diff --git a/README.md b/README.md index a7b59d0..7608229 100644 --- a/README.md +++ b/README.md @@ -6,7 +6,7 @@ If you are into PowerShell, you can e.g. use my open source module [ACME-PS](htt Please be advised that this project is _NOT_ free for commercial-use, but you may test it in any company and use it for your personal projects as you see fit. Buying the license does not include maintenance, nevertheless I'll do my very best to answer issues here on GitHub as fast as possible. -If you need help installing the software or getting it up and running in your environment or you want a maintenance contract, feel free to contact me and we most likely will find a way. +If you need help installing the software or getting it up and running in your environment or you want a maintenance contract, feel free to [contact me via e-Mail](mailto:TG85+Github@outlook.de) and we'll figure something out. The software is provided "as is", without warranty of any kind. @@ -23,16 +23,17 @@ I assume your machine is domain joined. IIS PS> Install-WindowsFeature Web-Server,Web-Http-Logging,Web-Request-Monitor,Web-Http-Tracing,Web-Filtering,Web-IP-Security,Web-Mgmt-Console; ``` -- [ ] Install the required [LTS Version of .NET](https://dotnet.microsoft.com/en-us/download/dotnet/6.0) (6.0 LTS). You'll need the hosting bundle from the .NET Runtime section. +- [ ] Install the required [LTS Version of .NET](https://dotnet.microsoft.com/en-us/download/dotnet/8.0) (8.0 LTS). You'll need the hosting bundle from the .NET Runtime section. - [ ] Download the latest release of [ACME-ADCS](https://github.com/glatzert/ACME-Server-ADCS/releases) - [ ] Extract the contents of the Release ZIP-file into `C:\inetpub\wwwroot\`. -- [ ] Modify the IIS-AppPool, to not use .NET Framework (new .NET is loaded via another mechanism) and set it's identity to either a custom account (recommended) or "NetworkService". +- [ ] Modify the IIS-AppPool, to not use .NET Framework (new .NET is loaded via another mechanism) and set it's identity to either a group managed service account (recommended), custom account or "NetworkService". +- [ ] Allow the account to "Logon as a batch job". Read more about [Appliction Pool Identites](https://learn.microsoft.com/en-us/iis/manage/configuring-security/application-pool-identities) and [Managed Service Accounts](https://learn.microsoft.com/de-de/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview) ## Configure ACME-ADCS - [ ] Create a path for working files of ACME-ADCS, e.g `C:\ACME-ADCS` (this is the default path) -- [ ] Grant full rights to the account used above +- [ ] Grant read/write rights to the account used above - [ ] Copy `C:\inetpub\wwwroot\appsettings-custom.dist.json` to `C:\inetpub\wwwroot\appsettings-custom.json` - [ ] Open `C:\inetpub\wwwroot\appsettings-custom.json` in the editor of your choice. @@ -41,7 +42,7 @@ IIS PS> Install-WindowsFeature Web-Server,Web-Http-Logging,Web-Request-Monitor,W ```cmd CMD> certutil -dump ``` -- [ ] Look for "Configuration" and set this as `CAServer` in the opened configuration file. Watch for '\', which need to be escaped. +- [ ] Look for "Configuration" and set this as `CAServer` in the opened configuration file. Watch for '\', which need to be escaped. Refer to 'appsettings-sample.json' to see how it might look like. - [ ] Use `certutil -ADTemplate`, `certutil -CATemplates` or `certutil -Template` to find the name of the template to be used (or ask your CA-Admin) - [ ] Set the `TemplateName` in the opened configuration file diff --git a/src/ACME.CertProvider.ADCS/ACME.CertProvider.ADCS.csproj b/src/ACME.CertProvider.ADCS/ACME.CertProvider.ADCS.csproj index 830c216..2f13f5b 100644 --- a/src/ACME.CertProvider.ADCS/ACME.CertProvider.ADCS.csproj +++ b/src/ACME.CertProvider.ADCS/ACME.CertProvider.ADCS.csproj @@ -1,12 +1,13 @@  - - net6.0 - TGIT.ACME.Protocol.CertProvider.ADCS - TGIT.ACME.Protocol.CertProvider.ADCS - Library - - - + true--> + - - - - 728ab348-217d-11da-b2a4-000e7bbb2b09 - 1 - 0 - tlbimp - 0 - false - - - 372fce32-4324-11d0-8810-00a0c903b83c - 1 - 0 - tlbimp - 0 - false - - - - - - - - - - - - - - + + + 728ab348-217d-11da-b2a4-000e7bbb2b09 + 1 + 0 + tlbimp + 0 + false + + + 372fce32-4324-11d0-8810-00a0c903b83c + 1 + 0 + tlbimp + 0 + false + + + + + + + + + + + + + + diff --git a/src/ACME.CertProvider.ADCS/CertificateIssuer.cs b/src/ACME.CertProvider.ADCS/CertificateIssuer.cs index 72a0188..1d0aee3 100644 --- a/src/ACME.CertProvider.ADCS/CertificateIssuer.cs +++ b/src/ACME.CertProvider.ADCS/CertificateIssuer.cs @@ -27,7 +27,7 @@ public CertificateIssuer(IOptions options, ILogger IssueCertificate(string csr, CancellationToken cancellationToken) { - _logger.LogDebug($"Try to issue certificate for CSR: {csr}"); + _logger.LogDebug("Try to issue certificate for CSR: {csr}", csr); var result = (Certificates: (byte[]?)null, Error: (AcmeError?)null); try @@ -57,6 +57,7 @@ public CertificateIssuer(IOptions options, ILogger x.Value) - .Concat(order.Identifiers.Where(x => x.IsWildcard).Select(x => x.Value.Substring(2))) + .Concat( + order.Identifiers.Where(x => x.IsWildcard) + .Select(x => x.Value[2..]) + ) .Select(x => "CN=" + x) .ToList(); @@ -65,7 +68,7 @@ private bool SubjectIsValid(CertEnroll.CX509CertificateRequestPkcs10 request, Or (_options.Value.AllowCNSuffix && request.Subject.Name.StartsWith(x))); } // This is thrown, if there is no subject. - catch (Exception ex) + catch (Exception) when (_options.Value.AllowEmptyCN) { return true; diff --git a/src/ACME.Protocol.Abstractions/ACME.Protocol.Abstractions.csproj b/src/ACME.Protocol.Abstractions/ACME.Protocol.Abstractions.csproj index fb34625..863f529 100644 --- a/src/ACME.Protocol.Abstractions/ACME.Protocol.Abstractions.csproj +++ b/src/ACME.Protocol.Abstractions/ACME.Protocol.Abstractions.csproj @@ -1,7 +1,7 @@  - net6.0 + net8.0 TGIT.ACME.Protocol TGIT.ACME.Protocol.Abstractions Library diff --git a/src/ACME.Protocol.Model/ACME.Protocol.Model.csproj b/src/ACME.Protocol.Model/ACME.Protocol.Model.csproj index eac8f60..0380779 100644 --- a/src/ACME.Protocol.Model/ACME.Protocol.Model.csproj +++ b/src/ACME.Protocol.Model/ACME.Protocol.Model.csproj @@ -1,7 +1,7 @@ - net6.0 + net8.0 TGIT.ACME.Protocol TGIT.ACME.Protocol.Model Library @@ -15,7 +15,7 @@ - + diff --git a/src/ACME.Protocol/ACME.Protocol.csproj b/src/ACME.Protocol/ACME.Protocol.csproj index 74ac121..0c61913 100644 --- a/src/ACME.Protocol/ACME.Protocol.csproj +++ b/src/ACME.Protocol/ACME.Protocol.csproj @@ -1,7 +1,7 @@  - net6.0 + net8.0 TGIT.ACME.Protocol TGIT.ACME.Protocol.Impl Library @@ -16,13 +16,13 @@ - + - - - + + + - + diff --git a/src/ACME.Server.ADCS/ACME.Server.ADCS.csproj b/src/ACME.Server.ADCS/ACME.Server.ADCS.csproj index f3d815c..7df3a80 100644 --- a/src/ACME.Server.ADCS/ACME.Server.ADCS.csproj +++ b/src/ACME.Server.ADCS/ACME.Server.ADCS.csproj @@ -1,8 +1,7 @@  - net6.0 - win10-x64 + net8.0-windows @@ -13,7 +12,7 @@ - + diff --git a/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-SelfContained.pubxml b/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-SelfContained.pubxml index cecb0bd..cd9b89f 100644 --- a/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-SelfContained.pubxml +++ b/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-SelfContained.pubxml @@ -4,19 +4,19 @@ https://go.microsoft.com/fwlink/?LinkID=208121. --> - True - False - True + true + false + true Release Any CPU FileSystem bin\Release\net5.0\win10-x64\publish-exe\ FileSystem - net5.0 + net6.0 win10-x64 c45b90b6-3069-444d-a243-5a117def39d8 true - True + true \ No newline at end of file diff --git a/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-for-IIS.pubxml