spencerm/PacketStation
1
0
Fork 0
Code Issues 14 Pull Requests Actions Packages Projects Releases Wiki Activity

scripts: vsql certificate script fixes the six review findings, with a Pester suite on PowerShell 5.1 and 7
ci / frontend (push) Successful in 43s
Details
ci / server (push) Successful in 11m3s
Details
ci / image (push) Successful in 12s
Details
ci / e2e (push) Failing after 4m2s
Details

Browse Source 
- Admin check uses -not (IsAdmin); the old call passed -eq $false as arguments.
- Named instances: WQL filter Name='MSSQL$DEV' unescaped, lookup errors surface.
- SANs decoded from the raw extension (DER walk) and matched as whole names.
- Immutable deploy-, request- and rollback- records; already-bound instances
  get no snapshot; -Rollback takes the newest snapshot not yet rolled back,
  -Snapshot picks one.
- certreq -new, -submit, -accept and the key grants go through ShouldProcess;
  a declined or failed prerequisite binds nothing.
- Rollback and automatic restore work per instance, read back, report failures.

Also found while testing: PowerShell 7 returns RSACng for a CSP key, so the
provider check now reads CERT_KEY_PROV_INFO; ForEach-Object member form returned
nothing under -WhatIf; stderr capture under Stop threw on 5.1; LocalSystem and
NetworkService accounts go to icacls as SIDs; SQL Agent is started again after
a restart; signature checked by OID.

DEPLOY.md gains the run procedure: preflight, DEV, docker-1 checks, production, rollback.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
spencerm
2026-10-18 21:41:03 -06:00
co-authored by Claude Opus 5.5
parent 850e1da3a9
commit 90adcebc44
4 changed files with 1313 additions and 227 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/README.md
+15 -1
View File
@@ -9,4 +9,18 @@ Run on a domain-joined PC. Exports every unexpired PESCO CA certificate from the
## Request-VsqlServerCertificate.ps1
Run elevated on the SQL Server host behind vsql. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key encipherment, SANs vsql.pesco.com, vsql and the host names), installs it, validates it (private key, provider, key size, signature, dates, EKU, SANs) before anything is bound, grants only the selected instances' service accounts read on the private key, saves the instances' current bindings to a state file, binds the new thumbprint and prints or performs the restarts. `-WhatIf` previews every step; `-CerFile` continues a request that was pending; `-Thumbprint` binds a certificate already installed; `-Rollback` restores the saved bindings. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.
Run elevated on the SQL Server host behind vsql, in Windows PowerShell 5.1 or PowerShell 7. Requests a TLS certificate from PESCO-PSYLOCKE-CA with certreq the way SQL Server requires it (legacy Microsoft RSA SChannel Cryptographic Provider, KeySpec AT_KEYEXCHANGE, RSA 2048, SHA-256, Server Authentication, key usage 0xA0, SANs vsql.pesco.com, vsql and the host FQDN and short name). It installs it and validates it before anything is bound. The validation checks the key provider and KeySpec from the certificate's own key property, the key size, the signature, the dates, the EKU, and the SAN DNS names as whole names. It grants only the selected instances' service accounts read on the private key, then binds the thumbprint and reads it back.
- `-WhatIf` previews every step and changes nothing. `-Confirm` asks before each change. Declining enrollment or a key grant cancels the run with nothing bound (exit code 2).
- `-CerFile` continues a request that was pending. `-Thumbprint` binds a certificate already installed. `-Instances` limits the run (`DEV`, `MSSQLSERVER`). `-RestartInstances` restarts them and starts SQL Server Agent again if it ran.
- Each deployment writes a new `deploy-<time>.json` in `C:\ProgramData\PacketStation\vsql-cert` with the values it replaced. Instances already bound to the thumbprint are left alone and get no snapshot, so a rerun never hides the useful one. A pending request writes `request-<time>.json` with its request id.
- `-Rollback` restores the newest snapshot not yet rolled back, each instance on its own, verified by reading back, and records it in `rollback-<time>.json`. `-Snapshot` picks another. Failures are listed and the run exits with an error.
Tests: `scripts/tests/Request-VsqlServerCertificate.Tests.ps1` (Pester 5) fakes the host (instances, services, registry, machine store, certreq, icacls) and uses real throwaway certificates in `Cert:\CurrentUser\My`. Run it on both PowerShell versions:
```powershell
Install-Module Pester -RequiredVersion 5.7.1 -Scope CurrentUser -SkipPublisherCheck
Invoke-Pester -Path scripts ests -Output Detailed
```
The run procedure is in docs/DEPLOY.md, under the vsql known issue. Gitea issue 5 tracks the switch to `VISUAL_ENCRYPT=yes`.