Enroll-WebServerCert

[cmdletbinding()]
Param()

function New-CertificateRequest {
Param(
[Parameter(Mandatory=$true, HelpMessage = "Please enter the subject beginning with CN=")]
[ValidatePattern("CN=")]
[string]$subject,
[Parameter(Mandatory=$false, HelpMessage = "Please enter the SAN domains as a comma separated list")]
[array]$SANs,
[Parameter(Mandatory=$false, HelpMessage = "Please enter the Online Certificate Authority")]
[string]$OnlineCA,
[Parameter(Mandatory=$false, HelpMessage = "Please enter the Online Certificate Authority")]
[string]$CATemplate = "WebServer"
)

    ### Preparation
    $subjectDomain = $subject.split(',')[0].split('=')[1]
    If ($subjectDomain -match "\*.")
        {
            $subjectDomain = $subjectDomain -replace "\*", "star"
        }
    $CertificateINI = "$subjectDomain.ini"
    $CertificateREQ = "$subjectDomain.req"
    $CertificateRSP = "$subjectDomain.rsp"
    $CertificateCER = "$subjectDomain.cer"

    ### INI file generation
    new-item -type file $CertificateINI -force
    add-content $CertificateINI '[Version]'
    add-content $CertificateINI 'Signature="$Windows NT$"'
    add-content $CertificateINI ''
    add-content $CertificateINI '[NewRequest]'
    $temp = 'Subject="' + $subject + '"'
    add-content $CertificateINI $temp
    add-content $CertificateINI 'Exportable=TRUE'
    add-content $CertificateINI "FriendlyName=$env:computername.$env:userdnsdomain - Web Server $($(Get-Date).ToShortDateString())"
    add-content $CertificateINI 'KeyLength=2048'
    add-content $CertificateINI 'KeySpec=1'
    add-content $CertificateINI 'KeyUsage=0xA0'
    add-content $CertificateINI 'MachineKeySet=True'
    add-content $CertificateINI 'ProviderName="Microsoft RSA SChannel Cryptographic Provider"'
    add-content $CertificateINI 'ProviderType=12'
    add-content $CertificateINI 'SMIME=FALSE'
    add-content $CertificateINI 'RequestType=PKCS10'
    add-content $CertificateINI '[Strings]'
    add-content $CertificateINI 'szOID_ENHANCED_KEY_USAGE = "2.5.29.37"'
    add-content $CertificateINI 'szOID_PKIX_KP_SERVER_AUTH = "1.3.6.1.5.5.7.3.1"'
    add-content $CertificateINI 'szOID_PKIX_KP_CLIENT_AUTH = "1.3.6.1.5.5.7.3.2"'
    if ($SANs)
        {
            add-content $CertificateINI 'szOID_SUBJECT_ALT_NAME2 = "2.5.29.17"'
            add-content $CertificateINI '[Extensions]'
            add-content $CertificateINI '2.5.29.17 = "{text}"'

            foreach ($SAN in $SANs)
                {
                    $temp = '_continue_ = "dns=' + $SAN + '&"'
                    add-content $CertificateINI $temp
                }
        }

    ### Certificate request generation
    if (test-path $CertificateREQ)
        {
            Remove-Item $CertificateREQ
        }
    certreq -new $CertificateINI $CertificateREQ

    ### Online certificate request and import
    if ($OnlineCA)
        {
            if (test-path $CertificateCER)
                {
                    Remove-Item $CertificateCER
                }
            if (test-path $CertificateRSP)
                {
                    Remove-Item $CertificateRSP
                }
            certreq -submit -attrib "CertificateTemplate:$CATemplate" -config $OnlineCA $CertificateREQ $CertificateCER

            certreq -accept $CertificateCER
        }
}

function Install-Cert {
Param(
[Parameter(Mandatory=$true, HelpMessage = "Please enter the name of the IIS Website you wish to bind your certificate to")]
[string]$iisSite = "Default Web Site"
)
Import-Module WebAdministration

#preparation
$cert = $($(Get-ChildItem Cert:\LocalMachine\my | Where-Object {$_.FriendlyName -like "*$($(Get-Date).ToShortDateString())*"}).Thumbprint)
Write-Output $cert

$bindings = Get-WebBinding

#see if any https bindings exist
ForEach ($binding in $bindings)
    {
        If ($binding.protocol -eq 'https')
            {
                $httpsBindingExist = $true
                break
            }
        else
            {
                $httpsBindingExist = $false
            }
    }

#create or update bindings and apply certs
If (!($httpsBindingExist))
    {
        New-WebBinding -Name $iisSite -Protocol https -IP '*' -Port 443
    }
If (Test-Path "IIS:\SslBindings\0.0.0.0!443")
    {
        Get-Item -path cert:\localmachine\my\$cert | Set-Item -path IIS:\Sslbindings\0.0.0.0!443
    }
else
    {
        Get-Item -path cert:\localmachine\my\$cert | New-Item -path IIS:\Sslbindings\0.0.0.0!443
    }
}



New-CertificateRequest -subject "CN=$env:computername.$env:USERDNSDOMAIN" -SANs "$env:computername.$env:USERDNSDOMAIN" -OnlineCA "{fqdn of ca\CA name}"

Install-Cert -iisSite "Default Web Site"
iisreset /noforce