Merge 4.1.0 to main by indrora · Pull Request #201 · Keyfactor/iis-orchestrator

indrora · 2026-11-09T22:09:12Z

Merge release-4.1 to main - Automated PR

* 81018 adding jea support (#185) * Initial JEA for WinCert * Update generated docs * Helper updates * Updated spelling of PowerShell script and fixed Information Messages from PW * Added JEA support for IIS * Fixed and updated IIS Components * Completed SQL Module and updated test projects * Testing * Removed WinCertScripts from extension. * changed way LocalHost and JEA are configured. * Fixed ODKG missing file error * Updated KF Import of Signed Certificates PowerShell Script * Fixed missing PowerShell script not being found. * Fix missing path * Updated documentation to include JEA information. * Update generated docs * chore(ci): Update build workflow to v5 * docs: auto-generate README and documentation [skip ci] * Update generated docs * docs: auto-generate README and documentation [skip ci] * docs: auto-generate README and documentation [skip ci] * Adding dotnet 10 support * modified: IISU/PowerShell/Build/KeyfactorWinCert.pssc modified: docsource/content.md * docs: auto-generate README and documentation [skip ci] * Updated packages to support dotnet 10 * Updating Unit Tests * Fixed timeout issue when migrating to dotnet 10 * modified: IISU/PSHelper.cs * Remove .net6 libraries and support * docs: auto-generate README and documentation [skip ci] * #86137 Cleaned up messages returned to Command * Updated language for WinSQL binding concerns * docs: auto-generate README and documentation [skip ci] * Updated JEA Documentation Fixed SQL Restart issue * docs: auto-generate README and documentation [skip ci] * Added diagnostic cmdlet * Updated the JEA documentation. Added the get-keyfactordiagnostics cmdlet for troubleshooting. * docs: auto-generate README and documentation [skip ci] * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Updated error reporting when bad CSP * Updated PS scripts to get CSPs from registry not certutil. * docs: auto-generate README and documentation [skip ci] * Fixed formatting issue in CHANGELOG * Updated the Get-KeyfactorIISBoundCertificates.ps1 script to include support for JEA (Just Enough Administration) environments. Added a new documentation file for setting up an SSH development environment. * docs: auto-generate README and documentation [skip ci] * Changes to be committed: modified: IISU/ImplementedStoreTypes/WinIIS/Management.cs modified: IISU/PowerShell/Keyfactor.WinCert.Common/Keyfactor.WinCert.Common.psm1 new file: IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-KeyfactorAdminRights.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorResult.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.Common/RoleCapabilities/Keyfactor.WinCert.Common.psrc modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISCertificateIfUnused.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1 * Updated PowerShell initialization to check for appropriate permissions when running IIS jobs. * Fixed null error when testing for admin Fixed tempfile left behind when using ssh * added more logging to chase Ssh issue when running in docker containers. * Updating logging * logging * chasing issue with ssh * Moved try/catch * Fixed issue with test-admin check function not being found in IIS/SQL * docs: auto-generate README and documentation [skip ci] --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: spbsoluble <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update integration-manifest.json (#190) --------- Co-authored-by: Bob Pokorny <55611381+rcpokorny@users.noreply.github.com> Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: spbsoluble <1661003+spbsoluble@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* release: 3.0.0 3.0.0 * As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command, and will no longer use the SAN Entry Parameter. This version, we are removing the Entry Parameter "SAN" from the integration-manifest.json, but will still support previous versions of Command in the event the SAN Entry Parameter is passed. The next major version (4.0) will remove all support for the SAN Entry Parameter. * Added WinADFS Store Type for rotating certificates in ADFS environments. Please note, only the service-communications certificate is rotated throughout your farm. * Internal only: Added Integration Tests to aid in future development and testing. * Improved messaging in the event an Entry Parameter is missing (or does not meet the casing requirements) * Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags * Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags * Added SSL Flag validation to make sure the bit flag is correct. These are the valid bit flags for the version of Windows: ### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5): * 0 No SNI * 1 Use SNI * 2 Use Centralized SSL certificate store. ### Windows Server 2016 (IIS 10.0): * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. ### Windows Server 2019 (IIS 10.0.17763) * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. * 8 Disable OCSP Stapling. ### Windows Server 2022+ (IIS 10.0.20348+) * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. * 8 Disable OCSP Stapling. * 16 Disable QUIC. * 32 Disable TLS 1.3 over TCP. * 64 Disable Legacy TLS. --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * Release: 3.0.1 * Fixed an issues when renewing ECC Certificates * Update generated docs * validating documentation for IIS/SSL Flags. * Update generated docs --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> * SQL Services not restarting (#186) * Fix problem only SQL Service was getting restarted while the other SQL Services would not restart. * Update generated docs * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update generated docs * Delete local.runsettings --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Updated the PowerShell SDK to 7.4.17 to address a vulnerability in the System.Security.Cryptography.XML package (#188) Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> * Add WinLDAP store type for AD DS (NTDS) LDAPS certificate management Automates the customer's manual LDAPS certificate renewal workflow: staging into the Personal store, then registering into the NTDS service certificate store the LDAPS listener reads from. Each Domain Controller is managed as an independent store (no ADFS-style fan-out), and both local-agent and remote WinRM/JEA connections are supported since every operation stays local to the target DC. Several NTDS-store mechanics (exact certutil syntax, JEA write permissions, LDAPS pickup timing) are flagged as unverified pending lab validation on a real Domain Controller - see docs/winldap-implementation-notes.md and docs/winldap-ntds-validation.ps1. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: auto-generate README and documentation [skip ci] * modified: CHANGELOG.md modified: IISU/ImplementedStoreTypes/WinLDAP/Inventory.cs modified: IISU/ImplementedStoreTypes/WinLDAP/Management.cs modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Keyfactor.WinCert.LDAP.psm1 modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Get-NtdsServiceStoreCertificate.ps1 deleted: IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Invoke-CertUtilNtdsStore.