Integrate with new SSL certificate management functionality in SPSE

[TroyStarr]

You may want to consider having AutoSPInstaller integrate with the new SSL certificate management functionality in SharePoint Server Subscription Edition. (The AssignCert function in AutoSPInstaller and related code.) There's a risk that SharePoint Server Subscription Edition might stomp on the SSL certificate binding configured by the existing AutoSPInstaller code now that SharePoint thinks it has control over the SSL certificate used by the SSL binding.

Take a look at the following new SharePoint PowerShell cmdlets to see what functionality is available:

• Export-SPCertificate: Exports certificates from the SharePoint farm.
• Get-SPCertificate: Returns all certificates that match the specified criteria.
• Import-SPCertificate: Imports certificates into the SharePoint farm.
• Move-SPCertificate: Moves the specified certificate to a different certificate store.
• New-SPCertificate: Creates a new certificate signing request. (Also creates a self-signed certificate that's placed in SharePoint's Pending certificate store.)
• Remove-SPCertificate: Deletes a certificate and any associated private key.
• Rename-SPCertificate: Changes the friendly name (display name) of a certificate.
• Renew-SPCertificate: Renews a certificate and creates a new certificate signing request.
• Switch-SPCertificate: Replaces existing certificate assignments with a new certificate.
• Get-SPCertificateSettings: Returns the default properties for creating and renewing certificates and the certificate health analyzer rules.
• Set-SPCertificateSettings: Configures certificate management settings.
• Add-SPCertificateNotificationContact: Adds an email address to the list of contacts to be notified when certificates are about to expire or have already expired.
• Clear-SPCertificateNotificationContact: Deletes all email addresses from the list of contacts to be notified when certificates are about to expire or have already expired.
• Get-SPCertificateNotificationContact: Gets the email addresses to be notified when certificates are about to expire or have already expired.
• Remove-SPCertificateNotificationContact: Deletes an email address from the list of contacts to be notified when certificates are about to expire or have already expired.

... and the various PowerShell cmdlets that have been updated to add a -Certificate <SPServerCertificatePipeBind> parameter to specify which SSL certificate managed by the SharePoint SSL certificate management feature should be used. That includes New-SPCentralAdministration, Set-SPCentralAdministration, New-SPWebApplication, Set-SPWebApplication, and New-SPWebApplicationExtension.

[brianlala]

Definitely! Yesterday's push was just about providing initial SE support; I'll look at integrating the new cmdlets ASAP.

I also plan on looking at how SharePointDSC can leverage the new cert management too - if Yorick isn't already on it.

Cheers