From 6f5450d8c5e2ff9f549b9a3364abedab90c1ca5f Mon Sep 17 00:00:00 2001 From: leefine02 Date: Mon, 13 Jul 2026 19:28:07 +0000 Subject: [PATCH 01/16] ab90509 --- .../PKCS12CertificateStoreSerializer.cs | 4 ++-- RemoteFile/RemoteFile.csproj | 2 +- RemoteFile/RemoteHandlers/SSHHandler.cs | 21 +++++++++++-------- 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs index a66e9e6d..27822587 100644 --- a/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs @@ -56,7 +56,7 @@ public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContents, strin public List SerializeRemoteCertificateStore(Pkcs12Store certificateStore, string storePath, string storeFileName, string storePassword, IRemoteHandler remoteHandler) { Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder(); - storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc); + //storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc); storeBuilder.SetKeyAlgorithm(NistObjectIdentifiers.IdAes256Cbc, PkcsObjectIdentifiers.IdHmacWithSha256); storeBuilder.SetUseDerEncoding(true); @@ -95,7 +95,7 @@ public string GetPrivateKeyPath() private Pkcs12Store ConvertAliases(Pkcs12Store workingStore, bool useThumbprintAsAlias) { Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder(); - storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc); + //storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc); storeBuilder.SetKeyAlgorithm(NistObjectIdentifiers.IdAes256Cbc, PkcsObjectIdentifiers.IdHmacWithSha256); storeBuilder.SetUseDerEncoding(true); diff --git a/RemoteFile/RemoteFile.csproj b/RemoteFile/RemoteFile.csproj index 19ce51c3..85b6cf74 100644 --- a/RemoteFile/RemoteFile.csproj +++ b/RemoteFile/RemoteFile.csproj @@ -13,7 +13,7 @@ - + Always diff --git a/RemoteFile/RemoteHandlers/SSHHandler.cs b/RemoteFile/RemoteHandlers/SSHHandler.cs index 1921b2c3..05fdc878 100644 --- a/RemoteFile/RemoteHandlers/SSHHandler.cs +++ b/RemoteFile/RemoteHandlers/SSHHandler.cs @@ -6,7 +6,6 @@ // and limitations under the License. using System; -using System.Collections.Generic; using System.IO; using System.Linq; using System.Security.Cryptography; @@ -19,9 +18,7 @@ using Keyfactor.Logging; using Keyfactor.PKI.PrivateKeys; using Keyfactor.PKI.PEM; -using static Microsoft.ApplicationInsights.MetricDimensionNames.TelemetryContext; using Renci.SshNet.Common; -using Org.BouncyCastle.Bcpg; namespace Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers { @@ -57,19 +54,25 @@ internal SSHHandler(string server, string serverLogin, string serverPassword, bo { PrivateKeyFile privateKeyFile; + string privateKey = string.Empty; + + string[] sshSecret = serverPassword.Split(new[] { "|||" }, 2, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries); try { - using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(FormatPrivateKey(serverPassword)))) - { - privateKeyFile = new PrivateKeyFile(ms); - } + privateKey = FormatPrivateKey(sshSecret[0]); } catch (Exception) { - using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(ConvertToPKCS1(serverPassword)))) + privateKey = ConvertToPKCS1(sshSecret[0]); + } + + using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(privateKey))) + { + using (MemoryStream ms2 = new MemoryStream(Encoding.ASCII.GetBytes(sshSecret.Length == 1 ? string.Empty : sshSecret[1]))) { - privateKeyFile = new PrivateKeyFile(ms); + privateKeyFile = new PrivateKeyFile(ms, null, ms2.Length == 0 ? null : ms2); } + privateKeyFile = new PrivateKeyFile(ms); } Connection = new ConnectionInfo(server, sshPort, serverLogin, new PrivateKeyAuthenticationMethod(serverLogin, privateKeyFile)); From 53ee4cfb747e090f7c8837792f7e9c4ae5f3c6cc Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Mon, 13 Jul 2026 19:28:46 +0000 Subject: [PATCH 02/16] docs: auto-generate README and documentation [skip ci] --- README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 225b9e04..70c38193 100644 --- a/README.md +++ b/README.md @@ -1375,11 +1375,12 @@ the Keyfactor Command Portal | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `remote-file-orchestrator` .NET version to download | | --------- | ----------- | ----------- | ----------- | | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | - | `11.6` _and_ newer | `net8.0` | | `net8.0` | + | Between `11.6.0` and `24.x` | `net8.0` | | `net8.0` | + | `25.0` _and_ newer | `net10.0` | | `net10.0` | Unzip the archive containing extension assemblies to a known location. - > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net8.0`. + > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net10.0`. 2. **Locate the Universal Orchestrator extensions directory.** From 7ef73c4c25f3a0425ee83d88ee9c7eb9a008e41b Mon Sep 17 00:00:00 2001 From: leefine02 Date: Wed, 15 Jul 2026 18:59:03 +0000 Subject: [PATCH 03/16] ab90509 --- RemoteFile/ManagementBase.cs | 4 +- RemoteFile/ReenrollmentBase.cs | 2 +- RemoteFile/RemoteCertificateStore.cs | 29 +------------ RemoteFile/RemoteFileJobTypeBase.cs | 5 --- RemoteFile/RemoteHandlers/SSHHandler.cs | 1 - integration-manifest.json | 54 ------------------------- 6 files changed, 4 insertions(+), 91 deletions(-) diff --git a/RemoteFile/ManagementBase.cs b/RemoteFile/ManagementBase.cs index f9c2f7b4..b527c183 100644 --- a/RemoteFile/ManagementBase.cs +++ b/RemoteFile/ManagementBase.cs @@ -54,7 +54,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config) } certificateStore.LoadCertificateStore(certificateStoreSerializer, false); certificateStore.AddCertificate(config.JobCertificate.Alias ?? GetThumbprint(config.JobCertificate, logger), config.JobCertificate.Contents, config.Overwrite, config.JobCertificate.PrivateKeyPassword, RemoveRootCertificate); - certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); + certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); try { @@ -83,7 +83,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config) { certificateStore.LoadCertificateStore(certificateStoreSerializer, false); certificateStore.DeleteCertificateByAlias(config.JobCertificate.Alias); - certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); + certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); } logger.LogDebug($"END Delete Operation for {config.CertificateStoreDetails.StorePath} on {config.CertificateStoreDetails.ClientMachine}."); break; diff --git a/RemoteFile/ReenrollmentBase.cs b/RemoteFile/ReenrollmentBase.cs index f9c744f5..78b7134f 100644 --- a/RemoteFile/ReenrollmentBase.cs +++ b/RemoteFile/ReenrollmentBase.cs @@ -102,7 +102,7 @@ public JobResult ProcessJob(ReenrollmentJobConfiguration