Generating Certificate Requests With Certreq

Hey there,

SSL/TLS and the certificates it comes with are becoming more ubiquitous every day.  The system is not without its flaws, (BEAST, hash collision attacks, etc.,) but it's still generally regarded as "pretty good," and it's downright mandatory in any network that needs even a modicum of security.

One major downside is the administrative burden of having to keep track of and renew all those certificates, but Active Directory Certificate Services does a wonderful job of automating a lot of that away.  Many Windows administrator's lives would be a living hell if it weren't for Active Directory-integrated auto-enrollment.

But sometimes you don't always have the pleasure of working with an Enterprise CA. Sometimes you need to manually request a certificate from a non-Microsoft certificate authority, or a CA that is kept offline, etc.  Most people immediately start thinking about OpenSSL, which is a fine, multiplatform open-source tool.  But I usually seek out native tools that I already have on my Windows servers before I go download something off the internet that duplicates functionality that already comes with Windows.

Which brings me to certreq.  I use this guy to generate CSRs (certificate requests) when I need to submit one to a CA that isn't part of my AD forest or cannot otherwise be used in an auto-enrollment scenario. First paste something like this into an *.inf file:

;
;----------------- csr.inf -----------------
[Version]
Signature="$Windows NT$

[NewRequest]
Subject = "CN=web01.contoso.com, O=Contoso LLC, L=Redmond, S=Washington, C=US" 
KeySpec = 1
KeyLength = 2048
; Can be 1024, 2048, 4096, 8192, or 16384.
; Larger key sizes are more secure, but have
; a greater impact on performance.
Exportable = TRUE
MachineKeySet = TRUE
SMIME = False
PrivateKeyArchive = FALSE
UserProtected = FALSE
UseExistingKeySet = FALSE
ProviderName = "Microsoft RSA SChannel Cryptographic Provider"
ProviderType = 12
RequestType = PKCS10
KeyUsage = 0xa0

[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; this is for Server Authentication
;-----------------------------------------------

Then, run the command:

C:\> certreq -new csr.inf web01.req

And certreq will take the settings from the INF file that you created and turn them into a CSR with a .req extension.  The certreq reference and syntax, including all the various parameters that you can include in your INF file is right here. It's at this moment that the private key associated with this request is generated and stored, but it is not stored within the CSR so you don't have to worry about securely transporting the CSR.

Now you can submit that CSR to the certificate authority. Once the certificate authority has approved your request, they'll give you back a PEM or a CER file. If your CA gives you a PEM file, just rename it to CER.  The format is the same.  Remember that only the computer that generated the CSR has the private key for this certificate, so the request can only be completed on that computer.  To install the certificate, run:

C:\> certreq -Accept certificate.cer

Now you should see the certificate in the computer's certificate store, and the little key on the icon verifies that you do have the associated private key to go along with it.

So there you have it.  See you next time!

Today's Thoughts on Windows 8.1 (Will Do Server 2012 R2 Next)

Guten abend!

So thankfully, Microsoft reversed their earlier decision to not release Windows 8.1 and Server 2012 R2 RTM on TechNet or MSDN until October 18th. Both products popped up on TechNet a few days ago. So, I downloaded both and have been playing with them in my lab the past few days. (Which is likely the last good thing I will be able to get from TechNet.  Rest in peace, you final bastion of good will from Microsoft to IT professionals.)

Windows 8.1 has gone onto the following test machine:

  • Intel Core i5-2500k
  • 16GB RAM
  • 256GB Samsung SSD
  • NVidia GTX 670 2GB

Needless to say, it screams. My experience has been that you will typically have a better time with Win 8 if you set it up with your Microsoft Live ID from the beginning, and not a domain account. In fact, it's almost impossible to install Windows 8.1 with anything other than your Microsoft Live ID. (Although you're free to join a domain later, after the install. But good luck installing with a local account.) I would say that this will be a barrier for Windows 8 adoption in the enterprise, however, the actual Win 8.1 Enterprise SKU has not been released yet, so the installer for that edition should be tweaked for easier installation in an AD domain in an enterprise environment. (And I admittedly have not even tried custom deployable images as you would with an enterprise environment.)

