81018 adding jea support by rcpokorny · Pull Request #185 · Keyfactor/iis-orchestrator

rcpokorny · 2026-05-11T22:15:35Z

No description provided.

…or/iis-orchestrator into 81018-Adding_JEA_Support

…from PW

Copilot

Pull request overview

This PR introduces JEA (Just Enough Administration) support for WinRM-based remote execution by refactoring the extension’s PowerShell surface into installable modules/role capabilities, wiring a new JEAEndpointName job property through the orchestrator, and updating tests/docs to cover the new behavior.

Changes:

Add JEAEndpointName support end-to-end (job properties → PSHelper session creation → integration/unit tests).
Replace monolithic WinCertScripts.ps1 script injection with modular PowerShell (Keyfactor.WinCert.Common/IIS/SQL) plus JEA .psrc role capability files and a .pssc session configuration template.
Update documentation (README + docsource) and integration tests to reflect JEA setup and connection selection.

Reviewed changes

Copilot reviewed 67 out of 68 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
WindowsCertStore.UnitTests/WindowsCertStore.UnitTests.csproj	Adds Moq/Newtonsoft.Json; sets xUnit VS runner PrivateAssets metadata.
WindowsCertStore.UnitTests/PSHelperUnitTests.cs	Updates script folder name lookup from `PowerShellScripts` to `PowerShell`.
WindowsCertStore.UnitTests/PSHelperConfigTests.cs	Adds unit tests for PSHelper constructors, script directory discovery, and LocalMachine+JEA guard behavior.
WindowsCertStore.UnitTests/JobPropertiesTests.cs	Adds unit tests validating `JobProperties` defaulting + legacy field tolerance.
WindowsCertStore.IntegrationTests/WinSQLIntegrationTests.cs	Adds Integration trait; passes `JEAEndpointName`; uses SQL-only connection data source.
WindowsCertStore.IntegrationTests/WinIISIntegrationTests.cs	Adds Integration trait; passes `JEAEndpointName`; uses IIS-only connection data source.
WindowsCertStore.IntegrationTests/WinCertIntegrationTests.cs	New WinCert E2E integration tests (Add/Inventory/Remove and renewal flow) with JEA support.
WindowsCertStore.IntegrationTests/servers.json	Expands server definitions with StoreType + JEA endpoint name.
WindowsCertStore.IntegrationTests/Factories/ConnectionFactory.cs	Refactors connection loading, adds store-type filtering and env/appsettings credential sourcing.
WindowsCertStore.IntegrationTests/ClientConnection.cs	Adds `StoreType` and `JEAEndpointName` to connection model.
README.md	Adds detailed JEA documentation and updates WinRM port references (5985/5986).
docsource/content.md	Adds detailed JEA documentation for generated docs; notes module install requirements for JEA.
IISU/WindowsCertStore.csproj	Updates packaging to include new `PowerShell\` module tree + `.pssc` and legacy scripts.
IISU/RemoteSettings.cs	Adds `JEAEndpointName` to remote settings model.
IISU/PSHelper.cs	Adds JEA endpoint support (WinRM ConfigurationName), blocks LocalMachine+JEA, changes script loading strategy, improves Information stream handling.
IISU/Properties/AssemblyInfo.cs	Exposes internals to unit/integration test assemblies.
IISU/PowerShellScripts/WinCertScripts.ps1	Removes legacy monolithic script.
IISU/PowerShell/WinADFSScripts.ps1	Adjusts logging to use Information stream “[VERBOSE] …” convention.
IISU/PowerShell/Keyfactor.WinCert.SQL/RoleCapabilities/Keyfactor.WinCert.SQL.psrc	New SQL JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Remove-KeyfactorSQLCertificate.ps1	New SQL unbind function.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/New-KeyfactorSQLBinding.ps1	New SQL bind function wrapper.
IISU/PowerShell/Keyfactor.WinCert.SQL/Public/Get-KeyfactorSQLInventory.ps1	New SQL inventory function.
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Set-KeyfactorSQLCertificateBinding.ps1	New SQL bind implementation (registry + ACL + optional restart).
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceUser.ps1	New helper to read SQL service user.
IISU/PowerShell/Keyfactor.WinCert.SQL/Private/Get-KeyfactorSQLServiceName.ps1	New helper to compute SQL service name.
IISU/PowerShell/Keyfactor.WinCert.SQL/Keyfactor.WinCert.SQL.psm1	New SQL module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Keyfactor.WinCert.IIS/RoleCapabilities/Keyfactor.WinCert.IIS.psrc	New IIS JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISSiteBinding.ps1	New IIS binding removal function with IIS drive autodetect.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Remove-KeyfactorIISCertificateIfUnused.ps1	New IIS certificate cleanup helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/New-KeyfactorIISSiteBinding.ps1	New IIS binding creation with SSL flags handling and appcmd fallback.
