Skip to content

Commit 55367f4

Browse files
arudellarudell
authored
Improvements to certificate handling (#369)
# Description Summary of changes: This pull request includes several updates to improve the handling of certificates in the `SdnDiagnostics` module. The most important changes include renaming the `New-SdnCertificate` function, introducing a utility function to confirm if a certificate is self-signed, and ensuring administrative checks are performed consistently. Improvements to certificate handling: * [`src/SdnDiagnostics.psd1`](diffhunk://#diff-17aaaa968cc894449c79b449c228b28d8a8990bde4000e59bcf24d8189671ee1L126-R126): Renamed `New-SdnCertificate` to `New-SdnSelfSignedCertificate` to clarify its purpose. * [`src/modules/SdnDiag.Common.psm1`](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24L368-R368): Added `Confirm-IsCertSelfSigned` function to check if a certificate is self-signed and replaced direct comparisons with calls to this function. [[1]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24L368-R368) [[2]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24L1693-R1726) [[3]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24L1811-R1843) [[4]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24R1879-R1882) [[5]](diffhunk://#diff-15898640fc68e07afa836ad8d93af4f22a4442978d9c233f39d48d44d85cfb60L188-R188) * [`src/modules/SdnDiag.Common.psm1`](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24R1326-R1331): Added parameters `Subject`, `Thumbprint`, and `NetworkControllerOid` to `Get-SdnCertificate` to enhance certificate search capabilities. [[1]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24R1326-R1331) [[2]](diffhunk://#diff-9ab71f66f6e21719dc9527f01ea738656003bbbe631f4f1bd85ab1ab8a746f24L1350-L1369) Consistent administrative checks: * `src/SdnDiagnostics.psm1`, `src/modules/SdnDiag.LoadBalancerMux.psm1`, `src/modules/SdnDiag.NetworkController.psm1`, `src/modules/SdnDiag.Server.psm1`: Replaced inline administrator checks with calls to `Confirm-IsAdmin` for consistency. [[1]](diffhunk://#diff-490865628c61b2e97c50f45b37d7086647c70b2444cbfb9c60cc8c682801356eL278-R278) [[2]](diffhunk://#diff-8b1f41eba916fc0a86f95c4ab4e5c8c23ce217faa05f9aef2f3564bb60577c2cL391-R391) [[3]](diffhunk://#diff-26f7a08ead3e5bf8f7eb9bc916e1240653352463c34fb7321d570202143203f8L2541-R2541) [[4]](diffhunk://#diff-11217f20b55d3b4ea34c8c217794c81d65acc4852dff9bf4295e5cc4d6dfaeedL2643-R2643) These changes streamline the certificate management process and ensure consistent administrative privilege checks across the module. # Change type - [ ] Bug fix (non-breaking change) - [ ] Code style update (formatting, local variables) - [x] New Feature (non-breaking change that adds new functionality without impacting existing) - [ ] Breaking change (fix or feature that may cause functionality impact) - [ ] Other # Checklist: - [x] My code follows the style and contribution guidelines of this project. - [x] I have tested and validated my code changes.
1 parent 2525870 commit 55367f4

File tree

7 files changed

+78
-79
lines changed

7 files changed

+78
-79
lines changed

‎src/SdnDiagnostics.psd1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@
123123
'Invoke-SdnResourceDump',
124124
'Invoke-SdnServiceFabricCommand',
125125
'Move-SdnServiceFabricReplica',
126-
'New-SdnCertificate',
126+
'New-SdnSelfSignedCertificate',
127127
'New-SdnCertificateRotationConfig',
128128
'New-SdnExpressBgpHost',
129129
'New-SdnMuxCertificate',

‎src/SdnDiagnostics.psm1‎

Lines changed: 1 addition & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -275,10 +275,7 @@ function Start-SdnCertificateRotation {
275275
}
276276

277277
# ensure that the module is running as local administrator
278-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
279-
if (-NOT $elevated) {
280-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
281-
}
278+
Confirm-IsAdmin
282279

283280
if ($Global:SdnDiagnostics.EnvironmentInfo.ClusterConfigType -ine 'ServiceFabric') {
284281
throw New-Object System.NotSupportedException("This function is only supported on Service Fabric clusters.")
@@ -290,16 +287,6 @@ function Start-SdnCertificateRotation {
290287
throw New-Object System.NotSupportedException("The current machine is not a NetworkController, run this on NetworkController.")
291288
}
292289

