Repair-AcmeDnsCredential: auto-recover password, clear ARI cache, offer renewal

[andrewyager]

Summary

Three usability gaps in scripts/Recovery/Repair-AcmeDnsCredential.ps1 surfaced while recovering a host whose certificate had silently failed to renew. This PR addresses all three.

1. Auto-recover the acme-dns password from the existing credential file

The repair script previously always prompted for the original acme-dns /register password, but operators almost never have it written down — the password is generated once and only used programmatically by win-acme thereafter. The existing credential file already contains the password (encrypted), and the user that originally registered the domain can decrypt it without supplying anything.

• New Resolve-AcmeDnsPassword helper. When -Password is omitted:
  • StorageMethod = 'DPAPI' (CurrentUser) → unwrap with ConvertTo-SecureString -String (works when the script is run as the original registering user).
  • StorageMethod = 'DPAPI-LocalMachine' → unwrap with ProtectedData::Unprotect (makes re-runs idempotent).
  • Falls back to the interactive prompt only if auto-recovery fails, with a hint to "run as the original user."

2. Clear the win-acme ARI cache for the repaired domain

After multiple failed renewal attempts (e.g. while the DPAPI scope bug was active) Let's Encrypt rejects the next new-order with:

urn:ietf:params:acme:error:alreadyReplaced
cannot indicate an order replaces certificate with serial "…", which already has a replacement order

— because the earlier failed orders claimed the ARI replacement slot. The repair now finds renewal configs that reference the repaired domain and moves their cached *-temp.pfx files into a timestamped ari-bypass-backup-<ts> subdirectory. The next new-order request then omits the ARI replaces field and gets past the stale pending order. win-acme rebuilds the cache after a successful renewal.

• New Clear-WinAcmeAriCache helper. Honors -WhatIf/ShouldProcess.
• -SkipAriCleanup switch to disable.
• -WinAcmePath parameter for non-default win-acme installs (defaults to $env:ProgramData\win-acme).

3. Offer to run the renewal at the end

• New -RunRenewal <Prompt|Yes|No> parameter, defaulting to Prompt.
• Non-interactive sessions are treated as No so unattended RMM invocations don't hang on Read-Host.
• Find-WacsExecutable searches C:\Tools\win-acme\ and the Program Files locations.
• Invoke-WinAcmeRenewal runs wacs.exe --renew --force --verbose and reports the exit code.

Version bumped to 1.1.0; comment-based help and examples updated.

Test plan

• Run on a host with StorageMethod = 'DPAPI', as the original registering user, with no -Password. Confirm auto-recovery succeeds and the credential file is migrated to DPAPI-LocalMachine.
• Re-run the script on the same host. Confirm idempotent auto-recovery from the now-DPAPI-LocalMachine blob.
• Run on a host with StorageMethod = 'DPAPI' as a different admin. Confirm the script falls back to the interactive prompt with a clear message about which user to run as.
• Run with -RunRenewal Yes and confirm wacs.exe --renew --force --verbose is invoked and its exit code reported.
• Run with -WhatIf and confirm no destructive operations are performed (no credential file rewrite, no ARI cache file moves, no renewal invocation).
• Run with -SkipAriCleanup and confirm the win-acme cache is left untouched.
• On a host with stale ARI pending orders (the failure case that motivated this PR), confirm that after the repair + ARI cleanup, wacs.exe --renew --force --verbose reaches DNS validation instead of failing at new-order with alreadyReplaced.
• Invoke-ScriptAnalyzer -Path './scripts' -Recurse -ExcludeRule PSAvoidUsingWriteHost reports no findings (already verified locally).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Improves the scripts/Recovery/Repair-AcmeDnsCredential.ps1 recovery workflow to reduce operator friction and help unblock renewals after acme-dns credential repair, including optional post-repair renewal execution.

Changes:

• Adds automatic password recovery from existing credential files for both legacy DPAPI (CurrentUser) and DPAPI-LocalMachine.
• Adds win-acme ARI cache cleanup logic by moving matching *-temp.pfx files aside to avoid alreadyReplaced renewal failures.
• Adds an optional end-of-run renewal invocation (-RunRenewal Prompt|Yes|No) and wacs.exe discovery.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.