IISU/PowerShell/Keyfactor.WinCert.IIS/Public/Get-KeyfactorIISBoundCertificates.ps1	New IIS inventory function.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-ValidSslFlags.ps1	New SSL flag validation helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Test-IISDrive.ps1	New IIS:\ drive availability helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-ValidSslFlagsForSystem.ps1	New OS-build-based SSL flag support helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Get-IISManagementInfo.ps1	New IIS management mode detection helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Private/Add-IISBindingWithSSL.ps1	New IIS binding add + SSL attach helper.
IISU/PowerShell/Keyfactor.WinCert.IIS/Keyfactor.WinCert.IIS.psm1	New IIS module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Keyfactor.WinCert.Common/RoleCapabilities/Keyfactor.WinCert.Common.psrc	New common JEA role capability definition.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Remove-KeyfactorCertificate.ps1	New common remove-from-store implementation.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorResult.ps1	New common structured result helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/New-KeyfactorODKGEnrollment.ps1	New ODKG CSR generation function.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Import-KeyfactorSignedCertificate.ps1	New signed cert import helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Get-KeyfactorCertificates.ps1	New common inventory function.
IISU/PowerShell/Keyfactor.WinCert.Common/Public/Add-KeyfactorCertificate.ps1	New common add-to-store implementation.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Validate-CryptoProvider.ps1	New provider validation helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Test-CryptoServiceProvider.ps1	New provider existence helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CryptoProviders.ps1	New CSP discovery helper using certutil.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CertificateSAN.ps1	New SAN extraction helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Get-CertificateCSP.ps1	New CSP/KSP detection helper (CAPI + CNG).
IISU/PowerShell/Keyfactor.WinCert.Common/Private/Convert-DNSSubject.ps1	New DN subject parsing helper.
IISU/PowerShell/Keyfactor.WinCert.Common/Keyfactor.WinCert.Common.psm1	New Common module entry point with explicit dot-sourcing + exports.
IISU/PowerShell/Build/KeyfactorWinCert.pssc	New JEA session configuration template (`RestrictedRemoteServer` + transcripts + role mapping).
IISU/Models/JobProperties.cs	Adds `JEAEndpointName` job property.
IISU/ImplementedStoreTypes/WinSQL/WinSqlBinding.cs	Switches to new SQL module function names.
IISU/ImplementedStoreTypes/WinSQL/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/WinSQL/Inventory.cs	Wires `JEAEndpointName`; switches to new inventory function name and signature.
IISU/ImplementedStoreTypes/WinIIS/WinIISBinding.cs	Switches to new IIS module function names; updates unbind parameter shape and result parsing.
IISU/ImplementedStoreTypes/WinIIS/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/WinIIS/Inventory.cs	Wires `JEAEndpointName`; switches to new IIS inventory function name.
IISU/ImplementedStoreTypes/WinADFS/Inventory.cs	Removes SAN field propagation for ADFS inventory parameters.
IISU/ImplementedStoreTypes/Win/WinInventory.cs	Marks unused class obsolete.
IISU/ImplementedStoreTypes/Win/WinCertCertificateInfo.cs	Removes SAN field from WinCert cert info model.
IISU/ImplementedStoreTypes/Win/Management.cs	Wires `JEAEndpointName`; switches to new module function names.
IISU/ImplementedStoreTypes/Win/Inventory.cs	Wires `JEAEndpointName`; switches to new inventory function name; removes SAN parameter propagation.
IISU/ClientPSCertStoreReEnrollment.cs	Wires `JEAEndpointName`; switches to new ODKG/import function names; updates log strings.
CHANGELOG.md	Adds 4.0.0 entry documenting SAN removal and JEA support.
.vscode/launch.json	Adds VS Code launch configuration for PowerShell.
.gitignore	Ignores `local.runsettings` to avoid committing local credentials.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                var config = new ConfigurationBuilder()
+                    .SetBasePath(Directory.GetCurrentDirectory())
+                    .AddJsonFile("appsettings.json", optional: true)
+                    .Build();