config, SubmitReenrollm // save certificate certificateStore.AddCertificate(config.Alias ?? cert.Thumbprint, Convert.ToBase64String(cert.Export(X509ContentType.Pfx, "password")), config.Overwrite, "password", RemoveRootCertificate); - certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); + certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler)); try { diff --git a/RemoteFile/RemoteCertificateStore.cs b/RemoteFile/RemoteCertificateStore.cs index 79e445d7..e89b3939 100644 --- a/RemoteFile/RemoteCertificateStore.cs +++ b/RemoteFile/RemoteCertificateStore.cs @@ -125,38 +125,11 @@ internal void LoadCertificateStore(ICertificateStoreSerializer certificateStoreS logger.MethodExit(LogLevel.Debug); } - internal Pkcs12Store GetCertificateStore(bool requiresLegacyEncryption) + internal Pkcs12Store GetCertificateStore() { logger.MethodEntry(LogLevel.Debug); logger.MethodExit(LogLevel.Debug); - if (requiresLegacyEncryption) - { - Pkcs12StoreBuilder builder = new Pkcs12StoreBuilder(); - builder.SetKeyAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc); - builder.SetCertAlgorithm(PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc); - - Pkcs12Store tempStore = builder.Build(); - - foreach (string alias in CertificateStore.Aliases) - { - if (CertificateStore.IsKeyEntry(alias)) - { - var keyEntry = CertificateStore.GetKey(alias); - var certChain = CertificateStore.GetCertificateChain(alias); - - tempStore.SetKeyEntry(alias, keyEntry, certChain); - } - else if (CertificateStore.IsCertificateEntry(alias)) - { - var certEntry = CertificateStore.GetCertificate(alias); - tempStore.SetCertificateEntry(alias, certEntry); - } - } - - CertificateStore = tempStore; - } - return CertificateStore; } diff --git a/RemoteFile/RemoteFileJobTypeBase.cs b/RemoteFile/RemoteFileJobTypeBase.cs index 771e2155..9b96bf98 100644 --- a/RemoteFile/RemoteFileJobTypeBase.cs +++ b/RemoteFile/RemoteFileJobTypeBase.cs @@ -32,7 +32,6 @@ public abstract class RemoteFileJobTypeBase internal bool CreateCSROnDevice { get; set; } internal bool UseShellCommands { get; set; } internal string PostJobApplicationRestart { get; set; } - internal bool RequiresLegacyEncryption { get; set; } internal string KeyType { get; set; } internal int KeySize { get; set; } internal string SubjectText { get; set; } @@ -81,10 +80,6 @@ internal void SetJobProperties(JobConfiguration config, CertificateStore certifi null : properties.PostJobApplicationRestart; - RequiresLegacyEncryption = properties.RequiresLegacyEncryption == null || string.IsNullOrEmpty(properties.RequiresLegacyEncryption.Value) ? - false : - properties.RequiresLegacyEncryption; - if (config.JobProperties != null) { KeyType = !config.JobProperties.ContainsKey("keyType") || config.JobProperties["keyType"] == null || string.IsNullOrEmpty(config.JobProperties["keyType"].ToString()) ? string.Empty : config.JobProperties["keyType"].ToString(); diff --git a/RemoteFile/RemoteHandlers/SSHHandler.cs b/RemoteFile/RemoteHandlers/SSHHandler.cs index 05fdc878..aaeaf659 100644 --- a/RemoteFile/RemoteHandlers/SSHHandler.cs +++ b/RemoteFile/RemoteHandlers/SSHHandler.cs @@ -72,7 +72,6 @@ internal SSHHandler(string server, string serverLogin, string serverPassword, bo { privateKeyFile = new PrivateKeyFile(ms, null, ms2.Length == 0 ? null : ms2); } - privateKeyFile = new PrivateKeyFile(ms); } Connection = new ConnectionInfo(server, sshPort, serverLogin, new PrivateKeyAuthenticationMethod(serverLogin, privateKeyFile)); diff --git a/integration-manifest.json b/integration-manifest.json index 5633c6c2..99f4bfb8 100644 --- a/integration-manifest.json +++ b/integration-manifest.json @@ -132,15 +132,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache Tomcat Restart,Jetty Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -300,15 +291,6 @@ "Type": "MultipleChoice", "DefaultValue": "Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -432,15 +414,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -573,15 +546,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -705,15 +669,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], @@ -837,15 +792,6 @@ "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [], From ae21576adaf1892260995b4824ef5c91e2149ef4 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 15 Jul 2026 18:59:55 +0000 Subject: [PATCH 04/16] docs: auto-generate README and documentation [skip ci] --- README.md | 64 +------------------ .../RFDER-custom-fields-store-type-dialog.svg | 17 ++--- .../RFJKS-custom-fields-store-type-dialog.svg | 17 ++--- .../RFKDB-custom-fields-store-type-dialog.svg | 17 ++--- .../RFORA-custom-fields-store-type-dialog.svg | 17 ++--- .../RFPEM-custom-fields-store-type-dialog.svg | 17 ++--- ...Pkcs12-custom-fields-store-type-dialog.svg | 17 ++--- .../bash/curl_create_store_types.sh | 54 ---------------- .../restmethod_create_store_types.ps1 | 54 ---------------- 9 files changed, 26 insertions(+), 248 deletions(-) diff --git a/README.md b/README.md index 70c38193..9672f6f1 100644 --- a/README.md +++ b/README.md @@ -274,7 +274,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | MultipleChoice | Apache Tomcat Restart,Jetty Restart | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -352,13 +351,6 @@ the Keyfactor Command Portal ![RFJKS Custom Field - PostJobApplicationRestart](docsource/images/RFJKS-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFJKS Custom Field - RequiresLegacyEncryption](docsource/images/RFJKS-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFJKS Custom Field - RequiresLegacyEncryption](docsource/images/RFJKS-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -475,7 +467,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | MultipleChoice | Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -581,13 +572,6 @@ the Keyfactor Command Portal ![RFPEM Custom Field - PostJobApplicationRestart](docsource/images/RFPEM-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFPEM Custom Field - RequiresLegacyEncryption](docsource/images/RFPEM-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFPEM Custom Field - RequiresLegacyEncryption](docsource/images/RFPEM-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -698,7 +682,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. | MultipleChoice | None | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -776,13 +759,6 @@ the Keyfactor Command Portal ![RFPkcs12 Custom Field - PostJobApplicationRestart](docsource/images/RFPkcs12-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFPkcs12 