Set-XProtectCertificate on Recording servers

[mortefa-uio]

Hi
I have an issue with Set-XProtectCertificate when I try to set a new certificate on our recording server.
We ha a distributed system with several recording servers and when I try to set a new certificate on our servers, the Management server gets configured perfectly, but on the recording servers only the Streaming Media Certificate is changed, the Server certificate is still on the old certificate.
I use this code run as an administrator:
Set-XProtectCertificate -Thumbprint "aThumbprintValue" -VmsComponent "StreamingMedia" -Force

I have also tried to use VmsComponent "Server", but that does not help.

I use Milestone PSTools version 25.2.18

[joshooaj]

Hi @mortefa-uio, that command is due for an update for sure. The Server Configurator CLI has improved a bit since the original implementation and it supports changing the certificate for all "certificate groups" at once (server, streaming media, event server, mobile, whatever is present).

I don't have a standalone recorder ready at the moment but I did test running Set-XProtectCertificate -VmsComponent Server -Thumbprint $thumb on my all-in-one server and it changed the server certificate successfully. Then I ran it again with -VmsComponent StreamingMedia and that one changed too. Of course it still meant I had to run the command twice and wait for two recording server service restarts.

At the bare minimum I think we should probably update the existing command to accept more than one value for VmsComponent and assume ALL components if none are specified.

Meanwhile, I wonder if you can try using the ServerConfigurator.exe CLI directly - that is what the command is actually using underneath. This command will change all components to use the same certificate in one go:

& 'C:\Program Files\Milestone\Server Configurator\ServerConfigurator.exe' /quiet /enableencryption /thumbprint=<your-cert-thumbprint>

[mortefa-uio]

Hi
Thanks for your reply
The ServerConfigurator.exe CLI works as a charm, but I got a problem when I tried to use it remotely with invoke-command.

After some testing I got this hack to work:

$servers = "video-app","video-rec","video-rec-failover"   

# Get Credentials for user that has admin on server
$cred = Get-Credential -UserName "Admin_user" -Message "Password for admin"

# Get Credentials for user that have access to registrer servers in Milestone Xprotect system
$userToRunAs = Get-Credential -UserName "Milestone_Admin_User" -Message "Password for Milestone Admin"

Invoke-Command -ComputerName $servers -Credential $cred -ArgumentList $userToRunAs -ScriptBlock {
    param($user_cred)

    $path = 'C:\Program Files\Milestone\Server Configurator\ServerConfigurator.exe'
    $args = '/quiet /enableencryption /thumbprint=<CERT_THUMBPRINT>'
    $taskName = "MilestoneConfigUpdate"

    if (-not (Test-Path -LiteralPath $path)) {
        throw "Could not find exe on: $path"
    }

    $action    = New-ScheduledTaskAction -Execute $path -Argument $args -WorkingDirectory (Split-Path -Path $path -Parent)
    $principal = New-ScheduledTaskPrincipal -UserId $user_cred.UserName -LogonType Password -RunLevel Highest
    
    $task = New-ScheduledTask -Action $action -Principal $principal 

    # Registrer oppgaven
    Register-ScheduledTask -TaskName $taskName -InputObject $task `
        -User $user_cred.UserName -Password ($user_cred.GetNetworkCredential().Password) -Force

    # Start umiddelbart
    Start-ScheduledTask -TaskName $taskName

    # Wait until finished or timeout (10 min)
    $timeout = [TimeSpan]::FromMinutes(10)
    $sw = [System.Diagnostics.Stopwatch]::StartNew()
    do {
        Start-Sleep -Seconds 5
        $info = Get-ScheduledTask -TaskName $taskName | Get-ScheduledTaskInfo
    } while ($sw.Elapsed -lt $timeout -and $info.State -eq 'Running')

    # Get last result and clean up
    $result = "Task state: $($info.State); LastTaskResult: $($info.LastTaskResult)"
    Unregister-ScheduledTask -TaskName $taskName -Confirm:$false

    $result
}

The code creates a Scheduled Task that runs as an Milestone admin user, that runs the ServerConfigurator.exe CLI.
I would recommend to start with the Management Server and then the other servers you have.

Thanks a lot for you valuable help.
Morten

[joshooaj]

Glad to see you found the scheduled-task hack to get that working. The server configurator always performs a registration, even when you're just swapping out a certificate, and XProtect still only supports Windows authentication for the registration process. When running in a remote powershell session, the double-hop issue makes it pretty difficult to authenticate with a third system (the management server) from a second system (the recording server) using the credential used to open the pssession on the first system.

Hopefully one of these days we'll be able to automate registration/encryption setting changes using an API key or something so that we don't have to rely on windows auth.