-            // 3. Retrieve connection details from configuration
+                var vault = new VaultHelper(config);
+                return (vault.GetSecret("Username"), vault.GetSecret("Password"));
+            }


+                    // Pre-flight: verify Keyfactor modules are installed on the JEA endpoint.
+                    PS.AddCommand("Invoke-Command")
+                        .AddParameter("Session", _PSSession)
+                        .AddParameter("ScriptBlock", ScriptBlock.Create("[bool](Get-Command 'New-KeyfactorResult' -ErrorAction SilentlyContinue)"));
+                    var preFlightResults = PS.Invoke();
+                    PS.Commands.Clear();
+
+                    bool modulesInstalled = preFlightResults != null &&
+                        preFlightResults.Count > 0 &&
+                        preFlightResults[0]?.BaseObject is bool preFlightBool &&
+                        preFlightBool;
+
+                    if (!modulesInstalled)
+                    {
+                        throw new Exception(
+                            $"JEA endpoint '{jeaEndpoint}' is reachable but Keyfactor modules are not installed. " +
+                            "Install Keyfactor.WinCert.Common (and any required store-type modules) under " +
+                            "'C:\\Program Files\\WindowsPowerShell\\Modules\\' on the target machine, " +
+                            "re-register the JEA session configuration, and restart WinRM.");
+                    }


+
+    try {
+        Write-Information "Entering PowerShell Script Add-KeyfactorCertificateToStore"
+        Write-Information "[VERBOSE] Add-KeyfactorCertificateToStore - Received: StoreName: '$StoreName', CryptoServiceProvider: '$CryptoServiceProvider', Base64Cert: '$Base64Cert'"


+                Write-Information "[VERBOSE] Running certutil with arguments: $argLine"
+


+    if ($serviceUser) {
+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null
+    }


@@ -1,3 +1,7 @@
+4.0.0
+* As of this version of the extension, SANs will be handled through the ODKG Enrollment page in Command and will no longer use the SAN Entry Parameter. This version, we are removing all support for the SAN Entry Parameter. If you are still using the SAN Entry Parameter, you will need to remove it from your store types and re-run inventory to remove it from your database.
+* Adding JEA Support for local PowerShell execution.  This will allow for more secure execution of the extension when running in a local PowerShell Runspace.  To utilize this feature, you will need to create a JEA endpoint on the target server and specify the endpoint name as a new parameter in the specific Cert Store definition.  Refer to the README for more details.


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+


-                _results = _psHelper.ExecutePowerShell("Add-KFCertificateToStore", parameters);
+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");



-                _results = _psHelper.ExecutePowerShell("Add-KFCertificateToStore", parameters);
-                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");
+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
+                _logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");


-                    _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");
+                    _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
+                    _logger.LogTrace("Returned from executing PS function (Add-KeyfactorCertificate)");



Copilot

Pull request overview

Copilot reviewed 72 out of 145 changed files in this pull request and generated 11 comments.

+        [string]$StorePath,
+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"


+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null
+    }


+            var (username, password) = GetCredentials();
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
+                yield break;
+


+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");



                                                case "Skipped":
                                                    psResult = OrchestratorJobStatusJobResult.Failure;
-                                                    failureMessage = ($"PowerShell function New-KFIISSiteBinding failed on step: {step} - message:\n {errorMessage}");
+                                                    failureMessage = ($"PowerShell function New-KeyfactorIISSiteBinding failed on step: {step} - message:\n {errorMessage}");
                                                    _logger.LogDebug(failureMessage);
                                                    break;


+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert



+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


Copilot

Pull request overview

Copilot reviewed 72 out of 145 changed files in this pull request and generated 12 comments.

+    $serviceUser = (Get-CimInstance -ClassName Win32_Service -Filter "Name='$SQLServiceName'").StartName
+
+    if ($serviceUser) {
+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."
+        return $null


+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {


+    Write-Information "Entering PowerShell Script: New-KFIISSiteBinding" -InformationAction SilentlyContinue
+    Write-Information "[VERBOSE] Parameters: $(($PSBoundParameters.GetEnumerator() | ForEach-Object { "$($_.Key): '$($_.Value)'" }) -join ', ')"
+


+    catch {
+        $errorMessage = "Unexpected error in New-KFIISSiteBinding: $($_.Exception.Message)"
+        Write-Error $errorMessage
+        return New-KeyfactorResult -Status Error -Code 999 -Step UnexpectedError -ErrorMessage $errorMessage
+    }


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing
+    }


+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert

-if ($null -eq (Get-Command "kfutil" -ErrorAction SilentlyContinue)) {
-    Write-Host "kfutil could not be found. Please install kfutil"
-    Write-Host "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-}
+Write-Host "Creating store type: IISU"
+kfutil store-types create IISU


Copilot

Pull request overview

Copilot reviewed 77 out of 157 changed files in this pull request and generated 13 comments.

+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue



-                _results = _psHelper.ExecutePowerShell("Add-KFCertificateToStore", parameters);
+                _results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
                _logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");


+    # Generate INF file content for the CSR
+    $infContent = @"
+[Version]
+Signature=`"$`Windows NT$`"


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+    if ($serviceUser) {
+        return $serviceUser
+    } else {
+        Write-Error "SQL Server instance '$SQLInstanceName' not found or no service user associated."


+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias


+        # Close the store
+        $store.Close()
+    } catch {
+        # Log and rethrow the exception
+        Write-Error "An error occurred: $_"
+        throw $_
+    } finally {
+        # Ensure the store is closed
+        if ($store) {
+            $store.Close()
+        }
+    }


                _logger.LogTrace(LogHandler.FlattenException(ex));

-                var failureMessage = $"Management job {config.OperationType} failed for Site '{config.CertificateStoreDetails.StorePath}' on server '{config.CertificateStoreDetails.ClientMachine}' with error: '{LogHandler.FlattenException(ex)}'";
+                var failureMessage = $"Management job {config.OperationType} failed for Site '{config.CertificateStoreDetails.StorePath}' on server '{config.CertificateStoreDetails.ClientMachine}' with error: '{ex.Message}'";


Fixed SQL Restart issue

Copilot

Pull request overview

Copilot reviewed 77 out of 157 changed files in this pull request and generated 12 comments.

+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias


+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue


+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing


+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


+                var failureMessage = $"Management job {config.OperationType} failed for Site '{config.CertificateStoreDetails.StorePath}' on server '{config.CertificateStoreDetails.ClientMachine}' with error: '{ex.Message}'";
                _logger.LogWarning(failureMessage);


…let for troubleshooting.

…rchestrator into 81018-Adding_JEA_Support

Copilot

Pull request overview

Copilot reviewed 78 out of 158 changed files in this pull request and generated 8 comments.

+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+        [string]$Thumbprint,
+        [string]$StorePath,
+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        # Step 4: Import the certificate into the specified store
+        Write-Verbose "Importing the certificate to the store: Cert:\LocalMachine\$StoreName"
+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename
+        if ($importResult) {


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 78 out of 158 changed files in this pull request and generated 8 comments.

+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue


+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing


+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias


+        # Step 4: Import the certificate into the specified store
+        Write-Verbose "Importing the certificate to the store: Cert:\LocalMachine\$StoreName"
+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename


+    )
+
+    try {
+        Validate-CryptoProvider -ProviderName $CSPName -Verbose:$false


+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


+            var (username, password) = GetCredentials();
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
+                yield break;


Copilot

Pull request overview

Copilot reviewed 81 out of 161 changed files in this pull request and generated 13 comments.

+using Keyfactor.Extensions.Orchestrator.WindowsCertStore;
+
+namespace WindowsCertStore.UnitTests


+using Keyfactor.Extensions.Orchestrator.WindowsCertStore;
+using Newtonsoft.Json;
+using Newtonsoft.Json.Serialization;
+
+namespace WindowsCertStore.UnitTests


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert


+
+        [parameter(ParameterSetName = $false)]
+        [switch]$IsAlias
+    )


+        if ($cert) {
+            # Remove the certificate from the store
+            Write-Information "Attempting to remove certificate from store '$StorePath' with the thumbprint: $Thumbprint"
+            $store.Remove($cert)
+            Write-Information "Certificate removed successfully from store '$StorePath'"
+
+            # Mark success
+            $isSuccessful = $true
+        } else {


+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e



+# Store Type creation script using kfutil
+# Generated by Doctool



+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+        # Step 4: Import the certificate into the specified store
+        Write-Verbose "Importing the certificate to the store: Cert:\LocalMachine\$StoreName"
+        Set-Location -Path "Cert:\LocalMachine\$StoreName"
+
+        $importResult = Import-Certificate -FilePath $cerFilename
+        if ($importResult) {


+    # Path to temporary INF file
+    $infFile = [System.IO.Path]::GetTempFileName() + ".inf"
+    $csrOutputFile = [System.IO.Path]::GetTempFileName() + ".csr"
+
+    Set-Content -Path $infFile -Value $infContent
+    Write-Information "Generated INF file at: $infFile"


Copilot

Pull request overview

Copilot reviewed 81 out of 161 changed files in this pull request and generated 11 comments.

 using Microsoft.Extensions.Configuration;
 using Newtonsoft.Json;
 using System;
 using System.Collections.Generic;
+using System.IO;
 using System.Linq;
-using System.Text;
-using System.Threading.Tasks;



+            var (username, password) = GetCredentials();
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(password))
+                yield break;


+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinIIS", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "{SQL-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "" },
+  { "Machine": "{SQL-JEA-Server-IP-or-Hostname}", "StoreType": "WinSQL", "JEAEndpointName": "keyfactor.wincert" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
+  { "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }


+                Write-Information "[VERBOSE] Instance: $instance"
+                Write-Information "[VERBOSE] Full Instance: $fullInstance"
+                Write-Information "[VERBOSE] Registry Location: $regLocation"
+                Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"
+
+                $currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue
+
+                if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {
+                    Write-Information "Renewal thumbprint matches for instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                } elseif (-not $RenewalThumbprint) {
+                    Write-Information "No renewal thumbprint provided. Binding certificate to instance: $fullInstance"
+                    $result = Set-KeyfactorSQLCertificateBinding -InstanceName $instance -NewThumbprint $NewThumbprint -RestartService:$RestartService
+                }
+
+                if (-not $result) {
+                    Write-Error "Failed to bind certificate for instance: $instance"
+                    $bindingSuccess = $false
+                }


+            $sqlSettingsDict = @{
+                InstanceName = $instanceNames
+                ProviderName = $cert.PrivateKey.CspKeyContainerInfo.ProviderName
+            }


+    if ($build -ge 20348) {
+        # Windows Server 2022+ (IIS 10.0.20348+)
+        Write-Information "[VERBOSE] Detected Windows Server 2022 or later (Build: $build)"
+        return @(1, 4, 8, 16, 32, 64)  # Include unknowns for testing
+    }