Custom Field - RequiresLegacyEncryption](docsource/images/RFPkcs12-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFPkcs12 Custom Field - RequiresLegacyEncryption](docsource/images/RFPkcs12-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -888,7 +864,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. | MultipleChoice | None | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -973,13 +948,6 @@ the Keyfactor Command Portal ![RFDER Custom Field - PostJobApplicationRestart](docsource/images/RFDER-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFDER Custom Field - RequiresLegacyEncryption](docsource/images/RFDER-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFDER Custom Field - RequiresLegacyEncryption](docsource/images/RFDER-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -1087,7 +1055,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. | MultipleChoice | None | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -1165,13 +1132,6 @@ the Keyfactor Command Portal ![RFKDB Custom Field - PostJobApplicationRestart](docsource/images/RFKDB-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFKDB Custom Field - RequiresLegacyEncryption](docsource/images/RFKDB-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFKDB Custom Field - RequiresLegacyEncryption](docsource/images/RFKDB-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -1277,7 +1237,6 @@ the Keyfactor Command Portal | SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked | | UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked | | PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. | MultipleChoice | None | 🔲 Unchecked | - | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked | The Custom Fields tab should look like this: @@ -1355,13 +1314,6 @@ the Keyfactor Command Portal ![RFORA Custom Field - PostJobApplicationRestart](docsource/images/RFORA-custom-field-PostJobApplicationRestart-validation-options-dialog.svg) - ###### Requires Legacy Encryption - Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. - - ![RFORA Custom Field - RequiresLegacyEncryption](docsource/images/RFORA-custom-field-RequiresLegacyEncryption-dialog.svg) - ![RFORA Custom Field - RequiresLegacyEncryption](docsource/images/RFORA-custom-field-RequiresLegacyEncryption-validation-options-dialog.svg) - - @@ -1375,8 +1327,8 @@ the Keyfactor Command Portal | Universal Orchestrator Version | Latest .NET version installed on the Universal Orchestrator server | `rollForward` condition in `Orchestrator.runtimeconfig.json` | `remote-file-orchestrator` .NET version to download | | --------- | ----------- | ----------- | ----------- | | Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` | - | Between `11.6.0` and `24.x` | `net8.0` | | `net8.0` | - | `25.0` _and_ newer | `net10.0` | | `net10.0` | + | `11.6` _and_ newer | `net8.0` | | `net8.0` | + | `25.5` _and_ newer | `net10.0` | | `net10.0` | Unzip the archive containing extension assemblies to a known location. @@ -1507,7 +1459,6 @@ The Remote File Universal Orchestrator extension implements 6 Certificate Store | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -1542,7 +1493,6 @@ The Remote File Universal Orchestrator extension implements 6 Certificate Store | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** @@ -1610,7 +1560,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -1649,7 +1598,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** @@ -1713,7 +1661,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -1748,7 +1695,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** @@ -1813,7 +1759,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -1849,7 +1794,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** @@ -1913,7 +1857,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -1948,7 +1891,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** @@ -2012,7 +1954,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. | - | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | @@ -2047,7 +1988,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov | Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | | Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | | Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. | - | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | 3. **Import the CSV file to create the certificate stores** diff --git a/docsource/images/RFDER-custom-fields-store-type-dialog.svg b/docsource/images/RFDER-custom-fields-store-type-dialog.svg index 53acb957..f50692cf 100644 --- a/docsource/images/RFDER-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFDER-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 12 + Total: 11 Display Name @@ -135,13 +135,4 @@ Post Job Application Restart MultipleChoice None - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/docsource/images/RFJKS-custom-fields-store-type-dialog.svg b/docsource/images/RFJKS-custom-fields-store-type-dialog.svg index 92b717c2..f363c78e 100644 --- a/docsource/images/RFJKS-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFJKS-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 11 + Total: 10 Display Name @@ -127,13 +127,4 @@ Post Job Application Restart MultipleChoice Apache Tomcat Restart,Jetty Restart - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/docsource/images/RFKDB-custom-fields-store-type-dialog.svg b/docsource/images/RFKDB-custom-fields-store-type-dialog.svg index a0a79366..03f009cf 100644 --- a/docsource/images/RFKDB-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFKDB-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 11 + Total: 10 Display Name @@ -127,13 +127,4 @@ Post Job Application Restart MultipleChoice None - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/docsource/images/RFORA-custom-fields-store-type-dialog.svg b/docsource/images/RFORA-custom-fields-store-type-dialog.svg index a0a79366..03f009cf 100644 --- a/docsource/images/RFORA-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFORA-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 11 + Total: 10 Display Name @@ -127,13 +127,4 @@ Post Job Application Restart MultipleChoice None - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/docsource/images/RFPEM-custom-fields-store-type-dialog.svg b/docsource/images/RFPEM-custom-fields-store-type-dialog.svg index 52279299..d6d83261 100644 --- a/docsource/images/RFPEM-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFPEM-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 15 + Total: 14 Display Name @@ -162,13 +162,4 @@ Post