Merge 3.0.3 to main#189
Merged
Merged
Conversation
3.0.0 * As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command, and will no longer use the SAN Entry Parameter. This version, we are removing the Entry Parameter "SAN" from the integration-manifest.json, but will still support previous versions of Command in the event the SAN Entry Parameter is passed. The next major version (4.0) will remove all support for the SAN Entry Parameter. * Added WinADFS Store Type for rotating certificates in ADFS environments. Please note, only the service-communications certificate is rotated throughout your farm. * Internal only: Added Integration Tests to aid in future development and testing. * Improved messaging in the event an Entry Parameter is missing (or does not meet the casing requirements) * Fixed the SNI/SSL flag being returned during inventory, now returns extended SSL flags * Fixed the SNI/SSL flag when binding the certificate to allow for extended SSL flags * Added SSL Flag validation to make sure the bit flag is correct. These are the valid bit flags for the version of Windows: ### Windows Server 2012 R2 / Windows 8.1 and earlier (IIS 8.5): * 0 No SNI * 1 Use SNI * 2 Use Centralized SSL certificate store. ### Windows Server 2016 (IIS 10.0): * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. ### Windows Server 2019 (IIS 10.0.17763) * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. * 8 Disable OCSP Stapling. ### Windows Server 2022+ (IIS 10.0.20348+) * 0 No SNI * 1 Use SNI * 4 Disable HTTP/2. * 8 Disable OCSP Stapling. * 16 Disable QUIC. * 32 Disable TLS 1.3 over TCP. * 64 Disable Legacy TLS. --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Fixed an issues when renewing ECC Certificates * Update generated docs * validating documentation for IIS/SSL Flags. * Update generated docs --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io>
* Fix problem only SQL Service was getting restarted while the other SQL Services would not restart. * Update generated docs * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update generated docs * Delete local.runsettings --------- Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com> Co-authored-by: Keyfactor <keyfactor@keyfactor.github.io> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…e System.Security.Cryptography.XML package (#188) Co-authored-by: Bob Pokorny <bpokorny@keyfactor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Automated merge of the 3.0.3 release branch into main, updating dependency versions, documentation, and release notes for the IISU orchestrator.
Changes:
- Updated
Microsoft.PowerShell.SDKdependency version for thenet8.0build. - Simplified SQL Server service restart logic in the PowerShell scripts.
- Expanded IISU documentation and added 3.0.3/3.0.2 entries to the changelog.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| README.md | Updates IISU documentation with additional feature/limitation notes. |
| IISU/WindowsCertStore.csproj | Bumps Microsoft.PowerShell.SDK package version for net8.0. |
| IISU/PowerShellScripts/WinCertScripts.ps1 | Reworks SQL service restart logic during certificate binding. |
| CHANGELOG.md | Adds 3.0.3 (SDK update) and 3.0.2 (service restart behavior) notes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1403
to
1407
| Restart-Service -Name $serviceName -Force -ErrorAction Stop | ||
|
|
||
| $finalStatus = (Get-Service -Name $serviceName).Status | ||
|
|
||
| if ($finalStatus -eq 'Running') { |
Comment on lines
+469
to
+471
| - **Caveats:** It's important to ensure that the Windows Remote Management (WinRM) is properly configured on the target server. The orchestrator relies on WinRM to perform its tasks, such as manipulating the Windows Certificate Stores. Misconfiguration of WinRM may lead to connection and permission issues. | ||
| <br><br>When performing <b>Inventory</b>, all bound certificates <i>regardless</i> to their store location will be returned. | ||
| <br><br>When executing an Add or Renew Management job, the Store Location will be considered and place the certificate in that location. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge release-3.0 to main - Automated PR