Skip to content

Commit 1349696

Browse files
fiddlermikeyfiddlermikey
authored
Merge pull request #28 from Keyfactor/release-2.1
Release 2.1
2 parents 1f8e677 + c56f15f commit 1349696

File tree

4 files changed

+61
-36
lines changed

4 files changed

+61
-36
lines changed

‎CHANGELOG.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
1+
2.1.1
2+
* Fix issue identifying whether inventoried certificate contains a private key.
3+
* Renewing Unbound Certificates Causes The Job To Fail
4+
15
2.1.0
26
* Added new Custom Field, Link To Issuer, to identify if Managment-Add jobs should attempt to link an added certificate to its issuing certificate if it resides in Netscaler.
3-
7+
48
2.0.1
59
* Fixed Issue with Inventory when VServer Cannot be retreived by Citrix API
610

‎CitrixAdcOrchestratorJobExtension/CitrixAdcStore.cs

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -669,6 +669,7 @@ public X509Certificate2 GetX509Certificate(string fileLocation, out bool hasKey)
669669
{
670670
Logger.LogDebug("Entering GetX509Certificate(string fileLocation, out bool hasKey)");
671671
systemfile f;
672+
string[] privateKeyDelims = new string[3] { "-----BEGIN RSA PRIVATE KEY-----", "-----BEGIN PRIVATE KEY-----", "-----BEGIN ENCRYPTED PRIVATE KEY-----" };
672673

673674
string certString = null;
674675
string keyString = null;
@@ -701,18 +702,24 @@ public X509Certificate2 GetX509Certificate(string fileLocation, out bool hasKey)
701702
var fileString = Encoding.Default.GetString(b);
702703

703704
// Check if private key is included with certificate
704-
var containsKey = fileString.IndexOf("-----BEGIN RSA PRIVATE KEY-----", StringComparison.Ordinal) >= 0;
705+
var privateKeyIdx = -1;
706+
foreach(string privateKeyDelim in privateKeyDelims)
707+
{
708+
if (fileString.IndexOf(privateKeyDelim, StringComparison.Ordinal) >= 0)
709+
privateKeyIdx = Array.IndexOf(privateKeyDelims, privateKeyDelim);
710+
}
711+
705712
var containsCert = fileString.IndexOf("-----BEGIN CERTIFICATE-----", StringComparison.Ordinal) >= 0;
706713

707-
Logger.LogTrace($"containsKey: {containsKey} containsCert: {containsCert}");
714+
Logger.LogTrace($"containsKey: {privateKeyIdx > -1} containsCert: {containsCert}");
708715

709-
if (containsCert && containsKey)
716+
if (containsCert && privateKeyIdx > -1)
710717
{
711718
Logger.LogTrace($"File contains certificate and key: {fileLocation}");
712719

713-
var keyStart = fileString.IndexOf("-----BEGIN RSA PRIVATE KEY-----", StringComparison.Ordinal);
714-
var keyEnd = fileString.IndexOf("-----END RSA PRIVATE KEY-----", StringComparison.Ordinal) +
715-
"-----END RSA PRIVATE KEY-----".Length;
720+
var keyStart = fileString.IndexOf(privateKeyDelims[privateKeyIdx], StringComparison.Ordinal);
721+
var keyEnd = fileString.IndexOf(privateKeyDelims[privateKeyIdx].Replace("BEGIN","END"), StringComparison.Ordinal) +
722+
privateKeyDelims[privateKeyIdx].Replace("BEGIN", "END").Length;
716723

717724
// check if need to remove new line
718725
keyString = fileString.Substring(keyStart, keyEnd - keyStart);
@@ -725,7 +732,11 @@ public X509Certificate2 GetX509Certificate(string fileLocation, out bool hasKey)
725732
// check .key file
726733
try
727734
{
728-
string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(fileLocation);
735+
var fileNameWithoutExtension = fileLocation;
736+
if (fileLocation.EndsWith(".crt",StringComparison.CurrentCultureIgnoreCase) || fileLocation.EndsWith(".pem", StringComparison.CurrentCultureIgnoreCase) || fileLocation.EndsWith(".pfx", StringComparison.CurrentCultureIgnoreCase) || fileLocation.EndsWith(".cert", StringComparison.CurrentCultureIgnoreCase) || fileLocation.EndsWith(".der", StringComparison.CurrentCultureIgnoreCase))
737+
{
738+
fileNameWithoutExtension = Path.GetFileNameWithoutExtension(fileLocation);
739+
}
729740
var keyFile = GetSystemFile(fileNameWithoutExtension + ".key");
730741
keyString = Encoding.UTF8.GetString(Convert.FromBase64String(keyFile.filecontent));
731742
}
@@ -754,7 +765,7 @@ public X509Certificate2 GetX509Certificate(string fileLocation, out bool hasKey)
754765
return null;
755766
}
756767

757-
hasKey = EvaluatePrivateKey(x, keyString);
768+
hasKey = !string.IsNullOrEmpty(keyString);
758769
}
759770
catch (Exception e)
760771
{

‎CitrixAdcOrchestratorJobExtension/Management.cs

Lines changed: 33 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,8 @@ private void AddBindCert(CitrixAdcStore store, ManagementJobCertificate cert, st
102102

103103
_logger.LogDebug("Updating cert bindings");
104104
//update cert bindings
105-
store.UpdateBindings(keyPairName, virtualServerName, sniCert);
105+
if (virtualServerName != null)
106+
store.UpdateBindings(keyPairName, virtualServerName, sniCert);
106107

107108
if (linkToIssuer)
108109
{
@@ -176,41 +177,47 @@ private JobResult ProcessJob(CitrixAdcStore store, ManagementJobConfiguration jo
176177
//2. For Each check the binding /config/sslcertkey_binding store.GetBinding(strKey)
177178
foreach (var kp in keyPairList)
178179
{
179-
var binding = store.GetBinding(kp.certkey);
180-
_logger.LogTrace($"binding: {JsonConvert.SerializeObject(binding)}");
181-
if (binding != null)
180+
//4. Open the file and check the thumbprint
181+
var x = store.GetX509Certificate(
182+
kp.cert.Substring(kp.cert.LastIndexOf("/", StringComparison.Ordinal) + 1),
183+
out _);
184+
185+
//5. If the Thumbprint matches the cert renewed from KF then PerformAdd With Overwrite
186+
if (x?.Thumbprint == _thumbprint)
182187
{
183-
//4. Open the file and check the thumbprint
184-
var x = store.GetX509Certificate(
185-
kp.cert.Substring(kp.cert.LastIndexOf("/", StringComparison.Ordinal) + 1),
186-
out _);
187-
//5. If the Thumbprint matches the cert renewed from KF then PerformAdd With Overwrite
188-
if (x?.Thumbprint == _thumbprint)
188+
_logger.LogTrace($"Thumbprint Match: {_thumbprint}");
189+
var binding = store.GetBinding(kp.certkey);
190+
_logger.LogTrace($"binding: {JsonConvert.SerializeObject(binding)}");
191+
if (binding != null)
189192
{
190-
_logger.LogTrace($"Thumbprint Match: {_thumbprint}");
191-
if (binding.sslcertkey_sslvserver_binding == null)
193+
if (binding?.sslcertkey_sslvserver_binding != null)
192194
{
193-
_logger.LogTrace(
194-
$"Starting PerformAdd Binding kp.certkey: {kp.certkey}");
195-
PerformAdd(store, jobConfiguration.JobCertificate, kp.certkey,
196-
virtualServerName, true, sniCert, linkToIssuer);
197-
_logger.LogTrace(
198-
$"Finished PerformAdd kp.certkey: {kp.certkey}");
199-
}
200-
else
201-
{
202-
foreach (var sBinding in binding.sslcertkey_sslvserver_binding)
195+
foreach (var sBinding in binding?.sslcertkey_sslvserver_binding)
203196
{
204197
_logger.LogTrace(
205-
$"Starting PerformAdd Binding Name: {sBinding.servername} kp.certkey: {kp.certkey}");
206-
PerformAdd(store, jobConfiguration.JobCertificate, kp.certkey,
207-
sBinding.servername, true, sniCert, linkToIssuer);
198+
$"Starting PerformAdd Binding Name: {sBinding?.servername} kp.certkey: {kp?.certkey}");
199+
PerformAdd(store, jobConfiguration.JobCertificate, kp?.certkey,
200+
sBinding?.servername, true, sniCert, linkToIssuer);
208201
_logger.LogTrace(
209-
$"Finished PerformAdd Binding Name: {sBinding.servername} kp.certkey: {kp.certkey}");
202+
$"Finished PerformAdd Binding Name: {sBinding?.servername} kp.certkey: {kp?.certkey}");
210203
}
211204
}
205+
else
206+
{
207+
_logger.LogTrace($"Renewing cert with no binding Information");
208+
PerformAdd(store, jobConfiguration.JobCertificate, kp?.certkey, null, true, null, linkToIssuer);
209+
_logger.LogTrace($"Finished Renewing cert with no binding Information");
210+
}
211+
}
212+
else
213+
{
214+
_logger.LogTrace($"Renewing cert with no binding Information");
215+
PerformAdd(store, jobConfiguration.JobCertificate, kp?.certkey,null, true, null,linkToIssuer);
216+
_logger.LogTrace($"Finished Renewing cert with no binding Information");
212217
}
218+
213219
}
220+
214221
}
215222
}
216223
}

‎README.md

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ The Keyfactor Universal Orchestrator may be installed on either Windows or Linux
3838
|Supports Management Remove|✓ |✓ |
3939
|Supports Create Store| | |
4040
|Supports Discovery| | |
41-
|Supports Renrollment| | |
41+
|Supports Reenrollment| | |
4242
|Supports Inventory|✓ |✓ |
4343

4444

@@ -248,3 +248,6 @@ Case Number|Case Name|Enrollment Params|Expected Results|Passed|Screenshot
248248

249249
</details>
250250

251+
When creating cert store type manually, that store property names and entry parameter names are case sensitive
252+
253+

0 commit comments

Comments
 (0)