使用PowerShell将IIS SSL证书分配给与主机标头绑定
问题描述 投票：8回答：7
我正在尝试将证书分配给HTTPS绑定。不幸的是，我从PowerShell收到此错误：
new-item : Cannot create a file when that file already exists
At line:3 char:56
+ get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBi ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [New-Item], Win32Exception
+ FullyQualifiedErrorId : System.ComponentModel.Win32Exception,Microsoft.PowerShell.Commands.NewItemCommand
我执行的PowerShell是：
New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"} | Select-Object -ExpandProperty Thumbprint
get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBindings\0.0.0.0!443!$Name.domain.com
它似乎能够找到证书，但无法将其分配给创建的绑定。使用正确的IP / Port / HostHeader创建绑定，检查SNI，但SSL证书是“未选中”
从IIS管理器一切正常
我尝试过SO和其他网站的各种说明，例如： http://technet.microsoft.com/en-us/magazine/jj871065.aspx Powershell IIS7 Snap in Assign SSL certificate to https binding Powershell - Add SSL binding using shared certificate
另外，我试过了
IIS:\SslBindings\0.0.0.0!443!$Name.domain.com
和
IIS:\SslBindings\0.0.0.0!443
证书的主题是cloud.domain.com，以及多个SAN属性，例如适用于**。domain.com *，domain.com，**。seconddomain.com *，seconddomain.com，cloud.domain.com
编辑：
现在我正在使用这种方法，它确实有效：
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert hostnameport=$Name.domain.com:443 certhash=b58e54ca68c94f93c134c5da00a388ab0642a648 certstorename=MY appid="$guid"
我仍然对没有netsh / appcmd的解决方案感兴趣
7个回答
5
投票
投票
以下是我能够为机器FQDN生成自签名证书以及添加SSL证书和绑定的方法。
$fqdn = "$((Get-WmiObject win32_computersystem).DNSHostName).$((Get-WmiObject win32_computersystem).Domain)"
$cert=(Get-ChildItem cert:\LocalMachine\My | where-object { $_.Subject -match "CN=$fqdn" } | Select-Object -First 1)
if ($cert -eq $null) {
$cert = New-SelfSignedCertificate -DnsName $fqdn -CertStoreLocation "Cert:\LocalMachine\My"
}
$binding = (Get-WebBinding -Name SiteNameHere | where-object {$_.protocol -eq "https"})
if($binding -ne $null) {
Remove-WebBinding -Name SiteNameHere -Port 443 -Protocol "https" -HostHeader $fqdn
}
New-WebBinding -Name SiteNameHere -Port 443 -Protocol https -HostHeader $fqdn
(Get-WebBinding -Name SiteNameHere -Port 443 -Protocol "https" -HostHeader $fqdn).AddSslCertificate($cert.Thumbprint, "my")
3
投票
投票
现在我正在使用这种方法，它确实有效：
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert hostnameport=$Name.domain.com:443 certhash=b58e54ca68c94f93c134c5da00a388ab0642a648 certstorename=MY appid="$guid"
2
投票
投票
基于@ElanHasson的回答，我制作了这个脚本，它将制作一个自签名的TLS证书并将其应用到网站上。它可以整理一下，但它有效：
Clear-Host
$certificateDnsName = 'my.localcert.ssl' # a name you want to give to your certificate (can be anything you want for localhost)
$siteName = "Default Web Site" # the website to apply the bindings/cert to (top level, not an application underneath!).
$fqdn = "" #fully qualified domain name (empty, or e.g 'contoso.com')
# ----------------------------------------------------------------------------------------
# SSL CERTIFICATE CREATION
# ----------------------------------------------------------------------------------------
# create the ssl certificate that will expire in 2 years
$newCert = New-SelfSignedCertificate -DnsName $certificateDnsName -CertStoreLocation cert:\LocalMachine\My -NotAfter (Get-Date).AddYears(2)
"Certificate Details:`r`n`r`n $newCert"
# ----------------------------------------------------------------------------------------
# IIS BINDINGS
# ----------------------------------------------------------------------------------------
$webbindings = Get-WebBinding -Name $siteName
$webbindings
$hasSsl = $webbindings | Where-Object { $_.protocol -like "*https*" }
if($hasSsl)
{
Write-Output "ERROR: An SSL certificate is already assigned. Please remove it manually before adding this certificate."
Write-Output "Alternatively, you could just use that certificate (provided it's recent/secure)."
}
else
{
"Applying TLS/SSL Certificate"
New-WebBinding -Name $siteName -Port 443 -Protocol https -HostHeader $fqdn #could add -IPAddress here if needed (and for the get below)
(Get-WebBinding -Name $siteName -Port 443 -Protocol "https" -HostHeader $fqdn).AddSslCertificate($newCert.Thumbprint, "my")
"`r`n`r`nNew web bindings"
$webbindings = Get-WebBinding -Name $siteName
$webbindings
}
"`r`n`r`nTLS/SSL Assignment Complete"
使用fqdn为空（并且没有分配-IPAddress），它将在IIS中为您提供：
1
投票
投票
我不熟悉IIS，但是错误说绑定（文件）已经存在，所以你没有添加SSL绑定，你似乎正在更新它。尝试将-Force添加到New-Item命令。如果它像文件一样工作，它应该覆盖现有的绑定。喜欢：
New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"} | Select-Object -ExpandProperty Thumbprint
get-item -Path "cert:\localmachine\my\$cert" | new-item -path IIS:\SslBindings\0.0.0.0!443!$Name.domain.com -Force
0
投票
投票
我遇到了SNI和powershell的一些问题。我错过的一个重要步骤实际上是在证书的导入过程中。您需要确保证书被标记为“可导出”，否则webadministration模块将无法与其绑定。
如果你有，那么你的原始脚本应该工作。虽然，我个人更喜欢使用证书变量而不是指纹。
像这样：
New-WebBinding -name $Name -Protocol https -HostHeader "$Name.domain.com" -Port 443 -SslFlags 1
$cert = Get-ChildItem -Path Cert:\LocalMachine\My | where-Object {$_.subject -like "*cloud.domain.com*"}
New-Item -Path "IIS:\SslBindings\!443!$Name.domain.com" -Value $cert -SSLFlags 1
0
投票
投票
new-item：当该文件已存在时，无法创建文件
事先删除0.0.0.0!443绑定为我修复了这个问题：
Get-Item IIS:\SslBindings\0.0.0.0!443 | Remove-Item
仅供参考：这是一个Powershell脚本，我使用SNI / SSL主机标头批量分配通配符证书而没有明确的IP绑定，并且新证书的友好名称就像*.example.com 2019
#SCRIPT FOR ADMIN POWERSHELL TO BULK ASSIGN A WILDCARD SSL CERTIFICATE TO ONE OR MORE WEBSITES USING SSL HOST HEADERS WITHOUT EXPLICIT IPS
# —————————————————————————————
# User Configurable Variables:
# —————————————————————————————
$wildcardDomain="*.example.com"; # This string should be present in the friendly name of the new SSL certificate
$yearMatchingNewCert="2019"; # This string should be UNIQUELY present in the friendly name of the new SSL certificate
# Make the IIS: drive available
Import-Module WebAdministration;
# —————————————————————————————
# Auto-Determine the certificate store to use from the usual 'My' or 'WebHosting' locations
# —————————————————————————————
$certInWebHostingStore=dir Cert:\localmachine\WebHosting | where-Object {$_.subject -like "$wildcardDomain*"};
$certInPersonalStore=dir Cert:\localmachine\My | where-Object {$_.subject -like "$wildcardDomain*"};
if ($certInWebHostingStore) {$certStoreDir="WebHosting"} elseif ($certInPersonalStore) {$certStoreDir="My"} else {$certStoreDir=null};
$certStorePath="\localmachine\$certStoreDir";
echo "███ The NEW certificate is living in this store: $certStorePath";
# —————————————————————————————
# Get the Thumbprint of the NEW certificate
# —————————————————————————————
$certThumbHashNew=Get-ChildItem -Path Cert:$certStorePath | where-Object {$_.subject -like "$wildcardDomain*" -and $_.FriendlyName -like "*$yearMatchingNewCert*"} | Select-Object -ExpandProperty Thumbprint;
echo "███ The NEW certificate's thumbprint hash is: $certThumbHashNew"; # If this displays as empty then you have either not installed the certificate, it's not in the usual Certificate stores or the certificate friendly name doesn't match the pattern "*.example.com 2019" e.g. "*.example.com (2018-2021)"
# —————————————————————————————
# Display the existing bindings
# —————————————————————————————
#Dir IIS:\SslBindings; # Shows all bindings
