Venafi / Venafi/vcert

VCert Playbooks don't allow issuance to the Web Hosting CAPI store

Open
#508 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
106
Forks
77
Avg merge
6d 21h
Merged PRs (30d)
1

Description

PROBLEM SUMMARY

VCert Playbooks don't allow issuance to the Web Hosting CAPI store.

STEPS TO REPRODUCE

Create a Playbook with the following Installations config:
installations: - format: CAPI capiLocation: "LocalMachine\WebHosting" capiFriendlyName: Venafi vCert Managed - IIS TLS capiIsNonExportable: True afterInstallAction: Import-Module Webadministration; Get-WebBinding | where {($_.protocol -eq "https")} | % {$_.addsslcertificate($Env:VCERT_IISServerCertificate_THUMBPRINT, "WebHosting")}

EXPECTED RESULTS

Running the playbook will fail

ACTUAL RESULTS

2024-08-09T07:58:02.392-0700 ERROR vcert/playbook.go:114 invalid playbook file {"file": ".\\playbook.yaml", "error": "task 'IISServerCertificate' is invalid: \t\tinstallations[0]:\n\t\t\tinvalid CAPI store name. Should contain a valid storeName after the '\\' (i.e. 'LocalMachine\\My')"}

ENVIRONMENT DETAILS

OS: Windows Server 2022 and 2019
VCert: v5.7.1

COMMENTS/WORKAROUNDS

Line 35-36 in installation.go limits to the following stores:
var validStoreNames = []string{"addressbook", "authroot", "certificateauthority", "disallowed", "my", "root", "trustedpeople", "trustedpublisher"}
Limiting store installation is likely counterproductive to the useage of VCert Playbooks, users should be allowed to install to any valid CAPI store as environmental configurations will vary from one customer to the next.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in installation.go at lines 35-36, where valid CAPI store names are restricted, and compare that validation with the reported LocalMachine\WebHosting playbook configuration. Run the reproduction on the stated Windows environment or an available equivalent. Done means the playbook accepts the WebHosting CAPI store without producing the invalid store-name error.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.