使用 CertEnroll 远程更新证书答案

【问题标题】：Remotely renewing a certificate using CertEnroll使用 CertEnroll 远程更新证书
【发布时间】：2015-10-20 17:46:59
【问题描述】：

我正在尝试使用 PowerShell 中的 CertEnroll 和 CertLib COM 库更新证书。这是我的代码：

[CmdletBinding()]
param(
[parameter (mandatory=$true)]
[string]$ServerName
)

$credential = Get-Credential

Invoke-Command -ComputerName $ServerName -Credential $credential -ScriptBlock{

$location=[System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
$store =New-Object -TypeName System.Security.Cryptography.X509Certificates.X509Store -ArgumentList $location
$store.Open(1)
$cert = $store.Certificates.Find([System.Security.Cryptography.X509Certificates.X509FindType]::FindByIssuerName,"<CA-Name>",$false)[0]
#Write-Output $cert.IssuerName
$store.Close()
$request = New-Object -ComObject X509Enrollment.CX509CertificateRequestPkcs7 
try{
$request.InitializeFromCertificate(0x2,$true,[System.Convert]::ToBase64String($cert.RawData),0x1,3 -band 1024)

$enroll = New-Object -ComObject X509Enrollment.CX509Enrollment
$enroll.InitializeFromRequest($request)

$message = $enroll.CreateRequest(1)

$certReq = New-Object -ComObject CertificateAuthority.Request
$val=$certReq.Submit(0x1 -bor 0,$message,[string]::Empty,"<CA-Server>\"+ $cert.Issuer.Split('=')[1])

if($val -eq 3)
{
    Write-Host "Certificate request accepted"
} 
$reqid=$certReq.GetRequestId()
#$reqid=[System.Convert]::ToInt32($id)
$objcertRequest = New-Object -ComObject CertificateAuthority.Request
$pending = $objcertRequest.RetrievePending($reqid,"<CA-Server>"+$cert.Issuer.Split('=')[1])
if($pending -eq 3)
{
        $certificate = $objcertRequest.GetCertificate(0x1 -bor 0x100);
        $objEnroll = New-Object -ComObject  X509Enrollment.CX509Enrollment
        $objEnroll.Initialize(1);
        $objEnroll.InstallResponse(4,$certificate,1,$null);
       Write-Host "Installed Successfully"
}
else
{
   Write-Error 'error'
}
}
catch
{
Write-Output $_.Exception.Message
Write-Output $_.Exception.ItemName
}
}

我已经为 CA 服务器和 CA 名称提供了正确的值。我可以在本地计算机上更新证书，但是当我尝试在另一台计算机上更新证书时出现错误。这是我得到的错误：

 Exception calling "InitializeFromCertificate" with "5" argument  (s): "CertEnroll::CX509CertificateRequestPkcs7::InitializeFromCertificate: The operation being requested was not performed because the user has not been authenticated. 0x800704dc (WIN32: 1244)"

谁能告诉我为什么会出现身份验证错误。我提供了正确的凭据。

【问题讨论】：

标签： powershell x509certificate pki certenroll

【解决方案1】：

您提供了在远程主机上进行身份验证的凭据，但是这些凭据不用于在 CA 服务器上进行身份验证。您必须：

将远程计算机设为可信任的委派（不推荐）
使用 CredSSP 允许这些凭据用于在 CA 服务器上进行身份验证。更多详情：Enable PowerShell "Second-Hop" Functionality with CredSSP

【讨论】：

非常感谢您提供的信息。使用 CredSSP 对我有用。