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Remove-NtdsServiceStoreCertificate.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Set-NtdsServiceStoreCertificate.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Public/Add-KeyfactorLdapsCertificate.ps1 modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Public/Remove-KeyfactorLdapsCertificate.ps1 deleted: IISU/PowerShell/Keyfactor.WinCert.LDAP/RoleCapabilities/Keyfactor.WinCert.LDAP.psrc modified: docs/winldap-implementation-notes.md new file: docs/winldap-module-validation.ps1 modified: docs/winldap-ntds-validation.ps1 modified: docsource/winldap.md * docs: auto-generate README and documentation [skip ci] * modified: CHANGELOG.md modified: IISU/ImplementedStoreTypes/WinLDAP/Inventory.cs modified: IISU/ImplementedStoreTypes/WinLDAP/Management.cs modified: IISU/PowerShell/Build/KeyfactorWinCert.pssc modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Keyfactor.WinCert.LDAP.psm1 new file: IISU/PowerShell/Keyfactor.WinCert.LDAP/RoleCapabilities/Keyfactor.WinCert.LDAP.psrc modified: docs/winldap-implementation-notes.md modified: docs/winldap-module-validation.ps1 modified: docs/winldap-ntds-validation.ps1 modified: docsource/content.md modified: docsource/winldap.md * docs: auto-generate README and documentation [skip ci] * fixed issue with certutil when updating LDAP Cert. * changed how NTDS Cert added to regestry * modified: IISU/PowerShell/Keyfactor.WinCert.LDAP/Public/Get-KeyfactorLdapCertificates.ps1 * Fix WinLDAP Remove to also clear the Personal store copy Lab testing on a live DC showed removing only the NTDS registry entry does not stop LDAPS from presenting the certificate, even after restarting the NTDS service. Removing the Personal (My) store copy, with no restart required, did stop it. Remove-KeyfactorLdapsCertificate now removes from both locations, failing hard if the Personal-store removal fails so the bug can't silently resurface. Also documents the new shared-store caveat: this can now affect other services on the same DC that reuse the same certificate. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: auto-generate README and documentation [skip ci] * Updated Management.cs to remove old certificates upon add job. * docs: auto-generate README and documentation [skip ci] * Add ODKG (ReEnrollment) support for WinLDAP Brings WinLDAP to parity with WinCert/IISU/WinSql. The shared ClientPSCertStoreReEnrollment now imports the re-enrolled certificate into the Personal store for WinLDAP (its NTDS\My store path isn't a real Cert: provider path), then a new WinLdap binding case registers it into the NTDS service store via the same eligibility-checked write Add-KeyfactorLdapsCertificate uses. Matches WinSql's own ReEnrollment precedent of not restarting the service or cleaning up a prior certificate afterward. Also adds docs/winldap-reset-test-state.ps1, a guided script for resetting a lab DC's NTDS/Personal store state between test passes without blindly clearing certificates that may be unrelated to testing. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: auto-generate README and documentation [skip ci] * Fix Register-KeyfactorLdapsCertificate parameter name mismatch Set-NtdsServiceStoreCertificate was rewritten during the September 1 lab validation to take -Certificate <X509Certificate2> instead of -RawCertificateBytes <byte[]>. Add-KeyfactorLdapsCertificate already called it correctly; Register-KeyfactorLdapsCertificate was written afterward against the stale signature, causing the first live ODKG test to fail with "A parameter cannot be found that matches parameter name 'RawCertificateBytes'." after CSR generation/signing/import into Personal all succeeded. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Add WinNetSH store type for netsh http sslcert binding management Adds a new store type, WinNetSH, for managing SSL certificates bound to HTTP.sys via `netsh http sslcert` (e.g. the WinRM HTTPS listener, or any other HTTP.sys-hosted service without its own binding mechanism). Supports Inventory, Add, Remove, and Reenrollment (ODKG), following the same binding-based pattern as WinIIS, including local-agent, remote WinRM/SSH, and JEA connections. Since netsh has no native PowerShell cmdlet, Keyfactor.WinCert.NetSH shells out to netsh.exe and parses its text output. netsh http add sslcert requires an AppId; when the entry parameter is left blank, this store type reuses an existing binding's AppId across a renewal (rather than silently changing it) or generates a new one for a brand-new binding, and reports back whichever value was actually used. Adds xUnit coverage for NetSHBindingInfo (alias parsing, entry-parameter construction) - the first automated test coverage any PowerShell-backed store type in this repo has had. The local-agent path (Inventory, Add, renewal-AppId-reuse, SNI binding, Remove) was validated end-to-end against real netsh sslcert bindings; JEA support has not yet been lab validated and is flagged as the main open item in docs/winnetsh-implementation-notes.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: auto-generate README and documentation [skip ci] * Added PowerShell initialize string to overcome PowerShell bug. * modified: .gitignore new file: azure-test-lab/README.md new file: azure-test-lab/docs/01-prerequisites.md new file: azure-test-lab/docs/02-phase1-deploy.md new file: azure-test-lab/docs/03-manual-dns-cutover.md new file: azure-test-lab/docs/04-phase2-deploy.md new file: azure-test-lab/docs/05-adfs-farm-bootstrap.md new file: azure-test-lab/docs/06-verification-runbook.md new file: azure-test-lab/docs/07-teardown-and-redeploy.md new file: azure-test-lab/modules/network.bicep new file: azure-test-lab/modules/nsg.bicep new file: azure-test-lab/modules/windows-vm.bicep new file: azure-test-lab/phase1-foundation/main.bicep new file: azure-test-lab/phase1-foundation/phase1.parameters.json new file: azure-test-lab/phase1-foundation/scripts/New-ADForest.ps1 new file: azure-test-lab/phase2-member-servers/main.bicep new file: azure-test-lab/phase2-member-servers/phase2.parameters.json new file: azure-test-lab/phase2-member-servers/scripts/Bootstrap-AdfsPrimary.ps1 new file: azure-test-lab/phase2-member-servers/scripts/Bootstrap-AdfsSecondary.ps1 new file: azure-test-lab/phase2-member-servers/scripts/Confirm-SqlServerReady.ps1 new file: azure-test-lab/phase2-member-servers/scripts/Initialize-AdfsPrereqs.ps1 new file: azure-test-lab/phase2-member-servers/scripts/Install-DevBoxPrereqs.ps1 new file: azure-test-lab/phase2-member-servers/scripts/Install-IISRole.ps1 * Fixed up ChangeLog * Potential fix for pull request finding 'Report Remove-Item deletion failures correctly' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding 'Fail inventory on registry enumeration errors' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding 'Make certificate-store deletion errors terminating' Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fixed the content.md formatting of text. * docs: auto-generate README and documentation [skip ci] * updated content.md --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Morgan Gangwere <morgan.gangwere@keyfactor.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Morgan Gangwere <470584+indrora@users.noreply.github.com> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Copilot

🟡 Changes recommended

Unresolved critical issues let JEA users execute unrestricted native tools with privileged rights and allow failed NetSH enumeration to cause unsafe certificate deletion.

10 open issues

JEA exposes certutil and certreq to callers · New
JEA exposes unrestricted appcmd.exe access · New
Netsh failures can trigger deletion of an in-use certificate · New
JEA exposes unrestricted netsh.exe access · New
JEA exposes unrestricted icacls.exe access · New
IPv6 bindings fail to parse for removal · New
KSPs are omitted from crypto provider enumeration · New
Renewal result leaks across instances · New
Store creation passes the type as a positional argument · New
Store creation uses a positional type instead of --name · New

What changed in this PR

Merges release 4.1.0 into main, extending Windows certificate orchestration with LDAP and HTTP.sys support and modular, JEA-aware PowerShell integration.

Changes:

Adds WinLDAP and WinNetSH integration components and shared certificate-management modules.
Updates IIS, SQL, and Windows inventory operations and JEA configuration.
Expands tests, store-type scripts, documentation, and Azure lab provisioning.

This pull request requires changes. Unresolved critical findings affect JEA privilege boundaries and NetSH failure handling. Moderate findings also affect IPv6 removal, cryptographic-provider handling, SQL renewal reporting, lab provisioning, and unattended store-type creation.

File	Description
`WindowsCertStore.UnitTests/WindowsCertStore.UnitTests.csproj`	Adds test dependencies and isolates runner assets.
`WindowsCertStore.UnitTests/SANsUnitTests.cs`	Covers null and empty legacy SAN values.
`WindowsCertStore.UnitTests/PSHelperUnitTests.cs`	Updates the script-folder expectation.
`WindowsCertStore.UnitTests/PSHelperConfigTests.cs`	Tests PowerShell helper initialization and JEA configuration.
`WindowsCertStore.UnitTests/JobPropertiesTests.cs`	Tests property defaults and deserialization.
`WindowsCertStore.IntegrationTests/WinSQLIntegrationTests.cs`	Uses SQL-specific connections and JEA settings.
`WindowsCertStore.IntegrationTests/WinIISIntegrationTests.cs`	Uses IIS-specific connections and JEA settings.
`WindowsCertStore.IntegrationTests/servers.json`	Defines store-specific integration targets.
`WindowsCertStore.IntegrationTests/Factories/ConnectionFactory.cs`	Loads credentials and filters connections by store type.
`WindowsCertStore.IntegrationTests/Factories/CertificateFactory.cs`	Updates certificate-result nullability annotations.
`WindowsCertStore.IntegrationTests/ClientConnection.cs`	Adds store-type and JEA connection fields.
`scripts/store_types/powershell/kfutil_create_store_types.ps1`	Updates six creation commands. Moderate: restore `--name` to prevent interactive selection and enable unattended creation.
`scripts/store_types/bash/kfutil_create_store_types.sh`	Updates creation commands and failure handling. Moderate: restore `--name` on all six calls for unattended creation.
`IISU/WinCertJobTypeBase.cs`	Adds LDAP and NetSH binding categories.
`IISU/RemoteSettings.cs`	Carries the JEA endpoint setting.
`IISU/Properties/AssemblyInfo.cs`	Exposes internals to test assemblies.
`IISU/PowerShell/WinADFSScripts.ps1`	Moves selected diagnostics to the information stream.
`IISU/PowerShell/Keyfactor.WinCert.SQL/RoleCapabilities/Keyfactor.WinCert.SQL.psrc`	Defines SQL JEA capabilities. Critical: remove caller-visible `icacls.exe`, which permits arbitrary privileged ACL changes.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Remove-KeyfactorSQLCertificate.ps1`	Adds SQL certificate unbinding.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1`	Adds binding and renewal orchestration. Moderate: reset each instance’s result so a thumbprint mismatch cannot reuse an earlier success.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Get-KeyfactorSQLInventory.ps1`	Adds SQL inventory. Moderate: use `Get-CertificateCSP` to retain CNG provider names needed for reenrollment.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceUser.ps1`	Resolves SQL service identities.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceName.ps1`	Resolves default and named SQL services.
`IISU/PowerShell/Keyfactor.WinCert.SQL/Keyfactor.WinCert.SQL.psm1`	Loads and exports SQL functions.
`IISU/PowerShell/Keyfactor.WinCert.NetSH/RoleCapabilities/Keyfactor.WinCert.NetSH.psrc`	Defines NetSH JEA capabilities. Critical: remove caller-visible `netsh.exe`, which permits unrelated privileged network and firewall changes.
`IISU/PowerShell/Keyfactor.WinCert.NetSH/Public/Remove-KeyfactorNetSHCertificateIfUnused.ps1`	Removes certificates after checking remaining SSL bindings.
`IISU/PowerShell/Keyfactor.WinCert.NetSH/Public/Remove-KeyfactorNetSHBinding.ps1`	Removes HTTP.sys SSL bindings.
`IISU/PowerShell/Keyfactor.WinCert.NetSH/Private/Get-NetShSslCertBinding.ps1`	Parses native binding output. Critical: throw on unexpected failures rather than returning an empty list that can trigger certificate deletion or empty inventory.
`IISU/PowerShell/Keyfactor.WinCert.NetSH/Keyfactor.WinCert.NetSH.psm1`	Loads and exports NetSH functions.
`IISU/PowerShell/Keyfactor.WinCert.LDAP/Public/Get-KeyfactorLdapCertificates.ps1`	Inventories NTDS service-store certificates.
`IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Set-NtdsServiceStoreCertificate.ps1`	Writes serialized certificates to service stores.
`IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Remove-NtdsServiceStoreCertificate.ps1`	Removes service-store registry entries.
`IISU/PowerShell/Keyfactor.WinCert.LDAP/Private/Get-NtdsServiceStoreCertificate.ps1`	Reads service-store certificate metadata.
`IISU/PowerShell/Keyfactor.WinCert.LDAP/Keyfactor.WinCert.LDAP.psm1`	Loads and exports LDAP functions.
