Skip to content
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Commit 7a1e2f7

Browse files
ryanrichter94ryanrichter94
authoredFeb 18, 2025
Merge pull request #283 from chocolatey/serviceCertificateThumbprint
(#281) Prevents Creation Of Unrequired Self-Signed Certificate
2 parents 0b147ad + 52dd728 commit 7a1e2f7

File tree

7 files changed

+84
-35
lines changed

7 files changed

+84
-35
lines changed
 

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ Below are the minimum requirements for setting up your C4B server via this guide
125125
> <li>Creates a "choco-install" raw repository</li>
126126
> <li>Sets up "ChocolateyInternal" on C4B Server as source, with API key</li>
127127
> <li>Adds firewall rule for repository access</li>
128-
> <li>Installs MS Edge, and disables first-run experience</li>
128+
> <li>Installs MS Edge, as Internet Explorer cannot access the Sonatype Nexus site</li>
129129
> <li>Outputs data to a JSON file to pass between scripts</li>
130130
> </ul>
131131
> </details>

‎Set-SslSecurity.ps1

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ param(
2222
# Ignored if supplied alongside -Subject.
2323
[Parameter(ValueFromPipeline, ParameterSetName='Thumbprint')]
2424
[ArgumentCompleter({
25-
Get-ChildItem Cert:\LocalMachine\My | ForEach-Object {
25+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
2626
[System.Management.Automation.CompletionResult]::new(
2727
$_.Thumbprint,
2828
$_.Thumbprint,
29-
'ParameterValue',
30-
$_.FriendlyName
29+
"ParameterValue",
30+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
3131
)
3232
}
3333
})]

‎Start-C4bCcmSetup.ps1

Lines changed: 26 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,21 @@ param(
1717
[System.Management.Automation.PSCredential]
1818
$DatabaseCredential = (Get-Credential -Username ChocoUser -Message 'Create a credential for the ChocolateyManagement DB user (document this somewhere)'),
1919

20-
#Certificate to use for CCM service
20+
# Certificate to use for CCM service
2121
[Parameter()]
22+
[Alias('CertificateThumbprint')]
23+
[ArgumentCompleter({
24+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
25+
[System.Management.Automation.CompletionResult]::new(
26+
$_.Thumbprint,
27+
$_.Thumbprint,
28+
"ParameterValue",
29+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
30+
)
31+
}
32+
})]
2233
[String]
23-
$CertificateThumbprint
34+
$Thumbprint
2435
)
2536
process {
2637
$DefaultEap = $ErrorActionPreference
@@ -116,31 +127,27 @@ process {
116127
$hostName = [System.Net.Dns]::GetHostName()
117128
$domainName = [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().DomainName
118129

119-
if(-Not $hostName.endswith($domainName)) {
130+
if (-not $hostName.EndsWith($domainName)) {
120131
$hostName += "." + $domainName
121132
}
122133

123134
Write-Host "Installing Chocolatey Central Management Service"
124-
if($CertificateThumbprint){
135+
$chocoArgs = @('install', 'chocolatey-management-service', "--source='ChocolateyInternal'", '-y', "--package-parameters-sensitive=`"/ConnectionString:'Server=Localhost\SQLEXPRESS;Database=ChocolateyManagement;User ID=$DatabaseUser;Password=$DatabaseUserPw;'`"", '--no-progress')
136+
if ($Thumbprint) {
125137
Write-Verbose "Validating certificate is in LocalMachine\TrustedPeople Store"
126-
if($CertificateThumbprint -notin (Get-ChildItem Cert:\LocalMachine\TrustedPeople | Select-Object -Expand Thumbprint)){
127-
Write-Warning "You specified $CertificateThumbprint for use with CCM service, but the certificate is not in the required LocalMachine\TrustedPeople store!"
128-
Write-Warning "Please place certificate with thumbprint: $CertificateThumbprint in the LocalMachine\TrustedPeople store and re-run this step"
129-
throw "Certificate not in correct location....exiting."
130-
}
131-
else {
138+
if (-not (Get-Item Cert:\LocalMachine\TrustedPeople\$Thumbprint -EA 0) -and -not (Get-Item Cert:\LocalMachine\My\$Thumbprint -EA 0)) {
139+
Write-Warning "You specified $Thumbprint for use with CCM service, but the certificate is not in the required LocalMachine\TrustedPeople store!"
140+
Write-Warning "Please place certificate with thumbprint: $Thumbprint in the LocalMachine\TrustedPeople store and re-run this step"
141+
throw "Certificate not in correct location... exiting."
142+
} elseif ($MyCertificate = Get-Item Cert:\LocalMachine\My\$Thumbprint -EA 0) {
143+
Write-Verbose "Copying certificate from 'Personal' store to 'TrustedPeople'"
144+
Copy-CertToStore $MyCertificate
145+
} else {
132146
Write-Verbose "Certificate has been successfully found in correct store"
133-
$chocoArgs = @('install', 'chocolatey-management-service', '-y', "--package-parameters-sensitive='/ConnectionString:Server=Localhost\SQLEXPRESS;Database=ChocolateyManagement;User Id=$DatabaseUser;Password=$DatabaseUserPw'")
134-
& Invoke-Choco @chocoArgs
135-
136-
Set-CcmCertificate -CertificateThumbprint $CertificateThumbprint
137147
}
148+
$chocoArgs += @("--package-parameters='/CertificateThumbprint=$Thumbprint'")
138149
}
139-
140-
else {
141-
$chocoArgs = @('install', 'chocolatey-management-service', "--source='ChocolateyInternal'", '-y', "--package-parameters-sensitive=`"/ConnectionString:'Server=Localhost\SQLEXPRESS;Database=ChocolateyManagement;User ID=$DatabaseUser;Password=$DatabaseUserPw;'`"", '--no-progress')
142-
& Invoke-Choco @chocoArgs
143-
}
150+
& Invoke-Choco @chocoArgs
144151

145152
Write-Host "Installing Chocolatey Central Management Website"
146153
$chocoArgs = @('install', 'chocolatey-management-web', "--source='ChocolateyInternal'", '-y', "--package-parameters-sensitive=""'/ConnectionString:Server=Localhost\SQLEXPRESS;Database=ChocolateyManagement;User ID=$DatabaseUser;Password=$DatabaseUserPw;'""", '--no-progress')

‎Start-C4bSetup.ps1

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,16 @@ param(
6363
# the local machine certificate stores.
6464
# Only used in Unattend mode for the SSL setup script.
6565
[Parameter(ParameterSetName='Unattended')]
66+
[ArgumentCompleter({
67+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
68+
[System.Management.Automation.CompletionResult]::new(
69+
$_.Thumbprint,
70+
$_.Thumbprint,
71+
"ParameterValue",
72+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
73+
)
74+
}
75+
})]
6676
[string]
6777
$Thumbprint,
6878

@@ -150,16 +160,14 @@ try {
150160

151161
# Kick off unattended running of remaining setup scripts.
152162
if ($Unattend) {
163+
$Certificate = @{}
164+
if ($Thumbprint) {$Certificate.Thumbprint = $Thumbprint}
165+
153166
Set-Location "$env:SystemDrive\choco-setup\files"
154167
.\Start-C4BNexusSetup.ps1
155-
.\Start-C4bCcmSetup.ps1 -DatabaseCredential $DatabaseCredential
168+
.\Start-C4bCcmSetup.ps1 @Certificate -DatabaseCredential $DatabaseCredential
156169
.\Start-C4bJenkinsSetup.ps1
157-
if ($Thumbprint) {
158-
.\Set-SslSecurity.ps1 -Thumbprint $Thumbprint
159-
}
160-
else {
161-
.\Set-SslSecurity.ps1
162-
}
170+
.\Set-SslSecurity.ps1 @Certificate
163171
}
164172
} finally {
165173
$ErrorActionPreference = $DefaultEap

‎scripts/Set-CCMCert.ps1

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,19 @@ PS> .\Set-CCMCert.ps1 -CertificateThumbprint 'Your_Certificate_Thumbprint_Value'
1616
[CmdletBinding()]
1717
param(
1818
[Parameter(Mandatory)]
19+
[Alias("CertificateThumbprint")]
20+
[ArgumentCompleter({
21+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
22+
[System.Management.Automation.CompletionResult]::new(
23+
$_.Thumbprint,
24+
$_.Thumbprint,
25+
"ParameterValue",
26+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
27+
)
28+
}
29+
})]
1930
[String]
20-
$CertificateThumbprint
31+
$Thumbprint
2132
)
2233

2334
begin {
@@ -41,14 +52,14 @@ process {
4152
#Add new CCM Web IIS Binding
4253
Write-Verbose "Adding new IIS binding to Chocolatey Central Management"
4354
$guid = [Guid]::NewGuid().ToString("B")
44-
netsh http add sslcert ipport=0.0.0.0:443 certhash=$CertificateThumbprint certstorename=MY appid="$guid"
55+
netsh http add sslcert ipport=0.0.0.0:443 certhash=$Thumbprint certstorename=MY appid="$guid"
4556
Get-WebBinding -Name ChocolateyCentralManagement | Remove-WebBinding
4657
New-WebBinding -Name ChocolateyCentralManagement -Protocol https -Port 443 -SslFlags 0 -IpAddress '*'
4758

4859
#Write Thumbprint to CCM Service appsettings.json
4960
$appSettingsJson = 'C:\ProgramData\chocolatey\lib\chocolatey-management-service\tools\service\appsettings.json'
5061
$json = Get-Content $appSettingsJson | ConvertFrom-Json
51-
$json.CertificateThumbprint = $CertificateThumbprint
62+
$json.CertificateThumbprint = $Thumbprint
5263
$json | ConvertTo-Json | Set-Content $appSettingsJson -Force
5364

5465
#Try Restarting CCM Service

‎scripts/Set-JenkinsCert.ps1

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,19 @@
1111
param(
1212
# Thumbprint of the certificate stored in the Trusted People cert-store.
1313
[Parameter(Mandatory)]
14-
[string]$Thumbprint,
14+
[Alias("CertificateThumbprint")]
15+
[ArgumentCompleter({
16+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
17+
[System.Management.Automation.CompletionResult]::new(
18+
$_.Thumbprint,
19+
$_.Thumbprint,
20+
"ParameterValue",
21+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
22+
)
23+
}
24+
})]
25+
[String]
26+
$Thumbprint,
1527

1628
# Port number to use for Jenkins HTTPS.
1729
[uint16]$Port = 7443

‎scripts/Set-NexusCert.ps1

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,18 @@ PS> .\Set-NexusCert.ps1 -Thumbprint 'Your_Certificate_Thumbprint_Value' -NexusPo
1818
[CmdletBinding()]
1919
param(
2020
[Parameter(Mandatory)]
21-
[string]
21+
[Alias("CertificateThumbprint")]
22+
[ArgumentCompleter({
23+
Get-ChildItem Cert:\LocalMachine\TrustedPeople | ForEach-Object {
24+
[System.Management.Automation.CompletionResult]::new(
25+
$_.Thumbprint,
26+
$_.Thumbprint,
27+
"ParameterValue",
28+
($_.Subject -replace "^CN=(?<FQDN>.+),?.*$",'${FQDN}')
29+
)
30+
}
31+
})]
32+
[String]
2233
$Thumbprint,
2334

2435
[Parameter()]

0 commit comments

Comments
 (0)
Please sign in to comment.