Skip to content

Commit bc07ae8

Browse files
author
Bob Pokorny
committed
Updated error reporting when bad CSP
1 parent e0da7d4 commit bc07ae8

11 files changed

Lines changed: 817 additions & 181 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
* As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command and will no longer use the SAN Entry Parameter. This version, we are removing all support for the SAN Entry Parameter. If you are still using the SAN Entry Parameter, you will need to remove it from your store types and re-run inventory to remove it from your database.
44
* Adding JEA Support for local PowerShell execution. This will allow for more secure execution of the extension when running in a local PowerShell Runspace. To utilize this feature, you will need to create a JEA endpoint on the target server and specify the endpoint name as a new parameter in the specific Cert Store definition. Refer to the README for more details.
55
* .NET6 assemblies are no longer supported.
6+
* Fixed a problem when passing a bad CSP, the job was reporting successful, but did not actually add/bind the certificate.
67

78
3.0.2
89

@@ -21,14 +22,14 @@
2122
* Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags
2223
* Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags
2324
* Added SSL Flag validation to make sure the bit flag is correct. These are the valid bit flags for the version of Windows:
24-
### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5):
25+
### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5)### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5):
2526

2627

2728
* 0 No SNI
2829
* 1 Use SNI
2930
* 2 Use Centralized SSL certificate store.
3031

31-
### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0):
32+
### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0)### Windows Server 2016 (IIS 10.0):
3233

3334
* 0 No SNI
3435
* 1 Use SNI

‎IISU/ImplementedStoreTypes/Win/Management.cs‎

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
using Keyfactor.Logging;
2727
using System.Collections.ObjectModel;
2828
using System.Collections.Generic;
29+
using Keyfactor.Extensions.Orchestrator.WindowsCertStore.Models;
2930

3031
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.WinCert
3132
{
@@ -146,7 +147,7 @@ public JobResult AddCertificate(string certificateContents, string privateKeyPas
146147
{
147148
_psHelper.Initialize();
148149

149-
_logger.LogTrace("Attempting to execute PS function (Add-KFCertificateToStore)");
150+
_logger.LogTrace("Attempting to execute PS function (Add-KeyfactorCertificate)");
150151

151152
// Mandatory parameters
152153
var parameters = new Dictionary<string, object>
@@ -162,17 +163,31 @@ public JobResult AddCertificate(string certificateContents, string privateKeyPas
162163
_results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
163164
_logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");
164165

165-
// This should return the thumbprint of the certificate
166-
if (_results != null && _results.Count > 0)
167-
{
168-
var thumbprint = _results[0].ToString();
169-
_logger.LogTrace($"Added certificate to store {_storePath}, returned with the thumbprint {thumbprint}");
170-
}
171-
else
166+
ResultObject addResult = ResultObject.FromPSResults(_results);
167+
_logger.LogTrace($"Add-KeyfactorCertificate returned Status={addResult.Status}, Code={addResult.Code}, Step={addResult.Step}, Thumbprint='{addResult.Thumbprint}'");
168+
169+
_psHelper.Terminate();
170+
171+
if (!addResult.IsSuccess)
172172
{
173-
_logger.LogTrace("No results were returned. There could have been an error while adding the certificate. Look in the trace logs for PowerShell information.");
173+
string detail = !string.IsNullOrEmpty(addResult.ErrorMessage)
174+
? addResult.ErrorMessage
175+
: addResult.Message;
176+
177+
string failureMessage =
178+
$"Add certificate to store '{_storePath}' failed at step '{addResult.Step}' (code {addResult.Code}): {detail}";
179+
180+
_logger.LogWarning(failureMessage);
181+
182+
return new JobResult
183+
{
184+
Result = OrchestratorJobStatusJobResult.Failure,
185+
JobHistoryId = _jobHistoryID,
186+
FailureMessage = failureMessage
187+
};
174188
}
175-
_psHelper.Terminate();
189+
190+
_logger.LogTrace($"Added certificate to store {_storePath}, thumbprint {addResult.Thumbprint}");
176191
}
177192

178193
return new JobResult

‎IISU/ImplementedStoreTypes/WinIIS/Management.cs‎

Lines changed: 37 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
using Microsoft.Extensions.Logging;
2828
using Microsoft.PowerShell.Commands;
2929
using Newtonsoft.Json;
30-
3130
namespace Keyfactor.Extensions.Orchestrator.WindowsCertStore.IISU
3231
{
3332
public class Management : WinCertJobTypeBase, IManagementJobExtension
@@ -122,9 +121,31 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
122121