That looks weird.

But in a home setting, the reason I think it's awesome to go ahead and use your Live ID to install Windows 8.1 is because:

  • Your Skydrive sets itself up. It's already there waiting for you. It's integrated into Explorer already, and the coolest part is it initially takes up no room on your hard drive. It all stays online but browsable from within Explorer, and you only pull a file down from the cloud when you open it. But if you have some need to have it available offline? Just right-click the file, folder, or your entire Skydrive and choose "Make available offline" and it will all be downloaded locally. If you used Skydrive before 8.1, you should love this improvement. If you did not use Skydrive before 8.1 then you may find that this added feature only gets in the way. 
  • All your OS settings from Windows 8 are synchronized and brought into 8.1, even if you performed a clean install of 8.1. As soon as the installation finished, I landed on a Windows desktop and my wallpaper is already what I had on my last PC, because the wallpaper was stored on Skydrive. Furthermore, all my settings like 'folder view settings' were automatically sucked into the new installation as well. Ever since Windows 95, every time I would install the OS on a new machine, the first thing I did was go to the folder view settings and uncheck the "Hide File Extensions" option. I always hated that Windows would hide the file extension of files. Well, now that setting stays with me on every Win 8 machine I move to and I no longer have to worry about it.
  • IE11 seems great so far. Very fast, although, that could also be attributed to my beefy hardware. However, I have experienced one compatibility problem so far with IE11. I know that the user agent string for one thing changed dramatically in IE11. But in a pinch, hit F12 for the developer tools and you can emulate any down-level version of IE that you need. No big deal. I'll resist the urge to rant against web developers here.
  • (Though seriously, web developers, if you're listening, you are ruining the web.)
  • Boot to desktop and the ability to show your desktop wallpaper as your Start Screen background are welcome features. The resurrection of the classic Start Button on the taskbar, however, I don't care about one way or the other. I never really missed the old Start Menu from old versions of Windows. I pretty much don't care about the 'Modern,' 'Metro' interface either way, but I'm not bitter about it, because I know it wasn't made for me. It was made for phones and tablets. I have a desktop PC, and as such, I have no need for the Modern UI. End of story. Use what works for you. The OS now has a new feature now that I'm not really interested in, but who cares, the rest of the underlying OS is still there, and it's still good.
  • The Remote Server Administration Tools for Win 8.1 Preview installs on and works in Win 8.1 RTM, which I am using to set up a full Server 2012 R2 lab environment, which I shall talk about shortly in an upcoming blog post!

Microsoft MCM and MCA Certifications Are Dead

First they trash TechNet subscriptions, and now I'm hearing that Microsoft Certified Master and Architect certifications are officially dying now as well. (Note: the following email was not sent to me. It came from this guy.) 

We are contacting you to let you know we are making a change to the Microsoft Certified Master, Microsoft Certified Solutions Master, and Microsoft Certified Architect certifications. As technology changes so do Microsoft certifications and as such, we are continuing to evolve the Microsoft certification program. Microsoft will no longer offer Masters and Architect level training rotations and will be retiring the Masters level certification exams as of October 1, 2013. The IT industry is changing rapidly and we will continue to evaluate the certification and training needs of the industry to determine if there's a different certification needed for the pinnacle of our program.

As a Microsoft Certified Master, Microsoft Certified Solutions Master, or Microsoft Certified Architect, you have earned one of the highest certifications available through the Microsoft Certification program. Although individuals will no longer be able to earn these certifications, you will continue to hold the credential and you will not be required to recertify your credential in the future. You will continue to have access to the logos through the MCP site, and your certifications will continue to show in the appropriate section of your transcript, according to Microsoft technology retirement dates. If you are a Charter Member, you will continue to hold the Charter Member designation on your transcript.