`IISU/PowerShell/Keyfactor.WinCert.IIS/RoleCapabilities/Keyfactor.WinCert.IIS.psrc`	Defines IIS JEA capabilities. Critical: remove caller-visible `appcmd.exe`, which permits general privileged IIS administration beyond certificate bindings.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1`	Removes matching HTTPS bindings.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-ValidSslFlags.ps1`	Validates SSL flag values and combinations.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-IISDrive.ps1`	Detects WebAdministration drive availability.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1`	Selects SSL flags by Windows build.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-IISManagementInfo.ps1`	Resolves IIS management access and checks sites.
`IISU/PowerShell/Keyfactor.WinCert.IIS/Keyfactor.WinCert.IIS.psm1`	Loads and exports IIS functions.
`IISU/PowerShell/Keyfactor.WinCert.Common/RoleCapabilities/Keyfactor.WinCert.Common.psrc`	Defines shared JEA capabilities. Critical: remove caller-visible `certutil` and `certreq`, which permit privileged operations outside trusted wrappers, including file downloads and writes.
`IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1`	Adds certificate-store removal.
`IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorResult.ps1`	Defines structured operation results.
`IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorODKGEnrollment.ps1`	Generates on-device keys and CSRs.
`IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1`	Imports signed certificates.
`IISU/PowerShell/Keyfactor.WinCert.Common/Public/Get-KeyfactorCertificates.ps1`	Returns certificate-store inventory.
`IISU/PowerShell/Keyfactor.WinCert.Common/Private/Validate-CryptoProvider.ps1`	Validates requested cryptographic providers.
`IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-KeyfactorAdminRights.ps1`	Checks and caches administrative status.
`IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-CryptoServiceProvider.ps1`	Provides boolean provider validation.
`IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CryptoProviders.ps1`	Discovers cryptographic providers. Moderate: enumerate both CSPs and KSPs; a nonempty legacy-provider list currently suppresses KSP discovery and rejects valid providers.
`IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CertificateSAN.ps1`	Extracts SAN extension text.
`IISU/PowerShell/Keyfactor.WinCert.Common/Keyfactor.WinCert.Common.psm1`	Loads and exports shared functions.
`IISU/Models/JobProperties.cs`	Adds the JEA endpoint property.
`IISU/manifest.json`	Registers LDAP and NetSH job extensions.
`IISU/ImplementedStoreTypes/WinSQL/WinSqlBinding.cs`	Calls modular SQL PowerShell functions.
`IISU/ImplementedStoreTypes/WinSQL/Inventory.cs`	Passes JEA settings and updates inventory invocation.
`IISU/ImplementedStoreTypes/WinNetSH/ReEnrollment.cs`	Adds the NetSH reenrollment entry point.
`IISU/ImplementedStoreTypes/WinNetSH/NetSHCertificateInfo.cs`	Defines NetSH inventory metadata.
`IISU/ImplementedStoreTypes/WinNetSH/NetSHBindingInfo.cs`	Models and parses binding aliases. Moderate: preserve bracketed IPv6 addresses as one field so inventoried IPv6 bindings can be removed.
`IISU/ImplementedStoreTypes/WinLDAP/WinLdapCertificateInfo.cs`	Defines LDAP inventory metadata.
`IISU/ImplementedStoreTypes/WinLDAP/WinLdapBinding.cs`	Registers reenrolled certificates in NTDS stores.
`IISU/ImplementedStoreTypes/WinLDAP/ReEnrollment.cs`	Adds the LDAP reenrollment entry point.
`IISU/ImplementedStoreTypes/WinIIS/WinIISBinding.cs`	Updates function names, removal parameters, and result handling.
`IISU/ImplementedStoreTypes/WinIIS/Inventory.cs`	Enables JEA and administrative checks.
`IISU/ImplementedStoreTypes/WinAdfs/Management.cs`	Simplifies returned failure details.
`IISU/ImplementedStoreTypes/WinADFS/Inventory.cs`	Removes SAN from inventory parameters.
`IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs`	Removes an unused exception variable.
`IISU/ImplementedStoreTypes/Win/WinInventory.cs`	Marks the legacy inventory class obsolete.
`IISU/ImplementedStoreTypes/Win/WinCertCertificateInfo.cs`	Removes the SAN model property.
`IISU/ImplementedStoreTypes/Win/Inventory.cs`	Updates JEA settings, function invocation, and inventory parameters.
`docsource/winsql.md`	Documents SQL binding verification.
`docsource/winnetsh.md`	Documents HTTP.sys operations and requirements.
`docsource/images/WinSql-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates SQL WinRM protocol validation.
`docsource/images/WinSql-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates SQL WinRM port validation.
`docsource/images/WinSql-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates SQL SPN-port configuration.
`docsource/images/WinSql-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates SQL SSL configuration.
`docsource/images/WinSql-custom-field-RestartService-validation-options-dialog.svg`	Illustrates SQL service-restart configuration.
