Website: Choosing certificate with longest remaining validity (#633)

dsccommunity · May 22, 2024 · cfced5c · cfced5c
1 parent 3798530
commit cfced5c
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 5 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -18,11 +18,14 @@ For older change log history see the [historic changelog](HISTORIC_CHANGELOG.md)
 
 - Website
   - Add Ensure to LogCustomFieldInformation. ([issue #571](https://github.com/dsccommunity/WebAdministrationDsc/issues/571))
+  - Added code to ensure certificate selected has longest time until expiration when multiple matching certificates are found ([issue #578](https://github.com/dsccommunity/WebAdministrationDsc/issues/578))
 
 ### Fixed
 
 - IisLogging
   - Can now remove all LogCustomFields using Ensure. ([issue #571](https://github.com/dsccommunity/WebAdministrationDsc/issues/571))
+-  WebSite
+   - Added code to ensure certificate has private key. ([issue #578](https://github.com/dsccommunity/WebAdministrationDsc/issues/578))
 
 ## [4.1.0] - 2023-01-03
 
@@ -39,11 +42,11 @@ For older change log history see the [historic changelog](HISTORIC_CHANGELOG.md)
   In WebVirtualDirectory WebApplication '' and '/' can now be used interchangeably.
   - Fixed Add WebVirtualDirectory when WebApplication = '/'.
   - Fixed Remove WebVirtualDirectory when WebApplication = ''.
-- CommonTestHelper  
-  Added `Invoke-UnitTestCleanup` to get consistent cleanup of stubs.  
-  Gives correct execution of integration tests when run in same PowerShell session as unit tests (no longer calling stubs).  
+- CommonTestHelper
+  Added `Invoke-UnitTestCleanup` to get consistent cleanup of stubs.
+  Gives correct execution of integration tests when run in same PowerShell session as unit tests (no longer calling stubs).
   Gives correct `Restore-WebConfiguration` after integration tests when run in same PowerShell session as unit tests (no longer calling stub).
-- MockWebAdministrationWindowsFeature  
+- MockWebAdministrationWindowsFeature
   [Issue #351](https://github.com/dsccommunity/WebAdministrationDsc/issues/351)
   Stubs now throw StubNotImplemented when they are called in order to show when a cmdlet is not mocked correctly.
 

diff --git a/source/DSCResources/DSC_WebSite/DSC_WebSite.psm1 b/source/DSCResources/DSC_WebSite/DSC_WebSite.psm1
@@ -1474,7 +1474,8 @@ function ConvertTo-WebBinding
                     if ($FindCertificateSplat)
                     {
                         $FindCertificateSplat.Add('Store',$CertificateStoreName)
-                        $Certificate = Find-Certificate @FindCertificateSplat | Select-Object -First 1
+                        $Certificate = Find-Certificate @FindCertificateSplat | Where-Object {$_.HasPrivateKey -eq $true} | `
+                                        Sort-Object -Property NotAfter -Descending | Select-Object -First 1
                         if ($Certificate)
                         {
                             $certificateHash = $Certificate.Thumbprint

diff --git a/tests/Unit/DSC_Website.Tests.ps1 b/tests/Unit/DSC_Website.Tests.ps1
@@ -2521,6 +2521,8 @@ try
                 Mock Find-Certificate -MockWith {
                     return [PSCustomObject]@{
                         Thumbprint = 'C65CE51E20C523DEDCE979B9922A0294602D9D5C'
+                        HasPrivateKey = $true
+                        NotAfter = (Get-Date).AddDays(50)
                     }
                 }
 
@@ -2549,6 +2551,8 @@ try
                 Mock Find-Certificate -MockWith {
                     return [PSCustomObject]@{
                         Thumbprint = 'C65CE51E20C523DEDCE979B9922A0294602D9D5C'
+                        HasPrivateKey = $true
+                        NotAfter = (Get-Date).AddDays(50)
                     }
                 }
 
@@ -2576,11 +2580,20 @@ try
 
                 Mock Find-Certificate -MockWith {
                     return @(
+                        [PSCustomObject]@{
+                            Thumbprint = 'AFD927459B4ACD3CAFBAD7DFD9317B740A7D8122'
+                            HasPrivateKey = $true
+                            NotAfter = (Get-Date).AddDays(15)
+                        }
                         [PSCustomObject]@{
                             Thumbprint = 'C65CE51E20C523DEDCE979B9922A0294602D9D5C'
+                            HasPrivateKey = $true
+                            NotAfter = (Get-Date).AddDays(50)
                         },
                         [PSCustomObject]@{
                             Thumbprint = '28B88504F609F685B9A49C8F0EC49EDA1337CAFE'
+                            HasPrivateKey = $true
+                            NotAfter = (Get-Date).AddDays(25)
                         }
                     )
                 }