1
<#
2
.SYNOPSIS
3
Imports a cert from WACS renewal into the RD Gateway and RD Listener
4

5
.DESCRIPTION
6
Note that this script is intended to be run via the install script plugin from win-acme via the batch script wrapper. As such, we use positional parameters to avoid issues with using a dash in the cmd line.
7

8
Proper information should be available here
9

10
https://github.com/PKISharp/win-acme/wiki/Install-Script
11

12
or more generally, here
13

14
https://github.com/PKISharp/win-acme/wiki/Example-Scripts
15

16
.PARAMETER NewCertThumbprint
17
The exact thumbprint of the cert to be imported. The script will copy this cert to the Personal store if not already there.
18

19
.EXAMPLE
20

21
ImportRDS.ps1 <certThumbprint>
22

23
.NOTES
24

25
#>
26

27
param(
28
    [Parameter(Position = 0, Mandatory = $true)]
29
    [string]$NewCertThumbprint
30
)
31

32
function Write-Log {
33
    param($Message)
34
    Write-Host $Message
35
}
36

37
Write-Log "Script started with thumbprint: $NewCertThumbprint"
38

39
Write-Log "Searching for certificate in store..."
40
try {
41
    $store = New-Object System.Security.Cryptography.X509Certificates.X509Store("My", "LocalMachine")
42
    $store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly)
43
    $CertInStore = $store.Certificates | Where-Object { $_.Thumbprint -eq $NewCertThumbprint } | Select-Object -First 1
44
    $store.Close()
45
    Write-Log "Certificate search completed"
46
}
47
catch {
48
    Write-Log "Failed to search for certificate: $($_.Exception.Message)"
49
    return
50
}
51

52
if ($CertInStore) {
53
    Write-Log "Certificate found in store"
54

55
    # 将证书指纹转换为字节数组
56
    try {
57
        $ThumbprintBytes = $CertInStore.Thumbprint -replace '([A-Fa-f0-9]{2})', '0x$1' -split '0x' | Where-Object { $_ -ne '' } | ForEach-Object { [byte]('0x' + $_) }
58
        Write-Log "Thumbprint converted to bytes"
59
    }
60
    catch {
61
        Write-Log "Failed to convert thumbprint: $($_.Exception.Message)"
62
        return
63
    }
64

65
    # 修改计算机注册表 \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\SSLCertificateSHA1Hash 的值为二进制格式
66
    try {
67
        Write-Log "Updating registry for RDP listener..."
68
        Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'SSLCertificateSHA1Hash' -Value ([byte[]]$ThumbprintBytes) -ErrorAction Stop
69
        Write-Log "Registry value for RDP listener updated successfully"
70
    }
71
    catch {
72
        Write-Log "Failed to update registry value for RDP listener: $($_.Exception.Message)"
73
        return
74
    }
75

76
    # 为证书的私钥添加 NETWORK SERVICE 用户并授予读取权限
77
    try {
78
        Write-Log "Adding NETWORK SERVICE permissions to private key..."
79

80
        if ($CertInStore.HasPrivateKey) {
81
            $privateKey = $CertInStore.PrivateKey
82

83
            if ($privateKey -and $privateKey.CspKeyContainerInfo) {
84
                $keyContainerName = $privateKey.CspKeyContainerInfo.UniqueKeyContainerName
85
                $keyFilePath = Join-Path "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" $keyContainerName
86

87
                Write-Log "Private key file path: $keyFilePath"
88

89
                if (Test-Path $keyFilePath) {
90
                    $fileInfo = New-Object System.IO.FileInfo($keyFilePath)
91
                    $fileSecurity = $fileInfo.GetAccessControl()
92

93
                    # 创建 NETWORK SERVICE 的访问规则
94
                    $networkServiceSid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-20")
95
                    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule(
96
                        $networkServiceSid,
97
                        [System.Security.AccessControl.FileSystemRights]::Read,
98
                        [System.Security.AccessControl.AccessControlType]::Allow
99
                    )
100

101
                    $fileSecurity.AddAccessRule($accessRule)
102
                    $fileInfo.SetAccessControl($fileSecurity)
103

104
                    Write-Log "NETWORK SERVICE permissions added to private key successfully"
105
                }
106
                else {
107
                    Write-Log "Private key file not found at: $keyFilePath"
108
                }
109
            }
110
            else {
111
                Write-Log "Certificate private key information not available"
112
            }
113
        }
114
        else {
115
            Write-Log "Certificate does not have a private key"
116
        }
117
    }
118
    catch {
119
        Write-Log "Failed to add NETWORK SERVICE user to the certificate's private key: $($_.Exception.Message)"
120
    }
121
}
122
else {
123
    Write-Log "Cert thumbprint not found in the My cert store... have you specified --certificatestore My?"
124
}
125

126
Write-Log "Script completed"

1
./wacs.exe --source manual --host YOUR_DOMAIN --validation cloudflare --cloudflareapitoken YOUR_API_TOKEN --certificatestore My --installation script --script "Scripts\CustomImportRDS.ps1" --scriptparameters "{CertThumbprint}"