IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:41

• $currentThumbprint is logged before it’s assigned, and the renewal check uses -contains against a string. This makes the renewal path always evaluate false and can incorrectly mark binding as failed when RenewalThumbprint is provided.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:8
• [parameter(ParameterSetName = $false)] is not a valid attribute value (ParameterSetName must be a string). This will cause a parse error when importing the module.
  WindowsCertStore.IntegrationTests/servers.json:7
• servers.json now contains a hard-coded private IP (192.168.230.139). This is environment-specific and can leak internal network details; it also makes the sample file less reusable for other environments. Prefer placeholders or documentation-reserved example IPs.
  scripts/store_types/bash/kfutil_create_store_types.sh:17
• The script no longer checks whether kfutil is installed or whether the user is logged in; it will now fail with a less actionable error when prerequisites aren’t met. Also, #!/bin/bash is less portable than #!/usr/bin/env bash.
  scripts/store_types/powershell/kfutil_create_store_types.ps1:14
• The script no longer checks whether kfutil is installed or whether the user is logged in. Without these guards, failures are harder to diagnose in automation.

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:32

• $currentThumbprint is logged before it is assigned, and the renewal-thumbprint comparison uses -contains against a string (which won’t behave as intended). Also, when a renewal thumbprint is provided but doesn’t match, $result is never set, causing the bind to be treated as a failure.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1:34
• Import-Certificate requires a -CertStoreLocation (and changing location via Set-Location is a side effect that can leak outside the function). This currently risks importing to the wrong store or failing outright.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:7
• [Parameter(ParameterSetName = $false)] is not a valid use of ParameterSetName and can cause confusing parameter binding behavior. This switch should just be a normal optional parameter.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:22
• $store.Remove($cert) expects a single X509Certificate2, but $cert here is the result of a pipeline filter and can be a collection. That will either throw or remove unpredictably when multiple matches exist (e.g., alias collisions).
  IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1:24
• The log message still references the old function name New-KFIISSiteBinding, which makes troubleshooting harder now that the function is New-KeyfactorIISSiteBinding.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1:116
• The thrown/captured error message still references New-KFIISSiteBinding, which no longer matches the function name and will mislead operators when diagnosing failures.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1:16
• For Windows Server 2022+ this returns flag bits marked as "Include unknowns for testing" (16/32/64). That causes Test-ValidSslFlags to accept unsupported flags in production. The valid-bit list should only include IIS-documented sslFlags bits for the target OS/IIS version (or be discovered dynamically).
  WindowsCertStore.IntegrationTests/servers.json:6
• This integration-test config currently hardcodes a specific private IP (192.168.230.139). That makes the repo environment-specific and risks accidentally leaking internal infrastructure details. Prefer placeholders/example values only.
  scripts/store_types/bash/kfutil_create_store_types.sh:5
• The script now assumes kfutil is installed and available, so failures will be a generic "command not found". Adding an explicit availability check improves usability and makes CI failures clearer. Also, using /usr/bin/env bash is more portable than hardcoding /bin/bash.
  scripts/store_types/powershell/kfutil_create_store_types.ps1:5
• The script assumes kfutil is installed/available; when it isn’t, users get a less actionable error. Add an explicit Get-Command check to fail fast with guidance.
  WindowsCertStore.UnitTests/SANsUnitTests.cs:86
• This test can be simplified: both null and "" are expected to yield an empty result, and the commented-out assert should be removed to avoid confusion.

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:35

• $currentThumbprint is logged before it’s assigned, and the renewal check uses -contains (collection membership) which won’t work for comparing thumbprint strings. When $RenewalThumbprint is provided but doesn’t match, $result is never set, so the function will report failure even though it should simply skip binding for that instance.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:8
• [parameter(ParameterSetName = $false)] is not a valid use of ParameterSetName and can create an unintended parameter set named False. If there’s only one parameter set here, the attribute line should be removed (or replaced with a normal [Parameter()]).
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:29
• $store.Remove($cert) will fail when $cert is a collection (e.g., multiple matches from Where-Object). Iterate and remove each certificate explicitly (and keep behavior consistent for single/multiple matches).
  IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1:16
• The Server 2022+ branch advertises unsupported/unknown flag bits (16, 32, 64) as valid (per the comment), while the validator also treats bit 0x2 (CentralCertStore) as a known flag (see Test-ValidSslFlags), but 0x2 is not included in the 2022+ valid list. This makes validation inconsistent and can allow invalid flags through (or incorrectly reject CentralCertStore).
  WindowsCertStore.UnitTests/SANsUnitTests.cs:96
• This theory contains a commented-out assert and redundant branching (legacySan == null and legacySan == string.Empty both expect the same result). This makes the test harder to read and maintain without changing behavior.