b/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-for-IIS.pubxml index b83f5a4..5647840 100644 --- a/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-for-IIS.pubxml +++ b/src/ACME.Server.ADCS/Properties/PublishProfiles/Publish-for-IIS.pubxml @@ -4,19 +4,19 @@ https://go.microsoft.com/fwlink/?LinkID=208121. --> - True - False - True + true + false + true Release Any CPU FileSystem - bin\Release\net6.0\win10-x64\publish-iis\ + bin\publish-iis\ FileSystem - net6.0 - win10-x64 + net8.0-windows + win-x64 c45b90b6-3069-444d-a243-5a117def39d8 false - False + false \ No newline at end of file diff --git a/src/ACME.Server/ACME.Server.csproj b/src/ACME.Server/ACME.Server.csproj index 52c3e4f..417d836 100644 --- a/src/ACME.Server/ACME.Server.csproj +++ b/src/ACME.Server/ACME.Server.csproj @@ -1,7 +1,7 @@  - net6.0 + net8.0 TGIT.ACME.Server TGIT.ACME.Server.Core Library diff --git a/src/ACME.Storage.FileStore/ACME.Storage.FileStore.csproj b/src/ACME.Storage.FileStore/ACME.Storage.FileStore.csproj index d119fc4..28d44cd 100644 --- a/src/ACME.Storage.FileStore/ACME.Storage.FileStore.csproj +++ b/src/ACME.Storage.FileStore/ACME.Storage.FileStore.csproj @@ -1,7 +1,7 @@  - net6.0 + net8.0 TGIT.ACME.Protocol.Storage.FileStore TGIT.ACME.Protocol.Storage.FileStore Library @@ -16,11 +16,11 @@ - - - + + + - + diff --git a/tests/ACME.CertProvider.ADCS.Tests.Manual/ACME.CertProvider.ADCS.Tests.Manual.csproj b/tests/ACME.CertProvider.ADCS.Tests.Manual/ACME.CertProvider.ADCS.Tests.Manual.csproj index d8bf177..931a361 100644 --- a/tests/ACME.CertProvider.ADCS.Tests.Manual/ACME.CertProvider.ADCS.Tests.Manual.csproj +++ b/tests/ACME.CertProvider.ADCS.Tests.Manual/ACME.CertProvider.ADCS.Tests.Manual.csproj @@ -2,13 +2,18 @@ Exe - net6.0 + net8.0-windows enable enable - + + + + + + diff --git a/tests/ACME.CertProvider.ADCS.Tests.Manual/Program.cs b/tests/ACME.CertProvider.ADCS.Tests.Manual/Program.cs index 63cd534..174e931 100644 --- a/tests/ACME.CertProvider.ADCS.Tests.Manual/Program.cs +++ b/tests/ACME.CertProvider.ADCS.Tests.Manual/Program.cs @@ -3,6 +3,7 @@ using System.Security.Cryptography.X509Certificates; using System.Text; using TGIT.ACME.Protocol.IssuanceServices.ACDS; +using TGIT.ACME.Protocol.IssuanceServices.ADCS; using TGIT.ACME.Protocol.Model; if (args.Length <= 1) @@ -26,15 +27,15 @@ async Task ManualCSRValidationTest() { var base64Csr = ""; - var acdsOptions = new Microsoft.Extensions.Options.OptionsWrapper( - new ACDSOptions + var adcsOptions = new Microsoft.Extensions.Options.OptionsWrapper( + new ADCSOptions { CAServer = "", TemplateName = "", AllowCNSuffix = true, }); - var csrValidator = new CsrValidator(acdsOptions, new NullLogger()); + var csrValidator = new CsrValidator(adcsOptions, new NullLogger()); var validationResult = await csrValidator.ValidateCsrAsync( new Order("FakeAccountId", new Identifier[] { new Identifier("dns", "www.test.uni-mainz.de") }), @@ -67,8 +68,8 @@ async Task ManualIssuanceTest(string[] args) var csrBytes = csr.CreateSigningRequest(); var csrPEM = $"{Convert.ToBase64String(csrBytes)}"; - var acdsOptions = new Microsoft.Extensions.Options.OptionsWrapper( - new ACDSOptions + var acdsOptions = new Microsoft.Extensions.Options.OptionsWrapper( + new ADCSOptions { CAServer = caConfig, TemplateName = caTemplate, diff --git a/tests/ACME.Protocol.Model.Tests/ACME.Protocol.Model.Tests.csproj b/tests/ACME.Protocol.Model.Tests/ACME.Protocol.Model.Tests.csproj index f60b9e4..f32d13b 100644 --- a/tests/ACME.Protocol.Model.Tests/ACME.Protocol.Model.Tests.csproj +++ b/tests/ACME.Protocol.Model.Tests/ACME.Protocol.Model.Tests.csproj @@ -1,19 +1,19 @@  - net6.0 + net8.0 false - - - + + + runtime; build; native; contentfiles; analyzers; buildtransitive all - + runtime; build; native; contentfiles; analyzers; buildtransitive all