293-
# add disclaimer that this feature is currently under preview
294-
if (!$Force) {
295-
"This feature is currently under preview. Please report any issues to https://github.com/microsoft/SdnDiagnostics/issues so we can accurately track any issues and help unblock your cert rotation." | Trace-Output -Level:Warning
296-
$confirm = Confirm-UserInput -Message "Do you want to proceed with certificate rotation? [Y/N]:"
297-
if (-NOT $confirm) {
298-
"User has opted to abort the operation. Terminating operation" | Trace-Output -Level:Warning
299-
return
300-
}
301-
}
302-
303290
try {
304291
"Starting certificate rotation" | Trace-Output
305292

‎src/modules/SdnDiag.Common.psm1‎

Lines changed: 63 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ function Copy-CertificateToFabric {
155155
foreach ($controller in $FabricDetails.NetworkController) {
156156
# if the certificate being passed is self-signed, we will need to copy the certificate to the other controller nodes
157157
# within the fabric and install under localmachine\root as appropriate
158-
if ($certData.Subject -ieq $certData.Issuer) {
158+
if (Confirm-IsCertSelfSigned -Certificate $certData) {
159159
"Importing certificate [Subject: {0} Thumbprint:{1}] to {2}" -f `
160160
$certData.Subject, $certData.Thumbprint, $controller | Trace-Output
161161

@@ -241,7 +241,7 @@ function Copy-CertificateToFabric {
241241

242242
# if the certificate being passed is self-signed, we will need to copy the certificate to the other controller nodes
243243
# within the fabric and install under localmachine\root as appropriate
244-
if ($certData.Subject -ieq $certData.Issuer) {
244+
if (Confirm-IsCertSelfSigned -Certificate $certData) {
245245
"Importing certificate [Subject: {0} Thumbprint:{1}] to {2}" -f `
246246
$certData.Subject, $certData.Thumbprint, $controller | Trace-Output
247247

@@ -273,7 +273,7 @@ function Copy-CertificateToFabric {
273273
foreach ($controller in $FabricDetails.NetworkController) {
274274
# if the certificate being passed is self-signed, we will need to copy the certificate to the other controller nodes
275275
# within the fabric and install under localmachine\root as appropriate
276-
if ($certData.Subject -ieq $certData.Issuer) {
276+
if (Confirm-IsCertSelfSigned -Certificate $certData) {
277277
"Importing certificate [Subject: {0} Thumbprint:{1}] to {2}" -f `
278278
$certData.Subject, $certData.Thumbprint, $controller | Trace-Output
279279

@@ -365,7 +365,7 @@ function Copy-UserProvidedCertificateToFabric {
365365
$certificateConfig.RestCert = $restCertificate.pfxData.EndEntityCertificates.Thumbprint
366366
}
367367

368-
if ($cert.pfxdata.EndEntityCertificates.Subject -ieq $cert.pfxdata.EndEntityCertificates.Issuer) {
368+
if (Confirm-IsCertSelfSigned -Certificate $cert.pfxdata.EndEntityCertificates) {
369369
$cert.SelfSigned = $true
370370
}
371371
}
@@ -1323,6 +1323,12 @@ function Get-SdnCertificate {
13231323
Returns a list of the certificates within the given certificate store.
13241324
.PARAMETER Path
13251325
Defines the path within the certificate store. Path is expected to start with cert:\.
1326+
.PARAMETER Subject
1327+
Specifies the subject of the certificate to search for.
1328+
.PARAMETER Thumbprint
1329+
Specifies the thumbprint of the certificate to search for.
1330+
.PARAMETER NetworkControllerOid
1331+
Optional parameter that filters the certificates based on the Network Controller OID.
13261332
.EXAMPLE
13271333
PS> Get-SdnCertificate -Path "Cert:\LocalMachine\My"
13281334
#>
@@ -1347,26 +1353,53 @@ function Get-SdnCertificate {
13471353

13481354
[Parameter(Mandatory = $false, ParameterSetName = 'Thumbprint')]
13491355
[ValidateNotNullorEmpty()]
1350-
[System.String]$Thumbprint
1356+
[System.String]$Thumbprint,
1357+
1358+
[Parameter(Mandatory = $false, ParameterSetName = 'Default')]
1359+
[Parameter(Mandatory = $false, ParameterSetName = 'Subject')]
1360+
[Parameter(Mandatory = $false, ParameterSetName = 'Thumbprint')]
1361+
[switch]$NetworkControllerOid
13511362
)
13521363

1364+
[string]$objectIdentifier = @('1.3.6.1.4.1.311.95.1.1.1') # this is a custom OID used for Network Controller
1365+
$array = @()
1366+
13531367
try {
13541368
$certificateList = Get-ChildItem -Path $Path -Recurse | Where-Object {$_.PSISContainer -eq $false} -ErrorAction Stop
1369+
if ($null -eq $certificateList) {
1370+
throw New-Object System.NullReferenceException("No certificates found $Path")
1371+
}
1372+
1373+
if ($NetworkControllerOid) {
1374+
$certificateList | ForEach-Object {
1375+
if ($objectIdentifier -iin $_.EnhancedKeyUsageList.ObjectId) {
1376+
$array += $_
1377+
}
1378+
}
1379+
1380+
# if no certificates are found based on the OID, search based on other criteria
1381+
if ($null -eq $array) {
1382+
"Unable to locate certificates that match Network Controller OID: {0}." -f $objectIdentifier | Trace-Output -Level:Warning
1383+
$array = $certificateList
1384+
}
1385+
}
1386+
else {
1387+
$array = $certificateList
1388+
}
13551389

13561390
switch ($PSCmdlet.ParameterSetName) {
13571391
'Subject' {
1358-
$filteredCert = $certificateList | Where-Object {$_.Subject -ieq $Subject}
1392+
$filteredCert = $array | Where-Object {$_.Subject -ieq $Subject}
13591393
}
13601394
'Thumbprint' {
1361-
$filteredCert = $certificateList | Where-Object {$_.Thumbprint -ieq $Thumbprint}
1395+
$filteredCert = $array | Where-Object {$_.Thumbprint -ieq $Thumbprint}
13621396
}
13631397
default {
1364-
return $certificateList
1398+
return $array
13651399
}
13661400
}
13671401

13681402
if ($null -eq $filteredCert) {
1369-
"Unable to locate certificate using {0}" -f $PSCmdlet.ParameterSetName | Trace-Output -Level:Warning
13701403
return $null
13711404
}
13721405

@@ -1690,8 +1723,7 @@ function Import-SdnCertificate {
16901723
}
16911724

16921725
# determine if the certificates being used are self signed
1693-
if ($certObject.CertInfo.Subject -ieq $certObject.CertInfo.Issuer) {
1694-
"Detected the certificate subject and issuer are the same. Setting SelfSigned to true" | Trace-Output -Level:Verbose
1726+
if (Confirm-IsCertSelfSigned -Certificate $certObject.CertInfo) {
16951727
$certObject.SelfSigned = $true
16961728

16971729
# check to see if we installed to root store with above operation
@@ -1808,7 +1840,7 @@ function Invoke-SdnGetNetView {
18081840
}
18091841
}
18101842

1811-
function New-SdnCertificate {
1843+
function New-SdnSelfSignedCertificate {
18121844
<#
18131845
.SYNOPSIS
18141846
Creates a new self-signed certificate for use with SDN fabric.
@@ -1819,7 +1851,7 @@ function New-SdnCertificate {
18191851
.PARAMETER NotAfter
18201852
Specifies the date and time, as a DateTime object, that the certificate expires. To obtain a DateTime object, use the Get-Date cmdlet. The default value for this parameter is one year after the certificate was created.
18211853
.EXAMPLE
1822-
PS> New-SdnCertificate -Subject rest.sdn.contoso -CertStoreLocation Cert:\LocalMachine\My
1854+
PS> New-SdnSelfSignedCertificate -Subject rest.sdn.contoso -CertStoreLocation Cert:\LocalMachine\My
18231855
#>
18241856

18251857
[CmdletBinding()]
@@ -1844,6 +1876,10 @@ function New-SdnCertificate {
18441876
try {
18451877
"Generating certificate with subject {0} under {1}" -f $Subject, $CertStoreLocation | Trace-Output
18461878

1879+
# create new self signed certificate with the following EnhancedKeyUsageList
1880+
# 1.3.6.1.5.5.7.3.1 - Server Authentication OID
1881+
# 1.3.6.1.5.5.7.3.2 - Client Authentication OID
1882+
# 1.3.6.1.4.1.311.95.1.1.1 - Network Controller OID
18471883
$selfSignedCert = New-SelfSignedCertificate -Type Custom -KeySpec KeyExchange -Subject $Subject `
18481884
-KeyExportPolicy Exportable -HashAlgorithm sha256 -KeyLength 2048 `
18491885
-CertStoreLocation $CertStoreLocation -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1,1.3.6.1.5.5.7.3.2,1.3.6.1.4.1.311.95.1.1.1") `
@@ -2248,3 +2284,17 @@ function Stop-SdnNetshTrace {
22482284
}
22492285
}
22502286

2287+
function Confirm-IsCertSelfSigned {
2288+
[CmdletBinding()]
2289+
param (
2290+
[Parameter(Mandatory = $true)]
2291+
[System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate
2292+
)
2293+
2294+
if ($Certificate.Issuer -eq $Certificate.Subject) {
2295+
"Detected the certificate subject and issuer are the same. Setting SelfSigned to true" | Trace-Output -Level:Verbose
2296+
return $true
2297+
}
2298+
2299+
return $false
2300+
}

‎src/modules/SdnDiag.Health.psm1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,7 @@ function Test-HostRootStoreNonRootCert {
185185
$nonRootCerts = @()
186186
$rootCerts = Get-ChildItem Cert:LocalMachine\Root
187187
foreach ($rootCert in $rootCerts) {
188-
if ($rootCert.Subject -ne $rootCert.Issuer) {
188+
if (-NOT (Confirm-IsCertSelfSigned -Certificate $rootCert)) {
189189
$certInfo = [PSCustomObject]@{
190190
Thumbprint = $rootCert.Thumbprint
191191
Subject = $rootCert.Subject

‎src/modules/SdnDiag.LoadBalancerMux.psm1‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ function Get-SdnMuxCertificate {
9595
try {
9696
$muxCert = Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SlbMux' -Name 'MuxCert'
9797
$subjectName = "CN={0}" -f $muxCert
98-
$certificate = Get-SdnCertificate -Subject $subjectName -Path 'Cert:\LocalMachine\My'
98+
$certificate = Get-SdnCertificate -Subject $subjectName -Path 'Cert:\LocalMachine\My' -NetworkControllerOid
9999
return $certificate
100100
}
101101
catch {
@@ -388,10 +388,7 @@ function New-SdnMuxCertificate {
388388
}
389389

390390
# ensure that the module is running as local administrator
391-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
392-
if (-NOT $elevated) {
393-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
394-
}
391+
Confirm-IsAdmin
395392

396393
try {
397394
if (-NOT (Test-Path -Path $Path -PathType Container)) {
@@ -404,7 +401,7 @@ function New-SdnMuxCertificate {
404401

405402
$muxCert = Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\SlbMux' -Name 'MuxCert'
406403
$subjectName = "CN={0}" -f $muxCert
407-
$certificate = New-SdnCertificate -Subject $subjectName -NotAfter $NotAfter
404+
$certificate = New-SdnSelfSignedCertificate -Subject $subjectName -NotAfter $NotAfter
408405

409406
# after the certificate has been generated, we want to export the certificate and save the file to directory
410407
# This allows the rest of the function to pick up these files and perform the steps as normal
@@ -508,20 +505,7 @@ function Start-SdnMuxCertificateRotation {
508505
}
509506

510507
# ensure that the module is running as local administrator
511-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
512-
if (-NOT $elevated) {
513-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
514-
}
515-
516-
# add disclaimer that this feature is currently under preview
517-
if (!$Force) {
518-
"This feature is currently under preview. Please report any issues to https://github.com/microsoft/SdnDiagnostics/issues so we can accurately track any issues and help unblock your cert rotation." | Trace-Output -Level:Warning
519-
$confirm = Confirm-UserInput -Message "Do you want to proceed with certificate rotation? [Y/N]:"
520-
if (-NOT $confirm) {
521-
"User has opted to abort the operation. Terminating operation" | Trace-Output -Level:Warning
522-
return
523-
}
524-
}
508+
Confirm-IsAdmin
525509

526510
$array = @()
527511
$ncRestParams = @{

‎src/modules/SdnDiag.NetworkController.psm1‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2538,10 +2538,7 @@ function New-SdnNetworkControllerNodeCertificate {
25382538
}
25392539

25402540
# ensure that the module is running as local administrator
2541-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
2542-
if (-NOT $elevated) {
2543-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
2544-
}
2541+
Confirm-IsAdmin
25452542

25462543
try {
25472544
if ($null -eq $FabricDetails) {
@@ -2560,7 +2557,7 @@ function New-SdnNetworkControllerNodeCertificate {
25602557

25612558
# if we return multiple certificates, we want to select the first one as the subject should be the same
25622559
$nodeCertSubject = (Get-SdnNetworkControllerNodeCertificate)[0].Subject
2563-
$certificate = New-SdnCertificate -Subject $nodeCertSubject -NotAfter $NotAfter
2560+
$certificate = New-SdnSelfSignedCertificate -Subject $nodeCertSubject -NotAfter $NotAfter
25642561

25652562
# after the certificate has been generated, we want to export the certificate using the $CertPassword provided by the operator
25662563
# and save the file to directory. This allows the rest of the function to pick up these files and perform the steps as normal
@@ -2626,10 +2623,7 @@ function New-SdnNetworkControllerRestCertificate {
26262623
}
26272624

26282625
# ensure that the module is running as local administrator
2629-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
2630-
if (-NOT $elevated) {
2631-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
2632-
}
2626+
Confirm-IsAdmin
26332627

26342628
try {
26352629
if ($FabricDetails) {
@@ -2657,7 +2651,7 @@ function New-SdnNetworkControllerRestCertificate {
26572651
}
26582652

26592653
[System.String]$formattedSubject = "CN={0}" -f $RestName.Trim()
2660-
$certificate = New-SdnCertificate -Subject $formattedSubject -NotAfter $NotAfter
2654+
$certificate = New-SdnSelfSignedCertificate -Subject $formattedSubject -NotAfter $NotAfter
26612655

26622656
# after the certificate has been generated, we want to export the certificate using the $CertPassword provided by the operator
26632657
# and save the file to directory. This allows the rest of the function to pick up these files and perform the steps as normal

‎src/modules/SdnDiag.Server.psm1‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2067,7 +2067,7 @@ function Get-SdnServerCertificate {
20672067
try {
20682068
$serverCert = Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NcHostAgent\Parameters' -Name 'HostAgentCertificateCName'
20692069
$subjectName = "CN={0}" -f $serverCert
2070-
$certificate = Get-SdnCertificate -Subject $subjectName -Path 'Cert:\LocalMachine\My'
2070+
$certificate = Get-SdnCertificate -Subject $subjectName -Path 'Cert:\LocalMachine\My' -NetworkControllerOid
20712071
return $certificate
20722072
}
20732073
catch {
@@ -2640,10 +2640,7 @@ function New-SdnServerCertificate {
26402640
}
26412641

26422642
# ensure that the module is running as local administrator
2643-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
2644-
if (-NOT $elevated) {
2645-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
2646-
}
2643+
Confirm-IsAdmin
26472644

26482645
try {
26492646
if (-NOT (Test-Path -Path $Path -PathType Container)) {
@@ -2656,7 +2653,7 @@ function New-SdnServerCertificate {
26562653

26572654
$serverCert = Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\NcHostAgent\Parameters' -Name 'HostAgentCertificateCName'
26582655
$subjectName = "CN={0}" -f $serverCert
2659-
$certificate = New-SdnCertificate -Subject $subjectName -NotAfter $NotAfter
2656+
$certificate = New-SdnSelfSignedCertificate -Subject $subjectName -NotAfter $NotAfter
26602657

26612658
# after the certificate has been generated, we want to export the certificate and save the file to directory
26622659
# This allows the rest of the function to pick up these files and perform the steps as normal
@@ -2980,20 +2977,7 @@ function Start-SdnServerCertificateRotation {
29802977
}
29812978

29822979
# ensure that the module is running as local administrator
2983-
$elevated = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
2984-
if (-NOT $elevated) {
2985-
throw New-Object System.Exception("This function requires elevated permissions. Run PowerShell as an Administrator and import the module again.")
2986-
}
2987-
2988-
# add disclaimer that this feature is currently under preview
2989-
if (!$Force) {
2990-
"This feature is currently under preview. Please report any issues to https://github.com/microsoft/SdnDiagnostics/issues so we can accurately track any issues and help unblock your cert rotation." | Trace-Output -Level:Warning
2991-
$confirm = Confirm-UserInput -Message "Do you want to proceed with certificate rotation? [Y/N]:"
2992-
if (-NOT $confirm) {
2993-
"User has opted to abort the operation. Terminating operation" | Trace-Output -Level:Warning
2994-
return
2995-
}
2996-
}
2980+
Confirm-IsAdmin
29972981

29982982
$array = @()
29992983
$ncRestParams = @{

0 commit comments

Comments
 (0)