Merge to main by indrora · Pull Request #177 · Keyfactor/iis-orchestrator

indrora · 2026-01-12T17:29:02Z

Merge 76022-IIS_Orchestrator-3.0.0 to main - Automated PR

Completed adding Integration Tests

…r SNI retrieval. - Enhanced `New-KFIISSiteBinding` to robustly handle SSL flags, including checks for managed API range and updating extended flags via `appcmd.exe`. - Improved comments and verbose logging for better clarity and debugging.

…rrectly 76938 sni flag not reporting correctly

…N_Entry_Parameter 76023 eliminate but support san entry parameter

…ocal and remote sessions.

… additional "housekeeping" for ADFS.

…tor/iis-orchestrator into 60764_Adding_ADFS_Support

60764 adding adfs support

Updated SAN handling in integration-manifest.json and clarified support for previous versions. Added new features and improvements.

Updated changelog to reflect changes in version 3.0.0, including SAN handling and new WinADFS Store Type.

…perly.

Added SSL Flag validation details and improved messaging.

Updated SSL Flag descriptions for clarity and accuracy.

Fixed an issue with SSL flags

…ing ssh.

…he Windows Server.

…ng_Issues Fixed SSH Formatting issue

…Using_SSH Update generated docs

…e automatically added via Command.

Copilot

Pull request overview

This PR introduces version 3.0.0 of the Windows Certificate Orchestrator Extension, adding ADFS certificate rotation capabilities and transitioning from entry parameter-based SANs to ODKG enrollment-based SANs. The changes support backward compatibility while preparing for a future major version that will remove legacy SAN handling.

Changes:

Added WinADFS store type for automated ADFS Service-Communications certificate rotation across primary and secondary farm nodes
Transitioned SAN handling from entry parameters to ODKG enrollment with backward compatibility
Enhanced IIS SSL flag handling with validation and extended flag support
Added comprehensive unit and integration test infrastructure

Reviewed changes

Copilot reviewed 38 out of 51 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
integration-manifest.json	Removed legacy SAN entry parameters and added WinAdfs store type configuration
docsource/winadfs.md	Added documentation for WinADFS store type requirements and configuration
docsource/content.md	Updated overview to include WinADFS functionality
WindowsCertStore.sln	Added unit and integration test projects to solution
WindowsCertStore.UnitTests/*.cs	Added unit test files for SANs, PowerShell helpers, certificates, and ADFS
WindowsCertStore.IntegrationTests/*.cs	Added integration test infrastructure and end-to-end tests
IISU/SANBuilder.cs	New utility class for building SAN strings from dictionary format
IISU/PowerShellScripts/WinCertScripts.ps1	Enhanced PowerShell scripts with ADFS support and improved IIS SSL flag handling
IISU/PowerShellScripts/WinADFSScripts.ps1	New PowerShell script containing ADFS-specific management functions
IISU/PSHelper.cs	Enhanced to support ADFS stores, improved script loading, and better error handling
IISU/ImplementedStoreTypes/WinAdfs/*.cs	New ADFS store type implementation with rotation manager and inventory
IISU/ClientPSCertStoreReEnrollment.cs	Updated to support new SAN resolution with backward compatibility
IISU/Certificate.cs	Added utility methods for temporary PFX file handling

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-12T17:30:48Z

IISU/PSHelper.cs

 using System.Collections.ObjectModel;
 using System.Diagnostics;
 using System.IO;
+using System.IO.Ports;


The System.IO.Ports namespace is imported but doesn't appear to be used anywhere in the code. This unused import should be removed to keep the code clean.

Suggested change

using System.IO.Ports;

Copilot · 2026-01-12T17:30:48Z

IISU/PowerShellScripts/WinCertScripts.ps1

 # 11/21/25          Renamed Set-KFCertificateBinding to Set-KFSQLCertificateBinding
 #                   Fixed the Set-KFSQLCertificateBinding function to correctly bind and set the ACL permissions on the private key when using Windows-to-Windows and SSH-based remote connections.
 #                   Updated the Set-KFSQLCertificateBinding to handle both CNG (modern) and CAPI (legacy) certificate key storage providers when setting ACLs on private keys.
+# 10/08/25  3.0     Updated the Get-KFIISBoundCertificates function to fixed the SSL flag not returning the correct value when reading IIS bindings


Corrected spelling of 'fixed' to 'fix'.

Suggested change

# 10/08/25 3.0 Updated the Get-KFIISBoundCertificates function to fixed the SSL flag not returning the correct value when reading IIS bindings

# 10/08/25 3.0 Updated the Get-KFIISBoundCertificates function to fix the SSL flag not returning the correct value when reading IIS bindings

Copilot · 2026-01-12T17:30:49Z

IISU/ImplementedStoreTypes/WinAdfs/Management.cs

+// limitations under the License.using Keyfactor.Logging;
+using Keyfactor.Extensions.Orchestrator.WindowsCertStore.ImplementedStoreTypes.WinAdfs;
+using Keyfactor.Logging;
+using Keyfactor.Orchestrators.Common.Enums;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

using Keyfactor.Extensions.Orchestrator.WindowsCertStore.ImplementedStoreTypes.WinAdfs;

using Keyfactor.Logging;

using Keyfactor.Orchestrators.Common.Enums;

// limitations under the License.

using Keyfactor.Extensions.Orchestrator.WindowsCertStore.ImplementedStoreTypes.WinAdfs;

using Keyfactor.Logging;

Copilot · 2026-01-12T17:30:49Z

IISU/ImplementedStoreTypes/WinAdfs/CertificateRotationResult.cs

+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.using Keyfactor.Logging;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

// limitations under the License.

using Keyfactor.Logging;

Copilot · 2026-01-12T17:30:49Z

IISU/ImplementedStoreTypes/WinAdfs/AdfsNodeInfo.cs

+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.using Keyfactor.Logging;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

// limitations under the License.

using Keyfactor.Logging;

Copilot · 2026-01-12T17:30:50Z

IISU/ImplementedStoreTypes/WinAdfs/AdfsInventory.cs

+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.using Keyfactor.Logging;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

// limitations under the License.

Copilot · 2026-01-12T17:30:50Z

IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs

+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.using Keyfactor.Logging;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

// limitations under the License.

Copilot · 2026-01-12T17:30:51Z

IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateInfo.cs

+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.using Keyfactor.Logging;


Missing newline between the license comment and the using statement. The comment should end, followed by a blank line before the using directive.

Suggested change

// limitations under the License.using Keyfactor.Logging;

// limitations under the License.

using Keyfactor.Logging;

Copilot · 2026-01-12T17:30:51Z

WindowsCertStore.IntegrationTests/Factories/ConfigurationFactory.cs

+            // Define test inputs (machine, username, and password)
+            var testCases = new[]
+            {
+                    new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" },
+                    new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" }


Hardcoded credentials and file paths should not be committed to the repository. These should be externalized to configuration files or environment variables that are not checked into source control.

Suggested change

// Define test inputs (machine, username, and password)

var testCases = new[]

{

new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" },

new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" }

// Define test inputs (machine, username, and password) via environment variables

var machine = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_MACHINE");

var username = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_USERNAME");

var password = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_KEYPATH");

var testCases = new[]

{

new { Machine = machine, Username = username, Password = password },

new { Machine = machine, Username = username, Password = password }

Bob Pokorny and others added 30 commits October 8, 2025 15:08

Completed adding Integration Tests

42dfbc4

Merge pull request #154 from Keyfactor/72753-Add_Integration_Tests

ed59256

Completed adding Integration Tests

Updated the code to suppress output from PowerShell execution.

607c818

Added SSL Flag validation

df65fac

Merge pull request #156 from Keyfactor/76938_SNIFlag_Not_Reporting_Co…

a66870a

…rrectly 76938 sni flag not reporting correctly

Added SAN resolver to handle entry parameters and the new SAN Property

dee114c

Updated the integration-manifest to remove the SAN Entry Parameter.

afe8c79

Update generated docs

05ad84c

Merge pull request #157 from Keyfactor/76023-Eliminate_But_Support_SA…

dd85978

…N_Entry_Parameter 76023 eliminate but support san entry parameter

Initial ADFS infrastructure and modified how scripts are loaded for l…

af62f1e

…ocal and remote sessions.

