使用PowerShell将IIS SSL证书分配给与主机标头绑定

Question

我正在尝试将证书分配给HTTPS绑定。 不幸的是，我从PowerShell得到了这个错误：

new-item : Cannot create a file when that file already exists
At line:3 char:56
+         get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBi ...
+                                                        ~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [New-Item], Win32Exception
    + FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.NewItemCommand

我执行的PowerShell是：

 New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
 $cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"} | Select-Object -ExpandProperty Thumbprint
 get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBindings\0.0.0.0!443!$Name.domain.com

似乎能够找到证书，但无法将其分配给创建的绑定。 使用正确的IP / Port / HostHeader创建绑定，检查SNI，但SSL证书是“未选中”

一切正常，从IIS管理器

我尝试过来自SO和其他网站的各种指示，例如： http://technet.microsoft.com/en-us/magazine/jj871065.aspx
Powershell IIS7 Snap in Assign SSL certificate to https binding
Powershell - Add SSL binding using shared certificate

另外，我试过

IIS:\SslBindings\0.0.0.0!443!$Name.domain.com

和

IIS:\SslBindings\0.0.0.0!443

证书的主题是 cloud.domain.com ，以及多个SAN属性，例如：适用于**。domain.com *， domain.com ，**。seconddomain.com *， seconddomain.com ， cloud.domain.com

修改

现在我正在使用这种方法，它确实有效：

$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert hostnameport=$Name.domain.com:443 certhash=b58e54ca68c94f93c134c5da00a388ab0642a648 certstorename=MY appid="$guid"

我仍然对没有netsh / appcmd

的解决方案感兴趣

Answer 1

以下是我能够为机器FQDN生成自签名证书以及添加SSL证书和绑定的方法。

$fqdn = "$((Get-WmiObject win32_computersystem).DNSHostName).$((Get-WmiObject win32_computersystem).Domain)" 
$cert=(Get-ChildItem cert:\LocalMachine\My | where-object { $_.Subject -match "CN=$fqdn" } | Select-Object -First 1) 
if ($cert  -eq $null) { 
$cert = New-SelfSignedCertificate -DnsName $fqdn -CertStoreLocation "Cert:\LocalMachine\My" 
} 
$binding = (Get-WebBinding -Name SiteNameHere | where-object {$_.protocol -eq "https"})
if($binding -ne $null) {
    Remove-WebBinding -Name SiteNameHere -Port 443 -Protocol "https" -HostHeader $fqdn
} 
New-WebBinding -Name SiteNameHere -Port 443 -Protocol https -HostHeader $fqdn 
(Get-WebBinding -Name SiteNameHere -Port 443 -Protocol "https" -HostHeader $fqdn).AddSslCertificate($cert.Thumbprint, "my")

Answer 2

现在我正在使用这种方法，它确实有效：

$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert hostnameport=$Name.domain.com:443 certhash=b58e54ca68c94f93c134c5da00a388ab0642a648 certstorename=MY appid="$guid"

Answer 3

根据@ElanHasson的回答，我制作了这个脚本，它将制作一个自签名的TLS证书并将其应用到网站上。它可以整理一下，但它有效：

Clear-Host
$certificateDnsName = 'my.localcert.ssl' # a name you want to give to your certificate (can be anything you want for localhost)

$siteName = "Default Web Site" # the website to apply the bindings/cert to (top level, not an application underneath!).
$fqdn = ""                     #fully qualified domain name (empty, or e.g 'contoso.com')


# ----------------------------------------------------------------------------------------
# SSL CERTIFICATE CREATION
# ----------------------------------------------------------------------------------------

# create the ssl certificate that will expire in 2 years
$newCert = New-SelfSignedCertificate -DnsName $certificateDnsName -CertStoreLocation cert:\LocalMachine\My -NotAfter (Get-Date).AddYears(2)
"Certificate Details:`r`n`r`n $newCert"


# ----------------------------------------------------------------------------------------
# IIS BINDINGS
# ----------------------------------------------------------------------------------------


$webbindings = Get-WebBinding -Name $siteName
$webbindings


$hasSsl = $webbindings | Where-Object { $_.protocol -like "*https*" }

if($hasSsl)
{
    Write-Output "ERROR: An SSL certificate is already assigned. Please remove it manually before adding this certificate."
    Write-Output "Alternatively, you could just use that certificate (provided it's recent/secure)."
}
else
{
    "Applying TLS/SSL Certificate"
    New-WebBinding -Name $siteName -Port 443 -Protocol https -HostHeader $fqdn #could add -IPAddress here if needed (and for the get below)
    (Get-WebBinding -Name $siteName -Port 443 -Protocol "https" -HostHeader $fqdn).AddSslCertificate($newCert.Thumbprint, "my")

    "`r`n`r`nNew web bindings"
    $webbindings = Get-WebBinding -Name $siteName
    $webbindings
}


"`r`n`r`nTLS/SSL Assignment Complete"

在fqdn为空（并且没有分配-IPAddress）的情况下，它会在IIS中为您提供：

Answer 4

我不熟悉IIS，但错误表明绑定（文件）已经存在，因此您没有添加SSL绑定，而是您正在更新它。尝试将-Force添加到New-Item命令。如果它像文件一样工作，它应该覆盖现有的绑定。像：

New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"} | Select-Object -ExpandProperty Thumbprint
get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBindings\0.0.0.0!443!$Name.domain.com -Force

Answer 5

我遇到了一些SNI和PowerShell的问题。我错过的一个重要步骤实际上是在证书的导入过程中。您需要确保证书被标记为＆＃34;可导出＆＃34;，否则web管理模块将无法与其绑定。

如果你有，那么原始脚本应该有效。虽然，我个人更喜欢使用证书变量而不是指纹。

像这样：

New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"}
New-Item -Path "IIS:\SslBindings\!443!$Name.domain.com" -Value $cert -SSLFlags 1

Answer 6

以下方法对我有用：

在HTTP.sys中添加新的SSL配置后，将新绑定添加到网站，并将SslFlags设置为1，如下所示

1. 在HTTP.sys中添加新绑定

$guid = [guid]::NewGuid().ToString("B")

$certHash = (gci Cert:\LocalMachine\My | where {$_.Subject -match "CN\=TestSSLBinding"} | Select -First 1).Thumbprint

netsh http add sslcert hostnameport=TestsslBinding:443 certhash="$certHash" certstorename=MY appid="$guid"

1. 使用New-WebBinding
向网站添加新绑定

New-WebBinding -Name TestWebsite -Protocol https -Port 443 -HostHeader TestsslBinding -IPAddress 192.168.1.108 -SslFlags 1

Setting existing SSL certificate on an IIS website which uses hostheader

Answer 7

  

new-item：该文件已存在时无法创建文件

预先删除0.0.0.0!443绑定可以为我解决此问题：

Get-Item IIS:\SslBindings\0.0.0.0!443 | Remove-Item

FYI：这是我制作的Powershell脚本，用于使用SNI / SSL主机头将通配符证书批量分配给没有显式IP绑定的站点，并且新证书的友好名称类似于*.example.com 2019

#SCRIPT FOR ADMIN POWERSHELL TO BULK ASSIGN A WILDCARD SSL CERTIFICATE TO ONE OR MORE WEBSITES USING SSL HOST HEADERS WITHOUT EXPLICIT IPS


# —————————————————————————————
# User Configurable Variables:
# —————————————————————————————
$wildcardDomain="*.example.com";    # This string should be present in the friendly name of the new SSL certificate

$yearMatchingNewCert="2019";    # This string should be UNIQUELY present in the friendly name of the new SSL certificate


