Functions/Set-IisCert.ps1
|
function Set-IisCert { <# .SYNOPSIS Updates an IIS binding to use the specified certificate .DESCRIPTION Compares the current certificate used by the binding to the specified certificate (based on thumbprint). Certificate is stored in LocalMachine\WebHosting certificate store. Updates IIS binding certificate if thumbprint different. .OUTPUTS $True if binding was updated. $False if binding was not updated. .EXAMPLE Set-IisCert -Certificate $pfxCert -PfxPassword "!234SECRETbc123" -Port 443 -IisSite "Default Web Site" -SniHostName "test.mysite.com" Updates the IIS site's binding to use the specified certificate. #> [OutputType([bool])] param ( [Parameter(ValueFromPipeline = $true, Mandatory = $true)] [string] $Certificate, [Parameter(Mandatory = $true)] [string] $PfxPassword, [Parameter(Mandatory = $true)] [int] $Port, [Parameter(Mandatory = $true)] [string] $IisSite, [Parameter(Mandatory = $true)] [string] $SniHostName ) $isPem = $Certificate.StartsWith("-----BEGIN CERTIFICATE-----") if ($isPem) { throw "PEM format not supported" } $bytes = [Convert]::FromBase64String($Certificate) $xCert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection $xCert.Import($bytes, $PfxPassword, "DefaultKeySet") $thumbprint = ($xCert.Thumbprint | select -last 1) $binding = Get-WebBinding -Name $IisSite -Port $Port -Protocol "https" | Where-Object { ($_.bindingInformation -Split ":")[-1] -eq $SniHostName } $updateCert = $True if ($binding) { # Compare thumbprint $updateCert = $binding.certificateHash -ne $thumbprint } else { throw "Unable to locate IIS binding: $IisSite`:$Port`:$SniHostName" } if ($updateCert) { Write-Host "Binding thumbprint $($binding.certificateHash) does not match available thumbprint $thumbprint" $tempFile = New-TemporaryFile try { # Save cert to temp location that will be deleted after [IO.File]::WriteAllBytes($tempFile, $bytes) $securePwd = ConvertTo-SecureString -String $PfxPassword -AsPlainText -Force $importedCert = (Import-PfxCertificate -FilePath $tempFile -Password $securePwd -CertStoreLocation Cert:\LocalMachine\WebHosting -Verbose) $binding.AddSslCertificate($importedCert.Thumbprint, "WebHosting") } finally { Remove-Item $tempFile } } else { Write-Host "Binding certificate same as available certificate" } return $updateCert } |