# Creates vCenter 5.5 certificates and related files
# Do not use with vCenter 5.1. Run on the vCenter 5.5 server. 
# 
# Derek Seaman, VCDX #125, www.derekseaman.com
# vSphere 5.5 Install series: vexpert.me/Derek55
# For full instructions see Part 8 & 9 in the vSphere 5.5 install series
# Download the latest version from: vexpert.me/toolkit55
#
# v1.59 August 9, 2014
# Updated OpenSSL download to 0.9.8.zb
# Added check for PowerShell 3.0 (minimum requirement)
#
# v1.58 July 12, 2014
# Updated OpenSSL download to 0.9.8za
# Removed SQL 2012 SP1 client download (link broken)
# Fixed Database creation script bug
# Added additional error handling and Powershell-ized more commands
# Changed the sts.properties file to use sts in the URI per KB2058519
#
# v1.57 February 14, 2014
# More robust handling of non-internet connected systems
# Removed line continuation characters
#
# v1.56 January 19, 2014
# Fixed bug when no subordinate CA was present (Thanks Troy)
# Changed Microsoft "renewal" default to 0 for root/subordinate
#
# v1.55 January 12, 2014
# Added additional CA/subordinate error checking
#
# v1.50 December 22, 2013
# Added ESXi host support
#
# v1.42 December 3, 2013
# Modified how the certificate hash files are created
# Added Authentication Proxy certificate generation
# Changed MS CA download parameter to Renewal=1
#
# v1.41 November 14, 2013
# Changed the root/intermediate CA download order and added more error checking
#
# v1.40 November 10, 2013
# Added Auto Deploy, Dump Collector and Syslog collector SSL certs for Windows
# Added support for CA approval of submitted requests (Thanks Ryan Bolger)
# Added SHA512 request in CSR creation
# Ask for vCenter name when selecting Option 3
#
# v1.31 Octover 29, 2013
# Bugfix in option #2 where CSRs would fail to create
#
# v1.3 October 22, 2013
# Added basic support for vCenter Server Appliance cert minting/CSR
# Added support for manually entering vCenter FQDN
# Changed method of building the automatic vCenter FQDN 
#
# v1.2 October 19, 2013
# Added SQL database script creation
# Added vCenter/VUM DSN creation
#
# v1.1 October 10, 2013 Changes:
# Added IP address support for SAN field
# Added configurable CA download method (HTTP or HTTPS)
# Skips Root/subordinate certificate download if files already exist
#
#
[CmdletBinding()]
param()

# Directory where the certificate folders will be created. Does not need to exist.
$Cert_Dir = "C:\Certs"

# Path to your existing Open SSL directory. It may be c:\OpenSSL-Win32, too
# If OpenSSL is not located in this directory it will be downloaded and installed
$openssldir = "C:\OpenSSL"

# Modify these Certificate Details for your environment
$Country="NZ"
$State="BoP"
$City="Tauranga"
$org="AutoLab"

# If you want the vCenter server IP address included in the certificate set
# the value to the appropriate IP. If you don't want an IP, comment out the line.
# This applies to Windows vCenter and the vCenter Appliance.
$vCenterIP="192.168.199.5"

# The URLs where your Root and Subordinate CA certificates can be downloaded.
# If your CA certificates are not available online or you don't have a subordinate
# CA, just comment out the associated lines with a hash.  
#
# If you have an online Microsoft CA running the Web Enrollment role service,
# the CA certificate should be downloadable using the following URL:
# http(s)://YourCA.domain/certsrv/certnew.cer?ReqID=CACert&Renewal=0&Enc=b64
#
# If your have issues with the root certificate downloading, change Renewal=0
# in the body of the code. Or if the tool is downloading an expired certificate,
# increase the renewal number until it pulls the current certificate. 
#
# If you CA doesn't have web services or enabled or it's offline, you can download
# the root and intermediate CA certs manually and place them in the $Cert_Dir.
# Please see Part 9 of my vexpert.me\Derek55 series for details on how to create
# the root/intermediate files in the proper format. 
#
$rootCA = "dc.lab.local"
#$SubCA = "subca01.contoso.local"

# If your CA web enrollment site is not SSL enabled change to HTTP (insecure)
# Ignore if you don't have online Microsoft CAs.
$CADownload = "http"

# Online Microsoft CA name that will issue the certificates.
# Ignore if you don't have online Microsoft CAs.  
$ISSUING_CA = "dc\LabCA"

# Your VMware CA certificate template name (not the display name; no spaces)
# Ignore if you don't have online Microsoft CAs. 
$Template = "CertificateTemplate:VMware-SSL"

#######
# The magic happens here...don't modify
#######

# SSO and vCenter administrator usernames. Should not need to change these.
$sso_admin = "administrator@vsphere.local"
$vc_admin = "administrator@vsphere.local"

$rootcer = "$Cert_Dir\root64.cer"
$intermcer = "$Cert_Dir\interm64.cer" 
$openssl = $openssldir+"\bin\openssl.exe"
$ESXUser = "root"
$wc = New-Object System.Net.WebClient
$wc.UseDefaultCredentials = $true
New-Alias -Name OpenSSL $openssl

$Script:CertsWaitingForApproval = $false

$WServices = @("vCenterServer","vCenterInventoryService","vCenterSSO","VMwareUpdateManager","vCenterWebClient","vCenterLogBrowser","VMwareOrchestrator","AutoDeploy","DumpCollector","SysLogCollector", "AuthenticationProxy")

$LServices = @("VMware vCenter Service Certificate","VMware Inventory Service Certificate","VMware LDAP Service Certificate","VMware vCenter VAMI Certificate","vCenter Web Client Service Certificate","VMware Logbrowser Service Certificate","VMware vSphere Autodeploy Service Certificate")

# Check for PowerShell 3.0 and higher (required)

$PSpath = "HKLM:\SOFTWARE\Microsoft\PowerShell\3"

if(!(Test-Path $PSpath)) {
 write-host "PowerShell 3.0 or higher required. Please install"; exit 
 }
 
# Download OpenSSL if it's not already installed

if (!(Test-Path($openssl))) {
	Write-Host -Foreground "DarkBlue" -Background "White" "Downloading OpenSSL.."
	$null = New-Item -Type Directory $openssldir -erroraction silentlycontinue
	$sslurl = "http://slproweb.com/download/Win32OpenSSL-0_9_8zb.exe"
	$sslexe = "$env:temp\openssl.exe"
	$wc.DownloadFile($sslurl,$sslexe)
	$env:path = $env:path + ";$openssldir"
    if (!(test-Path($sslexe))) { write-host -Foreground "red" -Background "white" "Could not download or find OpenSSL. Please install OpenSSL 0.9.8y manually."; exit}
	Write-Host -Foreground "DarkBlue" -Background "White" "Installing OpenSSL.."
    cmd /c $sslexe /silent /verysilent /sp- /suppressmsgboxes
	Remove-Item $sslexe
}

# Create certificate directory if it does not exist

if(!(Test-Path $Cert_Dir)) { New-Item $Cert_Dir -Type Directory }

#
# Functions Begin Here
#

Function CheckOpenSSL {
   if (!(Test-Path $openssl)) {throw "Openssl required, unable to download, please install."}
}

Function WinVCCheck {

# Validates Windows vCenter SSO is installed

# Sets SSO filesystem path if SSO is installed
$ssoregpath = "HKLM:\SOFTWARE\VMware, Inc.\VMware Identity Services"

if(!(Test-Path $ssoregpath)) {
 write-host "SSO 5.5 not installed. Please install it first."; exit 
 }
 Else {
   $ssoreg = (Get-ItemProperty -Path $ssoregpath)
   $Script:ssodir = $ssoreg.InstallPath ; $ssodir= $ssodir -replace ".$"
}

# Configures JRE keytool alias with path if SSO is installed
$JREregpath = "HKLM:\SOFTWARE\VMware, Inc.\VMware Infrastructure\vJRE"

if(!(Test-Path $JREregpath)) {
 write-host "JRE not installed. Please install SSO 5.5 first."; exit 
 }
 Else {
   $JREreg = (Get-ItemProperty -Path $JREregpath)
   $JREBinDir = $JREreg.InstallPath ; $JREBinDir= $JREBinDir -replace ".$"
   $keytool = $JREBinDir+"\bin\keytool.exe"
   New-Alias -Name keytool $keytool -Scope script
  }
}

Function VCFQDN {

# Construct vCenter server hostname (localhost) and ask for input

$Computername = get-wmiobject win32_computersystem
$DEFFQDN = "$($computername.name).$($computername.domain)".ToLower() 

$Script:FQDN = $(
Write-Host "Is the vCenter FQDN $DEFFQDN ?"
$Input = Read-Host "Press ENTER to accept or input a new vCenter FQDN"
If ($input) {$input} else {$DEFFQDN}
)

$POS = $FQDN.IndexOf(".")
$Script:Shortname = $FQDN.Substring(0, $POS) 

}

Function DownloadRoot
{

# Download Root CA public certificate, if defined
# If the certificate exists (root64.cer) then it won't attempt to download

if ($RootCA) {

 If (!(test-path -Path $rootcer)){
   write-host "Downloading root certificate from $rootca ..."
   $url = "$CADownload"+"://$rootCA/certsrv/certnew.cer?ReqID=CACert&Renewal=0&Enc=b64"
   $wc.DownloadFile($url,$rootcer)
   If (!(test-path -Path $rootcer)) {write-host "Root64.cer did not download. Check Root CA variable, CA web services, or manually download root cert and copy to $Cert_Dir\root64.cer. See vExpert.me/Derek55 Part 9 for more details." -foregroundcolor red;exit}
   Write-host "Root CA download successful." -foregroundcolor yellow
   }
 Else { Write-host "Root CA file found, will not download." -ForegroundColor yellow} 
  }
 $Validation = select-string -simple CERTIFICATE----- $rootcer
 If (!$Validation) {write-host "Invalid Root certificate format. Validate BASE64 encoding and try again." -foregroundcolor red; exit}
}

Function DownloadSub
{
# Download Subordinate CA public certificate, if defined
# If the certificate exists (interm64.cer) then it won't attempt to download

if ($SubCA) {
  
  If (!(test-path -Path $intermcer)){
   write-host "Downloading subordinate certificate from $subca ..."
   $url = "$CADownload"+"://$SubCA/certsrv/certnew.cer?ReqID=CACert&Renewal=1&Enc=b64"
   $wc.DownloadFile($url,$intermcer)
   If (!(test-path -Path $intermcer)) {write-host "Interm64.cer did not download. Check Intermediate CA variable, CA web services, or manually download intermediate cert and copy to $Cert_Dir\interm64.cer. See vExpert.me/Derek55 Part 9 for more details." -foregroundcolor red;exit}
   Write-host "Intermediate CA download successful." -foregroundcolor yellow
   }
  Else { Write-host "Intermediate CA file found, will not download." -ForegroundColor yellow} 
  
 $Validation = select-string -simple CERTIFICATE----- $intermcer
 If (!$Validation) {write-host "Invalid subordinate certificate format. Validate BASE64 encoding and try again." -foregroundcolor red; exit}
}
}

Function CAHashes{
# Computes CA hash file(s)

# Skip if we have pending cert requests
if ($Script:CertsWaitingForApproval) { return }

# Prompt for Root cert if it's not there yet
While (!(Test-Path $rootcer)) {
   read-host "Please copy the Root CA certificate root64.cer (Base64 encoded) to $rootcer and press Enter to continue"
   }

$roothash = & OpenSSL x509 -subject_hash -noout -in $rootcer
$hashdest = $roothash + '.0' 
copy-item -path $rootcer -Destination $Cert_Dir\$hashdest

If (Test-Path $intermcer) {
   $intermhash = & OpenSSL x509 -subject_hash -noout -in $intermcer
   $interdest = $intermhash + '.0' 
   Copy-Item -Path $intermcer -Destination $Cert_Dir\$interdest
   cmd /c copy $intermcer+$rootcer $Cert_Dir\chain.cer
   }

write-host "Root CA hash is $roothash" -foregroundcolor yellow
If ($intermhash) { write-host "Intermediate CA hash is $intermhash" -foregroundcolor yellow }
}

Function CreateCSR {
# Create RSA private keys and CSRs

# If IP address is defined, add it to the SAN field
If ($vCenterIP) { $IP = " IP:$vCenterIP, DNS:$vCenterIP," }

$RequestTemplate = "[ req ]
default_md = sha512
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:$ShortName,$IP DNS:$FQDN
 
[ req_distinguished_name ]
countryName = $Country
stateOrProvinceName = $State
localityName = $City
0.organizationName = $Org
organizationalUnitName = SVCREPLACE
commonName = $FQDN
"

ForEach ($Service in $Services) {
	Set-Location $Cert_Dir
    if(!(Test-Path $Service)) { new-Item $Service -Type Directory }
	Set-Location $Service

	# Create CSR and private key
	$Out = $RequestTemplate -replace "SVCREPLACE", $Service | Out-File "$Cert_Dir\$Service\$Service.cfg" -Encoding Default -Force
        OpenSSL req -new -nodes -out "$Cert_Dir\$Service\$Service.csr" -keyout "$Cert_Dir\$Service\rui-orig.key" -config "$Cert_Dir\$Service\$Service.cfg"
	    OpenSSL rsa -in "$Cert_Dir\$Service\rui-orig.key" -out "$Cert_Dir\$Service\rui.key"
        Remove-Item rui-orig.key
  }
}

Function CreateESXCSR {
# Create RSA private keys and CSR

ForEach ($Service in $Services) {

$POS = $Service.IndexOf(".")
$Script:Shortname = $Service.Substring(0, $POS) 

$RequestTemplate = "[ req ]
default_md = sha512
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
 
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:$ShortName, DNS:$Service
 
[ req_distinguished_name ]
countryName = $Country
stateOrProvinceName = $State
localityName = $City
0.organizationName = $Org
commonName = $Service
"

	Set-Location $Cert_Dir
    if(!(Test-Path $Service)) { new-Item $Service -Type Directory }
	Set-Location $Service

	# Create CSR and private key
	$Out = $RequestTemplate -replace "SVCREPLACE", $Service | Out-File "$Cert_Dir\$Service\$Service.cfg" -Encoding Default -Force
        OpenSSL req -new -nodes -out "$Cert_Dir\$Service\$Service.csr" -keyout "$Cert_Dir\$Service\rui-orig.key" -config "$Cert_Dir\$Service\$Service.cfg"
	    OpenSSL rsa -in "$Cert_Dir\$Service\rui-orig.key" -out "$Cert_Dir\$Service\rui.key"
        Remove-Item rui-orig.key
  }
}


Function OnlineMint { 
#Mint certificates from online Microsoft CA

    # initialize objects to use for external processes
    $psi = New-Object System.Diagnostics.ProcessStartInfo
    $psi.CreateNoWindow = $true
    $psi.UseShellExecute = $false
    $psi.RedirectStandardOutput = $true
    $psi.RedirectStandardError = $true
    $process = New-Object System.Diagnostics.Process
    $process.StartInfo = $psi

    $certsRequireApproval = $false

    ForEach ($Service in $Services) {

        # submit the CSR to the CA
        $psi.FileName = "certreq.exe"
        $psi.Arguments = @("-submit -attrib `"$Template`" -config `"$ISSUING_CA`" -f `"$Cert_Dir\$Service\$Service.csr`" `"$Cert_Dir\$Service\rui.crt`"")
	    write-host "Submitting certificate request for $Service"
        [void]$process.Start()

        $cmdOut = $process.StandardOutput.ReadToEnd()
        if ($cmdOut.Trim() -like "*request is pending*")
        {
            # Output indicates the request requires approval before we can download the signed cert.
            $Script:CertsWaitingForApproval = $true

            # So we need to save the request ID to use later once they're approved.
            $reqID = ([regex]"RequestId: (\d+)").Match($cmdOut).Groups[1].Value
            if ($reqID.Trim() -eq [String]::Empty)
            {
                write-error "Unable to parse RequestId from output."
                write-debug $cmdOut
                Exit
            }
            write-host "RequestId: $reqID is pending" -ForegroundColor Yellow

            # Save the request ID to a file that OnlineMintResume can read back in later
            $reqID | out-file "$Cert_Dir\$Service\requestid.txt"
        }
        else
        {
            # Output doesn't indicate a pending request, so check for a signed cert file
            if (!(Test-Path $Cert_Dir\$Service\rui.crt)) {
                Write-Error "Certificate request failed or was unable to download the signed certificate."
                Write-Error "Verify that the ISSUING_CA variable is set correctly." 
                Write-Debug $cmdOut
                Exit
            }
        }

    }

    if ($Script:CertsWaitingForApproval) {
        write-host
        write-host "One or more certificate requests require manual approval before they can be downloaded."
        Write-host "Contact your CA administrator to approve the request IDs listed above."
        write-host "To resume use Option 3 for Windows vCenter, 9 for vCenter Appliance or 13 for ESXi Hosts"
    }

}

Function OnlineMintResume {
#Resume the minting process for certificates from online Microsoft CA that required approval

    # initialize objects to use for external processes
    $psi = New-Object System.Diagnostics.ProcessStartInfo
    $psi.CreateNoWindow = $true
    $psi.UseShellExecute = $false
    $psi.RedirectStandardOutput = $true
    $psi.RedirectStandardError = $true
    $process = New-Object System.Diagnostics.Process
    $process.StartInfo = $psi

    ForEach ($Service in $Services) {

        # skip if there's no requestid.txt file
        if (!(Test-Path "$Cert_Dir\$Service\requestid.txt")) { continue }

        $reqID = Get-Content "$Cert_Dir\$Service\requestid.txt"
        write-verbose "Found RequestId: $reqID for $Service"