# Make the IIS: drive available
Import-Module WebAdministration;



# —————————————————————————————
# Auto-Determine the certificate store to use from the usual 'My' or 'WebHosting' locations
# —————————————————————————————
$certInWebHostingStore=dir Cert:\localmachine\WebHosting | where-Object {$_.subject -like "$wildcardDomain*"};
$certInPersonalStore=dir Cert:\localmachine\My | where-Object {$_.subject -like "$wildcardDomain*"};
if ($certInWebHostingStore) {$certStoreDir="WebHosting"} elseif ($certInPersonalStore) {$certStoreDir="My"} else {$certStoreDir=null};
$certStorePath="\localmachine\$certStoreDir";
echo "███ The NEW certificate is living in this store: $certStorePath";


# —————————————————————————————
# Get the Thumbprint of the NEW certificate
# —————————————————————————————
$certThumbHashNew=Get-ChildItem -Path Cert:$certStorePath | where-Object {$_.subject -like "$wildcardDomain*" -and $_.FriendlyName -like "*$yearMatchingNewCert*"} | Select-Object -ExpandProperty Thumbprint;
echo "███ The NEW certificate's thumbprint hash is: $certThumbHashNew"; # If this displays as empty then you have either not installed the certificate, it's not in the usual Certificate stores or the certificate friendly name doesn't match the pattern "*.example.com 2019" e.g. "*.example.com (2018-2021)"



# —————————————————————————————
# Display the existing bindings
# —————————————————————————————
#Dir IIS:\SslBindings;                      # Shows all bindings
#Dir IIS:\SslBindings\!443!*;               # Shows all port 443 bindings
Dir IIS:\SslBindings\!443!$wildcardDomain;  # Shows all bindings in use matching the wildcard certificate



# —————————————————————————————
# Remove the Existing Bindings
# —————————————————————————————
# NOTE: SNI settings are in the Registry if all else fails: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTTP\Parameters\SslSniBindingInfo
Get-Item IIS:\SslBindings\!443!$wildcardDomain | Remove-Item;



# —————————————————————————————
# Add the New Bindings
# —————————————————————————————
Get-Item -Path "cert:$certStorePath\$certThumbHashNew" | New-Item -Path IIS:\SslBindings\!443!$wildcardDomain;



# —————————————————————————————
# The IIS Manager doesn't seem to update its GUI without this bit
# —————————————————————————————
#(Get-WebBinding -Port 443 -Protocol "https" -HostHeader $wildcardDomain).RemoveSslCertificate($certThumbHashNew, $certStoreDir);
(Get-WebBinding -Port 443 -Protocol "https" -HostHeader $wildcardDomain).AddSslCertificate($certThumbHashNew, $certStoreDir);

很奇怪，在获得新的控制台会话之前，在PowerShell中查看更改（列出绑定）不会显示更改，因此请关闭并重新打开Admin PowerShell窗口。

# —————————————————————————————
# User Configurable Variables:
# —————————————————————————————
$wildcardDomain="*.example.com";
# —————————————————————————————


# Make the IIS: drive available
Import-Module WebAdministration;


# —————————————————————————————
# Display the new bindings
# —————————————————————————————
Dir IIS:\SslBindings\!443!$wildcardDomain



# —————————————————————————————
# Troubleshooting
# —————————————————————————————
# If things go awry, the 0.0.0.0 address usually seems to be at fault, particularly if the error is "New-Item : Cannot create a file when that file already exists"
# To remove it follow these steps, then start over with the previous script again:
# View all the port 443 bindings, not just the ones matching our wilcard:
#Dir IIS:\SslBindings\!443!*
# If the 0.0.0.0 binding shows in the list then use this to drop it:
#Get-Item IIS:\SslBindings\0.0.0.0!443 | Remove-Item

制作此脚本时使用的参考文献：

• 此线程
• https://blogs.technet.microsoft.com/heyscriptingguy/2015/03/01/weekend-scripter-use-powershell-to-update-ssl-bindings/
• https://docs.microsoft.com/en-us/iis/manage/powershell/powershell-snap-in-configuring-ssl-with-the-iis-powershell-snap-in