Dr. Scripto and the Certificate Conundrum

It was a bustling Monday morning at the PowerShell Academy. The corridors were filled with the excited chatter of students discussing their weekend coding projects. Dr. Scripto, the renowned PowerShell wizard, was in his office, sipping his morning coffee from his favorite cmdlet-decorated mug, when his phone rang.

“Dr. Scripto speaking,” he answered cheerfully.

“Doctor, we need your help urgently!” It was the panicked voice of Sarah, the IT manager from Contoso Corp, a long-time partner of the Academy. “Our certificate infrastructure is in shambles. We have hundreds of expiring certificates, and our manual process can’t keep up. Can you help us automate this with PowerShell?”

Dr. Scripto’s eyes lit up with excitement. “Certificates, you say? And automation? Sarah, my dear, you’ve just made my Monday! I’ll be right over.”

Within the hour, Dr. Scripto arrived at Contoso Corp, his trusty laptop under one arm and a stack of PowerShell reference books under the other. Sarah greeted him at the reception, looking frazzled.

“It’s a mess, Doctor,” she said, leading him to the server room. “We have web servers, email servers, VPN endpoints, all needing new certificates. And don’t get me started on our internal PKI…”

Dr. Scripto stroked his PowerShell-blue beard thoughtfully. “Fear not, Sarah. PowerShell is more than up to this task. Let’s start by assessing the situation.”

He opened his laptop and began typing furiously:

# Get all certificates in the LocalMachine store
$certs = Get-ChildItem -Path Cert:\LocalMachine -Recurse

# Find soon-to-expire certificates
$expiringSoon = $certs | Where-Object { $_.NotAfter -lt (Get-Date).AddDays(30) }

# Display the results
$expiringSoon | Select-Object Subject, NotAfter, Thumbprint

“Great Scott!” Dr. Scripto exclaimed. “You weren’t exaggerating, Sarah. You have 237 certificates expiring within the next month!”

Sarah nodded grimly. “And that’s just on this server. We have dozens more.”

Dr. Scripto’s eyes gleamed with the thrill of a challenge. “Well then, we’d better get cracking. First, let’s create a function to generate new certificate requests.”

He began typing again:

function New-CertificateRequest {
    param (
        [string]$Subject,
        [string]$SANs,
        [string]$OutputPath
    )

    $sanList = $SANs -split ','

    $params = @{
        Subject = $Subject
        KeyAlgorithm = 'RSA'
        KeyLength = 2048
        HashAlgorithm = 'SHA256'
        KeyUsage = 'DigitalSignature', 'KeyEncipherment'
        TextExtension = @("2.5.29.17={text}DNS=$($sanList -join '&DNS=')")
    }

    $cert = New-SelfSignedCertificate @params

    $certPath = Join-Path -Path $OutputPath -ChildPath "$($Subject.Split('=')[1]).pfx"
    $cert | Export-PfxCertificate -FilePath $certPath -Password (ConvertTo-SecureString -String 'P@ssw0rd' -AsPlainText -Force)

    return $certPath
}

“Excellent!” Sarah exclaimed. “But what about our internal Certificate Authority?”

“Ah, yes,” Dr. Scripto nodded. “We’ll need to submit these requests to your CA. Let’s create another function for that.”

function Submit-CertificateRequest {
    param (
        [string]$CertReqPath,
        [string]$CAName,
        [string]$Template
    )

    $certReq = Get-Content -Path $CertReqPath -Raw
    $response = certreq -submit -config $CAName -attrib "CertificateTemplate:$Template" $certReq

    if ($response -match 'Certificate retrieved') {
        Write-Host "Certificate issued successfully!"
    } else {
        Write-Host "Failed to issue certificate. Error: $response"
    }
}

As the day wore on, Dr. Scripto and Sarah worked tirelessly, crafting scripts to inventory all servers, generate certificate requests, submit them to the CA, and install the new certificates. They created scheduled tasks to automate the process and set up monitoring to alert them of any issues.

As the sun began to set, Dr. Scripto ran a final check:

$newCerts = Get-ChildItem -Path Cert:\LocalMachine -Recurse | 
    Where-Object { $_.NotAfter -gt (Get-Date).AddDays(365) }

Write-Host "New certificates installed: $($newCerts.Count)"

The console displayed: “New certificates installed: 237”

Sarah let out a whoop of joy. “Dr. Scripto, you’ve done it! You’ve saved us months of manual work!”

Dr. Scripto smiled, adjusting his PowerShell-themed bowtie. “My dear Sarah, this is the power of PowerShell. It turns days of tedious work into mere hours of exciting scripting!”

As they walked out of the server room, Sarah asked, “Dr. Scripto, how can we ever thank you?”

Dr. Scripto’s eyes twinkled. “Well, I’ve always wanted to deliver a guest lecture on ‘The Art of Certificate Automation with PowerShell’. Perhaps you could put in a good word with your CEO?”

Sarah laughed. “Consider it done! I have a feeling our entire IT department will be signing up for that lecture.”

As Dr. Scripto drove back to the PowerShell Academy, he couldn’t help but smile. Another day, another PowerShell victory. He was already looking forward to sharing this adventure with his students.

“Remember,” he mused to himself, “in the world of IT, certificates may expire, but the power of PowerShell is eternal!”

And with that thought, Dr. Scripto began planning his next lecture, excited to inspire a new generation of PowerShell enthusiasts to tackle the challenges of modern IT infrastructure.