`docsource/images/WinSql-custom-field-JEAEndpointName-validation-options-dialog.svg`	Illustrates SQL JEA endpoint configuration.
`docsource/images/WinNetSH-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates NetSH WinRM protocol validation.
`docsource/images/WinNetSH-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates NetSH WinRM port validation.
`docsource/images/WinNetSH-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates NetSH SPN-port configuration.
`docsource/images/WinNetSH-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates NetSH SSL configuration.
`docsource/images/WinNetSH-custom-field-JEAEndpointName-validation-options-dialog.svg`	Illustrates NetSH JEA endpoint configuration.
`docsource/images/WinLDAP-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates LDAP WinRM protocol validation.
`docsource/images/WinLDAP-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates LDAP WinRM port validation.
`docsource/images/WinLDAP-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates LDAP SPN-port configuration.
`docsource/images/WinLDAP-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates LDAP SSL configuration.
`docsource/images/WinLDAP-custom-field-RestartService-validation-options-dialog.svg`	Illustrates LDAP service-restart configuration.
`docsource/images/WinLDAP-custom-field-JEAEndpointName-validation-options-dialog.svg`	Illustrates LDAP JEA endpoint configuration.
`docsource/images/WinCert-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates WinCert WinRM protocol validation.
`docsource/images/WinCert-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates WinCert WinRM port validation.
`docsource/images/WinCert-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates WinCert SPN-port configuration.
`docsource/images/WinCert-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates WinCert SSL configuration.
`docsource/images/WinCert-custom-field-JEAEndpointName-validation-options-dialog.svg`	Illustrates WinCert JEA endpoint configuration.
`docsource/images/WinAdfs-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates ADFS WinRM protocol validation.
`docsource/images/WinAdfs-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates ADFS WinRM port validation.
`docsource/images/WinAdfs-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates ADFS SPN-port configuration.
`docsource/images/WinAdfs-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates ADFS SSL configuration.
`docsource/images/IISU-custom-field-WinRM Protocol-validation-options-dialog.svg`	Illustrates IIS WinRM protocol validation.
`docsource/images/IISU-custom-field-WinRM Port-validation-options-dialog.svg`	Illustrates IIS WinRM port validation.
`docsource/images/IISU-custom-field-spnwithport-validation-options-dialog.svg`	Illustrates IIS SPN-port configuration.
`docsource/images/IISU-custom-field-ServerUseSsl-validation-options-dialog.svg`	Illustrates IIS SSL configuration.
`docsource/images/IISU-custom-field-JEAEndpointName-validation-options-dialog.svg`	Illustrates IIS JEA endpoint configuration.
`azure-test-lab/phase2-member-servers/scripts/Install-IISRole.ps1`	Installs IIS and seeds an HTTPS binding. Moderate: explicitly install `Web-Scripting-Tools` so WebAdministration commands work on clean server images.
`azure-test-lab/phase2-member-servers/scripts/Install-DevBoxPrereqs.ps1`	Installs lab development tools.
`azure-test-lab/phase2-member-servers/scripts/Confirm-SqlServerReady.ps1`	Checks SQL readiness and configures firewall access.
`azure-test-lab/phase2-member-servers/phase2.parameters.json`	Supplies member-server deployment parameters.
`azure-test-lab/phase1-foundation/scripts/New-ADForest.ps1`	Installs AD DS and promotes the domain controller.
`azure-test-lab/phase1-foundation/phase1.parameters.json`	Supplies foundation deployment parameters.
`azure-test-lab/modules/nsg.bicep`	Defines lab network access rules.
`azure-test-lab/modules/network.bicep`	Defines the lab VNet and subnet.
`azure-test-lab/docs/07-teardown-and-redeploy.md`	Documents scoped cleanup and rebuilding.
`azure-test-lab/docs/03-manual-dns-cutover.md`	Documents the DNS cutover procedure.
`azure-test-lab/docs/02-phase1-deploy.md`	Documents foundation deployment and verification.
`azure-test-lab/docs/01-prerequisites.md`	Documents tools, credentials, images, and costs.
`.vscode/launch.json`	Adds PowerShell script debugging.
`.gitignore`	Excludes local credentials and lab parameter overrides.
`.github/workflows/keyfactor-starter-workflow.yml`	Updates the reusable starter workflow to v5.

_{Review effort: Balanced}

+    # certutil.exe is called directly via the PowerShell pipeline by Get-CryptoProviders.
+    # certreq.exe is called directly via the PowerShell pipeline by New-KeyfactorODKGEnrollment.
+    # Full path is required for both. Add-KeyfactorCertificate uses certutil via .NET ProcessStartInfo
+    # and does NOT need it listed here.
+    VisibleExternalCommands = @(
+        'C:\Windows\System32\certutil.exe',
+        'C:\Windows\System32\certreq.exe'
+    )


+    # appcmd.exe is invoked inside New-KeyfactorIISSiteBinding for extended SSL flag support.
+    # Trusted module code can call external commands unrestricted, but listing it here
+    # makes the allowed command surface explicit.
+    VisibleExternalCommands = @(
+        'C:\Windows\System32\inetsrv\appcmd.exe'
+    )


+    if ($LASTEXITCODE -ne 0 -or $outputText -match 'not found') {
+        if ($IPPort -or $HostnamePort) {
+            return @()
+        }
+    }


+    # netsh.exe is the only external command this module shells out to - there is no native
+    # PowerShell cmdlet for HTTP.sys SSL certificate bindings.
+    VisibleExternalCommands = @('C:\Windows\System32\netsh.exe')


+    # icacls.exe is called via the PowerShell pipeline by Set-KeyfactorSQLCertificateBinding.
+    # Full path is required.
+    VisibleExternalCommands = @(
+        'C:\Windows\System32\icacls.exe'
+    )


+            var parts = alias.Split(':');
+            if (parts.Length < 3 || parts.Length > 4)
+                throw new FormatException("Alias must be in the format of Thumbprint:IPAddress:Port[:Hostname]");
+
+            return new NetSHBindingInfo
+            {
+                Thumbprint = parts[0],
+                IPAddress = parts[1],
+                Port = parts[2],
+                HostName = parts.Length == 4 ? parts[3] : null
+            };


+        if ($cspInfoList.Count -eq 0) {
+            Write-Information "[VERBOSE] Registry enumeration returned no CSPs; falling back to certutil."


+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }


+kfutil store-types create WinCert
+
+echo "Creating store type: IISU"
+kfutil store-types create IISU
+
+echo "Creating store type: WinSql"
+kfutil store-types create WinSql
+
+echo "Creating store type: WinAdfs"
+kfutil store-types create WinAdfs
+
+echo "Creating store type: WinLDAP"
+kfutil store-types create WinLDAP
+
+echo "Creating store type: WinNetSH"
+kfutil store-types create WinNetSH


-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert


Copilot

🟡 Changes recommended

Critical findings expose unrestricted privileged netsh commands through JEA, risk deleting active certificates and HTTPS bindings, and block ADFS deployment through task-registration, certificate-handoff, and missing-parameter failures.

19 open issues

_{Review effort: Balanced}

+
+        # A block with no certificate hash isn't a real sslcert binding (defensive - every real
+        # binding block has one), so skip it rather than returning a half-populated object.
+        if ([string]::IsNullOrEmpty($certificateHash)) { continue }


+    if ($existingBinding) {
+        Write-Information "[VERBOSE] Removing existing sslcert binding at '$bindingKey' before rebinding"
+        $deleteKeyArg = if ($useHostname) { "hostnameport=$bindingKey" } else { "ipport=$bindingKey" }
+        $deleteOutput = & netsh http delete sslcert $deleteKeyArg 2>&1


+if ($farmAlreadyExists) {
+    Write-Output "ADFS farm already exists on this node - skipping farm creation."
+    exit 0


+& schtasks.exe /Create /TN $taskName /TR "powershell.exe $taskArgs" /SC ONCE /ST 00:00 /RU "$DomainAdminUsername" /RP "$DomainAdminPassword" /RL HIGHEST /F | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "schtasks /Create failed with exit code $LASTEXITCODE"
+}


+$exported = $false
+while (-not $exported -and $attempt -lt 5) {
+    try {
+        Export-PfxCertificate -Cert "Cert:\LocalMachine\My\$($cert.Thumbprint)" -FilePath $pfxPath -Password $exportPassword | Out-Null


+    [Parameter(Mandatory = $true)]
+    [string] $AdfsServiceAccountName,


+$attempt = 0
+$found = $false
+while (-not $found -and $attempt -lt 20) {
+    if (Test-Path $pfxPath) {


+& schtasks.exe /Create /TN $taskName /TR "powershell.exe $taskArgs" /SC ONCE /ST 00:00 /RU "$DomainAdminUsername" /RP "$DomainAdminPassword" /RL HIGHEST /F | Out-Null
+if ($LASTEXITCODE -ne 0) {
+    throw "schtasks /Create failed with exit code $LASTEXITCODE"
+}


+$jeaTestCert = New-SelfSignedCertificate -Subject "CN=jea-validation" -KeyUsage KeyEncipherment, DigitalSignature `
+    -CertStoreLocation "Cert:\LocalMachine\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1") -KeyExportPolicy Exportable


indrora and others added 2 commits August 11, 2026 09:08

Copilot AI balanced review requested due to automatic review settings November 9, 2026 22:09

Copilot started reviewing on behalf of indrora November 9, 2026 22:09

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Merge branch 'main' into release-4.1

b1c7488

Copilot AI balanced review requested due to automatic review settings November 9, 2026 23:00

docs: auto-generate README and documentation [skip ci]

0656c35

Copilot started reviewing on behalf of indrora November 9, 2026 23:01

View session

indrora merged commit 3ac14f2 into main Nov 9, 2026

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Navigation Menu

Repository navigation

Merge 4.1.0 to main - #201

Merge 4.1.0 to main#201
indrora merged 4 commits into
mainfrom
release-4.1

indrora commented Nov 9, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		if ($cspInfoList.Count -eq 0) {
		Write-Information "[VERBOSE] Registry enumeration returned no CSPs; falling back to certutil."

		[Parameter(Mandatory = $true)]
		[string] $AdfsServiceAccountName,

		$jeaTestCert = New-SelfSignedCertificate -Subject "CN=jea-validation" -KeyUsage KeyEncipherment, DigitalSignature `
		-CertStoreLocation "Cert:\LocalMachine\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1") -KeyExportPolicy Exportable

Conversation

indrora commented Nov 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants