
563807
| --------- | ----------- | ----------- | ----------- |
564808
| Older than `11.0.0` | | | `net6.0` |
565809
| Between `11.0.0` and `11.5.1` (inclusive) | `net6.0` | | `net6.0` |
566-
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` |
567-
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
568-
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
810+
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `Disable` | `net6.0` || Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
811+
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
569812

570813
Unzip the archive containing extension assemblies to a known location.
571814

‎docsource/images/IISU-advanced-store-type-dialog.png‎

-86 Bytes
Loading

‎docsource/images/IISU-basic-store-type-dialog.png‎

2 Bytes
Loading

‎docsource/images/IISU-custom-field-ServerUseSsl-dialog.png‎

20.2 KB
Loading

‎docsource/images/IISU-custom-field-WinRMPort-dialog.png‎

19.7 KB
Loading

‎docsource/images/IISU-custom-field-WinRMProtocol-dialog.png‎

20.6 KB
Loading

‎docsource/images/IISU-custom-field-spnwithport-dialog.png‎

16.7 KB
Loading

0 commit comments

Comments
 (0)