Skip to content

Commit 815281c

Browse files
author
William Lam
committed
Retrieve vCenter Server Certificates
1 parent 8e62841 commit 815281c

File tree

1 file changed

+125
-0
lines changed

1 file changed

+125
-0
lines changed

‎powershell/Get-VCSACertificate.ps1

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
Function Get-VCSACertificate {
2+
<#
3+
.DESCRIPTION Function to retreive all VCSA certifcates (Machine, VMCA Root, STS & Trusted Root)
4+
.NOTES Author: William Lam
5+
.NOTES Site: www.williamlam.com
6+
.PARAMETER Type
7+
Optionally filter on a specific certificate type: MACHINE, VMCA_ROOT, STS or TRUSTED_ROOT
8+
#>
9+
param(
10+
[Parameter(Mandatory=$false)][ValidateSet("MACHINE","VMCA_ROOT","STS", "TRUSTED_ROOT")][string]$Type
11+
)
12+
13+
Function CreateCertObject {
14+
param(
15+
[Parameter(Mandatory=$true)]$Cert,
16+
[Parameter(Mandatory=$true)]$Type
17+
)
18+
19+
$tmp = [pscustomobject] [ordered]@{
20+
Type = $Type
21+
CertificateCommonName = [regex]::Match($cert.Subject, 'CN=([^,]+)').Value.replace("CN=","");
22+
CertificateIssuedBy = [regex]::Match($cert.issuer, 'CN=([^,]+)').Value.replace("CN=","");
23+
CertificateValidFrom = $cert.NotBefore;
24+
CertificateValidUntil = $cert.NotAfter;
25+
CertificateSignatureAlgorithm = $cert.SignatureAlgorithm.FriendlyName;
26+
CertificateThumbprint = $cert.Thumbprint;
27+
CertificateOrganization = [regex]::Match($cert.Subject, 'O=([^,]+)').Value.replace("O=","");
28+
CertificateOrganizationalUnit = [regex]::Match($cert.Subject, 'OU=([^,]+)').Value.replace("OU=","");
29+
CertificateStateProvince = [regex]::Match($cert.Subject, 'S=([^,]+)').Value.replace("S=","");
30+
CertificateCountry = [regex]::Match($cert.Subject, 'C=([^,]+)').Value.replace("C=","");
31+
IssuerName = [regex]::Match($cert.issuer, 'CN=([^,]+)').Value.replace("CN=","");
32+
IssuerOrganization = [regex]::Match($cert.issuer, 'O=([^,]+)').Value.replace("O=","");
33+
IssuerOrganizationalUnit = [regex]::Match($cert.issuer, 'OU=([^,]+)').Value.replace("OU=","");
34+
IssuerStateProvince = [regex]::Match($cert.issuer, 'S=([^,]+)').Value.replace("S=","");
35+
IssuerCountry = [regex]::Match($cert.issuer, 'C=([^,]+)').Value.replace("C=","");
36+
# BigInt required to convert serial from Hex->Dec https://stackoverflow.com/a/69207938
37+
IssuerSerialNumber = [decimal][bigint]::Parse($cert.SerialNumber, [System.Globalization.NumberStyles]::AllowHexSpecifier)
38+
IssuerVersion = $cert.Version
39+
}
40+
return $tmp
41+
}
42+
43+
$results =@()
44+
45+
# Cert library to convert from PEM format
46+
$xCert2Type = [System.Security.Cryptography.X509Certificates.X509Certificate2]
47+
48+
# Retrieve VMCA_ROOT and STS
49+
$signingCertService = Get-cisservice "com.vmware.vcenter.certificate_management.vcenter.signing_certificate"
50+
$signingCerts = $signingCertService.get().signing_cert_chains.cert_chain
51+
52+
foreach ($signingCert in $signingCerts) {
53+
$cert = $xCert2Type::CreateFromPem($signingCert) -as $xCert2Type
54+
if($cert.Subject -eq "CN=ssoserverSign") {
55+
$c = CreateCertObject -Cert $cert -Type "STS"
56+
$results+=$c
57+
} else {
58+
$c = CreateCertObject -Cert $cert -Type "VMCA_ROOT"
59+
$results+=$c
60+
}
61+
}
62+
63+
# Retrieve MACHINE
64+
$tlsService = Get-cisservice "com.vmware.vcenter.certificate_management.vcenter.tls"
65+
$tlsCert = $tlsService.get()
66+
67+
$tmp = [pscustomobject] [ordered]@{
68+
Type = "MACHINE"
69+
CertificateCommonName = [regex]::Match($tlsCert.subject_dn, 'CN=([^,]+)').Value.replace("CN=","");
70+
CertificateIssuedBy = [regex]::Match($tlsCert.subject_dn, 'C=([^,]+)').Value.replace("C=","");
71+
CertificateValidFrom = $tlsCert.valid_from;
72+
CertificateValidUntil = $tlsCert.valid_to;
73+
CertificateSignatureAlgorithm = $tlsCert.signature_algorithm;
74+
CertificateThumbprint = $tlsCert.thumbprint;
75+
CertificateOrganization = [regex]::Match($tlsCert.subject_dn, 'O=([^,]+)').Value.replace("O=","");
76+
CertificateOrganizationalUnit = [regex]::Match($tlsCert.subject_dn, 'OU=([^,]+)').Value.replace("OU=","");
77+
CertificateStateProvince = [regex]::Match($tlsCert.subject_dn, 'ST=([^,]+)').Value.replace("ST=","");
78+
CertificateCountry = [regex]::Match($tlsCert.subject_dn, 'C=([^,]+)').Value.replace("C=","");
79+
IssuerName = [regex]::Match($tlsCert.issuer_dn, 'CN=([^,]+)').Value.replace("CN=","");
80+
IssuerOrganization = [regex]::Match($tlsCert.issuer_dn, 'O=([^,]+)').Value.replace("O=","");
81+
IssuerOrganizationalUnit = [regex]::Match($tlsCert.issuer_dn, 'OU=([^,]+)').Value.replace("OU=","");
82+
IssuerStateProvince = [regex]::Match($tlsCert.issuer_dn, 'ST=([^,]+)').Value.replace("ST=","");
83+
IssuerCountry = [regex]::Match($tlsCert.issuer_dn, 'C=([^,]+)').Value.replace("C=","");
84+
IssuerSerialNumber = $tlsCert.serial_number
85+
IssuerVersion = $cert.version
86+
}
87+
$results+=$tmp
88+
89+
# Retrieve TRUSTED_ROOT
90+
$trustedRootChainService = Get-cisservice "com.vmware.vcenter.certificate_management.vcenter.trusted_root_chains"
91+
$trustedRootChains = $trustedRootChainService.list().chain
92+
foreach ($trustedRootChain in $trustedRootChains) {
93+
$rootChain = $trustedRootChainService.get($trustedRootChain).cert_chain.cert_chain | Out-String
94+
$rootCert = $xCert2Type::CreateFromPem($rootChain) -as $xCert2Type
95+
96+
$tmp = [pscustomobject] [ordered]@{
97+
Type = "TRUSTED_ROOT"
98+
CertificateCommonName = [regex]::Match($rootCert.Subject, 'CN=([^,]+)').Value.replace("CN=","");
99+
CertificateIssuedBy = [regex]::Match($rootCert.issuer, 'CN=([^,]+)').Value.replace("CN=","");
100+
CertificateValidFrom = $rootCert.NotBefore;
101+
CertificateValidUntil = $rootCert.NotAfter;
102+
CertificateSignatureAlgorithm = $rootCert.SignatureAlgorithm.FriendlyName;
103+
CertificateThumbprint = $rootCert.Thumbprint;
104+
CertificateOrganization = [regex]::Match($rootCert.Subject, 'O=([^,]+)').Value.replace("O=","");
105+
CertificateOrganizationalUnit = [regex]::Match($rootCert.Subject, 'OU=([^,]+)').Value.replace("OU=","");
106+
CertificateStateProvince = [regex]::Match($rootCert.Subject, 'S=([^,]+)').Value.replace("S=","");
107+
CertificateCountry = [regex]::Match($rootCert.Subject, 'C=([^,]+)').Value.replace("C=","");
108+
IssuerName = [regex]::Match($rootCert.issuer, 'CN=([^,]+)').Value.replace("CN=","");
109+
IssuerOrganization = [regex]::Match($rootCert.issuer, 'O=([^,]+)').Value.replace("O=","");
110+
IssuerOrganizationalUnit = [regex]::Match($rootCert.issuer, 'OU=([^,]+)').Value.replace("OU=","");
111+
IssuerStateProvince = [regex]::Match($rootCert.issuer, 'S=([^,]+)').Value.replace("S=","");
112+
IssuerCountry = [regex]::Match($rootCert.issuer, 'C=([^,]+)').Value.replace("C=","");
113+
# BigInt required to convert serial from Hex->Dec https://stackoverflow.com/a/69207938
114+
IssuerSerialNumber = [decimal][bigint]::Parse($rootCert.SerialNumber, [System.Globalization.NumberStyles]::AllowHexSpecifier)
115+
IssuerVersion = $rootCert.Version
116+
}
117+
$results+=$tmp
118+
}
119+
120+
if ($PSBoundParameters.ContainsKey("Type")){
121+
$results | where {$_.Type -eq $Type}
122+
} else {
123+
$results
124+
}
125+
}

0 commit comments

Comments
 (0)