The Windows Certificate Certificate Store Type, known by its short name 'WinCert,' enables the management of certificates within the Windows local machine certificate stores. This store type is a versatile option for general Windows certificate management and supports functionalities including inventory, add, remove, and reenrollment of certificates.

The store type represents the various certificate stores present on a Windows Server. Users can specify these stores by entering the correct store path. To get a complete list of available certificate stores, the PowerShell command Get-ChildItem Cert:\LocalMachine can be executed, providing the actual certificate store names needed for configuration.

• Functionality: The WinCert store type supports essential certificate management tasks, such as inventorying existing certificates, adding new certificates, removing old ones, and reenrolling certificates.

• Caveats: It's important to ensure that the Windows Remote Management (WinRM) is properly configured on the target server. The orchestrator relies on WinRM to perform its tasks, such as manipulating the Windows Certificate Stores. Misconfiguration of WinRM may lead to connection and permission issues.

• Limitations: Users should be aware that for this store type to function correctly, certain permissions are necessary. While some advanced users successfully use non-administrator accounts with specific permissions, it is officially supported only with Local Administrator permissions. Complexities with interactions between Group Policy, WinRM, User Account Control, and other environmental factors may impede operations if not properly configured.

The IIS Bound Certificate Certificate Store Type, identified by its short name 'IISU,' is designed for the management of certificates bound to IIS (Internet Information Services) servers. This store type allows users to automate and streamline the process of adding, removing, and reenrolling certificates for IIS sites, making it significantly easier to manage web server certificates.

The IISU store type represents the IIS servers and their certificate bindings. It specifically caters to managing SSL/TLS certificates tied to IIS websites, allowing bind operations such as specifying site names, IP addresses, ports, and enabling Server Name Indication (SNI). By default, it supports job types like Inventory, Add, Remove, and Reenrollment, thereby offering comprehensive management capabilities for IIS certificates.

• Caveats: It's important to ensure that the Windows Remote Management (WinRM) is properly configured on the target server. The orchestrator relies on WinRM to perform its tasks, such as manipulating the Windows Certificate Stores. Misconfiguration of WinRM may lead to connection and permission issues.

• Limitations: Users should be aware that for this store type to function correctly, certain permissions are necessary. While some advanced users successfully use non-administrator accounts with specific permissions, it is officially supported only with Local Administrator permissions. Complexities with interactions between Group Policy, WinRM, User Account Control, and other environmental factors may impede operations if not properly configured.

• Custom Alias and Private Keys: The store type does not support custom aliases for individual entries and requires private keys because IIS certificates without private keys would be invalid.

The WinSql Certificate Store Type, referred to by its short name 'WinSql,' is designed for the management of certificates used by SQL Server instances. This store type allows users to automate the process of adding, removing, reenrolling, and inventorying certificates associated with SQL Server, thereby simplifying the management of SSL/TLS certificates for database servers.

• Caveats: It's important to ensure that the Windows Remote Management (WinRM) is properly configured on the target server. The orchestrator relies on WinRM to perform its tasks, such as manipulating the Windows Certificate Stores. Misconfiguration of WinRM may lead to connection and permission issues.

• Limitations: Users should be aware that for this store type to function correctly, certain permissions are necessary. While some advanced users successfully use non-administrator accounts with specific permissions, it is officially supported only with Local Administrator permissions. Complexities with interactions between Group Policy, WinRM, User Account Control, and other environmental factors may impede operations if not properly configured.

• Create WinCert using kfutil:

  # Windows Certificate
  kfutil store-types create WinCert

• Create WinCert manually in the Command UI:

  Create WinCert manually in the Command UI

  Create a store type called WinCert with the attributes in the tables below:

