{"id":399,"date":"2017-04-11T14:34:15","date_gmt":"2017-04-11T14:34:15","guid":{"rendered":"https:\/\/www.nicovs.be\/?p=399"},"modified":"2017-08-29T14:39:19","modified_gmt":"2017-08-29T14:39:19","slug":"renewing-or-enabling-windows-remote-management-winrm-over-https","status":"publish","type":"post","link":"https:\/\/www.nicovs.be\/?p=399","title":{"rendered":"Renewing (or enabling) Windows Remote Management (WinRM) over HTTPS"},"content":{"rendered":"<p>This post became possible due to the work done by these 2 persons:<br \/>\n<a href=\"http:\/\/www.laurierhodes.info\/?q=node\/115\" target=\"_blank\" rel=\"noopener\">Laurie Rhodes<\/a> and of course <a href=\"https:\/\/gallery.technet.microsoft.com\/scriptcenter\/Self-signed-certificate-5920a7c6#content\" target=\"_blank\" rel=\"noopener\">Vadims Podans<\/a><br \/>\nSo don&#8217;t thank me for the &#8220;hard work&#8221; thank me only for the little adjustments that needed to be done to make this working&#8230;<\/p>\n<p>So, the problem: Set up WinRM over HTTPs, so that you can securely remote manage a window server with WinRM and Powershell. Since we are sometimes cheap, we like to use a self signed certificate and work with firewalled servers so that not every1 can connect to the WinRM if they like to.<br \/>\nWe once have set up WinRM on our remote server with a self signed certificate, but that worked for only 1 year and a few weeks\/months. I say AND a few weeks\/month because of the <a href=\"https:\/\/foxdeploy.com\/2016\/09\/16\/winrm-https-and-the-case-of-ghost-certificate\/\" target=\"_blank\" rel=\"noopener\">Spooky Certificate issue<\/a>.<br \/>\nSo today we ran into the issue that when trying to connect to our remote server we get this error:<br \/>\nWinRM testing failed with the following error:<\/p>\n<pre class=\"lang:ps decode:true \">Connecting to remote server XXX.XXX.XXX.XXX failed with the following error message: The server certificate on the destination computer (XXX.XXX.XXX.XXX:5986) has the following errors: The SSL certificate is expired.<\/pre>\n<p>Trying to renew this certificate is not easy, to I search together with my friend Google for a #HowToFixThis \ud83d\ude42<\/p>\n<p><span style=\"text-decoration: underline;\">Firstly<\/span>, you need to remove the WinRM listener using the expired certificate :<\/p>\n<ul>\n<li>Open an elevated command prompt or PowerShell prompt.<\/li>\n<li>View the currently existing listener with the following command:\n<pre class=\"lang:ps decode:true\">winrm get winrm\/config\/listener?Address=*+Transport=HTTPS\u00a0\r\n<\/pre>\n<\/li>\n<li>The CertificateThumbprint will match what is seen on the certificate.<\/li>\n<li>To remove the listener use the following command:\n<pre class=\"lang:ps decode:true \">winrm delete winrm\/config\/Listener?Address=*+Transport=HTTPS<\/pre>\n<p><span style=\"text-decoration: underline;\">Secondly<\/span>: Remove the expired certificate with MMC<\/li>\n<\/ul>\n<ul>\n<li>Click Run, then type MMC.<\/li>\n<li>Go to File &gt; Add\/Remote Snap-in.<\/li>\n<li>Select Certificates then click Add.<\/li>\n<li>Select the Computer Account option.<\/li>\n<li>In the left-hand pane, expand Certificates &gt; Personal &gt; Certificates.<\/li>\n<li>Right-click the certificate and click Delete.<\/li>\n<\/ul>\n<p>Now, creating the certificate: I need to use the Enhanced version of the, due to limitations in the Windows 2012 New-SelfSignedCertificate Powershell Module.<br \/>\nDownload\u00a0<a href=\"https:\/\/gallery.technet.microsoft.com\/scriptcenter\/Self-signed-certificate-5920a7c6#content\" target=\"_blank\" rel=\"noopener\">New-SelfSignedCertificateEx.zip<\/a><br \/>\nExtract in to a folder somewhere (eg: D:\\Tools)<br \/>\nOpen and run in an Admin PS console:<\/p>\n<pre class=\"lang:ps decode:true \">Import-Module D:\\Tools\\New-SelfSignedCertificateEx.ps1<\/pre>\n<p>Create a 2nd file D:\\Tools\\CreateWinRMCert.ps1 with the following content:<br \/>\nNote: change 2 things in this script if wanted:<br \/>\n* On line that start with: New-SelfSignedCertificateEx<br \/>\n<code> -NotAfter (Get-Date).AddMonths(60)<\/code><br \/>\nto a value that you like. By default, not adding this variable, yournew certificate wil be valid for 12 months only.<br \/>\n* At the end of the script, change your export password<br \/>\n<code>-ExportPassword \"S3cr3tP4ssw0rd\"<\/code><\/p>\n<pre class=\"lang:ps decode:true \"> \r\n&lt;##############################################################################\r\n #  Create-WinRMCert (-FriendlyName \"WinRMCert\" -ExportPassword \"MyPassword\")\r\n #\r\n #          Creates a self-signed cerificate for use with WinRM\r\n ##############################################################################&gt;\r\nfunction Create-WinRMCert(){\r\n\tparam (\r\n        # Create a Unique Friendly Name tag\r\n\t\t[Parameter(Mandatory = $false)]\r\n\t\t[string]$FriendlyName,\r\n\t\t[Parameter(Mandatory = $true)]\r\n\t\t[string]$ExportPassword\r\n)\r\n \r\n$ipProperties = [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties()\r\n$Hostname = \"{0}.{1}\" -f $ipProperties.Hostname,$ipProperties.DomainName\r\n$Hostname = $Hostname.ToLower() \r\n \r\n# The File location for the exported Certificate\r\n$ExportCertFile    = \"$($env:TEMP)\\$($Hostname).pfx\"\r\n \r\nIf (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`\r\n    [Security.Principal.WindowsBuiltInRole] \"Administrator\"))\r\n{\r\n    Write-Warning \"Script must be run with Admin Privileges\"\r\n    Break\r\n}\r\n \r\n \r\nNew-SelfSignedCertificateEx -Subject \"CN=$($Hostname)\" -StoreLocation LocalMachine -FriendlyName $FriendlyName -EnhancedKeyUsage @(\"1.3.6.1.5.5.7.3.1\") -Exportable -SignatureAlgorithm SHA256  -NotAfter (Get-Date).AddMonths(60)\r\n  \r\n# Create a handle to the certificate\r\n# Note that multiple certificates with the same friendly name could be returned\r\n# We will assume the desired certificate is the first in the returned array\r\n$foundCertArray = get-childitem cert:\\LocalMachine\\My | where-object {$_.FriendlyName -eq  $FriendlyName }\r\n \r\n \r\n#Export the Certificate - can't rely upon 'Export-Certificate' being available\r\n\"Exporting Certificate $($foundCertArray[0].Thumbprint)\"\r\n \r\nIf (Test-Path $ExportCertFile){ Remove-Item $ExportCertFile }\r\n \r\n \r\n$type = [System.Security.Cryptography.X509Certificates.X509ContentType]::pfx\r\n \r\n[byte[]]$Bytes  = $foundCertArray[0].Export($type, $ExportPassword)\r\n \r\n[io.file]::WriteAllBytes($ExportCertFile,$Bytes)\r\n \r\n\r\n  Write-Debug \"Thumbprint = $foundCertArray[0].Thumbprint)\"\r\n \r\n\r\n  Start-Process -FilePath \"C:\\Windows\\Explorer.exe\" -ArgumentList \"$($env:TEMP)\"\r\n}\r\n \r\n \r\n \r\n#### Call the example script\r\ncls\r\n \r\nCreate-WinRMCert -FriendlyName \"WinRMCert\" -ExportPassword \"S3cr3tP4ssw0rd\"<\/pre>\n<p>Run the script in Powershell:<\/p>\n<pre class=\"lang:ps decode:true \">PS D:\\Tools\\&gt; .\/CreateWinRMCert.ps1<\/pre>\n<p>So that your Certificate will be created.<br \/>\nPowershell output should be something like:<\/p>\n<pre class=\"lang:ps decode:true \">Thumbprint                                Subject\r\n----------                                -------\r\n8DCA1E0253ADDE2A3AZEE85BF751481A8B8228AB  CN=hostname.local\r\nExporting Certificate 8DCA1E0253ADDE2A3AZEE85BF751481A8B8228AB<\/pre>\n<p>Use the PFX generated in C:\\Users\\Administrator\\AppData\\Local\\Temp\\2 to import in your Client Server, using the Password provided above.<br \/>\nAfter Generating this Certificate, you need to configure the WinRM to use this certificate:<\/p>\n<pre class=\"lang:ps decode:true \">PS D:\\&gt; New-Item WSMan:\\localhost\\Listener -Address * -Transport HTTPS -HostName  \"hostname.local\" -CertificateThumbPrint \"8DAA1E0023ADDE2A3BAEE85BF751481A8B8788AB\"\r\n\r\nCreates a new Listener item.\r\nThis command creates a new Listener item.\r\n\r\nDo you want to continue?\r\n[Y] Yes  [N] No  [S] Suspend  [?] Help (default is \"Y\"): Y\r\n\r\n\r\n   WSManConfig: Microsoft.WSMan.Management\\WSMan::localhost\\Listener\r\n\r\nType            Keys                                Name\r\n----            ----                                ----\r\nContainer       {Transport=HTTPS, Address=*}        Listener_1305953032\r\n\r\n\r\nPS D:\\&gt; winrm enumerate winrm\/config\/listener\r\nListener\r\n    Address = *\r\n    Transport = HTTP\r\n    Port = 5985\r\n    Hostname\r\n    Enabled = true\r\n    URLPrefix = wsman\r\n    CertificateThumbprint\r\n    ListeningOn = x.x.x.x, 127.0.0.1, ::1\r\nListener\r\n    Address = *\r\n    Transport = HTTPS\r\n    Port = 5986\r\n    Hostname = hostname.local\r\n    Enabled = true\r\n    URLPrefix = wsman\r\n    CertificateThumbprint = 8DAA1E0023ADDE2A3BAEE85BF751481A8B8788AB\r\n    ListeningOn = x.x.x.x, 127.0.0.1, ::1\r\n\r\nPS D:\\&gt;<\/pre>\n<p>Test and enjoy WinRM again \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This post became possible due to the work done by these 2 persons: Laurie Rhodes and of course Vadims Podans So don&#8217;t thank me for the &#8220;hard work&#8221; thank me only for the little adjustments that needed to be done to make this working&#8230; So, the problem: Set up WinRM over HTTPs, so that you [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[84,72,32,85],"tags":[],"class_list":["post-399","post","type-post","status-publish","format-standard","hentry","category-powershell","category-ssl","category-windows","category-winrm"],"_links":{"self":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=399"}],"version-history":[{"count":6,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/399\/revisions"}],"predecessor-version":[{"id":403,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=\/wp\/v2\/posts\/399\/revisions\/403"}],"wp:attachment":[{"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nicovs.be\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}