Added ADFS Inventory Process and Unit Test

a6ef607

Added ADFS Store Type in the integration-manifest

837596d

Update generated docs

d80c527

Completed adding the logic to rotate the ADFS certificate and perform…

c6d9327

… additional "housekeeping" for ADFS.

Update generated docs

fe22b55

Updated the documentation to support ADFS

1fe9d67

Merge branch '60764_Adding_ADFS_Support' of https://github.com/Keyfac…

ad9e519

…tor/iis-orchestrator into 60764_Adding_ADFS_Support

Updated Changelog

31b15b6

Merge pull request #158 from Keyfactor/60764_Adding_ADFS_Support

40fdb7b

60764 adding adfs support

Update generated docs

10f8690

Revise SAN handling and enhance integration features

645448a

Updated SAN handling in integration-manifest.json and clarified support for previous versions. Added new features and improvements.

Update CHANGELOG for version 3.0.0 changes

dded928

Updated changelog to reflect changes in version 3.0.0, including SAN handling and new WinADFS Store Type.

Update generated docs

f8cbfc3

Fixed an issue with SSL flags greater than 3 weren't updating IIS pro…

ed354b5

…perly.

Update generated docs

984d342

Updated the SSL Flags per Microsoft documentation.

effd087

Update generated docs

03cdcc5

Update CHANGELOG with SSL Flag validation details

f71110d

Added SSL Flag validation details and improved messaging.

Revise SSL Flag entries in CHANGELOG

33dd469

Updated SSL Flag descriptions for clarity and accuracy.

Keyfactor and others added 20 commits November 18, 2025 22:56

Update generated docs

b6c2150

Merge pull request #159 from Keyfactor/78697-SSL_Flags_Not_Updating

c0feeeb

Fixed an issue with SSL flags

Update generated docs

02f3f26

Fixed formatting of private SSH key when creating a temp file when us…

842b3da

…ing ssh.

Update generated docs

55e17b2

Update generated docs

a86aa5b

Fixed an ACL issue on SQL Private Keys when using SSH to connect to t…

14785e8

…he Windows Server.

Update generated docs

7809742

Update generated docs

4a1a3c5

Merge pull request #162 from Keyfactor/78789-Private_SSH_Key_Formatti…

98bc604

…ng_Issues Fixed SSH Formatting issue

Merge pull request #163 from Keyfactor/78938-WinSQL_ACL_Not_Updating_…

42c99d0

…Using_SSH Update generated docs

Update generated docs

5a02aca

Merged conflicts from 2.6.4

9180cc4

Merged 2.6.4 fixes into this versioin.

b40d21f

Update generated docs

7e9c968

Updated Documentation to indicate the username and password fields ar…

8837600

…e automatically added via Command.

Merge conflicts

e4eef6c

made minor adjustments to integration-manifest

c63bcc2

Update generated docs

2a21790

Fixed merge conflicts

e295bf1

Copilot AI review requested due to automatic review settings January 12, 2026 17:29

spbsoluble closed this Jan 12, 2026

Copilot AI reviewed Jan 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge to main#177

Merge to main#177
indrora wants to merge 50 commits intomainfrom
76022-IIS_Orchestrator-3.0.0

indrora commented Jan 12, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Copilot AI Jan 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	# 10/08/25 3.0 Updated the Get-KFIISBoundCertificates function to fixed the SSL flag not returning the correct value when reading IIS bindings
	# 10/08/25 3.0 Updated the Get-KFIISBoundCertificates function to fix the SSL flag not returning the correct value when reading IIS bindings

	// limitations under the License.using Keyfactor.Logging;
	// limitations under the License.

-            // Define test inputs (machine, username, and password)
-            var testCases = new[]
-            {
-                    new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" },
-                    new { Machine = "192.168.230.137", Username = "ad\\administrator", Password = "C:\\Users\\bpokorny\\.ssh\\my_rsa" }
+            // Define test inputs (machine, username, and password) via environment variables
+            var machine = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_MACHINE");
+            var username = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_USERNAME");
+            var password = Environment.GetEnvironmentVariable("WINDOWS_CERT_STORE_TEST_KEYPATH");
+            var testCases = new[]
+            {
+                    new { Machine = machine, Username = username, Password = password },
+                    new { Machine = machine, Username = username, Password = password }

Conversation

indrora commented Jan 12, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants