如何通过 Powershell 脚本设置 IIS 10.0 管理服务 SSL 证书以允许 Web 部署？

Question

当我运行 Windows 更新并 sysprep 我的 Amazon EC2 实例 (Windows Server 2016) 时，我必须创建一个新的自签名证书。然后我可以在 Management Service 屏幕中选择 SSL 证书（我将其命名为 WebDeploy）。我已经知道如何从 Windows Powershell 创建 SSL 证书，但我必须从屏幕截图的下拉列表中选择 SSL 证书。如何从命令行设置 SSL 证书？

以下是我尝试过但不起作用的方法 - 我能够避免错误，但没有一个错误允许 WebDeploy 在我没有进入 IIS 管理器屏幕并手动选择下拉列表的情况下工作。

Stop-Service wmsvc
$strGuid = New-Guid
Import-Module WebAdministration
Remove-Item -Path IIS:\SslBindings\0.0.0.0!8172
Get-Item -Path  "cert:\localmachine\my\$strHashThumbprint" | New-Item -Path 
IIS:\SslBindings\0.0.0.0!8172 
Start-Service wmsvc

而且，这也没用：

Stop-Service wmsvc
netsh http delete sslcert ipport=0.0.0.0:8172
netsh http add sslcert ipport=0.0.0.0:8172 certhash=$strHashThumbprint appid=`{$strGuid`} certstorename="MY" sslctlstorename="MY"
Start-Service wmsvc

最后，这没有用：

Stop-Service wmsvc
Add-NetIPHttpsCertBinding -IpPort "0.0.0.0:8172" -CertificateHash $strHash -CertificateStoreName "My" -ApplicationId "{$strGuid}" -NullEncryption $false 
Start-Service wmsvc

Answer 1

我终于在https://forums.iis.net/t/1238001.aspx找到了答案

我不确定是否需要受信任的根存储部分 - 没有它似乎一切正常，但我非常有信心需要更新注册表项。这是让它发挥作用的关键。

完整的脚本：

# Delete any existing certificates
Set-Location -Path "cert:\LocalMachine\My"
Get-ChildItem -Path "cert:\LocalMachine\My" | Remove-Item

#Create the new certificate
$strNewCertficate = New-SelfSignedCertificate -FriendlyName "WebDeploy" -DnsName "yoursite.com" -CertStoreLocation "cert:\LocalMachine\My" -NotAfter $([datetime]::now.AddYears(5))
$strHashThumbprint = $strNewCertficate.Thumbprint

#add it to the trusted root store
$trustedRootStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("root","LocalMachine")
$trustedRootStore.open("ReadWrite");
$trustedRootStore.add($strNewCertficate);

#Use the new certificate
Stop-Service wmsvc
$strGuid = New-Guid
netsh http delete sslcert ipport=0.0.0.0:8172
netsh http add sslcert ipport=0.0.0.0:8172 certhash=$strHashThumbprint appid=`{$strGuid`} certstorename="MY"

#convert thumbprint to bytes and update registry
$bytes = for($i = 0; $i -lt $strHashThumbprint.Length; $i += 2) { [convert]::ToByte($strHashThumbprint.SubString($i, 2), 16) }
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\WebManagement\Server' -Name IPAddress -Value "*";
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\WebManagement\Server' -Name SslCertificateHash -Value $bytes
Start-Service wmsvc

Answer 2

尽管有 IIS 版本，但这个问题似乎与...非常相似

How to assign an different SSL certificate for the IIS7+ Management Service on Server-Core?

# get the thumbprint for the certificate we want to use:
$thumb = (Get-ChildItem cert:\LocalMachine\MY | where-object { $_.FriendlyName -eq   "www.stackoverflow.com" } | Select-Object -First 1).Thumbprint
# get a new guid:
$guid = [guid]::NewGuid()

# remove the self-signed certificate:
& netsh http delete sslcert ipport=0.0.0.0:8172
# add the 'proper' certificate:
& netsh http add sslcert ipport=0.0.0.0:8172 certhash=$thumb appid=`{$guid`}