123122
OrchestratorJobStatusJobResult psResult = OrchestratorJobStatusJobResult.Unknown;
124123
string failureMessage = "";
125-
126-
string newThumbprint = AddCertificate(certificateContents, privateKeyPassword, cryptoProvider);
127-
_logger.LogTrace($"Completed adding the certificate to the store");
124+
125+
ResultObject addResult = AddCertificate(certificateContents, privateKeyPassword, cryptoProvider);
126+
_logger.LogTrace($"Completed adding the certificate to the store. Status={addResult.Status}, Code={addResult.Code}, Step={addResult.Step}");
127+
128+
if (!addResult.IsSuccess)
129+
{
130+
string detail = !string.IsNullOrEmpty(addResult.ErrorMessage)
131+
? addResult.ErrorMessage
132+
: addResult.Message;
133+
134+
string addFailureMessage =
135+
$"Add certificate to store '{_storePath}' failed at step '{addResult.Step}' (code {addResult.Code}): {detail}";
136+
137+
_logger.LogError(addFailureMessage);
138+
139+
complete = new JobResult
140+
{
141+
Result = OrchestratorJobStatusJobResult.Failure,
142+
JobHistoryId = _jobHistoryID,
143+
FailureMessage = addFailureMessage
144+
};
145+
break;
146+
}
147+
148+
string newThumbprint = addResult.Thumbprint;
128149
_logger.LogTrace($"New thumbprint: {newThumbprint}");
129150

130151
// Bind Certificate to IIS Site
@@ -201,8 +222,9 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
201222
{
202223
Result = OrchestratorJobStatusJobResult.Failure,
203224
JobHistoryId = _jobHistoryID,
204-
FailureMessage = $"No thumbprint was returned. Unable to bind certificate to site: {bindingInfo.SiteName}."
205-
}; }
225+
FailureMessage = $"Add-KeyfactorCertificate reported Success but did not return a thumbprint. Unable to bind certificate to site: {bindingInfo.SiteName}."
226+
};
227+
}
206228
}
207229
catch (Exception ex)
208230
{
@@ -277,13 +299,11 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
277299
}
278300
}
279301

280-
public string AddCertificate(string certificateContents, string privateKeyPassword, string cryptoProvider)
302+
public ResultObject AddCertificate(string certificateContents, string privateKeyPassword, string cryptoProvider)
281303
{
282304
try
283305
{
284-
string newThumbprint = string.Empty;
285-
286-
_logger.LogTrace("Attempting to execute PS function (Add-KFCertificateToStore)");
306+
_logger.LogTrace("Attempting to execute PS function (Add-KeyfactorCertificate)");
287307

288308
// Mandatory parameters
289309
var parameters = new Dictionary<string, object>
@@ -297,20 +317,17 @@ public string AddCertificate(string certificateContents, string privateKeyPasswo
297317
if (!string.IsNullOrEmpty(cryptoProvider)) { parameters.Add("CryptoServiceProvider", cryptoProvider); }
298318

299319
_results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
300-
_logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");
320+
_logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");
301321

302-
// This should return the thumbprint of the certificate
303-
if (_results != null && _results.Count > 0)
304-
{
305-
newThumbprint = _results[0].ToString();
306-
_logger.LogTrace($"Added certificate to store {_storePath}, returned with the thumbprint {newThumbprint}");
307-
}
308-
else
322+
ResultObject result = ResultObject.FromPSResults(_results);
323+
_logger.LogTrace($"Add-KeyfactorCertificate returned Status={result.Status}, Code={result.Code}, Step={result.Step}, Thumbprint='{result.Thumbprint}'");
324+
325+
if (!result.IsSuccess && !string.IsNullOrEmpty(result.ErrorMessage))
309326
{
310-
_logger.LogTrace("No results were returned. There could have been an error while adding the certificate. Look in the trace logs for PowerShell information.");
327+
_logger.LogWarning($"Add-KeyfactorCertificate error: {result.ErrorMessage}");
311328
}
312329

313-
return newThumbprint;
330+
return result;
314331
}
315332
catch (Exception ex)
316333
{

0 commit comments

Comments
 (0)