Public/Add-NSServerCertificate.ps1
|
<#
Copyright 2015 Brandon Olin Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. #> function Add-NSServerCertificate { <# .SYNOPSIS Add server certificate to NetScaler appliance. .DESCRIPTION Add server certificate to NetScaler appliance. .EXAMPLE Add-NSServerCertificate -CAName 'webserver.example.com' -CommonName 'storefront.example.com' -OrganizationName 'My Company, Inc.' -CountryName "US" -StateName "Oregon" -KeyFileBits "2048" .PARAMETER Session The NetScaler session object. .PARAMETER CAName The FQDN of the Certification Authority host and Certification Authority name in the form CAHostNameFQDN\CAName .PARAMETER CommonName Fully qualified domain name for the company or web site. .PARAMETER OrganizationName Name of the organization that will use this certificate. .PARAMETER CountryName Two letter ISO code for your country. For example, US for United States. .PARAMETER StateName Full name of the state or province where your organization is located. Do not abbreviate. .PARAMETER KeyFileBits Size, in bits, of the private key. #> [cmdletbinding(SupportsShouldProcess = $true, ConfirmImpact='Low')] param( $Session = $script:session, [Parameter(Mandatory)] [string]$CAName, [Parameter(Mandatory)] [string]$CATemplate, [Parameter(Mandatory)] [ValidateLength(1,63)] [string]$CommonName, [Parameter(Mandatory)] [ValidateLength(1,63)] [string]$OrganizationName, [Parameter(Mandatory)] [ValidateLength(2,2)] [string]$CountryName, [Parameter(Mandatory)] [ValidateLength(1,127)] [string]$StateName, [ValidateRange(512,4096)] [int]$KeyFileBits = 2048 ) begin { _AssertSessionActive } process { if ($PSCmdlet.ShouldProcess($CommonName, 'Add server certificate')) { $fileName = $CommonName -replace "\*","wildcard" $certKeyFileName= "$($fileName).key" $certReqFileName = "$($fileName).req" $certFileName = "$($fileName).cert" # Temp files $certReqFileFull = "$($env:TEMP)\$certReqFileName" $certFileFull = "$($env:TEMP)\$certFileName" try { Write-Verbose -Message "Creating RSA key file for: $CommonName" $privKeyResp = Add-NSRSAKey -Session $session -Name $certKeyFileName -KeyFileBits $keyFileBits -PassThru -Force if ($privKeyResp.errorcode -ne 0) { throw $privKeyResp } Write-Verbose -Message 'Creating certificate request' $csrParams = @{ reqfile = $certReqFileName keyfile = $certKeyFileName commonname = $CommonName organizationname = $OrganizationName countryname = $CountryName statename = $StateName } _InvokeNSRestApi -Session $Session -Method POST -Type sslcertreq -Payload $csrParams -Action create Write-Verbose -Message 'Downloading certificate request' $downloadParams = @{ filelocation = "/nsconfig/ssl" } $response = _InvokeNSRestApi -Session $Session -Method GET -Type systemfile -Resource $certReqFileName -Arguments $downloadParams if (-not [String]::IsNullOrEmpty($response.systemfile.filecontent)) { $certReqContentBase64 = $response.systemfile.filecontent } else { throw "Certificate request file content returned empty" } $certReqContent = [System.Convert]::FromBase64String($certReqContentBase64) $certReqContent | Set-Content $certReqFileFull -Encoding Byte -Force Write-Verbose -Message "Requesting certificate for CN: $CommonName" certreq.exe -Submit -q -attrib "CertificateTemplate:$CATemplate" -config $CAName $certReqFileFull $certFileFull if (-not $? -or $LASTEXITCODE -ne 0) { throw "certreq.exe failed to request certificate" } Write-Verbose -Message 'Uploading certificate' if (Test-Path -Path $certFileFull) { $certContent = Get-Content -Path $certFileFull -Encoding "Byte" $certContentBase64 = [System.Convert]::ToBase64String($certContent) $certUploadParams = @{ filename = $certFileName filecontent = $certContentBase64 filelocation = '/nsconfig/ssl/' fileencoding = 'BASE64' } _InvokeNSRestApi -Session $Session -Method POST -Type systemfile -Payload $certUploadParams -Action add Write-Verbose -Message 'Creating certificate request' Add-NSCertKeyPair -Session $Session -CertKeyName $fileName -CertPath $certFileName -KeyPath $certKeyFileName } else { throw "Cert file '$certFileFull' not found." } catch { throw $_ } } finally { Write-Verbose -Message 'Cleaning up local temp files' Remove-Item -Path "$env:TEMP\$CommonName.*" -Force } } } } |