12

I have a third-party issued certificate that I need to ensure is running on all targets in a given domain. Is there a way to ensure this certificate is installed by way of DSC?

omencat
  • 225
  • 2
  • 8

2 Answers2

10

There is currently no built-in way to do this in DSC. I wrote a custom resource for my organization that installs a certificate from a PFX. I used the Cert: PSDrive, Import-PfxCertificate cmdlet and secured credentials in DSC (for the PFX password).

Update

This is now live in Microsoft's resources! The xPfxImport resource is in the xCertificate module v1.1 (and later presumably).

Also wrote about it on my own blog.

Thanks again for the encouragement (especially jscott).

Community
  • 1
briantist
  • 2,535
  • 18
  • 34
  • 1
    You tease! Please do update your answer should you clean up your code enough to share it publicly. :) +1 – jscott Oct 23 '14 at 14:26
  • @jscott almost a year later, but I'm attempting to get the code added to the `xCertificate` module in Microsoft's DSC resources, so hopefully it will soon be available as part of what was once the DSC Resource Kit (and would now be available through the PowerShell Gallery). My [pull request is waiting here](https://github.com/PowerShell/xCertificate/pull/12) but you can take a look at the code now if you like. – briantist Sep 24 '15 at 22:00
  • @jscott finally merged into `dev`, no idea how long it will take to get into master. Thanks for the bounty and your support. – briantist Nov 07 '15 at 01:10
2

How about using group policy to deploy the certificate to the domain? http://technet.microsoft.com/en-us/library/cc770315%28v=ws.10%29.aspx

To deploy a certificate by using Group Policy

Open Group Policy Management Console.

Find an existing or create a new GPO to contain the certificate settings. Ensure that the GPO is associated with the domain, site, or organizational unit whose users you want affected by the policy.

Right-click the GPO, and then select Edit.

Group Policy Management Editor opens, and displays the current contents of the policy object.

In the navigation pane, open Computer Configuration\Windows Settings\Security Settings\Public Key Policies\Trusted Publishers.

Click the Action menu, and then click Import.

Follow the instructions in the Certificate Import Wizard to find and import the certificate.

If the certificate is self-signed, and cannot be traced back to a certificate that is in the Trusted Root Certification Authorities certificate store, then you must also copy the certificate to that store. In the navigation pane, click Trusted Root Certification Authorities, and then repeat steps 5 and 6 to install a copy of the certificate to that store.
Mass Nerder
  • 997
  • 4
  • 6
  • 4
    It doesn't sound like this is a CA certificate that he needs his systems to trust which is what the solution you describe would be for. It sounds more like he has an actual certificate and private key that the target servers will be using to host SSL based services. I don't believe you can use the Public Key Policies GPO settings to deploy something like that. – Ryan Bolger Oct 22 '14 at 19:22