Also as a Microsoft Certified Master, Microsoft Certified Solutions Master, or Microsoft Certified Architect, you are a member of an exclusive, highly technical community and you've told us this community is one of the biggest benefits of your certification. We encourage you to stay connected with your peers through the main community distribution lists. Although we won't be adding more people to this community, you continue to be a valued member of it. Over time, Microsoft plans to transition the distribution lists to the community, and, with your consent, will include your information so that it can continue to be a valuable resource for your ongoing technical discussions.

Within the coming weeks, you will receive invitations to an updated community site. This community site will require you to sign in with a Microsoft Account and will replace the need for a Microsoft Partner account as is required today. From this site, you will be able to manage service requests for the Masters and Architects communities – such as ordering welcome kits and managing your contact information for the distribution lists and directory - and accessing training rotation and other community content (if applicable).

If you have not ordered your Welcome Kit, the last day to do so is October 31, 2013. To order your Welcome Kit, please contact the Advanced Cert team at advcert@microsoft.com.

We thank you for your commitment to Microsoft technologies.

This is extraordinarily depressing for me, as Microsoft Certified Master certification has been one of my biggest goals for the past three years. And now that's no longer a possibility.

I don't know why Microsoft would make such a decision, or if there will ever be a new equivalent certification to take the place of the MCM and MCA.

Microsoft, many of us do not understand your recent decisions that appear to be squarely anti-IT Pro. Microsoft Certified Masters and Architects were your strongest supporters and evangelists. They help advocate your products to customers and drive sales for you, Microsoft.  They spent the time and effort on that Masters or Architect certification because of a sincere passion for your products. I can't think of any other reason for you to make this decision unless you just don't want highly skilled and trained people advocating your products.

There are pockets of activism showing up already.  Here is a petition of sorts on Microsoft Connect that you can participate in. If you find any other similar petitions, please let me know.

My Powershell Profile Just Went Full-Glitz

My cat woke me up extremely early this Saturday morning with the incessant meowing and carpet-scratching that signals either her boredom, or an empty food dish.

So I got up, made some coffee, put some meat crackers into kitty's bowl, and then started tinkering with my Powershell profile... now it looks like this every time I launch PS: 

Powershell Profile

It all started a couple weeks ago when I watched a Channel9 video where Jeffrey Snover was playing with Powershell, and I noticed that he had changed his error text color to green. I'm guessing like so:

$Host.PrivateData.ErrorForegroundColor = "Green"

I don't know why he configured his error messages to be green. Maybe it's just because it's easier to see than the default red.  But I like to imagine the idea is to promote positive feedback... like elementary school teachers marking their student's incorrect homework answers with another color of pen besides a red pen... because red ink makes the kids feel bad.

Anyway, as I started playing with text colors and title bar text and whatnot, it occured to me that all these settings would just revert to defaults after I closed this Powershell session. So how do we make such changes permanent?

The Powershell Profile!

Just type $Profile into Powershell right now, and it will tell you the full path of your very own PS profile. It should be something like this:

C:\Users\Ryan\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1

That script gets executed first thing every time you launch PS. It may not exist yet - you have to create it.  Just type Notepad $Profile and Notepad will open that file up, or prompt you to create it if it doesn't already exist.

I'm still thinking of more neat gizmos to throw in here, but this is good for now. The  weather information comes from the Yahoo Weather web API, and the ServerFault rep information comes from the StackExchange API. *Swoon...* REST APIs are so dreamy...

The StackExchange API gives you 300 anonymous calls per day per IP (more if you authenticate.)  There is a basic amount of error handling so that if you can't connect to one or the other of the web APIs to get the data for whatever reason, it will just replace the appropriate string with [Error connecting to weather API], and so on. You'd want to put a short timeout on the API calls too... Powershell doesn't need any help being slow to load!

