tasks/Invoke-EnsureSSLCertificateTask.ps1

#
# Invoke_EnsureSSLCertificateTask.ps1
#

function Invoke-EnsureSSLCertificateTask
{
<#
.SYNOPSIS
    Ensure that a trusted SSL Certificate exists for the Solr host name, and export it for Solr to use
 
.DESCRIPTION
    The Invoke-EnsureSSLCertificateTask is registered as EnsureSSLCertificate type.
 
.EXAMPLE
    Json task configuration for Sitecore Install Framework:
 
    "Ensure trusted SSL certificate exists (if required)": {
            "Type": "EnsureSSLCertificate",
            "Params": {
                "solrSSL": "[parameter('SolrUseSSL')]",
                "solrName": "[variable('SolrName')]",
                "solrHost": "[parameter('SolrHost')]",
                "certificateStore": "[variable('CertStoreFile')]"
            }
        },
 
.EXAMPLE
 
.NOTE
    Source: https://gist.github.com/jermdavis/49018386ae7544ce0689568edb7ca2b8
 
#>


    [CmdletBinding(SupportsShouldProcess=$true)]
    param(
        [parameter(Mandatory=$true)]
        [bool]$solrSSL,
        [parameter(Mandatory=$true)]
        [string]$solrName,
        [parameter(Mandatory=$true)]
        [string]$solrHost,
        [parameter(Mandatory=$true)]
        [string]$certificateStore
    )

    PROCESS
    {
        if($solrSSL)
        {
            # Generate SSL cert
            $existingCert = Get-ChildItem Cert:\LocalMachine\Root | where FriendlyName -eq "$solrName"
            if(!($existingCert))
            {
                Write-TaskInfo -Message "$solrHost" -Tag "Creating and trusting an new SSL Cert"

                if($pscmdlet.ShouldProcess("$solrHost", "Generate new trusted SSL certificate"))
                {
                    # Generate a cert
                    # https://docs.microsoft.com/en-us/powershell/module/pkiclient/new-selfsignedcertificate?view=win10-ps
                    $cert = New-SelfSignedCertificate -FriendlyName "$solrName" -DnsName "$solrHost" -CertStoreLocation "cert:\LocalMachine" -NotAfter (Get-Date).AddYears(10)

                    # Trust the cert
                    # https://stackoverflow.com/questions/8815145/how-to-trust-a-certificate-in-windows-powershell
                    $store = New-Object System.Security.Cryptography.X509Certificates.X509Store "Root","LocalMachine"
                    $store.Open("ReadWrite")
                    $store.Add($cert)
                    $store.Close()

                    # remove the untrusted copy of the cert
                    $cert | Remove-Item
                }
            }
            else
            {
                Write-TaskInfo -Message "$solrHost" -Tag "Trusted SSL certificate already exists - skipping"
            }

            # export the cert to pfx using solr's default password
            if(!(Test-Path -Path $certificateStore))
            {
                Write-TaskInfo -Message "$certificateStore" -Tag "Exporting certificate to disk"

                $cert = Get-ChildItem Cert:\LocalMachine\Root | where FriendlyName -eq "$solrName"
    
                $certPwd = ConvertTo-SecureString -String "secret" -Force -AsPlainText

                if($pscmdlet.ShouldProcess("$certificateStore", "Export certificate to disk"))
                {
                    $cert | Export-PfxCertificate -FilePath $certificateStore -Password $certpwd | Out-Null
                }
            }
            else
            {
                Write-TaskInfo -Message "$certificateStore" -Tag "Certificate file already exported - skipping"
            }
        }
    }
}

Export-ModuleMember Invoke-EnsureSSLCertificateTask
Register-SitecoreInstallExtension -Command Invoke-EnsureSSLCertificateTask -As EnsureSSLCertificate -Type Task