  Basic Tab

  Attribute	Value	Description
  Name	Windows Certificate	Display name for the store type (may be customized)
  Short Name	WinCert	Short display name for the store type
  Capability	WinCert	Store type name orchestrator will register with. Check the box to allow entry of value
  Supports Add	✅ Checked	Check the box. Indicates that the Store Type supports Management Add
  Supports Remove	✅ Checked	Check the box. Indicates that the Store Type supports Management Remove
  Supports Discovery	🔲 Unchecked	Indicates that the Store Type supports Discovery
  Supports Reenrollment	✅ Checked	Indicates that the Store Type supports Reenrollment
  Supports Create	🔲 Unchecked	Indicates that the Store Type supports store creation
  Needs Server	✅ Checked	Determines if a target server name is required when creating store
  Blueprint Allowed	🔲 Unchecked	Determines if store type may be included in an Orchestrator blueprint
  Uses PowerShell	🔲 Unchecked	Determines if underlying implementation is PowerShell
  Requires Store Password	🔲 Unchecked	Enables users to optionally specify a store password when defining a Certificate Store.
  Supports Entry Password	🔲 Unchecked	Determines if an individual entry within a store can have a password.

  The Basic tab should look like this:

  

  Advanced Tab

  Attribute	Value	Description
  Supports Custom Alias	Forbidden	Determines if an individual entry within a store can have a custom Alias.
  Private Key Handling	Optional	This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid.
  PFX Password Style	Default	'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.)

  The Advanced tab should look like this:

  

  Custom Fields Tab

  Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:

  Name	Display Name	Description	Type	Default Value/Options	Required
  spnwithport	SPN With Port	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.	Bool	false	🔲 Unchecked
  WinRM Protocol	WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.	MultipleChoice	https,http	✅ Checked
  WinRM Port	WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.	String	5986	✅ Checked
  ServerUsername	Server Username	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.	Secret		🔲 Unchecked
  ServerPassword	Server Password	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.	Secret		🔲 Unchecked
  ServerUseSsl	Use SSL	Determine whether the server uses SSL or not (This field is automatically created)	Bool	true	✅ Checked

  The Custom Fields tab should look like this:

  

  Entry Parameters Tab

  Name	Display Name	Description	Type	Default Value	Entry has a private key	Adding an entry	Removing an entry	Reenrolling an entry
  ProviderName	Crypto Provider Name	Name of the Windows cryptographic provider to use during reenrollment jobs when generating and storing the private keys. If not specified, defaults to 'Microsoft Strong Cryptographic Provider'. This value would typically be specified when leveraging a Hardware Security Module (HSM). The specified cryptographic provider must be available on the target server being managed. The list of installed cryptographic providers can be obtained by running 'certutil -csplist' on the target Server.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  SAN	SAN	String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs. Can be made optional if RFC 2818 is disabled on the CA.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	✅ Checked

  The Entry Parameters tab should look like this:

  

• Create IISU using kfutil:

  # IIS Bound Certificate
  kfutil store-types create IISU

• Create IISU manually in the Command UI:

  Create IISU manually in the Command UI

  Create a store type called IISU with the attributes in the tables below:

  Basic Tab

  Attribute	Value	Description
  Name	IIS Bound Certificate	Display name for the store type (may be customized)
  Short Name	IISU	Short display name for the store type
  Capability	IISU	Store type name orchestrator will register with. Check the box to allow entry of value
  Supports Add	✅ Checked	Check the box. Indicates that the Store Type supports Management Add
  Supports Remove	✅ Checked	Check the box. Indicates that the Store Type supports Management Remove
  Supports Discovery	🔲 Unchecked	Indicates that the Store Type supports Discovery
  Supports Reenrollment	✅ Checked	Indicates that the Store Type supports Reenrollment
  Supports Create	🔲 Unchecked	Indicates that the Store Type supports store creation
  Needs Server	✅ Checked	Determines if a target server name is required when creating store
  Blueprint Allowed	🔲 Unchecked	Determines if store type may be included in an Orchestrator blueprint
  Uses PowerShell	🔲 Unchecked	Determines if underlying implementation is PowerShell
  Requires Store Password	🔲 Unchecked	Enables users to optionally specify a store password when defining a Certificate Store.
  Supports Entry Password	🔲 Unchecked	Determines if an individual entry within a store can have a password.

  The Basic tab should look like this:

  

  Advanced Tab

  Attribute	Value	Description
  Supports Custom Alias	Forbidden	Determines if an individual entry within a store can have a custom Alias.
  Private Key Handling	Required	This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid.
  PFX Password Style	Default	'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.)

