76022 iis orchestrator 3.0.0 Ready for release #178

rcpokorny · 2026-01-14T16:41:29Z

3.0.0

As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command, and will no longer use the SAN Entry Parameter. This version, we are removing the Entry Parameter "SAN" from the integration-manifest.json, but will still support previous versions of Command in the event the SAN Entry Parameter is passed. The next major version (4.0) will remove all support for the SAN Entry Parameter.
Added WinADFS Store Type for rotating certificates in ADFS environments. Please note, only the service-communications certificate is rotated throughout your farm.
Internal only: Added Integration Tests to aid in future development and testing.
Improved messaging in the event an Entry Parameter is missing (or does not meet the casing requirements)
Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags
Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags
Added SSL Flag validation to make sure the bit flag is correct. These are the valid bit flags for the version of Windows:

Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5):
- 0 No SNI
- 1 Use SNI
- 2 Use Centralized SSL certificate store.
Windows Server 2016 (IIS 10.0):
- 0 No SNI
- 1 Use SNI
- 4 Disable HTTP/2.
Windows Server 2019 (IIS 10.0.17763)
- 0 No SNI
- 1 Use SNI
- 4 Disable HTTP/2.
- 8 Disable OCSP Stapling.
Windows Server 2022+ (IIS 10.0.20348+)
- 0 No SNI
- 1 Use SNI
- 4 Disable HTTP/2.
- 8 Disable OCSP Stapling.
- 16 Disable QUIC.
- 32 Disable TLS 1.3 over TCP.
- 64 Disable Legacy TLS.

Completed adding Integration Tests

…r SNI retrieval. - Enhanced `New-KFIISSiteBinding` to robustly handle SSL flags, including checks for managed API range and updating extended flags via `appcmd.exe`. - Improved comments and verbose logging for better clarity and debugging.

…rrectly 76938 sni flag not reporting correctly

…N_Entry_Parameter 76023 eliminate but support san entry parameter

…ocal and remote sessions.

… additional "housekeeping" for ADFS.

…tor/iis-orchestrator into 60764_Adding_ADFS_Support

60764 adding adfs support

Updated SAN handling in integration-manifest.json and clarified support for previous versions. Added new features and improvements.

Updated changelog to reflect changes in version 3.0.0, including SAN handling and new WinADFS Store Type.

…perly.

Added SSL Flag validation details and improved messaging.

Updated SSL Flag descriptions for clarity and accuracy.

…ng_Issues Fixed SSH Formatting issue

…Using_SSH Update generated docs

…e automatically added via Command.

…paring for release.

Copilot

Pull request overview

This PR releases version 3.0.0 of the IIS orchestrator extension with significant changes to SAN handling, a new WinADFS store type for ADFS certificate rotation, integration tests, and various bug fixes related to SSL flags and error messaging.

Changes:

SANs are now handled through ODKG Enrollment in Command rather than the SAN Entry Parameter (backward compatibility maintained in 3.0)
Added WinADFS store type for automated ADFS service-communications certificate rotation across farm nodes
Fixed SNI/SSL flag handling in IIS bindings with validation for correct bit flag combinations

Reviewed changes

Copilot reviewed 39 out of 52 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
integration-manifest.json	Removed SAN entry parameters from WinCert, IISU, and WinSql store types; added new WinAdfs store type configuration
docsource/winadfs.md	Added documentation for the new WinADFS store type
WindowsCertStore.sln	Added integration and unit test projects to solution
WindowsCertStore.UnitTests/*	Added unit test project and tests for SANs, PowerShell helpers, certificates, and ADFS
WindowsCertStore.IntegrationTests/*	Added integration test project with end-to-end tests for WinSQL and WinIIS
IISU/SANBuilder.cs	New class for building SAN strings from dictionary input
IISU/PowerShellScripts/WinCertScripts.ps1	Updated version to 1.5.0 with SSL flag fixes and certificate retrieval improvements
IISU/PowerShellScripts/WinADFSScripts.ps1	New PowerShell script with ADFS management functions
IISU/PSHelper.cs	Enhanced to support multiple script loading, ADFS module import, and improved error handling
IISU/ImplementedStoreTypes/WinIIS/*	Added SSL flag validation and improved error messaging
IISU/ImplementedStoreTypes/WinAdfs/*	New implementation for ADFS certificate rotation manager
IISU/ClientPSCertStoreReEnrollment.cs	Updated to support new SAN handling with backward compatibility
README.md	Updated documentation to include WinADFS store type

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

docsource/winadfs.md

docsource/content.md

WindowsCertStore.UnitTests/SANsUnitTests.cs

WindowsCertStore.IntegrationTests/servers.json

WindowsCertStore.IntegrationTests/appsettings.json

WindowsCertStore.IntegrationTests/Factories/ConfigurationFactory.cs

WindowsCertStore.UnitTests/AdfsUnitTests.cs

README.md

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

…of Windows Server and IIS.