+# Store Type creation script using kfutil
+# Generated by Doctool

-# Uncomment if kfutil is not in your PATH
-# Set-Alias -Name kfutil -Value 'C:\Program Files\Keyfactor\kfutil\kfutil.exe'
+Write-Host "Creating store type: WinCert"
+kfutil store-types create WinCert



+#!/bin/bash
+# Store Type creation script using kfutil
+# Generated by Doctool

-# Creates all 4 store types using kfutil.
-# kfutil reads definitions from the Keyfactor integration catalog.
-#
-# Auth environment variables (first matching method is used):
-#   OAuth access token:   KEYFACTOR_AUTH_ACCESS_TOKEN
-#   OAuth client creds:   KEYFACTOR_AUTH_CLIENT_ID + KEYFACTOR_AUTH_CLIENT_SECRET
-#                         + KEYFACTOR_AUTH_TOKEN_URL
-#   Basic auth (AD):      KEYFACTOR_HOSTNAME + KEYFACTOR_USERNAME + KEYFACTOR_PASSWORD
-#                         + KEYFACTOR_DOMAIN
-#
-# Auto-generated by doctool generate-store-type-scripts — do not edit by hand.
+set -e

-if ! command -v kfutil &> /dev/null; then
-    echo "kfutil could not be found. Please install kfutil"
-    echo "See https://github.com/Keyfactor/kfutil#quickstart"
-    exit 1
-fi
+echo "Creating store type: WinCert"
+kfutil store-types create WinCert



+        [InlineData("dns=legacy.example.com&dns=old.example.com")]
+        [InlineData("")]
+        [InlineData(null)]
+        public void ResolveSanString_UsesLegacySAN_WhenConfigSANsMissing(string legacySan)


            // Assert
-            Assert.Equal("dns=legacy.example.com&dns=old.example.com", result);
+            //Assert.Equal(legacySan, result);
+
+            // Assert
+            if (legacySan == null)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else if (legacySan == string.Empty)
+            {
+                Assert.Equal(string.Empty, result);
+            }
+            else
+            {
+                Assert.Equal(legacySan, result);
+            }


Bob Pokorny and others added 17 commits April 24, 2026 13:21

Initial JEA for WinCert

4c4f900

Update generated docs

c45ef24

Helper updates

585fd7f

Merge branch '81018-Adding_JEA_Support' of https://github.com/Keyfact…

aa2e660

…or/iis-orchestrator into 81018-Adding_JEA_Support

Updated spelling of PowerShell script and fixed Information Messages …

3d8180a

…from PW

Added JEA support for IIS

59d239f

Fixed and updated IIS Components

d3a92d4

Completed SQL Module and updated test projects

355c3ac

Testing

c38621d

Removed WinCertScripts from extension.

0643435

changed way LocalHost and JEA are configured.

a9cd833

Fixed ODKG missing file error

0c432a9

Updated KF Import of Signed Certificates PowerShell Script

eca4c19

Fixed missing PowerShell script not being found.

f9bd02b

Fix missing path

df9ddcf

Updated documentation to include JEA information.

8ad923c

Update generated docs

4094f15

Copilot AI review requested due to automatic review settings May 11, 2026 22:15

Copilot started reviewing on behalf of rcpokorny May 11, 2026 22:16 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

spbsoluble and others added 2 commits May 12, 2026 09:12

chore(ci): Update build workflow to v5

9e102ea

docs: auto-generate README and documentation [skip ci]

2158f3c

Copilot AI review requested due to automatic review settings May 12, 2026 16:12

Copilot started reviewing on behalf of indrora May 12, 2026 16:13 View session

Copilot AI reviewed May 12, 2026

View reviewed changes

spbsoluble and others added 2 commits May 12, 2026 09:33

Update generated docs

f85f910

docs: auto-generate README and documentation [skip ci]

fb4031a

Copilot AI review requested due to automatic review settings May 12, 2026 16:34

Copilot AI reviewed May 12, 2026

View reviewed changes

docs: auto-generate README and documentation [skip ci]

d9fbee8

Copilot AI review requested due to automatic review settings May 15, 2026 23:12

docs: auto-generate README and documentation [skip ci]

