How keyfactor/iis-orchestrator works
This is a Keyfactor Universal Orchestrator extension for inventorying and managing Windows certificates, plus reenrolling certificates for supported store types. The principal workflow is a configured UO job that reaches a Windows certificate store, performs a store-specific operation, and reports results. ADFS has a distinct farm-rotation capability. The README documents supported store types and remote connection modes; sampled source confirms shared PowerShell and reenrollment calls. Several inventory and management implementations are unsampled, so their internal call paths are not asserted.
Main entry points: ClientPSCertStoreReEnrollment.cs Reenrollment jobs · ImplementedStoreTypes Inventory jobs · AdfsCertificateRotationManager.cs ADFS rotation · InventoryJobLogger.cs Job reporting
Components 16
Job handling
- Job configuration
IISU/JobConfigurationParser.cs - Inventory jobs
IISU/ImplementedStoreTypes - Management jobs
IISU/ImplementedStoreTypes - Reenrollment jobs
IISU/ClientPSCertStoreReEnrollment.cs - Job reporting
IISU/Models/InventoryJobLogger.cs
Shared runtime
- PowerShell sessions
IISU/PSHelper.cs - Certificate data
IISU/Certificate.cs
Certificate stores
- Local machine store
IISU/ImplementedStoreTypes/Win - IIS bindings
IISU/ImplementedStoreTypes/WinIIS - SQL bindings
IISU/ImplementedStoreTypes/WinSQL - LDAPS bindings
IISU/ImplementedStoreTypes/WinLDAP - HTTP.sys bindings
IISU/ImplementedStoreTypes/WinNetSH - ADFS rotation
IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs
Remote targets
- Windows servers
- Keyfactor services
Other components
- UO job
Connections 18
- UO job → Job configuration: provides config
IISU/JobConfigurationParser.cs - UO job → Inventory jobs: requests inventory
- UO job → Management jobs: requests management
- UO job → Reenrollment jobs: requests reenrollment
- Inventory jobs → Job reporting: reports inventory
- Management jobs → Job reporting: reports results
- Reenrollment jobs → PowerShell sessions: initializes session
IISU/ClientPSCertStoreReEnrollment.cs - Reenrollment jobs → Certificate data: uses certificate data
IISU/ClientPSCertStoreReEnrollment.cs - Reenrollment jobs → IIS bindings: binds certificates
IISU/ClientPSCertStoreReEnrollment.cs - Reenrollment jobs → SQL bindings: binds certificates
IISU/ClientPSCertStoreReEnrollment.cs - Reenrollment jobs → LDAPS bindings: binds certificates
IISU/ClientPSCertStoreReEnrollment.cs - Reenrollment jobs → HTTP.sys bindings: binds certificates
IISU/ClientPSCertStoreReEnrollment.cs - ADFS rotation → PowerShell sessions: invokes remote functions
IISU/ImplementedStoreTypes/WinAdfs/AdfsCertificateRotationManager.cs - Inventory jobs → Windows servers: connects remotely
- Management jobs → Windows servers: manages stores
- Reenrollment jobs → Windows servers: connects remotely
- ADFS rotation → Windows servers: rotates farm certificates
- UO job → Keyfactor services: submits enrollment