Advertisement
Guest User

Untitled

a guest
Dec 2nd, 2024
38
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Invoke-Command -ComputerName $computer -credential $cred -Authentication CredSSP -ScriptBlock {
  2.     param($csr, $ca_template_name, $ca_name)
  3.  
  4.     function cleanTempfiles() {
  5.         param(
  6.             [String[]] $files
  7.         )
  8.         Remove-Item -Path $files -Force -ErrorAction SilentlyContinue
  9.     }
  10.  
  11.     try {
  12.         #Step 1 --- Prepare and Clean any existing temporary files
  13.         $req = [System.IO.Path]::GetTempFileName()
  14.         $cer = Join-Path -Path $env:TEMP -ChildPath "temp.cer"
  15.         $rsp = Join-Path -Path $env:TEMP -ChildPath "temp.rsp"
  16.         cleanTempFiles -files $cer, $rsp
  17.  
  18.         #Step 2 --- Retrieve Microsoft CA name from domain configuration
  19.         $clean_ca_name = ""
  20.  
  21.         #No CA Name was provided --- attempt to get the CA Name from LDAP automatically
  22.         if(!$ca_name) {
  23.             $rootDse = [System.DirectoryServices.DirectoryEntry]'LDAP://RootDSE'
  24.             $sb = [System.DirectoryServices.DirectoryEntry]"LDAP://$($rootDse.configurationNamingContext)"
  25.             $cas = [System.DirectoryServices.DirectorySearcher]::new($sb,'objectClass=pKIEnrollmentService').FindAll()
  26.  
  27.             if($cas.Count -eq 1){
  28.                 $ca_name = "$($cas[0].Properties.dnshostname)\$($cas[0].Properties.cn)"
  29.                 $clean_ca_name = $ca_name
  30.             } else {
  31.                 #No CA Name was provided --- Multiple CAs on Host can't resolve CA Name automatically
  32.                 throw "Multiple CAs on Host, Please provide CA Name in routing policy"
  33.             }
  34.         }
  35.  
  36.         if (!$ca_name -eq "") {
  37.             $clean_ca_name = $ca_name
  38.             $ca_name = " -config `"$ca_name`""
  39.         }
  40.  
  41.         if(!$ca_template_name -eq "") {
  42.             $ca_template_name = " -attrib `"CertificateTemplate:$ca_template_name`""
  43.         }
  44.  
  45.         #Step 4 --- Execute request logic
  46.         Set-Content -Path $req -Value $csr
  47.  
  48.         #Step 4.4 -- Submit request to CA
  49.         $requestId = Invoke-Expression "certreq -f -q -submit $ca_template_name $ca_name `"$req`" `"$cer`" 2>&1"
  50.         $requestId = ($requestId -split '\n')[0]
  51.         $requestId = ($requestId -split ': ')[1]
  52.         $requestId = [int]$requestId
  53.  
  54.         if (!($LastExitCode -eq 0)) {
  55.             throw "certreq -f -q -submit command failed"
  56.         }
  57.  
  58.         #Step 4.5 --- Retrieve root CA pem
  59.         Invoke-Expression -Command "& certutil '-f' $ca_name '-ca.cert' 'ca.cer'" | Out-Null
  60.         Invoke-Expression -Command "& certutil '-f' '-encode' 'ca.cer' 'ca.pem'" | Out-Null
  61.         $root_pem = Get-Content -Path ca.pem | Out-String
  62.  
  63.         #Step 4.6 -- Parse certificate details from CA
  64.         $CaView = New-Object -ComObject CertificateAuthority.View
  65.         $CaView.OpenConnection($clean_ca_name)
  66.         $Table = "Request"
  67.         $CaView.SetTable(0x0)
  68.         $ColumnIndex = $CaView.GetColumnIndex(0,"RequestID")
  69.         $operator = @{"eq" = 1;"le" = 2; "lt" = 4; "ge" = 8; "gt" = 16}
  70.         $CaView.SetRestriction($ColumnIndex,$operator["eq"],0,$requestId)
  71.         $ColumnCount = $CaView.GetColumnCount(0)
  72.         $CaView.SetResultColumnCount($ColumnCount)
  73.         0..($ColumnCount - 1) | ForEach-Object {$CaView.SetResultColumn($_)}
  74.         $Row = $CaView.OpenView()
  75.         while ($Row.Next() -ne -1) {
  76.             $cert = New-Object psobject -Property @{
  77.                 ConfigString = $ConfigString;
  78.             }
  79.             $Column = $Row.EnumCertViewColumn()
  80.             while ($Column.Next() -ne -1) {
  81.                 $current = $Column.GetName()
  82.                 $Cert | Add-Member -MemberType NoteProperty $($Column.GetName()) –Value $($Column.GetValue(1)) –Force
  83.                 if ($Cert.CertificateTemplate -match "^(\d\.){3}") {
  84.                     $cert.CertificateTemplate = ([Security.Cryptography.Oid]$Column.GetValue(1)).FriendlyName
  85.                 }
  86.             }
  87.         }
  88.  
  89.         $cert | add-member -name "RootPem" -value $root_pem -memberType NoteProperty
  90.         $cert | ConvertTo-Json
  91.  
  92.     } catch {
  93.         Write-Error $_
  94.     } finally {
  95.         cleanTempfiles -files $cer, $req, $rsp
  96.     }
  97. } -ArgumentList ($csr, $ca_template_name, $ca_name)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement