证书已安装在机器上。现在我想授予应用程序用户对证书私钥的读取权限。
这就是答案。
创建了一个powershell脚本文件AddUserToCertificate.ps1
这是脚本文件的内容。
param(
[string]$userName,
[string]$permission,
[string]$certStoreLocation,
[string]$certThumbprint
);
# check if certificate is already installed
$certificateInstalled = Get-ChildItem cert:$certStoreLocation | Where thumbprint -eq $certThumbprint
# download & install only if certificate is not already installed on machine
if ($certificateInstalled -eq $null)
{
$message="Certificate with thumbprint:"+$certThumbprint+" does not exist at "+$certStoreLocation
Write-Host $message -ForegroundColor Red
exit 1;
}else
{
try
{
$rule = new-object security.accesscontrol.filesystemaccessrule $userName, $permission, allow
$root = "c:\programdata\microsoft\crypto\rsa\machinekeys"
$l = ls Cert:$certStoreLocation
$l = $l |? {$_.thumbprint -like $certThumbprint}
$l |%{
$keyname = $_.privatekey.cspkeycontainerinfo.uniquekeycontainername
$p = [io.path]::combine($root, $keyname)
if ([io.file]::exists($p))
{
$acl = get-acl -path $p
$acl.addaccessrule($rule)
echo $p
set-acl $p $acl
}
}
}
catch
{
Write-Host "Caught an exception:" -ForegroundColor Red
Write-Host "$($_.Exception)" -ForegroundColor Red
exit 1;
}
}
exit $LASTEXITCODE
现在将其作为部署的一部分运行。在 powershell 控制台窗口中运行上述脚本的示例。
C:\>.\AddUserToCertificate.ps1 -userName testuser1 -permission read -certStoreLocation \LocalMachine\My -certThumbprint 1fb7603985a8a11d3e85abee194697e9784a253
此示例向用户 testuser1 授予安装在 \LocalMachine\My 中的证书的 read 权限，并具有指纹 1fb7603985a8a11d3e85abee194697e9784a253
如果您使用 ApplicationPoolIdentity，那么您的用户名将为 'IIS AppPool\AppPoolNameHere'
注意：您需要使用' '，因为 IIS 和 AppPool 之间有一个空格。
接受的答案对我不起作用，因为
$_.privatekeyparam (
[string]$certStorePath = "Cert:\LocalMachine\My",
[string]$AppPoolName,
[string]$certThumbprint
)
Import-Module WebAdministration
$certificate = Get-ChildItem $certStorePath | Where thumbprint -eq $certThumbprint
if ($certificate -eq $null)
{
$message="Certificate with thumbprint:"+$certThumbprint+" does not exist at "+$certStorePath
Write-Host $message -ForegroundColor Red
exit 1;
}else
{
$rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($certificate)
$fileName = $rsaCert.key.UniqueName
$path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\Keys\$fileName"
$permissions = Get-Acl -Path $path
$access_rule = New-Object System.Security.AccessControl.FileSystemAccessRule("IIS AppPool\$AppPoolName", 'Read', 'None', 'None', 'Allow')
$permissions.AddAccessRule($access_rule)
Set-Acl -Path $path -AclObject $permissions
}
几周前，我注意到某些东西发生了变化（我怀疑是 Windows 更新），并破坏了某些证书使用 Michael Armitage 脚本中引用的
CspKeyContainerInfo.UniqueKeyContainerName$serviceUser = "DOMAIN\Service User"
$certificate = Get-ChildItem Cert:\LocalMachine\My | Where-Object Thumbprint -eq "certificatethumbprint"
$privateKey = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($certificate)
$containerName = ""
if ($privateKey.GetType().Name -ieq "RSACng")
{
$containerName = $privateKey.Key.UniqueName
}
else
{
$containerName = $privateKey.CspKeyContainerInfo.UniqueKeyContainerName
}
$keyFullPath = $env:ProgramData + "\Microsoft\Crypto\RSA\MachineKeys\" + $containerName;
if (-Not (Test-Path -Path $keyFullPath -PathType Leaf))
{
throw "Unable to get the private key container to set permissions."
