MicrosoftGreat news! Is there anything planned for automated certificate management? Editing the HTTP.SYS listener every time the certificate changes isn't an efficient way of managing this feature. Maybe GPO? Thanks
MicrosoftThanks for the feedback. Certificate lifecycle management is definitely an area we've heard about from customers.
DNS over HTTPS on Windows DNS Server leverages HTTP.sys for the HTTPS endpoint, so certificate binding and management are currently handled outside of DNS itself. We generally don't want DNS Server to become a certificate management solution, but we do want to reduce operational friction for administrators.
GPO is an interesting option for Windows-centric environments, although many customers run mixed-OS networks, so we're also thinking about the broader management experience. Appreciate the suggestion and the feedback.
Thanks for the quick reply! I know that DNS Server is leveraging HTTP.SYS. What about a CMDLet which lets us configure the binding, etc.? Or integration with PowerShell DSC? This would also accommodate mixed-os environments…
MicrosoftThanks for the suggestion. As you know, the current configuration relies on the existing HTTP.SYS certificate binding mechanism. That mechanism is already scriptable and can be automated as part of deployment workflows. Nevertheless, I can certainly see the appeal of a more DNS-specific PowerShell or DSC experience, particularly for administrators managing large numbers of servers. Appreciate the feedback.
