Set RDP Session Host Certificate (enhancement / feature request) about posh-acme.deploy HOT 15 CLOSED

# Cloud Flare requires a simple API token, securing the string to keep it safe
$token = ConvertTo-SecureString '[INSERT API KEY]' -AsPlainText -Force
$pArgs = @{CFToken=$token}

# The default certificate password is "poshacme", but we prefer some extra security. At this point you could also just use the CF token. 
$CertPass = '$token'

# To get the correct hostname independent of features installed, use System.Net.Dns (does not work on linux).
$certName = @([System.Net.Dns]::GetHostEntry([string]"localhost").HostName)

# This notification email is contacted if the certificate is close to expiration date.
$notifyEmail = '[[email protected]]'

# Constructs all Cert Params for a successful request.
$certParams = @{
    Domain = $certName
    PfxPass = $CertPass
    DnsPlugin = 'Cloudflare'
    PluginArgs = $pArgs
    AcceptTOS = $true
    Install = $true
    Contact = $notifyEmail  # optional
    Verbose = $true         # optional
}

New-PACertificate @certParams 

# Sets the certificate also for RDP Host Listener
Set-PAOrder $certName
Get-PACertificate $certName | Set-RDSHCertificate -Verbose

Start-Transcript $env:LOCALAPPDATA\cert-renewal.log -Append
$hostname = @([System.Net.Dns]::GetHostEntry([string]"localhost").HostName)
$oldCert = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.Subject -eq "CN=$hostname" } |
    Sort-Object -Descending NotAfter |
    Select-Object -First 1
if (Submit-Renewal -Verbose) {
    Get-PACertificate | Set-RDSHCertificate
    $oldCert | Remove-Item
    Restart-Service ADWS
}
Stop-Transcript

    Get-PACertificate | Set-RDSHCertificate

 # run in .\PsExec64.exe -i -h -s powershell.exe
# Install Posh-Acme and Posh-Acme Deploy with all dependencies
Install-Module -Name Posh-ACME -Scope AllUsers -Force -SkipPublisherCheck
Install-Module -Name Posh-ACME.Deploy -Scope AllUsers -Force -SkipPublisherCheck

# Cloud Flare requires a simple API token, securing the string to keep it safe
$token = ConvertTo-SecureString 'token' -AsPlainText -Force
$pArgs = @{CFToken=$token}

# The default certificate password is "poshacme", but we prefer some extra security. At this point you could also just use the CF token. 
$CertPass = '$token'

# To get the correct hostname independent of features installed, use System.Net.Dns (does not work on linux).
$certName = ([System.Net.Dns]::GetHostEntry([string]"localhost").HostName)

# This notification email is contacted if the certificate is close to expiration date.
$notifyEmail = '[email protected]'

# Constructs all Cert Params for a successful request.
$certParams = @{
    Domain = $certName
    PfxPass = $CertPass
    DnsPlugin = 'Cloudflare'
    PluginArgs = $pArgs
    AcceptTOS = $true
    Install = $true
    Contact = $notifyEmail  # optional
    Verbose = $true         # optional
}

New-PACertificate @certParams 

# Sets the certificate also for RDP Host Listener
Set-PAOrder $certName
Get-PACertificate $certName | Set-RDSHCertificate -Verbose

# Sets the scheduler to check and renew certificate when due
$taskname = "Renew SSL Server Certificate"
$taskdesc = "Renews the Let's Encrypt certificate installed on this server."
$actionArg = '-C "Start-Transcript $env:LOCALAPPDATA\cert-renewal.log -Append; $name=([System.Net.Dns]::GetHostEntry([string]"localhost").HostName); $oldCert=gci Cert:\LocalMachine\My | ?{ $_.Subject -eq \"CN=$name\" } | sort -d NotAfter | select -f 1; if (Submit-Renewal -Verbose) { Get-PACertificate | Set-RDSHCertificate; $oldCert | ri; Restart-Service ADWS } Stop-Transcript; exit $LASTEXITCODE"'
$action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument $actionArg
$trigger =  New-ScheduledTaskTrigger -Daily -At 2am -RandomDelay (New-TimeSpan -Minutes 30)
$settings = New-ScheduledTaskSettingsSet -ExecutionTimeLimit (New-TimeSpan -Minutes 30)
Register-ScheduledTask $taskname -Action $action -Trigger $trigger -User 'System' -Settings $settings -Desc $taskdesc 

Start-Transcript $env:LOCALAPPDATA\cert-renewal.log -Append $name=([System.Net.Dns]::GetHostEntry([string]"localhost").HostName)
$oldCert=gci Cert:\LocalMachine\My |
	Where-Object { $_.Subject -eq \"CN=$name\" } |
	Sort-Object -Descending NotAfter |
	Select-Object -First 1
if (Submit-Renewal -Verbose) { 
	Get-PACertificate | Set-RDSHCertificate
	$oldCert | ri; Restart-Service ADWS 
}
Stop-Transcript

**********************
Windows PowerShell transcript start
Start time: 20240808004658
Username: GMSERVICE\SYSTEM
RunAs User: GMSERVICE\SYSTEM
Configuration Name: 
Machine: MI-DEV-PS (Microsoft Windows NT 10.0.20348.0)
Host Application: powershell.exe
Process ID: 5540
PSVersion: 5.1.20348.2582
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.20348.2582
BuildVersion: 10.0.20348.2582
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
Transcript started, output file is C:\Windows\system32\config\systemprofile\AppData\Local\cert-renewal.log
PS>TerminatingError(Invoke-WebRequest): "{
  "type": "urn:ietf:params:acme:error:badNonce",
  "detail": "JWS has an invalid anti-replay nonce: \"Cb9-D9qJCtold24rWJytkwMfpT0aSbw-ohnEayo0PLMQaW-w_bk\"",
  "status": 400
}"
VERBOSE: Nonce rejected by ACME server. Retrying with updated nonce.
VERBOSE: Checking for updated renewal window via ARI
WARNING: Order 'mi-dev-ps.gmservice.app' is not recommended for renewal yet. Use -Force to override.
**********************
Windows PowerShell transcript end
End time: 20240808004659
**********************