Updated the Get-KeyfactorIISBoundCertificates.ps1 script to include support for JEA (Just Enough Administration) environments. Added a new documentation file for setting up an SSH development environment.

Author: Bob Pokorny

IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1

@@ -1,76 +1,130 @@
-function Get-KeyfactorIISBoundCertificates{
+function Get-KeyfactorIISBoundCertificates {
+
     $certificates = @()
     $totalBoundCertificates = 0
 
+    #
+    # Verify the current process is running with an elevated token.
+    #
+    $currentIdentity = [Security.Principal.WindowsIdentity]::GetCurrent()
+    $principal = [Security.Principal.WindowsPrincipal]::new($currentIdentity)
+
+    if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+        Write-Information `
+            -Message "Get-KeyfactorIISBoundCertificates requires an elevated PowerShell session (Run as Administrator) or a JEA endpoint configured with administrative privileges." `
+            -ErrorAction Stop
+    }
+
     try {
-        Add-Type -Path "$env:windir\System32\inetsrv\Microsoft.Web.Administration.dll"  #  -AssemblyName "Microsoft.Web.Administration"
-        $serverManager = New-Object Microsoft.Web.Administration.ServerManager
-    } catch {
-        Write-Error "Failed to create ServerManager. IIS might not be installed."
-        return
+        Add-Type -Path "$env:windir\System32\inetsrv\Microsoft.Web.Administration.dll" -ErrorAction Stop
+        $serverManager = [Microsoft.Web.Administration.ServerManager]::new()
+    }
+    catch {
+        Write-Information `
+            -Message "Failed to create the IIS ServerManager object. IIS may not be installed or the Microsoft.Web.Administration assembly could not be loaded.`n$($_.Exception.Message)" `
+            -ErrorAction Stop
+    }
+
+    #
+    # Verify IIS sites can actually be enumerated.
+    #
+    try {
+        $websites = $serverManager.Sites
+
+        if ($null -eq $websites) {
+            Write-Information `
+                -Message "Unable to enumerate IIS websites." `
+                -ErrorAction Stop
+        }
+
+        if ($websites.Count -eq 0) {
+
+            $siteCount = (Get-Service W3SVC -ErrorAction SilentlyContinue)
+
+            if ($siteCount) {
+                Write-Information @"
+No IIS websites were returned.
+
+Possible causes include:
+  • The current user does not have permission to enumerate IIS configuration.
+  • IIS contains no configured websites.
+  • The IIS configuration is unavailable.
+"@
+            }
+
+            return
+        }
+    }
+    catch {
+        Write-Error `
+            -Message "Access denied while reading IIS configuration. Local Administrator privileges or an appropriately configured JEA endpoint are required.`n$($_.Exception.Message)" `
+            -ErrorAction Stop
     }
 
-    $websites = $serverManager.Sites
     Write-Information "There were $($websites.Count) websites found."
 
     foreach ($site in $websites) {
+
         $siteName = $site.Name
         $siteBoundCertificateCount = 0
 
         foreach ($binding in $site.Bindings) {
+
             if ($binding.Protocol -eq 'https' -and $binding.CertificateHash) {
+
                 $certHash = ($binding.CertificateHash | ForEach-Object { $_.ToString("X2") }) -join ""
                 $storeName = if ($binding.CertificateStoreName) { $binding.CertificateStoreName } else { "My" }
 
                 try {
-                    $cert = Get-ChildItem -Path "Cert:\LocalMachine\$storeName" | Where-Object {
-                        $_.Thumbprint -eq $certHash
-                    }
+
+                    $cert = Get-ChildItem "Cert:\LocalMachine\$storeName" |
+                        Where-Object Thumbprint -eq $certHash
 
                     if (-not $cert) {
-                        Write-Warning "Certificate with thumbprint not found in Cert:\LocalMachine\$storeName"
+                        Write-Warning "Certificate with thumbprint '$certHash' was not found in Cert:\LocalMachine\$storeName."
                         continue
                     }
 
                     $certBase64 = [Convert]::ToBase64String($cert.RawData)
                     $ip, $port, $hostname = $binding.BindingInformation -split ":", 3
 
-                    $certInfo = [PSCustomObject]@{
-                        SiteName           = $siteName
-                        Binding            = $binding.BindingInformation
-                        IPAddress          = $ip
-                        Port               = $port
-                        Hostname           = $hostname
-                        Protocol           = $binding.Protocol
-                        SNI                = $binding.SslFlags
-                        ProviderName       = Get-CertificateCSP $cert
-                        SAN                = Get-CertificateSAN $cert
-                        Certificate        = $cert.Subject
-                        ExpiryDate         = $cert.NotAfter
-                        Issuer             = $cert.Issuer
-                        Thumbprint         = $cert.Thumbprint
-                        HasPrivateKey      = $cert.HasPrivateKey
-                        CertificateBase64  = $certBase64
+                    $certificates += [PSCustomObject]@{
+                        SiteName          = $siteName
+                        Binding           = $binding.BindingInformation
+                        IPAddress         = $ip
+                        Port              = $port
+                        Hostname          = $hostname
+                        Protocol          = $binding.Protocol
+                        SNI               = $binding.SslFlags
+                        ProviderName      = Get-CertificateCSP $cert
+                        SAN               = Get-CertificateSAN $cert
+                        Certificate       = $cert.Subject
+                        ExpiryDate        = $cert.NotAfter
+                        Issuer            = $cert.Issuer
+                        Thumbprint        = $cert.Thumbprint
+                        HasPrivateKey     = $cert.HasPrivateKey
+                        CertificateBase64 = $certBase64
                     }
 
-                    $certificates += $certInfo
                     $siteBoundCertificateCount++
                     $totalBoundCertificates++
-                } catch {
-                    Write-Warning "Could not retrieve certificate details for hash $certHash in store $storeName."
+                }
+                catch {
+                    Write-Warning "Could not retrieve certificate details for thumbprint '$certHash' in store '$storeName'."
                     Write-Warning $_
                 }
             }
         }
 
-        Write-Information "Website: $siteName has $siteBoundCertificateCount bindings with certificates."
+        Write-Information "Website '$siteName' has $siteBoundCertificateCount HTTPS binding(s) with certificates."
     }
 
-    Write-Information "A total of $totalBoundCertificates bindings with valid certificates were found."
+    Write-Information "A total of $totalBoundCertificates HTTPS binding(s) with valid certificates were found."
 
     if ($totalBoundCertificates -gt 0) {
         $certificates | ConvertTo-Json
-    } else {
-        Write-Information "No valid certificates were found bound to websites."
+    }
+    else {
+        Write-Information "No HTTPS bindings with valid certificates were found."
     }
 }