Skip to content

Commit cc3a1b8

Browse files
author
Keyfactor
committed
Update generated README
1 parent 3265e0f commit cc3a1b8

File tree

1 file changed

+31
-25
lines changed

1 file changed

+31
-25
lines changed

README.md

Lines changed: 31 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,34 @@
1-
# Windows IIS Orchestrator
1+
# Windows IIS Binding Orchestrator
22
## Orchestrator
33

4-
The IIS-With-Bindings AnyAgent allows a user to create, configure, and manage a Keyfactor certificate store defined as an Internet Information Systems (IIS) binding definition. The certificate itself will still be stored in the defined server's personal certificate store, but the management within Keyfactor will be abstracted to appear as if the binding itself houses the certificate.
4+
The IIS Bindings orchestrator treats the certificates bound (actively in use) on a Microsoft Internet Information Server (IIS) as a Keyfactor certificate store. Inventory and Management functions are supported. The orchestrator replaces the IIS orchestrator (which did not support binding.)
55

66
<!-- add integration specific information below -->
77
***
8-
**IIS With Binding AnyAgent Configuration**
8+
**IIS Binding Orchestrator Configuration**
99

1010
**Overview**
1111

12-
The IIS-With-Bindings AnyAgent allows a user to create, configure, and manage a Keyfactor certificate store defined as an Internet Information Systems (IIS) binding definition. The certificate itself will still be stored in the defined server&#39;s personal certificate store, but the management within Keyfactor will be abstracted to appear as if the binding itself houses the certificate.
12+
The IIS Binding Orchestrator remotely manages certificates in a Windows Server local machine certificate store.
13+
The "Personal" (My) and "Web Hosting" Stores are supported.
14+
Only certificates that are bound to an IIS web site are managed.
15+
Unbound certificates are ignored.
1316

1417
This agent implements three job types – Inventory, Management Add, and Management Remove. Below are the steps necessary to configure this AnyAgent.
1518

16-
**1. Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent**
19+
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow
20+
the server running the orchestrator to manage the server running IIS.
21+
22+
**1. Create the New Certificate Store Type for the IIS Binding Orchestrator**
1723

1824
In Keyfactor Command create a new Certificate Store Type similar to the one below:
1925

2026
#### STORE TYPE CONFIGURATION
2127
CONFIG ELEMENT | DESCRIPTION
22-
---------------------|------------------
28+
------------------|------------------
2329
Name |Descriptive name for the Store Type
2430
Short Name |The short name that identifies the registered functionality of the orchestrator. Must be IISBinding
31+
Custom Capability|Store type name orchestrator will register with. Must be "IISBindings".
2532
Needs Server |Must be checked
2633
Blueprint Allowed |Unchecked
2734
Requires Store Password |Determines if a store password is required when configuring an individual store. This must be unchecked.
@@ -30,7 +37,7 @@ Supports Custom Alias |Determines if an individual entry within a store can have
3037
Uses PowerShell |Unchecked
3138
Store Path Type |Determines what restrictions are applied to the store path field when configuring a new store. This must be Multiple Choice
3239
Store Path Value|A comma separated list of options to select from for the Store Path. This, combined with the hostname, will determine the location used for the certificate store management and inventory. Must be My, WebHosting
33-
Private Keys |This determines if Keyfactor can send the private key associated with a certificate to the store. This is requried since IIS will need the private key material to establish TLS connections.
40+
Private Keys |This determines if Keyfactor can send the private key associated with a certificate to the store. This is required since IIS will need the private key material to establish TLS connections.
3441
PFX Password Style |This determines how the platform generate passwords to protect a PFX enrollment job that is delivered to the store. This can be either Default (system generated) or Custom (user determined).
3542
Job Types |Inventory, Add, and Remove are the supported job types.
3643

@@ -44,25 +51,16 @@ Job Types |Inventory, Add, and Remove are the supported job types.
4451

4552
**Custom Fields:**
4653

47-
<table>
48-
<tr><th>Parameter Name</th><th>Parameter Type</th><th>Default Value</th><th>Required</th></tr>
49-
<tr><td>spnwithport</td><td>Boolean</td><td>false</td><td>No</td></tr>
54+
- **SPN With Port** – Defaults to false but some customers need for remote PowerShell Access
5055

51-
- **SPN With Port** – Defaults to false but some customers need for remote Powershell Access
52-
</table>
56+
Parameter Name|Parameter Type|Default Value|Required
57+
---|---|---|---
58+
spnwithport|Boolean|false|No
5359

5460
![](images/screen1-b.gif)
5561

5662
**Entry Parameters:**
5763
This section must be configured with binding fields. The parameters will be populated with the appropriate data when creating a new certificate store.<br/>
58-
<table>
59-
<tr><th>Parameter Name</th><th>Parameter Type</th><th>Default Value</th><th>Required</th></tr>
60-
<tr><td>Port</td><td>String</td><td>443</td><td>Yes</td></tr>
61-
<tr><td>IP Address</td><td>String</td><td>*</td><td>Yes</td></tr>
62-
<tr><td>Host Name</td><td>String</td><td></td><td>No</td></tr>
63-
<tr><td>Site Name</td><td>String</td><td>Default Web Site</td><td>Yes</td></tr>
64-
<tr><td>Sni Flag</td><td>String</td><td>0 - No SNI</td><td>No</td></tr>
65-
<tr><td>Protocol</td><td>Multiple Choice</td><td>https</td><td>Yes</td></tr>
6664

6765
- **Site Name** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The site name for the web site being bound to – i.e. &quot;Default Web Site&quot;
6866
- **IP Address** – Required (Adding an entry, Removing an entry, Reenrolling an entry). The IP address for the web site being bound to. Default is &quot;\*&quot; for all IP Addresses.
@@ -71,19 +69,27 @@ This section must be configured with binding fields. The parameters will be popu
7169
- *Protocol* - Required (Adding an entry, Removing an entry, Reenrolling an entry)
7270
- https
7371
- http
74-
- **Sni Flag** – Optional. Set the SNI flag assoicated with the binding being created.Default is &quot;0&quot;. Acceptable values are:
72+
- **Sni Flag** – Optional. Set the SNI flag associated with the binding being created. Default is "0". Acceptable values are:
7573
- 0 - No SNI
7674
- 1 - SNI Enabled
7775
- 2 - Non SNI Binding
7876
- 3 - SNI Binding
79-
</table>
77+
78+
Parameter Name|Parameter Type|Default Value|Required
79+
---|---|---|---
80+
Port|String|443|Yes
81+
IP Address|String|*|Yes
82+
Host Name |String||No
83+
Site Name |String|Default Web Site|Yes
84+
Sni Flag |String|0 - No SNI|No
85+
Protocol |Multiple Choice|https|Yes
8086

8187
![](images/screen1-c.gif)
8288

83-
**2. Register the IIS-With-Bindings AnyAgent with Keyfactor**
84-
See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your Keyfactor contact/representitive.
89+
**2. Register the IIS Binding Orchestrator with Keyfactor**
90+
See Keyfactor InstallingKeyfactorOrchestrators.pdf Documentation. Get from your Keyfactor contact/representative.
8591

86-
**3. Create an IIS With Binding Certificate Store within Keyfactor Command**
92+
**3. Create an IIS Binding Certificate Store within Keyfactor Command**
8793

8894
In Keyfactor Command create a new Certificate Store similar to the one below, selecting IIS With Binding as the Category and the parameters as described in &quot;Create the New Certificate Store Type for the New IIS-With-Bindings AnyAgent&quot;.
8995

0 commit comments

Comments
 (0)