}
# Get the current ACL of the private key
$acl = (Get-Item $keyFullPath).GetAccessControl()
# Add the new ACE to the ACL of the private key
$accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($serviceUser, "Read", "Allow")
$acl.AddAccessRule($accessRule);
# Write back the new ACL
Set-Acl -Path $keyFullPath -AclObject $acl;
您当然希望调整/增强它以满足您的特定需求。
添加 Michael Armitage 脚本，这适用于存在 PrivateKey 值和空白的情况
function setCertificatePermission {
param($accountName, $certificate)
if([string]::IsNullOrEmpty($certificate.PrivateKey))
{
$rsaCert = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($certificate)
$fileName = $rsaCert.key.UniqueName
$path = "$env:ALLUSERSPROFILE\Microsoft\Crypto\Keys\$fileName"
$permissions = Get-Acl -Path $path
$access_rule = New-Object System.Security.AccessControl.FileSystemAccessRule($accountName, 'FullControl', 'None', 'None', 'Allow')
$permissions.AddAccessRule($access_rule)
Set-Acl -Path $path -AclObject $permissions
} else{
$user = New-Object System.Security.Principal.NTAccount($accountName)
$accessRule = New-Object System.Security.AccessControl.CryptoKeyAccessRule($user, 'FullControl', 'Allow')
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My","LocalMachine")
$store.Open("ReadWrite")
$rwCert = $store.Certificates | where {$_.Thumbprint -eq $certificate.Thumbprint}
$csp = New-Object System.Security.Cryptography.CspParameters($rwCert.PrivateKey.CspKeyContainerInfo.ProviderType, $rwCert.PrivateKey.CspKeyContainerInfo.ProviderName, $rwCert.PrivateKey.CspKeyContainerInfo.KeyContainerName)
$csp.Flags = "UseExistingKey","UseMachineKeyStore"
$csp.CryptoKeySecurity = $rwCert.PrivateKey.CspKeyContainerInfo.CryptoKeySecurity
$csp.KeyNumber = $rwCert.PrivateKey.CspKeyContainerInfo.KeyNumber
$csp.CryptoKeySecurity.AddAccessRule($AccessRule)
$rsa2 = New-Object System.Security.Cryptography.RSACryptoServiceProvider($csp)
$store.close()
}
}
作为上述脚本的替代。您可以使用 PowerShell 模块。我自己没有尝试过，但模块看起来不错。 http://get-carbon.org/index.html
您可以使用WinHttpCertCfg.exe，一个证书配置工具 链接：https://learn.microsoft.com/en-us/windows/desktop/winhttp/winhttpcertcfg-exe--a-certificate-configuration-tool
一些代码示例：
Set privatekeyAcces to [email protected]
*.\WinHttpCertCfg.exe -g -c LOCAL_MACHINE\MY -s *.d365.mydomain.com -a "[email protected]"*
最近看到这篇文章，想加入我使用的简化代码。
它取自上面的脚本，并进行了一些简化（在我看来）。
每 45 天左右生成一个新证书时，我用它来设置 Let's Encrypt 证书的权限。因此，主题中的名称相同并选择最新的。
它需要证书的一部分或完整主题，然后是要添加的用户名以及可选的 FullControl。如果未指定任何内容，则默认仅读取密钥。它还支持运行前-WhatIf。
诗。使用 ChatGPT 进行初始代码，并通过 FleshCPU 进行测试 🧠 😉
function Set-CertificatePrivateKeyPermission {
[CmdletBinding(SupportsShouldProcess=$true)]
param(
[string]$certSubjectPart,
[string]$adUsername,
[ValidateSet('Read','FullControl')]
[string]$permissionType = 'Read'
)
try {
# Find the newest certificate that matches the subject part
$newestCert = Get-ChildItem -Path Cert:\LocalMachine\My |
Where-Object { $_.Subject -like "*$certSubjectPart*" } |
Sort-Object NotBefore -Descending |
Select-Object -First 1
if ($newestCert -eq $null) {
Write-Error "No certificate found with subject part '$certSubjectPart'"
return
}
# Define the private key path
$root = "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys"
$keyname = $newestCert.PrivateKey.CspKeyContainerInfo.UniqueKeyContainerName
$path = [IO.Path]::Combine($root, $keyname)
if ([IO.File]::Exists($path)) {
if ($PSCmdlet.ShouldProcess($path, "Add $permissionType permission for $adUsername")) {
# Creating the access rule for the user
$rule = new-object Security.AccessControl.FileSystemAccessRule $adUsername, $permissionType, 'Allow'
$acl = Get-Acl -Path $path
$acl.AddAccessRule($rule)
Set-Acl -Path $path -AclObject $acl
Write-Host "Permissions would be updated for certificate with thumbprint: $($newestCert.Thumbprint)"
}
} else {
Write-Error "Private key file not found."
}
} catch {
Write-Host "Caught an exception:" -ForegroundColor Red
Write-Host "$($_.Exception)" -ForegroundColor Red
exit 1;
}
}