And without further ado, here's the code:

Set-StrictMode -Version Latest
[String]$WOEID           = "2355944" # Where on earth ID for Arlington TX
[String]$WelcomeName     = "Ryan"
[Xml]$WeatherAPIResponse = $Null
$StackExAPIResponse      = $Null
[String]$WelcomeBanner   = [String]::Empty
[String]$WeatherString   = [String]::Empty
[String]$StackExString   = [String]::Empty

Try
{
    $WeatherAPIResponse = Invoke-WebRequest http://weather.yahooapis.com/forecastrss?w=$WOEID -TimeoutSec 3 -ErrorAction Stop
    If($WeatherAPIResponse -NE $Null -AND $WeatherAPIResponse.PSObject.Properties.Match('rss').Count)
    {
        $WeatherString = "Current weather in $($WeatherAPIResponse.rss.channel.location.city), $($WeatherAPIResponse.rss.channel.location.Region): $($WeatherAPIResponse.rss.channel.item.condition.temp)°, $($WeatherAPIResponse.rss.channel.item.condition.text), $($WeatherAPIResponse.rss.channel.atmosphere.humidity)% humidity"
    }
    Else
    {
        Throw
    }
}
Catch
{
    $WeatherString = "[Error connecting to weather service.]"
}

Try
{
    $StackExAPIResponse = Invoke-WebRequest https://api.stackexchange.com/users/104624?site=serverfault -TimeoutSec 3 -ErrorAction Stop
    If($StackExAPIResponse -NE $Null -AND $StackExAPIResponse.PSObject.Properties.Match('Content'))
    {
        $StackExString = "Current ServerFault rep: $($(ConvertFrom-Json $StackExAPIResponse.Content).Items.Reputation) total,  $($(ConvertFrom-Json $StackExAPIResponse.Content).Items.reputation_change_day) today, $($(ConvertFrom-Json $StackExAPIResponse.Content).Items.reputation_change_week) this week"
    }
    Else
    {
        Throw
    }
}
Catch
{
    $StackExString = "[Error connecting to StackExchange.  ]"
}


$WelcomeBanner      = @"
            .ooooooo            Welcome back, $WelcomeName!
          oooooooooooo          $WeatherString
        ooooo      ooooo        $StackExString
       oooo          oooo       
       ooo            .oo       
   oooooooooo          ooo      
  ooooooo.oooo.        oo.      
 ooo        .o.        ooooo    
ooo                    ooooooo  
oo                    .oooooooo 
oo                    oo     ooo
ooo                           oo
.oo                          ooo
 oooo                        oo.
  .oo myotherpcisacloud.com oo 
    .oooooooooooooooooooooooo  

"@

Write-Host $WelcomeBanner -ForegroundColor Cyan

Accessing HKEY_USERS With Powershell

If you run  Get-PSDrive  in Powershell, you will see that you are given two registry providers: HKEY_LOCAL_MACHINE (HKLM) and HKEY_CURRENT_USER (HKCU).

Given that HKCU doesn't actually exist per se, but is rather just a "projection" or "mapped view" of HKEY_USERS\<Your SID>, that means that the HKCU provider can be problematic in certain remote registry or network logon situations, and of course it's no good at all if you want to view or manipulate the registry of another user.

So how do we access HKEY_USERS in Powershell?  Here are three ways that will work just fine:

#
Set-Location Registry::\HKEY_USERS
#
#
New-PSDrive HKU Registry HKEY_USERS
Set-Location HKU:
#

And in this last example, I will set the desktop wallpaper for my own user account to cats.jpg, without using HKCU. This way I can run it at system boot, before I ever even log on:

#
Set-ItemProperty -Path Microsoft.PowerShell.Core\Registry::HKEY_USERS\S-1-5-21-2381515279-1434780867-6353740611-13738\Software\Microsoft\Windows\CurrentVersion\Policies\System -Name Wallpaper -Value C:\Pictures\cats.jpg
#