Job Application Restart MultipleChoice Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/docsource/images/RFPkcs12-custom-fields-store-type-dialog.svg b/docsource/images/RFPkcs12-custom-fields-store-type-dialog.svg index a0a79366..03f009cf 100644 --- a/docsource/images/RFPkcs12-custom-fields-store-type-dialog.svg +++ b/docsource/images/RFPkcs12-custom-fields-store-type-dialog.svg @@ -1,5 +1,5 @@  - + - + Edit Certificate Store Type @@ -24,7 +24,7 @@ Entry Parameters - + @@ -33,7 +33,7 @@ EDIT DELETE - Total: 11 + Total: 10 Display Name @@ -127,13 +127,4 @@ Post Job Application Restart MultipleChoice None - - - - - - - Requires Legacy Encryption - Bool - False \ No newline at end of file diff --git a/scripts/store_types/bash/curl_create_store_types.sh b/scripts/store_types/bash/curl_create_store_types.sh index 6662fada..28f9bb7a 100755 --- a/scripts/store_types/bash/curl_create_store_types.sh +++ b/scripts/store_types/bash/curl_create_store_types.sh @@ -131,15 +131,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "Apache Tomcat Restart,Jetty Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -303,15 +294,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -439,15 +421,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -584,15 +557,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -720,15 +684,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -856,15 +811,6 @@ curl -s -X POST "https://${KEYFACTOR_HOSTNAME}/${KEYFACTOR_API_PATH}/Certificate "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] diff --git a/scripts/store_types/powershell/restmethod_create_store_types.ps1 b/scripts/store_types/powershell/restmethod_create_store_types.ps1 index bf6c13e9..688a596e 100644 --- a/scripts/store_types/powershell/restmethod_create_store_types.ps1 +++ b/scripts/store_types/powershell/restmethod_create_store_types.ps1 @@ -131,15 +131,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "Apache Tomcat Restart,Jetty Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -303,15 +294,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -439,15 +421,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -584,15 +557,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -720,15 +684,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] @@ -856,15 +811,6 @@ $Body = @' "Type": "MultipleChoice", "DefaultValue": "None", "Description": "Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA." - }, - { - "Name": "RequiresLegacyEncryption", - "DisplayName": "Requires Legacy Encryption", - "Required": false, - "DependsOn": "", - "Type": "Bool", - "DefaultValue": "False", - "Description": "Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances." } ], "EntryParameters": [] From 2d88c755295afe20d404f11b708dad51a3f30f72 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Thu, 16 Jul 2026 15:21:33 +0000 Subject: [PATCH 05/16] ab90509 --- CHANGELOG.md | 5 ++++ docsource/content.md | 66 ++++++++++++++++++++++++++++++++++++-------- 2 files changed, 59 insertions(+), 12 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a3d89ae0..6ff143f6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,8 @@ +v4.2.0 +- Deprecate legacy encryption. From this release forward, RequiresLegacyEncryption will be ignored. +- Modification to suppor SSH certificate authentication for Linux managed servers. If a certificate is used, the private key must be in OpenSSH format and the public key must be in OpenSSH format or PEM format. +- Add new custom field to RFKDB to support management of IBM MQ key database files. + v4.1.0 - Add custom field to select legacy encryption for certificate stores - Improve error message when attempting a management or ODKG job and Ignore Private Key on Inventory is selected. diff --git a/docsource/content.md b/docsource/content.md index 67549cfb..789c2825 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -78,18 +78,8 @@ certificates and certificate store files. access to read/write to the certificate store location, OR the `config.json` file must be set up to use the alternative upload/download file. -3. `SSH` Authentication: When creating a Keyfactor certificate store for the `RemoteFile` orchestrator extension, you may - supply either a user id and password for the certificate store credentials (directly or through one of Keyfactor - Command's PAM integrations), or supply a user id and `SSH` private key. When using a password, the connection is - attempted using `SSH` password authentication. If that fails, Keyboard Interactive Authentication is automatically - attempted. One or both of these must be enabled on the Linux box being managed. If private key authentication is - desired, copy and paste the full SSH private key into the Password textbox (or pointer to the private key if using a - PAM provider). Please note that SSH Private Key Authentication is not available when running locally as an agent. The - following private key formats are supported: - -- PKCS#1 (`BEGIN RSA PRIVATE KEY`) -- PKCS#8 (`BEGIN PRIVATE KEY`) -- ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`) +3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed + Linux servers using SSH. Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file and [Defining Certificate Stores](#defining-certificate-stores) @@ -223,6 +213,58 @@ For agent mode (accessing stores on the same server where Universal Orchestrator - `Store Type` + `Client Machine` + `Store Path` must be unique in Keyfactor Command - Best practice: Use the full DNS or IP Address to the left of the `|` character +## SSH Authentication Options + When managing certificate stores on remote Linux servers, SSH is used to communicate between the Keyfactor Universal + Orchestrator server and the orchestrated server hosting the certificate store. There are three options for SSH authentication: + * `SSH` user id and password authentication + * `SSH` private key authentication, or + * `SSH` certificate authentication + + **User ID and Password Authentication:** + This is the simplest method and requires you to enter a valid Linux user id and password into the server username and + server password fields when creating the Keyfactor Command certificate store or discovery job. If the user id and/or + password is stored in a Keyfactor Command PAM integration, you would enter the PAM provider key for each respective value. + If the user id and password are valid, the orchestrator will connect to the orchestrated server and manage the certificate + store as needed. If this method is used, please ensure that either SSH Password Authentication or Keyboard Interactive + Authentication is enabled on the Linux server. + + **SSH Private Key Authentication:** + This method requires you to enter a valid Linux user id and the full SSH private key (non-encrypted) into the server username and + server password fields when creating the Keyfactor Command certificate store or discovery job. A PAM provider may + be alternatively utilized for either or both the user id and private key similar to **User ID/Password Authentication**. + Valid SSH Private key formats are: + + - PKCS#1 (`BEGIN RSA PRIVATE KEY`) + - PKCS#8 (`BEGIN PRIVATE KEY`) + - ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`) + + If using this method, make sure that: + + - The accompanying SSH public key is correctly installed into the Linux server's `~/.ssh/authorized_keys` file for the user id + being used. + - If creating the key pair on a Linux server and transferring it to the server password field in a browser on a Windows server, + make sure that extra white space characters or line breaks are not added to the private key when copying and pasting. The private + key must be in the same format as it was generated. Your best bet is to SFTP or SCP the contents of the private key to a Windows + server rather than making use of copy and paste. If making use of a PAM Provider, ensure that the private key is stored in the + same format as it was generated. + - Private key authentication is enabled on the Linux server. If not, the orchestrator will attempt to connect using password + authentication and fail. + + **SSH Certificate Authentication:** + This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key + concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating + the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters + ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5L...". + A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password + Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format. + + If using this method, make sure that: + + - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points + to the public key of the CA that signed the SSH certificate. If this is not done, the orchestrator will attempt to connect using password authentication + and fail. + - No matching certificate needs to exist in the `~/.ssh/authorized_keys` file for the user id being used. The SSH certificate is validated against the + CA public key specified in the `TrustedUserCAKeys` option in the `/etc/ssh/sshd_config` file. ## Use Shell Commands Setting From 201dc33267f46a838f5e016343e33254dace2506 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 16 Jul 2026 15:22:38 +0000 Subject: [PATCH 06/16] docs: auto-generate README and documentation [skip ci] --- README.md | 67 +++++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 55 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index 9672f6f1..b069186d 100644 --- a/README.md +++ b/README.md @@ -129,18 +129,8 @@ Before installing the Remote File Universal Orchestrator extension, we recommend access to read/write to the certificate store location, OR the `config.json` file must be set up to use the alternative upload/download file. -3. `SSH` Authentication: When creating a Keyfactor certificate store for the `RemoteFile` orchestrator extension, you may - supply either a user id and password for the certificate store credentials (directly or through one of Keyfactor - Command's PAM integrations), or supply a user id and `SSH` private key. When using a password, the connection is - attempted using `SSH` password authentication. If that fails, Keyboard Interactive Authentication is automatically - attempted. One or both of these must be enabled on the Linux box being managed. If private key authentication is - desired, copy and paste the full SSH private key into the Password textbox (or pointer to the private key if using a - PAM provider). Please note that SSH Private Key Authentication is not available when running locally as an agent. The - following private key formats are supported: - -- PKCS#1 (`BEGIN RSA PRIVATE KEY`) -- PKCS#8 (`BEGIN PRIVATE KEY`) -- ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`) +3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed + Linux servers using SSH. Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file and [Defining Certificate Stores](#defining-certificate-stores) @@ -2065,6 +2055,59 @@ For agent mode (accessing stores on the same server where Universal Orchestrator - `Store Type` + `Client Machine` + `Store Path` must be unique in Keyfactor Command - Best practice: Use the full DNS or IP Address to the left of the `|` character +## SSH Authentication Options + When managing certificate stores on remote Linux servers, SSH is used to communicate between the Keyfactor Universal + Orchestrator server and the orchestrated server hosting the certificate store. There are three options for SSH authentication: + * `SSH` user id and password authentication + * `SSH` private key authentication, or + * `SSH` certificate authentication + + **User ID and Password Authentication:** + This is the simplest method and requires you to enter a valid Linux user id and password into the server username and + server password fields when creating the Keyfactor Command certificate store or discovery job. If the user id and/or + password is stored in a Keyfactor Command PAM integration, you would enter the PAM provider key for each respective value. + If the user id and password are valid, the orchestrator will connect to the orchestrated server and manage the certificate + store as needed. If this method is used, please ensure that either SSH Password Authentication or Keyboard Interactive + Authentication is enabled on the Linux server. + + **SSH Private Key Authentication:** + This method requires you to enter a valid Linux user id and the full SSH private key (non-encrypted) into the server username and + server password fields when creating the Keyfactor Command certificate store or discovery job. A PAM provider may + be alternatively utilized for either or both the user id and private key similar to **User ID/Password Authentication**. + Valid SSH Private key formats are: + + - PKCS#1 (`BEGIN RSA PRIVATE KEY`) + - PKCS#8 (`BEGIN PRIVATE KEY`) + - ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`) + + If using this method, make sure that: + + - The accompanying SSH public key is correctly installed into the Linux server's `~/.ssh/authorized_keys` file for the user id + being used. + - If creating the key pair on a Linux server and transferring it to the server password field in a browser on a Windows server, + make sure that extra white space characters or line breaks are not added to the private key when copying and pasting. The private + key must be in the same format as it was generated. Your best bet is to SFTP or SCP the contents of the private key to a Windows + server rather than making use of copy and paste. If making use of a PAM Provider, ensure that the private key is stored in the + same format as it was generated. + - Private key authentication is enabled on the Linux server. If not, the orchestrator will attempt to connect using password + authentication and fail. + + **SSH Certificate Authentication:** + This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key + concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating + the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters + ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5L...". + A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password + Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format. + + If using this method, make sure that: + + - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points + to the public key of the CA that signed the SSH certificate. If this is not done, the orchestrator will attempt to connect using password authentication + and fail. + - No matching certificate needs to exist in the `~/.ssh/authorized_keys` file for the user id being used. The SSH certificate is validated against the + CA public key specified in the `TrustedUserCAKeys` option in the `/etc/ssh/sshd_config` file. + ## Use Shell Commands Setting The Use Shell Commands Setting (orchestrator level in config.json and per store override of this value as a custom field value) From d02cc2d494bfdcf7375ffa7653e699c694219f35 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Thu, 16 Jul 2026 16:27:35 +0000 Subject: [PATCH 07/16] ab90509 --- docsource/content.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docsource/content.md b/docsource/content.md index 789c2825..3472cd31 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -80,11 +80,6 @@ certificates and certificate store files. 3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed Linux servers using SSH. - -Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file -and [Defining Certificate Stores](#defining-certificate-stores) -and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for -more information on defining and configuring certificate stores.
@@ -100,9 +95,15 @@ Please reference [Certificate Stores and Discovery Jobs](#certificate-stores-and creating certificate stores for the `RemoteFile` Orchestrator Extension.
-C + Please consult with your system administrator for more information on configuring `SSH/SCP/SFTP` or `WinRM` in your environment. +Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file +and [Defining Certificate Stores](#defining-certificate-stores) +and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for +more information on defining and configuring certificate stores. + + ## Post Installation The Remote File Orchestrator Extension uses a JSON configuration file. It is located at `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile\config.json`. None of the values are required, and a description of each follows below: From 1d373707ac184d60a0ca03599765b58cba557eed Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 16 Jul 2026 16:36:37 +0000 Subject: [PATCH 08/16] docs: auto-generate README and documentation [skip ci] --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index b069186d..9df04310 100644 --- a/README.md +++ b/README.md @@ -131,11 +131,6 @@ Before installing the Remote File Universal Orchestrator extension, we recommend 3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed Linux servers using SSH. - -Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file -and [Defining Certificate Stores](#defining-certificate-stores) -and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for -more information on defining and configuring certificate stores.
@@ -151,9 +146,14 @@ Please reference [Certificate Stores and Discovery Jobs](#certificate-stores-and creating certificate stores for the `RemoteFile` Orchestrator Extension.
-C + Please consult with your system administrator for more information on configuring `SSH/SCP/SFTP` or `WinRM` in your environment. +Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file +and [Defining Certificate Stores](#defining-certificate-stores) +and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for +more information on defining and configuring certificate stores. + ## Certificate Store Types To use the Remote File Universal Orchestrator extension, you **must** create the Certificate Store Types required for your use-case. This only needs to happen _once_ per Keyfactor Command instance. From 2a0675b4c10d716e76e1d69aad4f71956dcda652 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Thu, 16 Jul 2026 17:36:37 +0000 Subject: [PATCH 09/16] ab90509 --- docsource/content.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docsource/content.md b/docsource/content.md index 3472cd31..ab29351f 100644 --- a/docsource/content.md +++ b/docsource/content.md @@ -255,7 +255,7 @@ For agent mode (accessing stores on the same server where Universal Orchestrator This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters - ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5L...". + ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...". A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format. From 390093cfd613a8938f4fd6fe2238ae61b3a22541 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Thu, 16 Jul 2026 17:37:28 +0000 Subject: [PATCH 10/16] docs: auto-generate README and documentation [skip ci] --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9df04310..499118e6 100644 --- a/README.md +++ b/README.md @@ -2096,7 +2096,7 @@ For agent mode (accessing stores on the same server where Universal Orchestrator This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters - ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01@openssh.com AAAAIHNzaC1lZDI1NTE5L...". + ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...". A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format. From 6f8bc776877923bc6cf0096a5140d9a00a0d1c83 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Mon, 20 Jul 2026 17:16:45 +0000 Subject: [PATCH 11/16] ab90509 --- RemoteFile/ICustomFileCreator.cs | 19 ++++++ .../KDB/KDBCertificateStoreSerializer.cs | 68 +++++++++++++++---- RemoteFile/RemoteCertificateStore.cs | 24 +++---- 3 files changed, 86 insertions(+), 25 deletions(-) create mode 100644 RemoteFile/ICustomFileCreator.cs diff --git a/RemoteFile/ICustomFileCreator.cs b/RemoteFile/ICustomFileCreator.cs new file mode 100644 index 00000000..62c16c1f --- /dev/null +++ b/RemoteFile/ICustomFileCreator.cs @@ -0,0 +1,19 @@ +// Copyright 2021 Keyfactor +// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. +// You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 +// Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions +// and limitations under the License. + +using Org.BouncyCastle.Pkcs; +using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers; +using Keyfactor.Extensions.Orchestrator.RemoteFile.Models; +using System.Collections.Generic; + +namespace Keyfactor.Extensions.Orchestrator.RemoteFile +{ + interface ICustomFileCreator + { + void CreateEmptyStoreFile(string storePath, string storePassword, string linuxFilePermissions, string linuxFileOwner, IRemoteHandler remoteHandler); + } +} diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs index d378a21f..daec3a37 100644 --- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs @@ -5,25 +5,24 @@ // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions // and limitations under the License. -using System; -using System.Collections.Generic; -using System.IO; - -using Keyfactor.Logging; -using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers; using Keyfactor.Extensions.Orchestrator.RemoteFile.Models; - +using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers; +using Keyfactor.Logging; using Microsoft.Extensions.Logging; - +using Newtonsoft.Json; using Org.BouncyCastle.Pkcs; +using Renci.SshNet; +using System; +using System.Collections.Generic; +using System.IO; namespace Keyfactor.Extensions.Orchestrator.RemoteFile.KDB { - class KDBCertificateStoreSerializer : ICertificateStoreSerializer + class KDBCertificateStoreSerializer : ICertificateStoreSerializer, ICustomFileCreator { private ILogger logger; - public KDBCertificateStoreSerializer(string storeProperties) + public KDBCertificateStoreSerializer(string storeProperties) { logger = LogHandler.GetClassLogger(this.GetType()); } @@ -44,7 +43,7 @@ public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContentBytes, s remoteHandler.UploadCertificateFile(storePath, tempStoreFile, storeContentBytes); - string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -type kdb -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12"; + string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12"; try { @@ -86,7 +85,7 @@ public List SerializeRemoteCertificateStore(Pkcs12Store cer string tempStoreFile = Guid.NewGuid().ToString().Replace("-", string.Empty) + ".kdb"; string tempCertFile = Guid.NewGuid().ToString().Replace("-", string.Empty) + ".p12"; - string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempCertFile}\" -pw \"{storePassword}\" -type p12 -new_db \"{storePath}{tempStoreFile}\" -new_pw \"{storePassword}\" -new_format kdb"; + string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempCertFile}\" -pw \"{storePassword}\" -type p12 -new_db \"{storePath}{tempStoreFile}\" -new_pw \"{storePassword}\" -new_format cms"; try { @@ -123,5 +122,50 @@ public string GetPrivateKeyPath() { return null; } + + public void CreateEmptyStoreFile(string storePath, string storePassword, string linuxFilePermissions, string linuxFileOwner, IRemoteHandler remoteHandler) + { + logger.MethodEntry(LogLevel.Debug); + + int extIdx = storePath.LastIndexOf('.'); + if (extIdx == -1) + throw new Exception("Store path must include a file name with an extension."); + + string pathDelim = storePath.Substring(0, 1) == "/" ? "/" : "\\"; + int fileNameIdx = storePath.LastIndexOf(pathDelim) + 1; + if (fileNameIdx == -1) + throw new Exception("Invalid format for store path."); + + string path = storePath.Substring(0, fileNameIdx); + string fileName = storePath.Substring(fileNameIdx, extIdx - fileNameIdx); + + string tempStoreFile = Guid.NewGuid().ToString().Replace("-", string.Empty); + string bashCommand = storePath.Substring(0, 1) == "/" ? "bash " : string.Empty; + + string command = $"{bashCommand}gskcapicmd -keydb -create -db \"{path}{tempStoreFile + ".kdb"}\" -pw \"{storePassword}\" -type cms -stash"; + + try + { + remoteHandler.CreateEmptyStoreFile(path + fileName + ".kdb", linuxFilePermissions, linuxFileOwner); + remoteHandler.CreateEmptyStoreFile(path + fileName + ".rdb", linuxFilePermissions, linuxFileOwner); + remoteHandler.CreateEmptyStoreFile(path + fileName + ".crl", linuxFilePermissions, linuxFileOwner); + remoteHandler.CreateEmptyStoreFile(path + fileName + ".sth", linuxFilePermissions, linuxFileOwner); + + remoteHandler.RunCommand("cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand("cp {path}{tempStoreFile}.kdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand("cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand("cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); + } + finally + { + try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".kdb"); } catch (Exception) { }; + try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".sth"); } catch (Exception) { }; + try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".rdb"); } catch (Exception) { }; + try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".crl"); } catch (Exception) { }; + } + + + logger.MethodExit(LogLevel.Debug); + } } } diff --git a/RemoteFile/RemoteCertificateStore.cs b/RemoteFile/RemoteCertificateStore.cs index e89b3939..77f1706f 100644 --- a/RemoteFile/RemoteCertificateStore.cs +++ b/RemoteFile/RemoteCertificateStore.cs @@ -237,19 +237,17 @@ internal void CreateCertificateStore(ICertificateStoreSerializer certificateStor ApplicationSettings.DefaultOwnerOnStoreCreation : propertiesCollection.LinuxFileOwnerOnStoreCreation.Value; - RemoteHandler.CreateEmptyStoreFile(storePath, linuxFilePermissions, linuxFileOwner); - string privateKeyPath = certificateStoreSerializer.GetPrivateKeyPath(); - if (!string.IsNullOrEmpty(privateKeyPath)) - RemoteHandler.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions, linuxFileOwner); - - logger.MethodExit(LogLevel.Debug); - } - - internal void CreateCertificateStore(ICertificateStoreSerializer certificateStoreSerializer, string storePath, string linuxFilePermissions, string linuxFileOwner) - { - logger.MethodEntry(LogLevel.Debug); - - + if (certificateStoreSerializer is ICustomFileCreator) + { + ((ICustomFileCreator)certificateStoreSerializer).CreateEmptyStoreFile(storePath, StorePassword, linuxFilePermissions, linuxFileOwner, RemoteHandler); + } + else + { + RemoteHandler.CreateEmptyStoreFile(storePath, linuxFilePermissions, linuxFileOwner); + string privateKeyPath = certificateStoreSerializer.GetPrivateKeyPath(); + if (!string.IsNullOrEmpty(privateKeyPath)) + RemoteHandler.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions, linuxFileOwner); + } logger.MethodExit(LogLevel.Debug); } From bc180784ea997b4b96ba99a4fcb6921c1a3552bc Mon Sep 17 00:00:00 2001 From: leefine02 Date: Mon, 20 Jul 2026 17:19:11 +0000 Subject: [PATCH 12/16] ab90509 --- CHANGELOG.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ff143f6..8b358230 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,7 +1,8 @@ v4.2.0 - Deprecate legacy encryption. From this release forward, RequiresLegacyEncryption will be ignored. - Modification to suppor SSH certificate authentication for Linux managed servers. If a certificate is used, the private key must be in OpenSSH format and the public key must be in OpenSSH format or PEM format. -- Add new custom field to RFKDB to support management of IBM MQ key database files. +- Modify Management-Create job for RFKDB to create all 4 IBM key dabase files - kdb, rdb, sth, and crl. Actual certificate management, however, remains centered on the kdb file. The other 3 files are +created to ensure that the kdb file can be used by IBM applications that require all 4 files to be present, such as IBM MQ. v4.1.0 - Add custom field to select legacy encryption for certificate stores From 3aee8b3beecdad492ac884db6ef9686d8f6ae86c Mon Sep 17 00:00:00 2001 From: leefine02 Date: Mon, 20 Jul 2026 18:58:41 +0000 Subject: [PATCH 13/16] ab90509 --- .../ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs index daec3a37..ecd3ebb4 100644 --- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs @@ -146,6 +146,8 @@ public void CreateEmptyStoreFile(string storePath, string storePassword, string try { + remoteHandler.RunCommand(command, null, ApplicationSettings.UseSudo, new string[] { storePassword }); + remoteHandler.CreateEmptyStoreFile(path + fileName + ".kdb", linuxFilePermissions, linuxFileOwner); remoteHandler.CreateEmptyStoreFile(path + fileName + ".rdb", linuxFilePermissions, linuxFileOwner); remoteHandler.CreateEmptyStoreFile(path + fileName + ".crl", linuxFilePermissions, linuxFileOwner); From 4eabc59933c1c1a1ffac7c5eeb6918dead63420d Mon Sep 17 00:00:00 2001 From: leefine02 Date: Tue, 21 Jul 2026 15:18:15 +0000 Subject: [PATCH 14/16] ab90509 --- .../KDB/KDBCertificateStoreSerializer.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs index ecd3ebb4..cf04e1e9 100644 --- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs @@ -153,10 +153,10 @@ public void CreateEmptyStoreFile(string storePath, string storePassword, string remoteHandler.CreateEmptyStoreFile(path + fileName + ".crl", linuxFilePermissions, linuxFileOwner); remoteHandler.CreateEmptyStoreFile(path + fileName + ".sth", linuxFilePermissions, linuxFileOwner); - remoteHandler.RunCommand("cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null); - remoteHandler.RunCommand("cp {path}{tempStoreFile}.kdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); - remoteHandler.RunCommand("cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); - remoteHandler.RunCommand("cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand($"cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand($"cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); } finally { From 27f3eee771217865ec622a441c88518bf3d6f695 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Wed, 22 Jul 2026 12:20:10 +0000 Subject: [PATCH 15/16] ab90509 --- .../ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs index cf04e1e9..4d53c60a 100644 --- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs @@ -154,7 +154,7 @@ public void CreateEmptyStoreFile(string storePath, string storePassword, string remoteHandler.CreateEmptyStoreFile(path + fileName + ".sth", linuxFilePermissions, linuxFileOwner); remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null); - remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); + remoteHandler.RunCommand($"cp {path}{tempStoreFile}.rdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null); remoteHandler.RunCommand($"cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); remoteHandler.RunCommand($"cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); } From b656d8155deb766bbad026470ef34e0c42b3f571 Mon Sep 17 00:00:00 2001 From: leefine02 Date: Fri, 24 Jul 2026 12:24:15 +0000 Subject: [PATCH 16/16] ab90509 --- .../KDB/KDBCertificateStoreSerializer.cs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs index 4d53c60a..0baf5c04 100644 --- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs +++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs @@ -136,11 +136,14 @@ public void CreateEmptyStoreFile(string storePath, string storePassword, string if (fileNameIdx == -1) throw new Exception("Invalid format for store path."); + string bashCommand = storePath.Substring(0, 1) == "/" ? "bash " : string.Empty; + if (storePath.Substring(0, 1) == "|") + storePath = "/" + storePath.Substring(1); + string path = storePath.Substring(0, fileNameIdx); string fileName = storePath.Substring(fileNameIdx, extIdx - fileNameIdx); string tempStoreFile = Guid.NewGuid().ToString().Replace("-", string.Empty); - string bashCommand = storePath.Substring(0, 1) == "/" ? "bash " : string.Empty; string command = $"{bashCommand}gskcapicmd -keydb -create -db \"{path}{tempStoreFile + ".kdb"}\" -pw \"{storePassword}\" -type cms -stash"; @@ -158,6 +161,16 @@ public void CreateEmptyStoreFile(string storePath, string storePassword, string remoteHandler.RunCommand($"cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null); remoteHandler.RunCommand($"cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null); } + catch (Exception ex) + { + if (ex.Message.Contains("cannot execute binary file", StringComparison.InvariantCultureIgnoreCase) && storePath.Substring(0, 1) == "/") + { + storePath = "|" + storePath.Substring(1); + CreateEmptyStoreFile(storePath, storePassword, linuxFilePermissions, linuxFileOwner, remoteHandler); + } + else + throw; + } finally { try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".kdb"); } catch (Exception) { };