REST API で vCenter Server のマシンSSL証明書を置き換える

 1# ICertificatePolicy.CheckValidationResult メソッドをオーバーライドして
 2# Invoke-WebRequest による HTTPS 接続時の証明書の検証をスキップしています。
 3# 端末がマシン SSL 証明書を信頼できる場合は不要です。
 4# https://docs.microsoft.com/ja-jp/dotnet/api/system.net.icertificatepolicy.checkvalidationresult?view=netframework-4.8
 5add-type @"
 6    using System.Net;
 7    using System.Security.Cryptography.X509Certificates;
 8    public class TrustAllCertsPolicy : ICertificatePolicy {
 9        public bool CheckValidationResult(
10            ServicePoint srvPoint, X509Certificate certificate,
11            WebRequest request, int certificateProblem) {
12            return true;
13        }
14    }
15"@
16[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy
17
18# vCenter SSO の認証情報
19$VC_USERNAME = "administrator@vsphere.local"
20$VC_PASSWORD = "VMware1!"
21$VC_HOSTNAME = "vcsa.api.lab"
22
23$cred = New-Object System.Management.Automation.PSCredential(
24          $VC_USERNAME,
25          (ConvertTo-SecureString $VC_PASSWORD -AsPlainText -Force)
26        )
27
28try {
29    $response = Invoke-WebRequest  -Method Post -Credential $cred `
30                    -H @{ "vmware-use-header-authn" = "string"} `
31                    -Uri "https://${VC_HOSTNAME}/rest/com/vmware/cis/session"
32} catch [System.Net.WebException] {
33    Write-Host $_.Exception
34    $_.Exception.Response
35}
36
37$session_id = (ConvertFrom-Json $response.Content).value

1PS> Write-Host $response.Content
2{"value":"bc9c22db3ada2cb3c4726effd93e042b"}
3
4PS> $session_id = (ConvertFrom-Json $response.Content).value

 1# CSR 生成のための証明書情報
 2$CSR_INFO = ConvertTo-Json @{
 3    "spec" = @{
 4        "common_name" = "vcsa.api.lab"
 5        "country" = "JP"
 6        "email_address" = "admin@api.lab"
 7        "key_size" = 2048
 8        "locality" = "Shibuya-ku"
 9        "organization" = "My Lab"
10        "organization_unit" = "API Unit"
11        "state_or_province" = "Tokyo"
12        "subject_alt_name" = @("$VC_HOSTNAME")
13    }
14}
15
16$headers = @{
17    "vmware-api-session-id" = ${session_id}
18    "Content-Type" = "application/json"
19}
20
21try {
22    $response = Invoke-WebRequest -Method Post -Headers $headers -Body $CSR_INFO `
23        -Uri "https://${VC_HOSTNAME}/rest/vcenter/certificate-management/vcenter/tls-csr"
24} catch [System.Net.WebException] {
25    Write-Host $_.Exception
26    $_.Exception.Response
27}
28
29$issue_date = Get-Date -Format "yyyyMMdd_HHmmss"
30(ConvertFrom-Json $response.Content).value.csr > "${issue_date}.csr"

1PS> $response.Content
2{"value":{"csr":"-----BEGIN CERTIFICATE REQUEST-----\nMIIDJTCCAg0CAQAwbTEVMBMGA1UEAwwMdmNzYS5hcGkubGFiMQswCQYDVQQGEwJK\nUDEOMAwGA1UECAwFVG9reW8xEzARBgNVBAcMClNoaWJ1eWEta3UxDzANBgNVBAoM\nBk15IExhYjERMA8GA1UECwwIQVBJIFVuaXQwggEiMA0GCSqGSIb3DQEBAQUAA4IB\nDwAwggEKAoIBAQDIrlYJLyhmDryEDXiXFWwr4FEamarCqem9SenBILmevaQTOQE1\nIYGocqxYXPavP2Gzdo3KkU23VGt/Jgcz009eZqu96Kxw8xFxEXJDoI91aT+3d6Ip\nAaJXH6Md9h3pUT5XERtSwQcm09JVXVtRJLPMmDeVo2YUiIGyBB5FNVXz+V7Xz9Ur\nhgo+pG7o9TsKN1tp2gaJyPiO7Hm5Q6r3W22jAg1ebQLfvzpfOBw+OjblR50Zbs2R\nhsG94vydWBsl2rCGgTd+efjljqExiRZaWC9fjuGRk2cpE7F3RiFJT1umWGStzcRN\nwJkjBOQSZKOQfDdsym8cLyeCip8vcoihApatAgMBAAGgczBxBgkqhkiG9w0BCQ4x\nZDBiMAsGA1UdDwQEAwIF4DA0BgNVHREELTArgQ1hZG1pbkBhcGkubGFiggx2Y3Nh\nLmFwaS5sYWKCDHZjc2EuYXBpLmxhYjAdBgNVHQ4EFgQUmCj2XqWkB4kM2ozlnnS0\ntkabC20wDQYJKoZIhvcNAQELBQADggEBAKlu3AOD+FxmKHx5KlI9IjfBDKQLGRQj\nOHB+pjCrfmgzxElbIp6H+PolyIYHcIm+n9uc1Ymm2v4z2UHvvl2JLxoBTIYPVX+T\nouZnKsHlyMCDVwsaPbvUjn/CxQtG8q6nwXuapqtE2B01B2b5LUBEbjjkb1IDKVsz\nifNTXMYav1EkYh1kw9tDZcXXED8OJd3XIlqwMj6BLXjs1zpZYghJTuLZiARFnMNI\nYvzifN4EkOSYmAE7UBYVxjCc8vkZKlc817ELURK4S51zKkbR0gN7pofB+XR4OYa+\nt6mctK/h5TTDlS5n8dq1ei45TGrqbAqZGwaAwJJn1AKVM5R3qzpOAHM=\n-----END CERTIFICATE REQUEST-----"}}
3
4PS> $issue_date = Get-Date -Format "yyyyMMdd_HHmmss"
5PS> (ConvertFrom-Json $response.Content).value.csr > "${issue_date}.csr"

1$CERTREQ_CONFIG = "ADCS.api.lab\api-ADCS-CA-1"
2certreq -submit -attrib CertificateTemplate:WebServer `
3    -config ${CERTREQ_CONFIG} `
4    "${issue_date}.csr" `
5    "${issue_date}.crt"

 1$issued_cert = (Get-Content "${issue_date}.crt" -Raw)
 2$root_cert = (Get-Content "cacert.cer" -Raw)
 3$replace_spec = (ConvertTo-Json @{
 4  "spec" = @{
 5    "cert" = "$issued_cert"
 6    "root_cert" = "$root_cert"
 7  }
 8}).Replace("\r\n","\n")
 9
10try {
11    Invoke-WebRequest -Method Put -Headers $headers -Body $replace_spec `
12        -Uri https://${VC_HOSTNAME}/rest/vcenter/certificate-management/vcenter/tls
13} catch [System.Net.WebException] {
14    Write-Host $_.Exception
15    $_.Exception.Response
16}