Tag Archives: certificate

Get Certificate from remote computers

Leave a reply

If you need to get all certificates, from a list of remote computers, you can use this script:

$Servers = "kennethdalbjerg-dc01",
           "kennethdalbjerg-dc02",
           "kennethdalbjerg-exch01",
           "kennethdalbjerg-fs01"
 
  $Results = @()
  $Results = Invoke-Command -cn $Servers {
          $Certs = @{} | Select Certificate,Expired
          $Cert = Get-ChildItem Cert:\LocalMachine\My
          If($Cert){
              $Certs.Certificate = $Cert.subject
              $Certs.Expired = $Cert.NotAfter
          }
          Else{
              $Certs.Certificate = " - "
              $Certs.Expired = " - "
          }
          $Certs
  } | Select-Object @{n='ServerName';e={$_.pscomputername}},Certificate,Expired
 
  #Display results in console
  $Results | Sort-Object Expired -Descending
 
  #Save results to CSV file
  $Results | Sort-Object Expired -Descending | Export-Csv -Path C:\users\$env:username\desktop\cert_results.csv -NoTypeInformation -Force
 
  #Open results in new window
  $Results | Sort-Object Expired -Descending | Out-GridView -Title "Final results"

Installation of New Exchange server

Leave a reply

If you ever have installed a new Exchange server in an Active Directory orgainisation that allready have an Exchange server (That’s not so often anymore), you may have discovered that users get Certificate warning in Outlook, unto you have changed the URL’s to match the certificates.

But I found this script on Github: https://gist.github.com/kevinblumenfeld/31b03bf439b1f94f460eb754ef74120e

It copy the settings of all IIS url’s to the new Exchange server, when it found it in Active Directory.
So run this script before the start of the installation, and you will not receive the certificate warnings after the installation.

VMWare – Certificate Status Trigger alarm Alert

Leave a reply

Back in December i replaced my Certificate on my VMWare Appliance with a our new Wildcard certificate.
But here in January, i got an alarm saying “Certificate Alarm” and it trigger it as an Alert.

Searching around for a solution, on what certificate that expire soon, i found this command:

for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

It showing me that a backup mackine certificate is expiring

STORE MACHINE_SSL_CERT
Alias : __MACHINE_CERT
            Not After : Jan 15 14:20:36 2022 GMT
STORE TRUSTED_ROOTS
Alias : b4a1550d09628bfe628d2685fe24f2b67afb9855
            Not After : Jan 31 10:55:48 2025 GMT
Alias : 7a1f6edf1e16498c4eff9190fa5ef6742bbdde0e
            Not After : Dec  4 14:03:36 2026 GMT
Alias : 909c4328a37dcff3d72de88c51df6f63600fc3f3
            Not After : Dec  4 14:03:36 2026 GMT
Alias : 98c6a8dc887963ba3cf9c2731cbdd3f7de05ac2d
            Not After : Nov  6 12:23:33 2027 GMT
Alias : 91c489ecb94b64e2eeffe438a0ad3fc1465959a2
            Not After : Jan 15 14:20:36 2022 GMT
Alias : 4c27431717565a3a07f3e6d0032c4258949cf9ec
            Not After : Feb 20 10:00:00 2024 GMT
Alias : b1bc968bd4f49d622aa89a81f2150152a41d829c
            Not After : Jan 28 12:00:00 2028 GMT
STORE TRUSTED_ROOT_CRLS
Alias : bcd1699f713eabf1dbd8a21618ea6b0487adbdc8
STORE STS_INTERNAL_SSL_CERT
Alias : __MACHINE_CERT
            Not After : Dec  4 14:03:36 2026 GMT
STORE machine
Alias : machine
            Not After : Jan 31 10:55:48 2025 GMT
STORE vsphere-webclient
Alias : vsphere-webclient
            Not After : Jan 31 10:55:48 2025 GMT
STORE vpxd
Alias : vpxd
            Not After : Jan 31 10:55:48 2025 GMT
STORE vpxd-extension
Alias : vpxd-extension
            Not After : Jan 31 10:55:48 2025 GMT
STORE SMS
Alias : sms_self_signed
            Not After : Feb  3 11:51:48 2025 GMT
STORE BACKUP_STORE
Alias : bkp___MACHINE_CERT
            Not After : Jan 20 12:00:00 2021 GMT
Alias : bkp_machine
            Not After : Jan 31 10:55:48 2025 GMT
Alias : bkp_vsphere-webclient
            Not After : Jan 31 10:55:48 2025 GMT
Alias : bkp_vpxd
            Not After : Jan 31 10:55:48 2025 GMT
Alias : bkp_vpxd-extension
            Not After : Jan 31 10:55:48 2025 GMT

So i exported this Machine certificate to a CRT file, and then deleted it with these commands

mkdir /certificates

/usr/lib/vmware-vmafd/bin/vecs-cli entry getcert --store BACKUP_STORE --alias bkp___MACHINE_CERT --output /certificates/old_machine.crt

/usr/lib/vmware-vmafd/bin/vecs-cli entry delete --store BACKUP_STORE --alias bkp___MACHINE_CERT -y

It then tell me that the certificate have been deleted

Deleted entry with alias [bkp___MACHINE_CERT] in store [BACKUP_STORE] successfully

Also running this command again

for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

Show that the certificate have now gone.

Update Service with new SSL certificate

Leave a reply

Some service SSL certificate is adminstrate though netsh

start netsh, though a CMD, with just type: netsh

If you then type: http show sslcert, you can see SSL certificate information:

netsh>http show sslcert
SSL Certificate bindings:
-------------------------
IP:port                      : 0.0.0.0:443
Certificate Hash             : 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5
Application ID               : {4dc3e181-e14b-4a21-b022-59fc669b0914}
Certificate Store Name       : (null)
Verify Client Certificate Revocation : Enabled
Verify Revocation Using Cached Client Certificate Only : Disabled
Usage Check                  : Enabled
Revocation Freshness Time    : 0
URL Retrieval Timeout        : 0
Ctl Identifier               : (null)
Ctl Store Name               : (null)
DS Mapper Usage              : Disabled
Negotiate Client Certificate : Disabled

So to update this ssl certificate you type:

netsh>http add sslcert ipport=0.0.0.0:443 certhash=5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 appid={4dc3e181-e14b-4a21-b022-59fc669b0914}

Where 5f5bd1c99549b2fd7d772d32a60b8a2ba38bedd5 is the thumbprint of the SSL certificate. The thumbprint of a certificate can be found by running this powershell commands:

Get-ChildItem -path cert:\LocalMachine\My

Enterprise Root CA can’t issue more than 2-year certificate

Leave a reply

If you want to issue a certificate with 20 years expiration, run this commands:

certutil -setreg ca\ValidityPeriodUnits 20

certutil -setreg ca\ValidityPeriod "Years"

net stop certsvc

net start certsvc

 

To issues a certificate with a template, run this command

certreq -submit -attrib "CertificateTemplate:CertificateTemplateName" CSRfile.csr