unknown
55 lines
1.9 KiB
Plaintext
55 lines
1.9 KiB
Plaintext
# Altes Zertifikat finden und entfernen (falls vorhanden)
|
|
Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*byte.trail*" } | Remove-Item -Force
|
|
|
|
# Neues Zertifikat mit korrekten Einstellungen fuer AD LDAPS
|
|
$cert = New-SelfSignedCertificate `
|
|
-Subject "CN=SRV-DC01.byte.trail" `
|
|
-DnsName "SRV-DC01.byte.trail","byte.trail","10.10.10.10" `
|
|
-CertStoreLocation "Cert:\LocalMachine\My" `
|
|
-KeyAlgorithm RSA `
|
|
-KeyLength 2048 `
|
|
-KeyExportPolicy Exportable `
|
|
-NotAfter (Get-Date).AddYears(10) `
|
|
-Provider "Microsoft RSA SChannel Cryptographic Provider" `
|
|
-KeyUsage DigitalSignature, KeyEncipherment `
|
|
-TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.1")
|
|
|
|
# NTDS neu starten - nimmt das Zertifikat automatisch auf
|
|
Restart-Service NTDS -Force
|
|
Start-Sleep -Seconds 5
|
|
|
|
# Pruefen ob LDAPS jetzt funktioniert
|
|
$tcp = New-Object System.Net.Sockets.TcpClient
|
|
$tcp.Connect("localhost", 636)
|
|
$ssl = New-Object System.Net.Security.SslStream($tcp.GetStream(), $false, {$true})
|
|
$ssl.AuthenticateAsClient("SRV-DC01.byte.trail")
|
|
Write-Host "LDAPS funktioniert! Zertifikat: $($ssl.RemoteCertificate.Subject)" -ForegroundColor Green
|
|
$ssl.Close(); $tcp.Close()
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
# Thumbprint holen
|
|
$thumb = (Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.Subject -like "*byte.trail*" }).Thumbprint
|
|
Write-Host "Thumbprint: $thumb"
|
|
|
|
# Pruefen ob der Private Key vorhanden ist
|
|
$cert = Get-ChildItem Cert:\LocalMachine\My\$thumb
|
|
Write-Host "Hat Private Key: $($cert.HasPrivateKey)"
|
|
|
|
# In den NTDS Personal Store legen
|
|
$ntdsStore = New-Object System.Security.Cryptography.X509Certificates.X509Store("NTDS\Personal","LocalMachine")
|
|
$ntdsStore.Open("ReadWrite")
|
|
$ntdsStore.Add($cert)
|
|
$ntdsStore.Close()
|
|
Write-Host "Zertifikat in NTDS Store abgelegt"
|
|
|
|
# NTDS neu starten
|
|
Restart-Service NTDS -Force
|
|
Start-Sleep -Seconds 5
|
|
|
|
# Verifizieren
|
|
certutil -verifystore "NTDS\Personal" |