Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

VCert Playbooks don't allow issuance to the Web Hosting CAPI store #508

Open
R3LentL355 opened this issue Aug 9, 2024 · 1 comment
Open
Labels
bug Something isn't working

Comments

@R3LentL355
Copy link

PROBLEM SUMMARY

VCert Playbooks don't allow issuance to the Web Hosting CAPI store.

STEPS TO REPRODUCE

Create a Playbook with the following Installations config:
installations: - format: CAPI capiLocation: "LocalMachine\WebHosting" capiFriendlyName: Venafi vCert Managed - IIS TLS capiIsNonExportable: True afterInstallAction: Import-Module Webadministration; Get-WebBinding | where {($_.protocol -eq "https")} | % {$_.addsslcertificate($Env:VCERT_IISServerCertificate_THUMBPRINT, "WebHosting")}

EXPECTED RESULTS

Running the playbook will fail

ACTUAL RESULTS

2024-08-09T07:58:02.392-0700 ERROR vcert/playbook.go:114 invalid playbook file {"file": ".\\playbook.yaml", "error": "task 'IISServerCertificate' is invalid: \t\tinstallations[0]:\n\t\t\tinvalid CAPI store name. Should contain a valid storeName after the '\\' (i.e. 'LocalMachine\\My')"}

ENVIRONMENT DETAILS

OS: Windows Server 2022 and 2019
VCert: v5.7.1

COMMENTS/WORKAROUNDS

Line 35-36 in installation.go limits to the following stores:
var validStoreNames = []string{"addressbook", "authroot", "certificateauthority", "disallowed", "my", "root", "trustedpeople", "trustedpublisher"}
Limiting store installation is likely counterproductive to the useage of VCert Playbooks, users should be allowed to install to any valid CAPI store as environmental configurations will vary from one customer to the next.

@R3LentL355 R3LentL355 added the bug Something isn't working label Aug 9, 2024
@R3LentL355
Copy link
Author

Created PR: remove store validation #509

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant