From c33283530efdd66d26293e6e253eec8a323357db Mon Sep 17 00:00:00 2001 From: David Schroeder Date: Sat, 15 Nov 2025 20:26:46 -0600 Subject: [PATCH] update --- defaults.inc | 2 +- inc/vCenter-SSL.ps1 | 149 +++++++++++++++++++++----------------------- 2 files changed, 71 insertions(+), 80 deletions(-) diff --git a/defaults.inc b/defaults.inc index a83d51fe..e1c05915 100755 --- a/defaults.inc +++ b/defaults.inc @@ -1,6 +1,6 @@ #!/usr/bin/env bash -VERS='5.6.28-11082025' +VERS='5.6.50-11152025' NM_BETA=false diff --git a/inc/vCenter-SSL.ps1 b/inc/vCenter-SSL.ps1 index b0ebb92c..c86e53a7 100644 --- a/inc/vCenter-SSL.ps1 +++ b/inc/vCenter-SSL.ps1 @@ -1,43 +1,32 @@ #!/usr/bin/env pwsh # ----------------------------------------------------------------------------------- -# vCenter + Posh-ACME Script (Fully Automated with Verbose Logging) +# vCenter + Posh-ACME Script (Fully Automated, Idempotent, Verbose Logging) # ----------------------------------------------------------------------------------- . /opt/idssys/nodemgmt/conf/powerwall/settings.ps1 -# ---------------------------- -# Global variables for troubleshooting -# ---------------------------- $global:helpme = $null $global:responseBody = $null -# ---------------------------- -# Error handler -# ---------------------------- function Show-Failure { param([System.Management.Automation.ErrorRecord]$ErrorRecord) - $global:responseBody = $ErrorRecord.Exception.Message $global:helpme = $global:responseBody - Write-Host "----------------------------------------" -ForegroundColor Red Write-Host "Status: A system exception was caught." -ForegroundColor Red Write-Host $global:responseBody -ForegroundColor Red Write-Host "The request/response body has been saved to `$global:helpme" -ForegroundColor Red Write-Host "----------------------------------------" -ForegroundColor Red - exit 1 } # ---------------------------- -# Ensure PowerCLI module +# PowerCLI # ---------------------------- if (-not (Get-Module -ListAvailable -Name VMware.PowerCLI)) { Install-Module -Name VMware.PowerCLI -Force -Scope AllUsers } Import-Module VMware.PowerCLI -ErrorAction Stop - -# Ignore self-signed cert warnings Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -Confirm:$false | Out-Null # ---------------------------- @@ -58,12 +47,10 @@ try { $vms = Get-VM Write-Host "Retrieved VM list:" -ForegroundColor Cyan $vms | ForEach-Object { Write-Host " - $($_.Name)" } -} catch { - Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow -} +} catch { Write-Host "Unable to retrieve VM list, continuing..." -ForegroundColor Yellow } # ---------------------------- -# Ensure Posh-ACME module +# Posh-ACME # ---------------------------- if (-not (Get-Module -ListAvailable -Name Posh-ACME)) { Install-Module -Name Posh-ACME -Force -Scope AllUsers @@ -71,47 +58,48 @@ if (-not (Get-Module -ListAvailable -Name Posh-ACME)) { Import-Module Posh-ACME -ErrorAction Stop # ---------------------------- -# ACME / PowerDNS certificate request +# Determine if ACME request is needed # ---------------------------- -# Convert API key to SecureString for PowerDNS plugin -if ($PDNSAPI -is [string]) { - $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force -} else { - $securePDNSAPI = $PDNSAPI -} - -$pArgs = @{ - PowerDNSApiHost = $WDNSHOST - PowerDNSApiKey = $securePDNSAPI - PowerDNSUseTLS = $true - PowerDNSPort = 443 - PowerDNSServerName = 'localhost' -} - -$certName = "vcenter-cert" $certSuccess = $false +$existingCert = Get-PAOrder -Domain $VCENTERHOST -ErrorAction SilentlyContinue | Sort-Object Created -Descending | Select-Object -First 1 -try { - Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan - New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15 - $certSuccess = $true -} catch { - Write-Host "ACME certificate request failed: $($_.Exception.Message)" -ForegroundColor Yellow - $global:helpme = $_.Exception.Message -} - -# ---------------------------- -# Collect certificate paths dynamically -# ---------------------------- -if ($certSuccess) { - # Get the most recent order - $paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1 - $certFolder = $paOrder.CertFolder - +if ($existingCert -and ($existingCert.Cert.NotAfter -gt (Get-Date).AddDays(30))) { + Write-Host "Existing certificate valid >30 days (expires $($existingCert.Cert.NotAfter)), skipping ACME request." -ForegroundColor Green + $certFolder = $existingCert.CertFolder $certPath = Join-Path $certFolder "cert.pem" $keyPath = Join-Path $certFolder "privkey.pem" $chainPath = Join-Path $certFolder "chain.pem" + $certSuccess = $true +} else { + if ($PDNSAPI -is [string]) { $securePDNSAPI = ConvertTo-SecureString $PDNSAPI -AsPlainText -Force } else { $securePDNSAPI = $PDNSAPI } + $pArgs = @{ + PowerDNSApiHost = $WDNSHOST + PowerDNSApiKey = $securePDNSAPI + PowerDNSUseTLS = $true + PowerDNSPort = 443 + PowerDNSServerName = 'localhost' + } + + try { + Write-Host "Requesting certificate via Posh-ACME..." -ForegroundColor Cyan + New-PACertificate -Domain $VCENTERHOST -DnsPlugin PowerDNS -PluginArgs $pArgs -Contact $ACMEEMAIL -AcceptTOS -Verbose -Force -DnsSleep 15 + $paOrder = Get-PAOrder | Sort-Object Created -Descending | Select-Object -First 1 + $certFolder = $paOrder.CertFolder + $certPath = Join-Path $certFolder "cert.pem" + $keyPath = Join-Path $certFolder "privkey.pem" + $chainPath = Join-Path $certFolder "chain.pem" + $certSuccess = $true + } catch { + Write-Host "ACME request failed: $($_.Exception.Message)" -ForegroundColor Yellow + $global:helpme = $_.Exception.Message + } +} + +# ---------------------------- +# Validate certificate files +# ---------------------------- +if ($certSuccess) { foreach ($f in @($certPath, $keyPath, $chainPath)) { if (-not (Test-Path $f)) { Write-Host "Certificate file missing: $f" -ForegroundColor Yellow @@ -121,48 +109,56 @@ if ($certSuccess) { } # ---------------------------- -# Upload and apply certificate via REST (with verbose logging) +# Check if vCenter already has this cert # ---------------------------- +$updateNeeded = $true if ($certSuccess) { try { - $sessionHeaders = @{ - 'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId - } + $sessionHeaders = @{ 'vmware-api-session-id' = $vCenterConn.ExtensionData.Content.SessionManager.SessionId } + $vcenterCertUri = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls" + $vCenterCert = Invoke-RestMethod -Uri $vcenterCertUri -Method Get -SkipCertificateCheck -Headers $sessionHeaders -ErrorAction Stop + $currentCertPem = $vCenterCert.certificate | Out-String + $newCertPem = Get-Content -Path $certPath -Raw + + if ($currentCertPem -eq $newCertPem) { + Write-Host "vCenter already has the latest certificate applied. Skipping upload/apply." -ForegroundColor Green + $updateNeeded = $false + } + } catch { + Write-Host "Unable to verify current vCenter certificate, will attempt update." -ForegroundColor Yellow + } +} + +# ---------------------------- +# Upload & apply if needed +# ---------------------------- +if ($certSuccess -and $updateNeeded) { + try { $body = @{ cert = Get-Content -Path $certPath -Raw key = Get-Content -Path $keyPath -Raw chain = Get-Content -Path $chainPath -Raw } - $jsonBody = $body | ConvertTo-Json -Compress - - $uriUpload = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls" Write-Host "Uploading TLS certificate to vCenter..." -ForegroundColor Cyan - Write-Host "URI: $uriUpload" -ForegroundColor DarkCyan - Write-Host "Headers: $(ConvertTo-Json $sessionHeaders -Compress)" -ForegroundColor DarkCyan - Write-Host "Body length: $($jsonBody.Length) characters" -ForegroundColor DarkCyan - - $uploadResp = Invoke-RestMethod -Uri $uriUpload -Method Post -Body $jsonBody -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck -Verbose - Write-Host "Upload response: $(ConvertTo-Json $uploadResp -Compress)" -ForegroundColor Green + Invoke-RestMethod -Uri $vcenterCertUri -Method Post -Body ($body | ConvertTo-Json -Compress) -ContentType 'application/json' -Headers $sessionHeaders -SkipCertificateCheck + Write-Host "Certificate uploaded successfully." -ForegroundColor Green $uriApply = "https://$VCENTERHOST/rest/vcenter/certificate-management/vcenter/tls?action=apply" Write-Host "Applying TLS certificate to vCenter..." -ForegroundColor Cyan - Write-Host "URI: $uriApply" -ForegroundColor DarkCyan - $applyResp = Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck -Verbose - Write-Host "Apply response: $(ConvertTo-Json $applyResp -Compress)" -ForegroundColor Green - - Write-Host "Certificate uploaded and applied successfully." -ForegroundColor Green + Invoke-RestMethod -Uri $uriApply -Method Post -Headers $sessionHeaders -SkipCertificateCheck + Write-Host "Certificate applied successfully." -ForegroundColor Green } catch { Write-Host "Certificate upload/apply failed: $($_.Exception.Message)" -ForegroundColor Red $global:helpme = $_.Exception.Message } -} else { - Write-Host "Skipping certificate upload/apply due to previous errors." -ForegroundColor Yellow +} elseif ($certSuccess -and -not $updateNeeded) { + Write-Host "Certificate already current, no changes applied." -ForegroundColor Green } # ---------------------------- -# Automatic vpxd restart via REST with retries +# Automatic vpxd restart via REST # ---------------------------- $maxRetries = 20 $retryCount = 0 @@ -170,19 +166,17 @@ $restartSucceeded = $false while ($retryCount -lt $maxRetries -and -not $restartSucceeded) { try { - # Test if REST endpoint is available $healthUri = "https://$VCENTERHOST/rest/appliance/health/system" Write-Host "Checking vCenter REST health endpoint..." -ForegroundColor Cyan - $resp = Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop + Invoke-RestMethod -Uri $healthUri -Method Get -SkipCertificateCheck -ErrorAction Stop - # Restart vpxd service $restartUri = "https://$VCENTERHOST/rest/appliance/system/services/vpxd?action=restart" Write-Host "Requesting vpxd service restart via REST..." -ForegroundColor Cyan Invoke-RestMethod -Uri $restartUri -Method Post -SkipCertificateCheck -ErrorAction Stop Write-Host "vpxd service restart requested successfully." -ForegroundColor Green $restartSucceeded = $true } catch { - Write-Host "vpxd REST endpoint not ready yet, retrying in 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow + Write-Host "vpxd REST endpoint not ready, retrying 15 seconds... (Attempt $($retryCount+1)/$maxRetries)" -ForegroundColor Yellow Start-Sleep -Seconds 15 $retryCount++ } @@ -194,8 +188,5 @@ if (-not $restartSucceeded) { Write-Host "ssh root@$VCENTERHOST 'service-control --stop vpxd; service-control --start vpxd'" -ForegroundColor Red } -# ---------------------------- -# Completion message -# ---------------------------- Write-Host "" Write-Host "Script completed. Check `$global:helpme for any error details." -ForegroundColor Green