Repository navigation
feat(pki-discovery): windows server discovery - #455
Conversation
Add a WinRM endpoint that reads the LocalMachine certificate stores and returns each requested certificate with its chain, built from the CA and Root stores. Advertise it with the windowsCertificateScan capability. Also give each NTLM-sealed HTTP session its own connection pool through the Infisical/winrm fork, so concurrent WinRM sessions to one host no longer fail with 401s or dropped connections.
|
💬 Discussion in Slack: #pr-review-cli-455-feat-pki-discovery-windows-server-discovery Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
 [High impact] The PR appears safe to merge; no actionable issue remains from this re-review.
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Beyond the inline findings, I checked whether store names could inject PowerShell into the scan script. They can't: the handler and the script builder in winrm/certstore.go both check each name against the fixed allowlist, and the builder also single-quote-escapes every value.
Extended reasoning...
Store names are the only request input placed in the PowerShell script, and they are checked against the allowlist in two places before they are interpolated. The inline findings cover what remains.
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 3 · PR risk: 0/10 |
Description 📣
Adds Windows Server certificate discovery, which scans the certificate stores on Windows hosts through a WinRM connection and its gateway and records each certificate as an installation with its chain. Admins choose which stores to read, and the Personal and Web Hosting stores are scanned by default. The gateway also gives each encrypted WinRM session its own connection pool, which fixes concurrent WinRM jobs against the same host failing to authenticate.
Paired with Infisical/infisical#8862
Type ✨
Tests 🛠️
Verified end to end against a Windows Server 2025 host over HTTP and HTTPS, directly and through a gateway pool.