  The Advanced tab should look like this:

  

  Custom Fields Tab

  Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:

  Name	Display Name	Description	Type	Default Value/Options	Required
  spnwithport	SPN With Port	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.	Bool	false	🔲 Unchecked
  WinRM Protocol	WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.	MultipleChoice	https,http	✅ Checked
  WinRM Port	WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.	String	5986	✅ Checked
  ServerUsername	Server Username	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.	Secret		🔲 Unchecked
  ServerPassword	Server Password	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.	Secret		🔲 Unchecked
  ServerUseSsl	Use SSL	Determine whether the server uses SSL or not (This field is automatically created)	Bool	true	✅ Checked

  The Custom Fields tab should look like this:

  

  Entry Parameters Tab

  Name	Display Name	Description	Type	Default Value	Entry has a private key	Adding an entry	Removing an entry	Reenrolling an entry
  Port	Port	String value specifying the IP port to bind the certificate to for the IIS site. Example: '443' for HTTPS.	String	443	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  IPAddress	IP Address	String value specifying the IP address to bind the certificate to for the IIS site. Example: '*' for all IP addresses or '192.168.1.1' for a specific IP address.	String	*	🔲 Unchecked	✅ Checked	✅ Checked	✅ Checked
  HostName	Host Name	String value specifying the host name (host header) to bind the certificate to for the IIS site. Leave blank for all host names or enter a specific hostname such as 'www.example.com'.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  SiteName	IIS Site Name	String value specifying the name of the IIS web site to bind the certificate to. Example: 'Default Web Site' or any custom site name such as 'MyWebsite'.	String	Default Web Site	🔲 Unchecked	✅ Checked	✅ Checked	✅ Checked
  SniFlag	SSL Flags	A 128-Bit Flag that determines what type of SSL settings you wish to use. The default is 0, meaning No SNI. For more information, check IIS documentation for the appropriate bit setting.)	String	0	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  Protocol	Protocol	Multiple choice value specifying the protocol to bind to. Example: 'https' for secure communication.	MultipleChoice	https	🔲 Unchecked	✅ Checked	✅ Checked	✅ Checked
  ProviderName	Crypto Provider Name	Name of the Windows cryptographic provider to use during reenrollment jobs when generating and storing the private keys. If not specified, defaults to 'Microsoft Strong Cryptographic Provider'. This value would typically be specified when leveraging a Hardware Security Module (HSM). The specified cryptographic provider must be available on the target server being managed. The list of installed cryptographic providers can be obtained by running 'certutil -csplist' on the target Server.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  SAN	SAN	String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs. Can be made optional if RFC 2818 is disabled on the CA.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	✅ Checked

  The Entry Parameters tab should look like this:

  

• Create WinSql using kfutil:

  # WinSql
  kfutil store-types create WinSql

• Create WinSql manually in the Command UI:

  Create WinSql manually in the Command UI

  Create a store type called WinSql with the attributes in the tables below:

  Basic Tab

  Attribute	Value	Description
  Name	WinSql	Display name for the store type (may be customized)
  Short Name	WinSql	Short display name for the store type
  Capability	WinSql	Store type name orchestrator will register with. Check the box to allow entry of value
  Supports Add	✅ Checked	Check the box. Indicates that the Store Type supports Management Add
  Supports Remove	✅ Checked	Check the box. Indicates that the Store Type supports Management Remove
  Supports Discovery	🔲 Unchecked	Indicates that the Store Type supports Discovery
  Supports Reenrollment	🔲 Unchecked	Indicates that the Store Type supports Reenrollment
  Supports Create	🔲 Unchecked	Indicates that the Store Type supports store creation
  Needs Server	✅ Checked	Determines if a target server name is required when creating store
  Blueprint Allowed	✅ Checked	Determines if store type may be included in an Orchestrator blueprint
  Uses PowerShell	🔲 Unchecked	Determines if underlying implementation is PowerShell
  Requires Store Password	🔲 Unchecked	Enables users to optionally specify a store password when defining a Certificate Store.
  Supports Entry Password	🔲 Unchecked	Determines if an individual entry within a store can have a password.

