xWebsite: finds certificates with no private key to bind to SSL. Doesn't choose a cert with most available time.

[ThomasHughesIV]

Details of the scenario you tried and the problem that is occurring

Using xWebSite to deploy SSL certificates using a subject name. When multiple certificates exist with the same subject name, xwebsite chooses one at random, not one with the most useable time. When multiple certificates exist with the same subject name, and one doesn't have a private key, the code may pick that cert and attempt to bind it to SSL, causing an error.

Verbose logs showing the problem

NA to share for security reasons

Suggested solution to the issue

Replace line 1476 with:
$Certificate = Find-Certificate @FindCertificateSplat | Where-Object {$_.HasPrivateKey -eq $true} | Sort-Object -Property NotAfter -Descending | Select-Object -First 1

The DSC configuration that is used to reproduce the issue (as detailed as possible)

        xWebSite BindCert {
            Ensure = 'Present'
            Name = 'Default Web Site'
            BindingInfo     = @(
                MSFT_xWebBindingInformation
                {
                    Protocol              = 'HTTPS'
                    Port                  = 443
                    CertificateSubject    = 'CN=DuplicateSubject'
                    CertificateStoreName  = 'MY'
                }
            )
        }

The operating system the target node is running

Version and build of PowerShell the target node is running

Version of the DSC module that was used

3.1.1.1

[Joe-Rennert]

We're experiencing this issue and hoping for a fix. I see PR #579 was created, but has not seen any movement in a while. Has it been abandoned? Can I help in anyway?

[johlju]

Yes it has been abandoned. I would need a unit test that validate the change. @Joe-Rennert if you have time then I suggest sending in a new PR with the change plus a unit test.

[ThomasHughesIV]

Sorry, i do not know anything about 7nit tests. Was hoping i had some time to learn.

…

On Tue, May 21, 2024, 8:48 AM Johan Ljunggren ***@***.***> wrote: Yes it has been abandoned. I would need a unit test that validate the change. @Joe-Rennert <https://github.com/Joe-Rennert> if you have time then I suggest sending in a new PR with the change plus a unit test. — Reply to this email directly, view it on GitHub <#578 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKARKU53IXOC5PRPL3HJHHLZDNUGFAVCNFSM4OO6OLPKU5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TEMJSGI4TGMBTG43Q> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[johlju]

No worries @ThomasHughesIV. Hopefully another contributor continue the work. 🙂