#Dir IIS:\SslBindings\!443!*; # Shows all port 443 bindings
Dir IIS:\SslBindings\!443!$wildcardDomain; # Shows all bindings in use matching the wildcard certificate
# —————————————————————————————
# Remove the Existing Bindings
# —————————————————————————————
# NOTE: SNI settings are in the Registry if all else fails: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\HTTP\Parameters\SslSniBindingInfo
Get-Item IIS:\SslBindings\!443!$wildcardDomain | Remove-Item;
# —————————————————————————————
# Add the New Bindings
# —————————————————————————————
Get-Item -Path "cert:$certStorePath\$certThumbHashNew" | New-Item -Path IIS:\SslBindings\!443!$wildcardDomain;
# —————————————————————————————
# The IIS Manager doesn't seem to update its GUI without this bit
# —————————————————————————————
#(Get-WebBinding -Port 443 -Protocol "https" -HostHeader $wildcardDomain).RemoveSslCertificate($certThumbHashNew, $certStoreDir);
(Get-WebBinding -Port 443 -Protocol "https" -HostHeader $wildcardDomain).AddSslCertificate($certThumbHashNew, $certStoreDir);
奇怪的是，在获得新的控制台会话之前，查看PowerShell中的更改（列出绑定）不会显示更改，因此请关闭并重新打开Admin PowerShell窗口。
# —————————————————————————————
# User Configurable Variables:
# —————————————————————————————
$wildcardDomain="*.example.com";
# —————————————————————————————
# Make the IIS: drive available
Import-Module WebAdministration;
# —————————————————————————————
# Display the new bindings
# —————————————————————————————
Dir IIS:\SslBindings\!443!$wildcardDomain
# —————————————————————————————
# Troubleshooting
# —————————————————————————————
# If things go awry, the 0.0.0.0 address usually seems to be at fault, particularly if the error is "New-Item : Cannot create a file when that file already exists"
# To remove it follow these steps, then start over with the previous script again:
# View all the port 443 bindings, not just the ones matching our wilcard:
#Dir IIS:\SslBindings\!443!*
# If the 0.0.0.0 binding shows in the list then use this to drop it:
#Get-Item IIS:\SslBindings\0.0.0.0!443 | Remove-Item
用于制作此脚本的参考：
0
投票
投票
以下方法对我有用：
在HTTP.sys中添加新的SSL配置后，将新绑定添加到网站，并将SslFlags设置为1，如下所示
- 在HTTP.sys中添加新绑定
$guid = [guid]::NewGuid().ToString("B")
$certHash = (gci Cert:\LocalMachine\My | where {$_.Subject -match "CN\=TestSSLBinding"} | Select -First 1).Thumbprint
netsh http add sslcert hostnameport=TestsslBinding:443 certhash="$certHash" certstorename=MY appid="$guid"
- 使用New-WebBinding向网站添加新绑定
New-WebBinding -Name TestWebsite -Protocol https -Port 443 -HostHeader TestsslBinding -IPAddress 192.168.1.108 -SslFlags 1
Setting existing SSL certificate on an IIS website which uses hostheader
最新问题
- Tinymce - 自动完成器与 Angular 集成
- 二进制流中 `size_t` 的兼容性
- 空手道验证响应密钥：Json 对象架构或空数组|对象
- 设置单元格的宽度，使用itext 7
- 测试JPA应用程序时如何管理事务
- HTTPStatusError：URL“http://localhost:11434/api/chat”的客户端错误“404 Not Found”
- ORA-12838 如何在删除和插入之前预先测试查询？
- VSCode：无法写入工作区设置，因为没有打开工作区。请先打开一个工作区然后重试
- getVolatile 和 getAcquire 有什么区别？
- Chrome 中的 CSS 背景图像错误
- SQLSTATE[28000]：[Microsoft][SQL Server 的 ODBC 驱动程序 17][SQL Server]用户登录失败
- 在 Chrome 中恢复输入类型=数字微调器
- 如何在 Tkinter python 中创建加载屏幕？
- 如何使用 TypeORM 正确使用 orWhere 查询进行查询
- AWS Elastic Beanstalk - 标记 EBS 卷
- 用 C 处理管道同步和进程通信以读取和处理 CSV 数据
- 突然，Expo SDK 48 iOS 构建在快速通道中失败了
- 如何维护不同 clang-format 版本的 .clang-format 文件？
- 透明按钮旁边的小超链接线，上面覆盖有图像
- 使用 CUDA 的 Halide 应用程序给出错误的分配编译错误
© www.soinside.com 2019 - 2024. All rights reserved.