spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

scripts: vsql certificate request uses the legacy SChannel CSP with an exchange key, validates before binding, scopes key access, saves bindings for rollback, resumes pending requests
ci / frontend (push) Successful in 42s
Details
ci / server (push) Successful in 11m30s
Details
ci / image (push) Successful in 13s
Details
ci / e2e (push) Failing after 9s
Details

Browse Source 
Co-Authored-By: Claude Fable 5.1 <[email protected]>
This commit is contained in:
spencerm
2026-10-18 21:19:39 -06:00
co-authored by Claude Fable 5.1
parent fdfb8ae40f
commit 850e1da3a9
2 changed files with 255 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/README.md
+1 -1
View File
@@ -9,4 +9,4 @@ Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the
## Request-VsqlServerCertificate.ps1
Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq (RSA 2048, SHA-256, Server Authentication, SANs vsql.pesco.com, vsql and the host names, Key Storage Provider, exportable), installs it, grants the SQL Server service accounts read on the private key, points each instance at it, and prints or performs the restarts. `-WhatIf` shows the steps. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.
Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key encipherment, SANs vsql.pesco.com, vsql and the host names), installs it, validates it (private key, provider, key size, signature, dates, EKU, SANs) before anything is bound, grants only the selected instances' service accounts read on the private key, saves the instances' current bindings to a state file, binds the new thumbprint and prints or performs the restarts. `-WhatIf` previews every step; `-CerFile` continues a request that was pending; `-Thumbprint` binds a certificate already installed; `-Rollback` restores the saved bindings. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.