  The Basic tab should look like this:

  

  Advanced Tab

  Attribute	Value	Description
  Supports Custom Alias	Forbidden	Determines if an individual entry within a store can have a custom Alias.
  Private Key Handling	Optional	This determines if Keyfactor can send the private key associated with a certificate to the store. Required because IIS certificates without private keys would be invalid.
  PFX Password Style	Default	'Default' - PFX password is randomly generated, 'Custom' - PFX password may be specified when the enrollment job is created (Requires the Allow Custom Password application setting to be enabled.)

  The Advanced tab should look like this:

  

  Custom Fields Tab

  Custom fields operate at the certificate store level and are used to control how the orchestrator connects to the remote target server containing the certificate store to be managed. The following custom fields should be added to the store type:

  Name	Display Name	Description	Type	Default Value/Options	Required
  spnwithport	SPN With Port	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.	Bool	false	🔲 Unchecked
  WinRM Protocol	WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.	MultipleChoice	https,http	✅ Checked
  WinRM Port	WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.	String	5986	✅ Checked
  ServerUsername	Server Username	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.	Secret		🔲 Unchecked
  ServerPassword	Server Password	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.	Secret		🔲 Unchecked
  ServerUseSsl	Use SSL	Determine whether the server uses SSL or not (This field is automatically created)	Bool	true	✅ Checked
  RestartService	Restart SQL Service After Cert Installed	Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation.	Bool	false	✅ Checked

  The Custom Fields tab should look like this:

  

  Entry Parameters Tab

  Name	Display Name	Description	Type	Default Value	Entry has a private key	Adding an entry	Removing an entry	Reenrolling an entry
  InstanceName	Instance Name	String value specifying the SQL Server instance name to bind the certificate to. Example: 'MSSQLServer' for the default instance or 'Instance1' for a named instance.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  ProviderName	Crypto Provider Name	Optional string value specifying the name of the Windows cryptographic provider to use during reenrollment jobs when generating and storing private keys. Example: 'Microsoft Strong Cryptographic Provider'.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	🔲 Unchecked
  SAN	SAN	String value specifying the Subject Alternative Name (SAN) to be used when performing reenrollment jobs. Format as a list of <san_type>=<san_value> entries separated by ampersands; Example: 'dns=www.example.com&dns=www.example2.com' for multiple SANs.	String		🔲 Unchecked	🔲 Unchecked	🔲 Unchecked	✅ Checked

  The Entry Parameters tab should look like this:

  

• Manually with the Command UI

  Create Certificate Stores manually in the UI

  1. Navigate to the Certificate Stores page in Keyfactor Command.

     Log into Keyfactor Command, toggle the Locations dropdown, and click Certificate Stores.

  2. Add a Certificate Store.

     Click the Add button to add a new Certificate Store. Use the table below to populate the Attributes in the Add form.

     Attribute	Description
     Category	Select "Windows Certificate" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the certificate store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Windows certificate store path to manage. The store must exist in the Local Machine store on the target server, e.g., 'My' for the Personal Store or 'Root' for the Trusted Root Certification Authorities Store.
     Orchestrator	Select an approved orchestrator capable of managing WinCert certificates. Specifically, one with the WinCert capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)

• Using kfutil

  Create Certificate Stores with kfutil

  1. Generate a CSV template for the WinCert certificate store

     kfutil stores import generate-template --store-type-name WinCert --outpath WinCert.csv

  2. Populate the generated CSV file

     Open the CSV file, and reference the table below to populate parameters for each Attribute.

     Attribute	Description
     Category	Select "Windows Certificate" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the certificate store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Windows certificate store path to manage. The store must exist in the Local Machine store on the target server, e.g., 'My' for the Personal Store or 'Root' for the Trusted Root Certification Authorities Store.
     Orchestrator	Select an approved orchestrator capable of managing WinCert certificates. Specifically, one with the WinCert capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)

  3. Import the CSV file to create the certificate stores

     kfutil stores import csv --store-type-name WinCert --file WinCert.csv

The content in this section can be supplimented by the official Command documentation.

• Manually with the Command UI

  Create Certificate Stores manually in the UI

  1. Navigate to the Certificate Stores page in Keyfactor Command.

     Log into Keyfactor Command, toggle the Locations dropdown, and click Certificate Stores.

  2. Add a Certificate Store.

     Click the Add button to add a new Certificate Store. Use the table below to populate the Attributes in the Add form.

     Attribute	Description
     Category	Select "IIS Bound Certificate" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the IIS certificate store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Windows certificate store path to manage. Choose 'My' for the Personal store or 'WebHosting' for the Web Hosting store.
     Orchestrator	Select an approved orchestrator capable of managing IISU certificates. Specifically, one with the IISU capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)

• Using kfutil

  Create Certificate Stores with kfutil

  1. Generate a CSV template for the IISU certificate store

     kfutil stores import generate-template --store-type-name IISU --outpath IISU.csv

  2. Populate the generated CSV file

     Open the CSV file, and reference the table below to populate parameters for each Attribute.

     Attribute	Description
     Category	Select "IIS Bound Certificate" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the IIS certificate store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Windows certificate store path to manage. Choose 'My' for the Personal store or 'WebHosting' for the Web Hosting store.
     Orchestrator	Select an approved orchestrator capable of managing IISU certificates. Specifically, one with the IISU capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)

  3. Import the CSV file to create the certificate stores

     kfutil stores import csv --store-type-name IISU --file IISU.csv

The content in this section can be supplimented by the official Command documentation.

• Manually with the Command UI

  Create Certificate Stores manually in the UI

  1. Navigate to the Certificate Stores page in Keyfactor Command.

     Log into Keyfactor Command, toggle the Locations dropdown, and click Certificate Stores.

  2. Add a Certificate Store.

     Click the Add button to add a new Certificate Store. Use the table below to populate the Attributes in the Add form.

     Attribute	Description
     Category	Select "WinSql" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the SQL Server Certificate Store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Fixed string value 'My' indicating the Personal store on the Local Machine. This denotes the Windows certificate store to be managed for SQL Server.
     Orchestrator	Select an approved orchestrator capable of managing WinSql certificates. Specifically, one with the WinSql capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)
     RestartService	Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation.

• Using kfutil

  Create Certificate Stores with kfutil

  1. Generate a CSV template for the WinSql certificate store

     kfutil stores import generate-template --store-type-name WinSql --outpath WinSql.csv

  2. Populate the generated CSV file

     Open the CSV file, and reference the table below to populate parameters for each Attribute.

     Attribute	Description
     Category	Select "WinSql" or the customized certificate store name from the previous step.
     Container	Optional container to associate certificate store with.
     Client Machine	Hostname of the Windows Server containing the SQL Server Certificate Store to be managed. If this value is a hostname, a WinRM session will be established using the credentials specified in the Server Username and Server Password fields. For more information, see Client Machine.
     Store Path	Fixed string value 'My' indicating the Personal store on the Local Machine. This denotes the Windows certificate store to be managed for SQL Server.
     Orchestrator	Select an approved orchestrator capable of managing WinSql certificates. Specifically, one with the WinSql capability.
     spnwithport	Internally set the -IncludePortInSPN option when creating the remote PowerShell connection. Needed for some Kerberos configurations.
     WinRM Protocol	Multiple choice value specifying the protocol (https or http) that the target server's WinRM listener is using. Example: 'https' to use secure communication.
     WinRM Port	String value specifying the port number that the target server's WinRM listener is configured to use. Example: '5986' for HTTPS or '5985' for HTTP.
     ServerUsername	Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\username'.
     ServerPassword	Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'.
     ServerUseSsl	Determine whether the server uses SSL or not (This field is automatically created)
     RestartService	Boolean value (true or false) indicating whether to restart the SQL Server service after installing the certificate. Example: 'true' to enable service restart after installation.

  3. Import the CSV file to create the certificate stores

     kfutil stores import csv --store-type-name WinSql --file WinSql.csv

The content in this section can be supplimented by the official Command documentation.