powershell 更新 IIS SSL 证书

powershell 更新 IIS SSL 证书

Intro#

最近发现我们开发环境的 IIS 上的 SSL 证书过期了，为了后面方便维护和更新，搞了一个 powershell 脚本，以后要更新的时候直接跑一下脚本就可以了，所以有了这篇文章

Solution#

更新过程：

1. 移除之前老的证书
2. 导入新的证书
3. 移除旧的 ssl 证书
4. 创建新的 ssl 证书绑定新的证书

完整的更新脚本如下：

$hostName = "xxx.com"

$pfxCertPath = "C:\backup\xxxxx.pfx"
$pfxCertPwdPath = "C:\backup\pfx-password.txt"
$certImportPwd = Get-Content $pfxCertPwdPath | ConvertTo-SecureString -AsPlainText -Force

# try remove before ssl certs
Get-ChildItem "cert:\LocalMachine\My" | where-object { $_.Subject -like "*$hostName*" }  | Remove-Item

# import new ssl 
$importedCert = Import-PfxCertificate -FilePath $pfxCertPath -CertStoreLocation "Cert:\LocalMachine\My" -p $certImportPwd

$certHash = $importedCert.Thumbprint

# remove sslcert binding
netsh http delete sslcert hostnameport="${hostName}:443"

# add new sslcert binding
$guid = [guid]::NewGuid().ToString("B")
netsh http add sslcert hostnameport="${hostName}:443" certhash=$certHash certstorename=MY appid="$guid"

Reference#

• https://docs.microsoft.com/en-us/windows/win32/http/delete-sslcert
• https://docs.microsoft.com/en-us/powershell/module/pkiclient/import-pfxcertificate?view=win10-ps
• https://stackoverflow.com/questions/37228851/delete-certificate-from-computer-store
• https://4sysops.com/archives/manage-iis-website-bindings-in-powershell/
• https://weblog.west-wind.com/posts/2016/Jun/23/Use-Powershell-to-bind-SSL-Certificates-to-an-IIS-Host-Header-Site