ubuntu 可信存储中的 X.509 证书 - Powershell Microsoft graph

Question

主要目标 我正在尝试找到一种向使用 ubuntu linux 的用户添加许可证的方法；通过 powershell 或任何其他可编程方法。我最后的手段是在 python 中使用 selenium。

实际问题 我正在尝试将Connect-MgGraph cmdlet 与无人值守脚本的证书一起使用。相关信息在这里：https://docs.microsoft.com/en-us/graph/powershell/app-only?tabs=azure-portal

我已经注册了具有交换和管理员访问权限的应用。我也已经有证书了。我之前连接交换在线powershell时使用过。

当我尝试运行时：Connect-MgGraph -ClientID $ApplicationId -TenantId $TenantId -CertificateName $Certificate

它给了我一个错误：certificate was not found or has expired.

这是我尝试过的：

我首先尝试使用 certpath 作为变量，然后将其传递 - 失败

$CertificateFilePath = "/home/tech/scripts/powershell_scripts/exchangecert/msexchange.pfx"
##other stuff
Connect-MgGraph -ClientID $ApplicationId -TenantId $TenantId -CertificateName $CertificateFilePath

### FAILED RESULT
Connect-MgGraph: /home/tech/scripts/powershell_scripts/exchangecert/msexchange.cer certificate was not found or has expired.

我尝试使用从这里找到的一些命令：https://github.com/Azure/azure-powershell/issues/8675

$StoreName = [System.Security.Cryptography.X509Certificates.StoreName]::My 
$StoreLocation = [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser 
$Store = [System.Security.Cryptography.X509Certificates.X509Store]::new($StoreName, $StoreLocation) 
$Flag = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable 
$Certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new("/home/tech/scripts/powershell_scripts/exchangecert/msexchange.cer","apassword",$Flag) 
$Store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite) 
$Store.Add($Certificate) 
$Store.Close() 

### FAILED RESULT
Connect-MgGraph: [Subject]
  CN=adomain.com
[Issuer]
  CN=adomain.com
[Serial Number]
  aserialnumber
[Not Before]
  5/30/2021 2:51:16 PM
[Not After]
  5/30/2022 3:01:17 PM
[Thumbprint]
  athumbprint
 certificate was not found or has expired.

到目前为止，我所尝试的一切都失败了。我知道这可以在 Windows 上工作，但我真的很想在 ubuntu 上进行无人值守的身份验证。

谢谢大家。

Answer 1

-CertificateName 应该是证书的主题名称，而不是证书的路径。但是，您应该尝试改用指纹。我认为您缺少更多用于安装证书的代码。尝试这样的事情，在开始时替换您的详细信息以生成正确的 PFX。 （即确保 key.pem 和 cert.pem 存在于 /etc/ssl/private/）

$CertPath = '/etc/ssl/private/'
$CertKey = $CertPath + 'key.pem'
$CertPublic = $CertPath + 'cert.pem'
$CertMerge = $CertPath + 'merged.pfx'
$CertPass = 'somepassword'
$CertExpire = 365
$CertName = 'somecertname')

# Generate new certificate and convert it to pfx format
openssl req -newkey rsa:2048 -new -nodes -x509 -days $CertExpire -keyout $CertKey -out $CertPublic -subj "/C=LV/ST=Some-State/L=LV/O=$CertName/OU=IT"
openssl pkcs12 -in $CertPublic -inkey $CertKey -export -out $CertMerge -passout pass:$CertPass

此时，您应该检查以确保已创建 merge.pfx。然后继续：

# Store certificate in certificate store
$StoreName = [System.Security.Cryptography.X509Certificates.StoreName]::My 
$StoreLocation = [System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser
$Store = [System.Security.Cryptography.X509Certificates.X509Store]::new($StoreName, $StoreLocation) 
$Flag = [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable
$Certificate = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($CertMerge, $CertPass, $Flag)
$Store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)
$Store.Add($Certificate)
$Store.Close() 

# Get cert thumbprint
$CertValue = [Convert]::ToBase64String($Certificate.GetRawCertData())
$Thumbprint = $Certificate.Thumbprint

然后使用$Thumbprint登录：

Connect-MgGraph -ClientID $ApplicationId -TenantId $TenantId -CertificateThumbprint "YOUR_CERT_THUMBPRINT"