Hello everyone, I’m excited to announce a public availability of PowerShell PKI module v3.7. New version is a big work around various aspects such as Microsoft Online Responder management, security descriptors. Here is a summary of what we’ve done.

PowerShell Module

Compatibility

We have added syntax compatibility with PowerShell 6.x and newer PowerShell versions.

New commands

With this version, we start remote Microsoft Online Responder (implementation of OCSP server) management support in PowerShell. We have added a set of new commands to manage Online Responder:

Renamed commands

To follow PowerShell command naming convention, the following commands were renamed:

Old name New name
Get-CASecurityDescriptor Get-CertificationAuthorityAcl
Add-CAAccessControlEntry Add-CertificationAuthorityAcl
Remove-CAAccessControlEntry Remove-CertificationAuthorityAcl
Set-CASecurityDescriptor Set-CertificationAuthorityAcl
Get-CASchema Get-CertificationAuthorityDbSchema

You still can access these commands via old names (they are aliases), but they will be removed in next PSPKI version.

Changes in existing commands

We have re-styled and unified syntax for Access Control List (ACL) management commands. Since now, all ACL-related commands implement standard .NET security descriptor classes (CommonObjectSecurity). A full list of changes in existing cmdlets are shown in the table:

Command name Changes
Add-CertificateTemplateAcl

Add-CertificationAuthorityAcl
  • Changed types for -InputObject, -AccessMask parameters and return value
  • Renamed -User parameter to -Identity
Get-CertificationAuthorityAcl

Get-CertificationAuthorityAcl
Changed type for return value
Remove-CertificateTemplateAcl

Remove-CertificationAuthorityAcl
  • Changed type for -InputObject and return value
  • Renamed -User parameter to -Identity
  • Added -Force switch
Remove-CertificateTemplateAcl

Remove-CertificationAuthorityAcl
Changed type for -InputObject and return value
Get-CertificationAuthority Added -Enterprise and -Standalone switch parameters

Bug fixes

The following GitHub items were fixed:

API Changes

New API

We have added lots of new APIs in the following namespaces

Removed API

We removed a set of legacy APIs that were marked Obsolete:

  • Method: PKI.CertificateServices.CertificateAuthority.GetSchema()
  • Method: PKI.CertificateServices.CertificateAuthority.GetCA()
  • Class: PKI.CertificateServices.DB.AdcsDbValue
  • Class: PKI.CertificateServices.DB.DataTypeEnum
  • Class: PKI.CertificateServices.DB.RequestRow
  • Class: PKI.CertificateServices.DB.Schema
  • Class: PKI.CertificateServices.DB.TableList
  • Class: PKI.ServiceProviders.ALG_ID
  • Class: PKI.ServiceProviders.ALG_IDCollection
  • Class: PKI.ServiceProviders.ALG_ID_CNG
  • Class: PKI.ServiceProviders.ALG_ID_CNGCollection
  • Class: PKI.ServiceProviders.Csp
  • Class: PKI.ServiceProviders.CspCNG
  • Class: PKI.ServiceProviders.CspCNGCollection
  • Class: PKI.ServiceProviders.CspCollection
  • Class: PKI.ServiceProviders.CspLegacy
  • Class: PKI.ServiceProviders.CspObject
  • Class: PKI.ServiceProviders.ProviderAlgorithm
  • Class: PKI.Security.AccessControlEntry2
  • Class: PKI.Security.SecurityDescriptor
  • Class: PKI.Security.AccessControlEntry2

Obsolete API

We marked a set of API with Obsolete attribute:

  • Ctor: PKI.CertificateServices.CertificateAuthority(String, String) moved to PKI.CertificateServices.CertificateAuthority.Connect() static method.
  • Prop: PKI.CertificateServices.CertificateAuthority.BaseCRL moved to GetBaseCRL() instance method
  • Prop: PKI.CertificateServices.CertificateAuthority.DeltaCRL moved to GetDeltaCRL() instance method
  • Prop: PKI.CertificateServices.CertificateAuthority.EnrollmentServiceURI renamed to EnrollmentEndpoints
  • Prop: SysadminsLV.PKI.Management.ActiveDirectory.DsCertEnrollContainer.CertificationAuthorities renamed EnrollmentServers

We will remove these APIs in next versions.

Download

As always:

Leave a Comment





This site uses Akismet to reduce spam. Learn how your comment data is processed.