SSL SAN Self Signed Certificate Creation in PowerShell - Revision history

AliIybar at 09:18, 10 November 2021

2021-11-10T09:18:37Z

AliIybar at 09:02, 10 November 2021

2021-11-10T09:02:54Z

AliIybar at 08:48, 10 November 2021

2021-11-10T08:48:11Z

AliIybar at 08:37, 10 November 2021

2021-11-10T08:37:51Z

AliIybar at 08:34, 10 November 2021

2021-11-10T08:34:37Z

AliIybar: Created page with "Category:SSL Category:Powershell

 $cert = New-SelfSignedCertificate -DnsName "server.docker.local", "localhost", "host.docker.internal" -CertStoreLocation cert:\..."

2021-11-10T08:33:59Z

Created page with "Category:SSL Category:Powershell <pre> $cert = New-SelfSignedCertificate -DnsName "server.docker.local", "localhost", "host.docker.internal" -CertStoreLocation cert:\..."

New page

[[Category:SSL]]
[[Category:Powershell]]

<pre>
$cert = New-SelfSignedCertificate -DnsName "server.docker.local", "localhost", "host.docker.internal" -CertStoreLocation cert:\localmachine\my

#export it for docker container to pick up later
$password = ConvertTo-SecureString -String "Pa55w0rd!" -Force -AsPlainText
Export-PfxCertificate -Cert $cert -FilePath C:\https\aspnetapp.pfx -Password $password

# trust it on our host machine
$store = New-Object System.Security.Cryptography.X509Certificates.X509Store "TrustedPublisher","LocalMachine"
$store.Open("ReadWrite")
$store.Add($cert)
$store.Close()

</pre>

@@ Line 46: / Line 46: @@
 $password = ConvertTo-SecureString -String $certPass -Force -AsPlainText
-# $cert = Get-PfxCertificate -FilePath (Join-Path $workDir "aspnetapp.pfx")  $password // OLD way
+# $cert = Get-PfxCertificate -FilePath (Join-Path $workDir "aspnetapp.pfx")  $password #### OLD way - it complains about password parameter ####
 $PfxData=Get-PfxData -FilePath (Join-Path $workDir "aspnetapp.pfx") -Password $password
 $cert = $SigningCert=$PfxData.EndEntityCertificates[0]

@@ Line 25: / Line 25: @@
 <pre>
-$certPass = "password_here"
+$certPass = "Pa55w0rd!"
 $certSubj = "host.docker.internal"
-$certAltNames = "DNS:localhost,DNS:host.docker.internal,DNS:identity_server" # we can also add individual IP addresses here like so: IP:127.0.0.1
+$certAltNames = "DNS:localhost,DNS:host.docker.internal,DNS:sign_api" # we can also add individual IP addresses here like so: IP:127.0.0.1
-$opensslPath="path\to\openssl\binaries" #aOpenSSL needs to be present on the host, no installation is necessary though
+$opensslPath="C:\Program Files\OpenSSL-Win64\bin" #aOpenSSL needs to be present on the host, no installation is necessary though
-$workDir="path\to\your\project"
+$workDir="C:\Users\aiybar\source\repos\AmScreenMicroServices"
-$dockerDir=Join-Path $workDir "ProjectApi"
+$dockerDir=Join-Path $workDir "ApiSign"
 #generate a self-signed cert with multiple domains
@@ Line 46: / Line 46: @@
 $password = ConvertTo-SecureString -String $certPass -Force -AsPlainText
-$cert = Get-PfxCertificate -FilePath (Join-Path $workDir "aspnetapp.pfx") -Password $password
+# $cert = Get-PfxCertificate -FilePath (Join-Path $workDir "aspnetapp.pfx")  $password // OLD way
 # and still, trust it on our host machine
@@ Line 53: / Line 55: @@
 $store.Add($cert)
 $store.Close()
 </pre>

← Older revision		Revision as of 08:48, 10 November 2021
Line 21:		Line 21:

	The above powershell script is also going to fall short as it’s only adding the cert onto development machine – containers will keep failing to validate the cert. The solution would build on the same principles: generate a self-signed cert and trust it everywhere. Since most Docker containers run Linux we might have better luck going the opposite direction and generating certs in PEM format using a well known tool OpenSSL. Then we’d use Dockerfiles to inject this cert into all our containers and finally we’d convert it into format suitable for our host Windows machine (PKCS#12).		The above powershell script is also going to fall short as it’s only adding the cert onto development machine – containers will keep failing to validate the cert. The solution would build on the same principles: generate a self-signed cert and trust it everywhere. Since most Docker containers run Linux we might have better luck going the opposite direction and generating certs in PEM format using a well known tool OpenSSL. Then we’d use Dockerfiles to inject this cert into all our containers and finally we’d convert it into format suitable for our host Windows machine (PKCS#12).
		+
		+	Download OpenSSL from [https://slproweb.com/products/Win32OpenSSL.html https://slproweb.com/products/Win32OpenSSL.html] or [https://wiki.openssl.org/index.php/Binaries https://wiki.openssl.org/index.php/Binaries]

	<pre>		<pre>

← Older revision		Revision as of 08:37, 10 November 2021
Line 17:		Line 17:
	$store.Close()		$store.Close()

		+	</pre>
		+	When one container needs to talk to another container it’s a slightly different story: dev tools don’t have control over containers and cannot magically trust certificates inside there. We can try opt for properly signed certificates (from Let’s Encrypt for example), but that’s a whole different story and is likely not worth it for development machines.
		+
		+	The above powershell script is also going to fall short as it’s only adding the cert onto development machine – containers will keep failing to validate the cert. The solution would build on the same principles: generate a self-signed cert and trust it everywhere. Since most Docker containers run Linux we might have better luck going the opposite direction and generating certs in PEM format using a well known tool OpenSSL. Then we’d use Dockerfiles to inject this cert into all our containers and finally we’d convert it into format suitable for our host Windows machine (PKCS#12).
		+
		+	<pre>
		+	$certPass = "password_here"
		+	$certSubj = "host.docker.internal"
		+	$certAltNames = "DNS:localhost,DNS:host.docker.internal,DNS:identity_server" # we can also add individual IP addresses here like so: IP:127.0.0.1
		+	$opensslPath="path\to\openssl\binaries" #aOpenSSL needs to be present on the host, no installation is necessary though
		+	$workDir="path\to\your\project"
		+	$dockerDir=Join-Path $workDir "ProjectApi"
		+
		+	#generate a self-signed cert with multiple domains
		+	Start-Process -NoNewWindow -Wait -FilePath (Join-Path $opensslPath "openssl.exe") -ArgumentList "req -x509 -nodes -days 365 -newkey rsa:2048 -keyout ",
		+	(Join-Path $workDir aspnetapp.key),
		+	"-out", (Join-Path $dockerDir aspnetapp.crt),
		+	"-subj `"/CN=$certSubj`" -addext `"subjectAltName=$certAltNames`""
		+
		+	# this time round we convert PEM format into PKCS#12 (aka PFX) so .net core app picks it up
		+	Start-Process -NoNewWindow -Wait -FilePath (Join-Path $opensslPath "openssl.exe") -ArgumentList "pkcs12 -export -in ",
		+	(Join-Path $dockerDir aspnetapp.crt),
		+	"-inkey ", (Join-Path $workDir aspnetapp.key),
		+	"-out ", (Join-Path $workDir aspnetapp.pfx),
		+	"-passout pass:$certPass"
		+
		+	$password = ConvertTo-SecureString -String $certPass -Force -AsPlainText
		+	$cert = Get-PfxCertificate -FilePath (Join-Path $workDir "aspnetapp.pfx") -Password $password
		+
		+	# and still, trust it on our host machine
		+	$store = New-Object System.Security.Cryptography.X509Certificates.X509Store [System.Security.Cryptography.X509Certificates.StoreName]::Root,"LocalMachine"
		+	$store.Open("ReadWrite")
		+	$store.Add($cert)
		+	$store.Close()
		+	</pre>
		+
		+	Example: Running Identity Server
		+	Now we have our certs (for example, located in %USERPROFILE%.aspnet\https). Here’s a quick how to tell asp.net core -base containers to pick them up:
		+	<pre>
		+	docker pull your_docker_image
		+	docker run --rm -it -p 8000:80 -p 8001:443 -e ASPNETCORE_URLS="https://+;http://+" -e ASPNETCORE_HTTPS_PORT=8001 -e ASPNETCORE_Kestrel__Certificates__Default__Password="123123" -e ASPNETCORE_Kestrel__Certificates__Default__Path=\https\aspnetapp.pfx -v %USERPROFILE%\.aspnet\https:C:\https\ your_docker_image
		+
		+	docker run <your image> --rm -it -p 8000:80 -p 8001:443 -e ASPNETCORE_URLS="https://+;http://+" -e ASPNETCORE_HTTPS_PORT=8001 -e ASPNETCORE_Kestrel__Certificates__Default__Password="123123" -e ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx
		+	</pre>
		+
		+	Or in docker-compose format:
		+	<pre>
		+	version: '3'
		+	services:
		+	identity_server:
		+	image: mcr.microsoft.com/dotnet/core/samples:aspnetapp
		+	environment:
		+	- ASPNETCORE_URLS=https://+:443;http://+:80
		+	- ASPNETCORE_Kestrel__Certificates__Default__Password=password_here
		+	- ASPNETCORE_Kestrel__Certificates__Default__Path=/https/aspnetapp.pfx
		+	volumes:
		+	- ~/.aspnet/https/:/https/:ro
		+	container_name: identity_server
		+	ports:
		+	- "8443:443"
		+	- "8080:80"
	</pre>		</pre>

@@ Line 1: / Line 1: @@
 [[Category:SSL]]
 [[Category:Powershell]]
 <pre>