Apply for/renew a certificate using Posh-ACME in Powershell

A PowerShell module and ACME client to create publicly trusted SSL/TLS certificates from an ACME capable certificate authority such as Let’s Encrypt.

Install Posh-ACME

1
2
3
4
5


# install for all users (requires elevated privs)
Install-Module -Name Posh-ACME -Scope AllUsers

# install for current user
Install-Module -Name Posh-ACME -Scope CurrentUser

Apply for a wildcard domain name certificate with the Cloudflare plug-in

First, you can use the Get-PAPlugin command to get the plugin parameter information

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


➜  ~ Get-PAPlugin Cloudflare -Params


    Set Name: Bearer (Default)


Parameter Type         IsMandatory
--------- ----         -----------
CFToken   SecureString True


    ...

Here we use Bearer authentication.

1
2
3
4
5
6
7


$pArgs = @{
    CFToken = (Read-Host 'API Token' -AsSecureString)
}
# Apply for a certificate
New-PACertificate 'example.com','*.example.com' -CertKeyLength 'ec-256' -AcceptTOS -Plugin Cloudflare -PluginArgs $pArgs
# Install the certificate
Get-PACertificate 'example.com' | Install-PACertificate

Renew the certificate and update the IIS website binding certificate

Create a new PowerShell script

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


Submit-Renewal -AllOrders | ForEach-Object {
    $cert = $_
    Install-PACertificate $cert

    $h = $cert.Subject
    if ('example.com' -in $cert.AllSANs) {
        $thumbprint = $cert.Thumbprint
        $appid = "{$([System.Guid]::NewGuid())}"
        $addr = "0.0.0.0:443"
        netsh http delete sslcert ipport=$addr
        netsh http add sslcert ipport=$addr certhash=$thumbprint appid=$appid
    }

    # Create symbolic links to facilitate third-party program references
    Remove-Item -Path "$env:AppData\Certs\$h.*"
    New-Item -Path "$env:AppData\Certs\$h.key" -ItemType SymbolicLink -Target $cert.KeyFile
    New-Item -Path "$env:AppData\Certs\$h.cer" -ItemType SymbolicLink -Target $cert.FullChainFile

    # Restart-Service -Name SunshineService
}

Create a scheduled task to execute periodically

Create a vbs script

1
2
3
4
5
6


Set shell = CreateObject("WScript.Shell")

prog = "powershell.exe -Nologo path\to\renewal.ps1"
shell.Run prog, 0, True

Set shell = Nothing

Create a new scheduled task and set Action to Start a program: C:\Windows\System32\wscript.exe path\to\renewal.vbs