Windows Chef将添加ssl证书并绑定到IIS

Windows Chef将添加ssl证书并绑定到IIS,ssl,ssl-certificate,chef-infra,chef-recipe,chef-windows,Ssl,Ssl Certificate,Chef Infra,Chef Recipe,Chef Windows,我正在使用Windows Chef cookbook 创建和绑定ssl 首先,我尝试: # Create/update certificate windows_certificate "create cert" do source "c://hn/ssl/cert.pfx" pfx_password {cert_pass} store_name "WEBHOSTING" action :create end # Bind certificate windows

我正在使用Windows Chef cookbook

创建和绑定ssl

首先,我尝试:

# Create/update certificate
windows_certificate "create cert" do
    source "c://hn/ssl/cert.pfx"
    pfx_password  {cert_pass}
    store_name "WEBHOSTING"
    action :create
end

# Bind certificate
windows_certificate_binding "bind to IIS" do
    action :create
    cert_name "{my_ssl_hash_number}"
    name_kind :hash
    port 443
    store_name "WEBHOSTING"
end
我得到了以下错误:

标准输出:SSL证书添加失败,错误:1312 A指定 登录会话不存在。它可能已经被终止了

我做了一些研究,看起来我导入的证书不可导出,需要授予私钥访问权限,参考:

下面是我的第二次尝试:

# Create/update certificate
windows_certificate "create cert" do
    source "c://hn/ssl/cert.pfx"
    pfx_password  {cert_pass}
    store_name "WEBHOSTING"
    private_key_acl ["IIS_IUSRS"]
    action [:create, :acl_add]
end 

# Bind certificate
windows_certificate_binding "bind to IIS" do
    action :create
    cert_name "{my_ssl_hash_number}"
    name_kind :hash
    port 443
    store_name "WEBHOSTING"
end
但是,我仍然得到了一个错误:

标准: STDERR:C:\Users\Administrator\AppData\Local\Temp\chef-script20180823-492-10cuvyo.ps1 :不存在私钥


有人能帮我吗?如何正确导入ssl并绑定到IIS?提前感谢。

我的另一种解决方案是使用powershell脚本来添加SSL证书,而不是使用下面的windows cookbook来绑定SSL证书和https端口。我还需要注意,如果添加了新证书,那么应该添加新证书

hostname = node['hostname']
hostnamelike = 'CN=' + node['hostname'].to_s + '*'
powershell_script 'find ssl certificate  on local machine root and assign certificate' do
  code <<-EOH
  $iisSite='your site name'
  $hostname="#{hostname}"
  $hostnamelike="#{hostnamelike}"
  $protocol='https'
  $port=443
  Get-WebBinding -Port $port -Name $iissite | Remove-WebBinding
  $guid_value = [GUID]::NewGUID().ToString('B')
  $thumbprint = (Get-ChildItem cert:\\LocalMachine\\my | where-object { $_.Subject -like $hostnamelike  } | Select-Object -First 1).Thumbprint
  New-WebBinding -Name $iissite -IP "*" -Port $port -Protocol https
  netsh http show sslcert ipport=0.0.0.0:$port
  if ($LASTEXITCODE -eq 1) {
  netsh http add sslcert ipport=0.0.0.0:$port certhash=$thumbprint appid=$guid_value certstorename=MY
  }
  else {
  netsh http delete sslcert ipport=0.0.0.0:$port
  netsh http add sslcert ipport=0.0.0.0:$port certhash=$thumbprint appid=$guid_value certstorename=MY
  }
  EOH
end
hostname=node['hostname']
hostnamelike='CN='+节点['hostname'].到_s+'*'
powershell\u脚本“在本地计算机根目录上查找ssl证书并分配证书”do
密码