Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow certificate renewal without key reuse #264

Closed
NathanBowdish opened this issue Feb 29, 2024 · 15 comments
Closed

Allow certificate renewal without key reuse #264

NathanBowdish opened this issue Feb 29, 2024 · 15 comments
Assignees
@gdbarron
Labels
enhancement New feature or request

Comments

@NathanBowdish
Copy link

Environment

Full Operating System:
VenafiPS version: Downloaded Main
PowerShell version:  5.1.14393.6343
TLSPDC version (if applicable):

Steps to reproduce

Invoke-VcCertificateAction -ID $certificateId -Renew

Expected behavior

Certificate successfully renewed

Actual behavior

The remote server returned an error: (412) Precondition Failed.
@gdbarron
Copy link
Collaborator

gdbarron commented Mar 1, 2024

Hi @NathanBowdish. Thanks for reporting and for posting your first issue :)

Can you tell me a bit about your certificate in addition to how it was created, ask or csr? Is it current and active? You can confirm the status and version with Get-VcCertificate -ID $certificateId.

Can you also run the command with -verbose and provide the (sanitized) output?

@NathanBowdish
Copy link
Author

NathanBowdish commented Mar 1, 2024 via email

@gdbarron
Copy link
Collaborator

gdbarron commented Mar 1, 2024

Assuming you didn't change any of the uuids, can you please try the following and let me know the output?

$body = @{
    existingCertificateId        = '44491930-b60f-11ee-bf75-9798121d6e8d'
    certificateIssuingTemplateId = '871a4960-20f4-11ee-a6ac-b3f7f9dc765a'
    applicationId                = '90522f70-25a9-11ee-8e58-c9df4e72279d'
    reuseCSR                     = $true
}
Invoke-WebRequest -Headers @{'tppl-api-key' = $VenafiSession.Key.GetNetworkCredential().password } -Uri 'https://api.venafi.cloud/outagedetection/v1/certificaterequests' -Method Post -Body ($body | ConvertTo-Json) -ContentType 'application/json'

@NathanBowdish
Copy link
Author

NathanBowdish commented Mar 1, 2024 via email

@gdbarron
Copy link
Collaborator

gdbarron commented Mar 1, 2024

Thanks! Looks like you haven't turned on key reuse with your issuing template. Go to your Issuing Template, scroll to the bottom, and turn this option on.

image

If you have any questions on this feature, please reach out to support.

I will work on ensuring this additional information is captured in the error VenafiPS provides.

@gdbarron gdbarron closed this as completed Mar 1, 2024
@gdbarron gdbarron reopened this Mar 1, 2024
@gdbarron gdbarron self-assigned this Mar 1, 2024
@gdbarron gdbarron added the enhancement New feature or request label Mar 1, 2024
@NathanBowdish
Copy link
Author

NathanBowdish commented Mar 1, 2024 via email

@gdbarron gdbarron changed the title Invoke-VcCertificateAction -Renew New Issue Allow certificate renewal without key reuse Mar 1, 2024
@gdbarron
Copy link
Collaborator

gdbarron commented Mar 3, 2024

@NathanBowdish can you give this a go? https://github.com/Venafi/VenafiPS/tree/renew-without-key-reuse

@STOTTCO
Copy link

STOTTCO commented Mar 5, 2024

@gdbarron Hello Greg, im another Engineer from BECU that also is following this issue. I have tried your new branch and encountered an issue with it. in VenafiPS/Public/Invoke-VcCertificateAction.ps1 its missing a required csrAttribute 'SubjectCN' in the switch starting on line 176. You will also have to cast the SubjectCN to a string to make it work since the return object of SubjectCN in $thisCert = Get-VcCertificate -ID $ID is an array and the CertificateRequest Endpoint seems to only accept a string for the subjectCN CSR attributes. My local branch is currently working with this.

                switch ($thisCert.PSObject.Properties.Name) {
                    'subjectCN' { $renewParams.csrAttributes.commonName = [string]$thisCert.subjectCN }
...

@gdbarron
Copy link
Collaborator

gdbarron commented Mar 5, 2024

Thanks Connor, I appreciate you pointing this out. I've added this, but instead of converting to string, I'm selecting the first item in the array since converting multiple items to string would be an issue. I've also added a check for multiple CNs and -Force switch to override default behavior.

@STOTTCO
Copy link

STOTTCO commented Mar 5, 2024

Great call on the -force, much cleaner than my suggestion. Your update works for me, at least for a basic SSL certificate.

@gdbarron
Copy link
Collaborator

gdbarron commented Mar 6, 2024

Great, thanks for confirming.

@gdbarron gdbarron closed this as completed Mar 6, 2024
@gdbarron
Copy link
Collaborator

gdbarron commented Mar 6, 2024

#266

@aprajitapriya
Copy link

Hi @gdbarron I tried out the latest main branch. Cert Renewal works but I need to pass the applicationId to the Invoke-VcCertificateAction Command otherwise it throws below error. While the cert is tagged to single application.

PS E:\Certs\VenafiPS-main\VenafiPS-main\VenafiPS> $result = Invoke-VcCertificateAction -ID $certificateId -Renew

PS E:\Certs\VenafiPS-main\VenafiPS-main\VenafiPS> $result.Error
Multiple applications associated, APP-ITBSR (90522f70-25a9-11ee-8e58-c9df4e72279d). Only 1 application can be
renewed at a time. Rerun Invoke-VcCertificateAction and add '-AdditionalParameter @{'Application'='applicati
on id'}' and provide the actual id you would like to renew._

@gdbarron
Copy link
Collaborator

gdbarron commented Mar 7, 2024

Thanks @aprajitapriya. I see the issue and given both Connor and I tested, I'm not sure how it got past. Please use the workaround for now and I'll get a fix out shortly.

@gdbarron
Copy link
Collaborator

@aprajitapriya v.6.2.1 has the fix.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@gdbarron gdbarron

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

When branches are created from issues, their pull requests are automatically linked.

264-allow-certificate-renewal-without-key-reuse Venafi/VenafiPS
4 participants
@gdbarron @aprajitapriya @NathanBowdish @STOTTCO