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:33

• $currentThumbprint is logged before it is assigned, so the verbose output will always be empty/incorrect. Assign the value first, then log it.
  IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:41
• Renewal thumbprint matching uses -contains against a string and has no branch when a non-matching renewal thumbprint is provided. This can cause bindings to be skipped silently and $result to be uninitialized (treated as failure). Split the renewal thumbprint list and explicitly handle the non-match case.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1:16
• This function claims to return valid SslFlags bits, but the WS2022+ branch explicitly includes "unknowns for testing" and also omits bit 0x2 (CentralCertStore) even though Test-ValidSslFlags checks for it. This will incorrectly reject legitimate flag combinations and/or accept unsupported bits.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1:24
• The informational log line still references the old function name New-KFIISSiteBinding, which makes troubleshooting confusing.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1:117
• The catch block error message still references the old function name New-KFIISSiteBinding, which can mislead during incident triage.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:8
• [Parameter(ParameterSetName = $false)] is not a meaningful parameter set name and will be coerced to the literal string "False". If you don't intend to use parameter sets here, remove this attribute to avoid confusing parameter metadata.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:35
• $cert can be an array (multiple matches), but X509Store.Remove() expects a single X509Certificate2. Also, throwing when the certificate isn't found forces the caller into exception handling for a common "not found" outcome. Iterate over matches and return $false when nothing is found.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:42
• The catch block rethrows (throw $_), which will fail the remote PowerShell invocation with an exception rather than returning a simple success/failure signal. Since this function already tracks $isSuccessful, prefer returning $false from the catch block.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1:33
• Set-Location changes the caller's current location and isn't restored, which can have surprising side effects in long-lived runspaces. Import-Certificate supports importing directly to a certificate store location, so you can avoid changing location entirely.

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:35

• $currentThumbprint is logged before it’s assigned, and the renewal-thumbprint check uses -contains on a string (which will never match). This can cause renewal matching to fail even when the thumbprints are identical.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:7
• ParameterSetName = $false is not a valid value for the [Parameter()] attribute and can cause parameter binding/parse errors. If this switch isn’t part of a parameter set, omit ParameterSetName entirely.
  IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1:16
• This returns flag values explicitly marked as “unknowns for testing”. That makes Test-ValidSslFlags accept unsupported SslFlags bits in production, defeating the validation.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1:33
• Using Set-Location to change the session’s current provider path is a side effect that can break subsequent operations in the same runspace. Import-Certificate supports importing directly to a target store via -CertStoreLocation.
  IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Get-KeyfactorSQLInventory.ps1:51
• $cert.PrivateKey.CspKeyContainerInfo.ProviderName can throw or be $null for CNG/ECC keys. The Common module already has Get-CertificateCSP to safely resolve provider/KSP names; using it here avoids inventory failures on non-CSP certificates.
  WindowsCertStore.IntegrationTests/servers.json:3
• This integration-test config file now contains a concrete private IP address (192.168.230.139). Committing environment-specific addresses makes the tests/docs harder to reuse and can leak internal network details; prefer placeholders like the existing {SQL-...} entries.
  integration-manifest.json:352
• This PR is titled as adding JEA support, but this change flips WinSql SupportedOperations.Enrollment from false to true, which is a functional capability change for the store type. Please confirm this is intentional and update the PR description/release notes accordingly (or revert if accidental).
  scripts/store_types/bash/kfutil_create_store_types.sh:1
• Using a hardcoded #!/bin/bash shebang reduces portability (e.g., systems where bash is not at /bin/bash). #!/usr/bin/env bash is more robust and matches the previous version.

IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1:41

• $currentThumbprint is logged before it’s assigned, and -contains is the wrong operator for checking whether a (comma-separated) renewal thumbprint string matches the currently bound thumbprint. This can cause false mismatches (or always-fail) renewals and also makes $result potentially uninitialized when a renewal thumbprint is provided but doesn’t match.
  IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Get-KeyfactorSQLInventory.ps1:51
• Provider name extraction uses $cert.PrivateKey.CspKeyContainerInfo.ProviderName, which breaks for CNG-backed keys (e.g., RSACng/ECDsa) because CspKeyContainerInfo isn’t available. The Common module already provides Get-CertificateCSP which handles both legacy CSP and CNG keys.
  IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1:6
• [parameter(ParameterSetName = $false)] is invalid/misleading here (ParameterSetName expects a string). As written it coerces to the literal set name "False", which can cause confusing parameter binding behavior.
  WindowsCertStore.IntegrationTests/servers.json:7
• This committed servers.json includes a specific private IP (192.168.230.139). This makes the repo’s default integration-test config non-portable and risks leaking internal environment details. Prefer placeholders only (or document that users should copy to a local, untracked file).
  IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs:559
• The catch (Exception) { throw; } block is redundant and adds noise without changing behavior. Removing it keeps the control flow clearer.

            catch (Exception)
            {
                throw;
            }