7f1cac9

Copilot started reviewing on behalf of rcpokorny May 15, 2026 23:13 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

Bob Pokorny and others added 2 commits June 18, 2026 08:24

Updated JEA Documentation

cd9a401

Fixed SQL Restart issue

docs: auto-generate README and documentation [skip ci]

8397532

Copilot AI review requested due to automatic review settings June 18, 2026 15:25

Copilot started reviewing on behalf of indrora June 18, 2026 15:25 View session

Copilot AI reviewed Jun 18, 2026

View reviewed changes

Bob Pokorny and others added 4 commits June 25, 2026 11:23

Added diagnostic cmdlet

8720d89

Updated the JEA documentation. Added the get-keyfactordiagnostics cmd…

970a9a8

…let for troubleshooting.

Merge branch '81018-Adding_JEA_Support' of github.com:Keyfactor/iis-o…

5479921

…rchestrator into 81018-Adding_JEA_Support

docs: auto-generate README and documentation [skip ci]

3fe25ef

Copilot AI review requested due to automatic review settings June 26, 2026 18:39

Copilot started reviewing on behalf of indrora June 26, 2026 18:39 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Potential fix for pull request finding

e0da7d4

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings June 26, 2026 18:53

Copilot started reviewing on behalf of rcpokorny June 26, 2026 18:54 View session

Copilot AI reviewed Jun 26, 2026

View reviewed changes

Updated error reporting when bad CSP

bc07ae8

Copilot Bot review requested due to automatic review settings July 6, 2026 20:40

Updated PS scripts to get CSPs from registry not certutil.

e38da14

Copilot started reviewing on behalf of rcpokorny July 6, 2026 20:41 View session

docs: auto-generate README and documentation [skip ci]

7250263

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Copilot Bot review requested due to automatic review settings July 6, 2026 20:46

Copilot started reviewing on behalf of rcpokorny July 6, 2026 20:46 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Fixed formatting issue in CHANGELOG

db4b068

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

81018 adding jea support#185

81018 adding jea support#185
rcpokorny wants to merge 48 commits into
release-4.0from
81018-Adding_JEA_Support

rcpokorny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		Write-Information "[VERBOSE] Running certutil with arguments: $argLine"

		Set-Location -Path "Cert:\LocalMachine\$StoreName"

		$importResult = Import-Certificate -FilePath $cerFilename

		_results = _psHelper.ExecutePowerShell("Add-KeyfactorCertificate", parameters);
		_logger.LogTrace("Returned from executing PS function (Add-KFCertificateToStore)");

		Write-Host "Creating store type: WinCert"
		kfutil store-types create WinCert

		Write-Information "Entering PowerShell Script: New-KFIISSiteBinding" -InformationAction SilentlyContinue
		Write-Information "[VERBOSE] Parameters: $(($PSBoundParameters.GetEnumerator() \| ForEach-Object { "$($_.Key): '$($_.Value)'" }) -join ', ')"

		Write-Information "[VERBOSE] Current Thumbprint: $currentThumbprint"

		$currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue


		$currentThumbprint = Get-ItemPropertyValue -Path $regLocation -Name "Certificate" -ErrorAction SilentlyContinue

		if ($RenewalThumbprint -and $RenewalThumbprint -contains $currentThumbprint) {

		{ "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "" },
		{ "Machine": "192.168.230.139", "StoreType": "WinCert", "JEAEndpointName": "keyfactor.wincert" }

		var failureMessage = $"Management job {config.OperationType} failed for Site '{config.CertificateStoreDetails.StorePath}' on server '{config.CertificateStoreDetails.ClientMachine}' with error: '{ex.Message}'";
		_logger.LogWarning(failureMessage);

		using Keyfactor.Extensions.Orchestrator.WindowsCertStore;

		namespace WindowsCertStore.UnitTests

		# Store Type creation script using kfutil
		# Generated by Doctool

Uh oh!

Conversation

rcpokorny commented May 11, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants