FlexdeskBlueprint

8.0.0.2

functions/public/New-FlexdeskAzureVpnCerts.ps1

<# #>
function New-FlexdeskAzureVpnCerts {
    [cmdletbinding(DefaultParameterSetName="AzureTenantDomain")]
    param(
        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $ResourceGroupName,
        
        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $GatewayName,
        
        [parameter(ParameterSetName="AzureTenantId",Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $TenantId,
        
        [parameter(ParameterSetName="AzureTenantDomain",Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $TenantDomain,

        [parameter()]
        [ValidateNotNullOrEmpty()]
        [string] $SubscriptionId,
        
        [parameter()]
        [ValidateNotNullOrEmpty()]
        [string] $SubscriptionName,

        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [pscredential] $TenantCredential = (Get-Credential -Message "Please provide your tenant credentials"),

        [parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string] $NumClientCertificate = 10,
        
        [parameter(Mandatory=$true)]
        [string] $CertPassword = $(New-SWRandomPassword),
        
        [parameter(Mandatory=$true)]
        [string] $VpnAddressPool = "10.4.5.0/24",

        [parameter(DontShow=$true)]
        [string] $Log = $null
        )

    begin
    {
        #Check UAC, if script is started as administrator
        $myWindowsID=[System.Security.Principal.WindowsIdentity]::GetCurrent()
        $myWindowsPrincipal=new-object System.Security.Principal.WindowsPrincipal($myWindowsID)
        $adminRole=[System.Security.Principal.WindowsBuiltInRole]::Administrator
        if (-not $myWindowsPrincipal.IsInRole($adminRole))
        {
            Write-Log -Type Error -Message "You have to run this script as administrator!"
            return $null
        }

        #Check environment
        $Continue = $true
        if([string]::IsNullOrEmpty($Log) -eq $false){
            if(test-path $Log){} else {
                $Log = Start-Log
            }
        } else {
            $Log = Start-Log
        }
        $PSDefaultParameterValues = @{"Write-Log:Log"=$Log}
        if($TenantCredential){
            try {
                Connect-MsolService -Credential $TenantCredential
                $Tenant = Get-Tenant -TenantDomain $TenantDomain
                if($Tenant.Default -eq $false){
                    $null = Add-AzureRMAccount -Credential $TenantCredential -TenantId $TenantId
                } else {
                    $null = Add-AzureRMAccount -Credential $TenantCredential
                }

                if($SubscriptionId){
                    $null = Select-AzureRmSubscription -SubscriptionId $SubscriptionId
                } elseif($SubscriptionName){
                    $null = Select-AzureRmSubscription -SubscriptionName $SubscriptionName
                } else {
                    # use default subscription
                }
            } catch {
                Write-Log -Type Error -Message "Error during Azure connection: $_"
            }
        }
        try{
            $null = Get-AzureRmContext
        }
        catch {
            Write-Error "No active Azure subscription is present in the session. Please use Login-AzureRMAccount and Select-AzureRMSubscription to set the target subscription, or specify Tenant/Credential information"
            return $null
        }
        
        $ResourceGroup = Get-AzureRmResourceGroup -Name $ResourceGroupName -ErrorAction Ignore
        if($ResourceGroup -eq $null){
            Write-Log -Type Error -Message "Resource group not found, please choose another ResourceGroupName"
            return
        }
        
        $Gateway = Get-AzureRmVirtualNetworkGateway -Name $GatewayName -ResourceGroupName $ResourceGroupName -ErrorAction Ignore
        if($Gateway -eq $null){
            Write-Log -Type Error -Message "Gateway not found, please choose another GatewayName"
            return
        }
    }
    process{
        if(!$Continue){return}

        Write-Host "Generating root certificate:"
        $rootCertificate = New-SelfSignedCertificate -Type Custom -KeySpec Signature -KeyUsageProperty Sign -KeyUsage CertSign -HashAlgorithm sha256 -KeyLength 2048 -KeyExportPolicy Exportable -CertStoreLocation "cert:\localmachine\my" -Subject "CN=$($GatewayName)_$($ResourceGroupName)_$($TenantDomain)"
        $pwd = ConvertTo-SecureString -String $CertPassword -Force -AsPlainText
        $null = Export-PfxCertificate -Cert $rootCertificate -FilePath "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_Root.pfx" -Password $pwd
        Write-Host " $($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_Root.pfx"
        $null = Export-Certificate -Cert $rootCertificate -FilePath "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_Root.cer"
        $([Convert]::ToBase64String($rootCertificate.Export('Cert'))) | Set-Content -Path "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_RootBase64.cer"
        Write-Host " $($TenantDomain)_$($ResourceGroupName)_$($GatewayName)__RootBase64.cer"
        
        Write-Host "Generating client certificates:"
        for($i=1; $i -le $NumClientCertificate; $i++)
        {
            $clientCertificate = New-SelfSignedCertificate -Type Custom -KeySpec Signature -HashAlgorithm sha256 -KeyLength 2048 -KeyExportPolicy Exportable -CertStoreLocation "cert:\localmachine\my" -Subject "CN=User$($i)_$($GatewayName)_$($ResourceGroupName)_$($TenantDomain)" -Signer $rootCertificate -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.2")
            $null = Export-PfxCertificate -Cert $clientCertificate -FilePath "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_User$($i).pfx" -Password $pwd
            Write-Host " $($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_User$($i).pfx"
            $null = Export-Certificate -Cert $clientCertificate -FilePath "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_User$($i).cer"
            $([Convert]::ToBase64String($clientCertificate.Export('Cert'))) | Set-Content -Path "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_User$($i)Base64.cer"
            Write-Host " $($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_User$($i)Base64.cer"
        }

        Write-Host "Installing root certificate in VPN Gateway"
        Write-Host " Setting VpnClientConfig"
        $vpnClientConfig = Set-AzureRmVirtualNetworkGatewayVpnClientConfig -VirtualNetworkGateway $Gateway -VpnClientAddressPool $VpnAddressPool
        Write-Host " Adding root certificate"
        $installedCertificate = Add-AzureRmVpnClientRootCertificate -VpnClientRootCertificateName "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_Root.cer" -PublicCertData $([Convert]::ToBase64String($rootCertificate.Export('Cert'))) -VirtualNetworkGatewayName $GatewayName -ResourceGroupName $ResourceGroupName
        $rootCert = Get-AzureRmVpnClientRootCertificate -VpnClientRootCertificateName "$($TenantDomain)_$($ResourceGroupName)_$($GatewayName)_Root.cer" -VirtualNetworkGatewayName $GatewayName -ResourceGroupName $ResourceGroupName
        if($rootCert -eq $null){
            Write-Log -Type Error -Message "Can't install the root certificate!"
            return
        }
        
        Write-Host "Downloading VPN client."
        $downloadUrl = Get-AzureRmVpnClientPackage -ResourceGroupName $ResourceGroupName -VirtualNetworkGatewayName $GatewayName -ProcessorArchitecture Amd64
        Invoke-WebRequest -Uri $downloadUrl -OutFile "VPNClient_$($TenantDomain)_$($ResourceGroupName)_$($GatewayName).exe"
    }
    
    end{} 
}