通过powershell或vbscript以编程方式将现有的ssl证书分配给iis6中的网站

Question

我有下面的powershell脚本，它在IIS6中创建了一个新网站：

https://github.com/dagda1/iis6/blob/master/create-site.ps1

有人知道我如何为网站分配一个现有的ssl证书吗？

我知道我可以像这样使用adsutil.vbs设置端口号：

cscript adsutil.vbs set w3svc/xxx/securebindings ":443:somewhere.com"

但是，当涉及到分配现有的ssl证书时，我感到很大的空白。

Answer 1

我想这就是你想要的：

$w3svc = "W3SVC/566412209"     # <-- W3SVC/[iis number]
$pfxPath = "c:\ssl\myssl.pfx"
$pfxPassword = "password123"   # Whatever the certificate file's password is

$certMgr = New-Object -ComObject IIS.CertObj
$certMgr.ServerName = [System.Environment]::MachineName
$certMgr.InstanceName = $w3svc
$certMgr.Import($pfxPath, $pfxPassword, $true, $true)

您还可以创建一个.NET互操作程序集(通过向C:\WINDOWS\system32\inetsrv\certobj.dll添加COM引用或使用tlbimp.exe)，以便您可以与PowerShell和.NET项目一起使用：

[void][reflection.assembly]::loadfrom("Interop.CERTOBJLib.dll")
$certMgr = new-object -typeName CERTOBJLib.IISCertObjClass
$certMgr.ServerName = [System.Environment]::MachineName
$certMgr.InstanceName = $w3svc
$certMgr.Import($pfxPath, $pfxPassword, $true, $true)

您仍然必须像前面所做的那样分别设置SSL端口绑定。

IIS.CertObj上的博士们在这里：

使用IISCertObj (IIS6.0)管理服务器证书

Answer 2

由于这个问题已经得到了回答，我将在一个函数中提供我自己的口味。这相当于使用GUI打开网站和“分配现有证书”。

Function ImportSSLCertificateToWebsite{
    param([string]$pfxPath, [string]$pfxPassword, [string]$siteName, [string]$SSLIPPort);
    <# This script is deigned to run locally on the destination box; however it can be run remotely via Invoke-Command using a PSSession #>;
    <# $pfxPath can be a local or remote location "c:\somesite.pfx" or "\\someserver\share\somesite.pfx" #>;
    <# SSLIPPort must look like: "10.5.100.2:443" or ":443", will be split out below #>;
    $SSLIPPortTemp=$SSLIPPort.Split(":");
    $SSLIP=[string]$SSLIPPortTemp[0];
    $SSLPort=[string]$SSLIPPortTemp[1];
    $iisWebSite = Get-WmiObject -Namespace 'root\MicrosoftIISv2' -Class IISWebServerSetting -Filter "ServerComment = '$siteName'";
    $secureBindings=[System.Management.ManagementBaseObject[]]$iisWebSite.SecureBindings;
    $secureBindings[0].IP="$SSLIP";
    $secureBindings[0].PORT="$SSLPort"+":"; <# must look like "443:" #>;
    $iisWebSite.SecureBindings=[System.Management.ManagementBaseObject[]]$secureBindings;
    $iisWebSite.SetInfo;
    $iisWebsite.Put();
    <# to output the SecureBindings object for confirmation changes were made #>; foreach($a in [System.Management.ManagementBaseObject[]]$iisWebSite.SecureBindings){$a};
    $certMgr = New-Object -ComObject IIS.CertObj -ErrorAction SilentlyContinue;
    $certMgr.InstanceName = [string]$iisWebSite.Name;
    $certMgr.Import($pfxPath,$pfxPassword,$true,$true);
}
ImportSSLCertificateToWebsite "\\secure101\Certs\PFX\somesite.yourdomain.com.pfx" "ThePasswordForThePFX" "somesite.yourdomain.com" ":443"

Answer 3

设置一些变量：

${HostName} = "mydomain.com"
${IPAddressString} = "127.0.0.1"
${Port} = 43
${CertificateThumbprint} = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "CN=*${HostName}*" } | Select-Object -expand Thumbprint

然后运行netsh或httpcfg。

netsh http add sslcert "ipport=${IPAddressString}:${Port}" "certhash=${CertificateThumbprint}" "appid={4dc3e181-e14b-4a21-b022-59fc669b0914}"

或

httpcfg set ssl -i ${IPAddressString}:${Port} -h ${CertificateThumbprint} -g "{4dc3e181-e14b-4a21-b022-59fc669b0914}"