Copilot

Pull request overview

Copilot reviewed 39 out of 52 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

IISU/ImplementedStoreTypes/WinIIS/Management.cs

WindowsCertStore.IntegrationTests/Factories/ConfigurationFactory.cs

Copilot

Pull request overview

Copilot reviewed 40 out of 53 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-21T23:53:29Z

docsource/iisu.md

+
+When binding certificates to IIS sites, certain SSL flags can be configured to modify the behavior of the SSL bindings. Depending on what version of Windows Server and IIS, these are the following flags are available:
+
+#### Windows Server 2016 (IIS 10.0):  #### Windows Server 2016 (IIS 10.0)


Duplicate heading found - remove the repeated text

Suggested change

#### Windows Server 2016 (IIS 10.0): #### Windows Server 2016 (IIS 10.0)

#### Windows Server 2016 (IIS 10.0):

Copilot · 2026-01-21T23:53:30Z

WindowsCertStore.IntegrationTests/Factories/ConfigurationFactory.cs

+                    new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" },
+                    new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" }


Duplicate test case entries should be removed or differentiated with unique values to avoid redundant test execution.

Suggested change

new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" },

new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" }

new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" },

new { Machine = "{IPAddressToClient2}", Username = "{username2}", Password = "{path_to_.ssh\\my_rsa2}" }

Copilot · 2026-01-21T23:53:30Z

IISU/PSHelper.cs

 using System.Collections.ObjectModel;
 using System.Diagnostics;
 using System.IO;
+using System.IO.Ports;


The System.IO.Ports namespace is imported but does not appear to be used anywhere in the file. Consider removing this unused import.

Suggested change

using System.IO.Ports;

Copilot · 2026-01-21T23:53:31Z

IISU/ImplementedStoreTypes/WinIIS/IISBindingInfo.cs

+            }
+            catch (KeyNotFoundException ex)
+            {
+                throw new ArgumentException($"An Entry Parameter was missing. Please check the Cert Store Type Definition, note that entry parameters are case sensitive. Message: {ex.Message}");


The error message structure is unclear - it states 'Message: {ex.Message}' at the end which could be confusing. Consider rephrasing to 'Missing required Entry Parameter. Please verify the Certificate Store Type Definition. Note that entry parameters are case-sensitive. Details: {ex.Message}'

Suggested change

throw new ArgumentException($"An Entry Parameter was missing. Please check the Cert Store Type Definition, note that entry parameters are case sensitive. Message: {ex.Message}");

throw new ArgumentException($"Missing required Entry Parameter. Please verify the Certificate Store Type Definition. Note that entry parameters are case-sensitive. Details: {ex.Message}");

Bob Pokorny and others added 30 commits October 8, 2025 15:08

Completed adding Integration Tests

42dfbc4

Merge pull request #154 from Keyfactor/72753-Add_Integration_Tests

ed59256

Completed adding Integration Tests

Updated the code to suppress output from PowerShell execution.

607c818

Added SSL Flag validation

df65fac

Merge pull request #156 from Keyfactor/76938_SNIFlag_Not_Reporting_Co…

a66870a

…rrectly 76938 sni flag not reporting correctly

Added SAN resolver to handle entry parameters and the new SAN Property

dee114c

Updated the integration-manifest to remove the SAN Entry Parameter.

afe8c79

Update generated docs

05ad84c

Merge pull request #157 from Keyfactor/76023-Eliminate_But_Support_SA…

dd85978

…N_Entry_Parameter 76023 eliminate but support san entry parameter

Initial ADFS infrastructure and modified how scripts are loaded for l…

af62f1e

…ocal and remote sessions.

Added ADFS Inventory Process and Unit Test

a6ef607

Added ADFS Store Type in the integration-manifest

837596d

Update generated docs

d80c527

Completed adding the logic to rotate the ADFS certificate and perform…

c6d9327

… additional "housekeeping" for ADFS.

Update generated docs

fe22b55

Updated the documentation to support ADFS

1fe9d67

Merge branch '60764_Adding_ADFS_Support' of https://github.com/Keyfac…

ad9e519

…tor/iis-orchestrator into 60764_Adding_ADFS_Support

Updated Changelog

31b15b6

Merge pull request #158 from Keyfactor/60764_Adding_ADFS_Support

40fdb7b

60764 adding adfs support

Update generated docs

10f8690

Revise SAN handling and enhance integration features

645448a

Updated SAN handling in integration-manifest.json and clarified support for previous versions. Added new features and improvements.

Update CHANGELOG for version 3.0.0 changes

dded928

Updated changelog to reflect changes in version 3.0.0, including SAN handling and new WinADFS Store Type.

Update generated docs

f8cbfc3

Fixed an issue with SSL flags greater than 3 weren't updating IIS pro…

ed354b5

…perly.

Update generated docs

984d342

Updated the SSL Flags per Microsoft documentation.

effd087

Update generated docs

03cdcc5

Update CHANGELOG with SSL Flag validation details

f71110d

Added SSL Flag validation details and improved messaging.

Revise SSL Flag entries in CHANGELOG

33dd469

Updated SSL Flag descriptions for clarity and accuracy.

Keyfactor and others added 15 commits November 21, 2025 20:12

Update generated docs

7809742

Update generated docs

4a1a3c5

Merge pull request #162 from Keyfactor/78789-Private_SSH_Key_Formatti…

98bc604

…ng_Issues Fixed SSH Formatting issue

Merge pull request #163 from Keyfactor/78938-WinSQL_ACL_Not_Updating_…

42c99d0

…Using_SSH Update generated docs

Update generated docs

5a02aca

Merged conflicts from 2.6.4

9180cc4

Merged 2.6.4 fixes into this versioin.

b40d21f

Update generated docs

7e9c968

Updated Documentation to indicate the username and password fields ar…

8837600

…e automatically added via Command.

Merge conflicts

e4eef6c

made minor adjustments to integration-manifest

c63bcc2

Update generated docs

2a21790

Fixed merge conflicts

e295bf1

Update generated docs

3159382

Validated code was updated post merge/rebase and performed tests. Pre…

1a26ccb

…paring for release.

Copilot AI review requested due to automatic review settings January 14, 2026 16:41

Copilot AI reviewed Jan 14, 2026

View reviewed changes

Bob Pokorny and others added 2 commits January 14, 2026 10:38

Made corrections per co-pilot

dc4d5ff

Update generated docs

3668a3d

Copilot AI review requested due to automatic review settings January 14, 2026 19:00

Copilot AI reviewed Jan 14, 2026

View reviewed changes

Fixed a problem with invalid SSL flags when using different versions …

ceda17c

…of Windows Server and IIS.

Copilot AI review requested due to automatic review settings January 20, 2026 20:52

corrected formatting of changelog.

4d2bf8f

Copilot AI reviewed Jan 20, 2026

View reviewed changes

IISU/ImplementedStoreTypes/WinIIS/Management.cs Outdated Show resolved Hide resolved

WindowsCertStore.IntegrationTests/Factories/ConfigurationFactory.cs Outdated Show resolved Hide resolved

Updated checks found by CoPilot

e52ff34

Copilot AI review requested due to automatic review settings January 21, 2026 23:52

Updated ReadMe to document supported SSL Bits.

613b6a4

Copilot AI reviewed Jan 21, 2026

View reviewed changes

Update generated docs

526f6c8


		When binding certificates to IIS sites, certain SSL flags can be configured to modify the behavior of the SSL bindings. Depending on what version of Windows Server and IIS, these are the following flags are available:

		#### Windows Server 2016 (IIS 10.0): #### Windows Server 2016 (IIS 10.0)

	#### Windows Server 2016 (IIS 10.0): #### Windows Server 2016 (IIS 10.0)
	#### Windows Server 2016 (IIS 10.0):

		new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" },
		new { Machine = "{IPAddressToClient}", Username = "{username}", Password = "{path_to_.ssh\\my_rsa}" }

	throw new ArgumentException($"An Entry Parameter was missing. Please check the Cert Store Type Definition, note that entry parameters are case sensitive. Message: {ex.Message}");
	throw new ArgumentException($"Missing required Entry Parameter. Please verify the Certificate Store Type Definition. Note that entry parameters are case-sensitive. Details: {ex.Message}");

76022 iis orchestrator 3.0.0 Ready for release #178

Are you sure you want to change the base?

76022 iis orchestrator 3.0.0 Ready for release #178

Uh oh!

Conversation

rcpokorny commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5):

Windows Server 2016 (IIS 10.0):

Windows Server 2019 (IIS 10.0.17763)

Windows Server 2022+ (IIS 10.0.20348+)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rcpokorny commented Jan 14, 2026 •

edited

Loading