        # retrieve the signed certificate
        $psi.FileName = "certreq.exe"
        $psi.Arguments = @("-retrieve -f -config `"$ISSUING_CA`" $reqID `"$Cert_Dir\$Service\rui.crt`"")
        write-host "Downloading the signed $Service certificate"
        [void]$process.Start()
        $cmdOut = $process.StandardOutput.ReadToEnd()
        if (!(test-path "$Cert_Dir\$Service\rui.crt"))
        {
            # it's not there, so check if the request is still pending
            if ($cmdOut.Trim() -like "*request is pending*")
            {
                $Script:CertsWaitingForApproval = $true
                write-host "RequestId: $reqID is pending" -ForegroundColor Yellow
            }
            else
            {
                write-warning "There was a problem downloading the signed certificate"
                write-warning $cmdOut
                continue
            }
        }

    }

    if ($Script:CertsWaitingForApproval) {
        write-host
        write-host "One or more certificate requests require manual approval before they can be downloaded."
        Write-host "Contact your CA administrator to approve the request IDs listed above."
        write-host "To resume use Option 3 for Windows vCenter, 9 for vCenter Appliance or 13 for ESXi Hosts"
    }
}

Function CreatePEMFiles {
# Create PEM files and JKS keystore. Rui.crt files must exist for all services.

# Skip if we have pending cert requests
if ($Script:CertsWaitingForApproval) { return; }

if (Test-Path $Cert_Dir\chain.cer) {
 $chaincer = "$Cert_Dir\chain.cer" 
  }
 Else { 
   $chaincer = "$Cert_Dir\root64.cer"
  }

ForEach ($Service in $WServices) {

   if (!(test-path $Cert_Dir\$Service\rui.crt)) {
      Write-host "$Service rui.crt file not found. Skipping PEM creation. Please correct and re-run." -ForegroundColor Red
      continue;
   }
   elseif ($Service -eq "vCenterSSO") {
	OpenSSL pkcs12 -export -in "$Cert_Dir\$Service\rui.crt" -inkey "$Cert_Dir\$Service\rui.key" -certfile "$Chaincer" -name "ssoserver" -passout pass:changeme -out "$Cert_Dir\$Service\ssoserver.p12"
    
    if (test-path $Cert_Dir\$Service\root-trust.jks) {remove-item $Cert_Dir\$Service\root-trust.jks}
    keytool -v -importkeystore -srckeystore $Cert_Dir\$Service\ssoserver.p12 -srcstoretype pkcs12 -srcstorepass changeme -srcalias ssoserver -destkeystore $Cert_Dir\$Service\root-trust.jks -deststoretype JKS -deststorepass testpassword -destkeypass testpassword
    keytool -v -importcert -noprompt -keystore $Cert_Dir\$Service\root-trust.jks -deststoretype JKS -storepass testpassword -keypass testpassword -file $rootcer -alias root-ca
    Copy-Item -Path $Cert_Dir\$Service\rui.key -Destination $Cert_Dir\$Service\ssoserver.key
         
    if (test-path -path $intermcer){ 
       keytool -v -importcert -noprompt -trustcacerts -keystore $Cert_Dir\$Service\root-trust.jks -deststoretype JKS -storepass testpassword -keypass testpassword -file $intermcer -alias intermediate-$intermhash.0
       
       }
    Copy-Item -Path $Cert_Dir\$Service\root-trust.jks -Destination $Cert_Dir\$Service\server-identity.jks
    cmd /c copy $Cert_Dir\$Service\rui.crt+$chaincer $Cert_Dir\$Service\chain.pem
    Copy-Item -Path $Cert_Dir\$Service\chain.pem -Destination $Cert_Dir\$Service\ssoserver.crt
    }
	else {
       OpenSSL pkcs12 -export -in "$Cert_Dir\$Service\rui.crt" -inkey "$Cert_Dir\$Service\rui.key" -certfile "$Chaincer" -name "rui" -passout pass:testpassword -out "$Cert_Dir\$Service\rui.pfx"
        $RUI = get-content $Cert_Dir\$Service\rui.crt
        $ChainCont = get-content $chaincer -encoding default
        $RUI + $ChainCont | out-file  $Cert_Dir\$Service\chain.pem -Encoding default
         }
       Set-Location $Cert_Dir
   }
}

Function CreateSSOFiles {

# Create the three SSO properties files, needed to replace SSO certificates

# Skip if we have pending cert requests
if ($Script:CertsWaitingForApproval) { return }

$LookupServiceURL = 'https://' + $FQDN + ':7444/lookupservice/sdk'
$SSOServices = @("gc","admin","sts")

if (Test-Path $Cert_Dir\chain.cer) {
 $SSLCert = "$Cert_Dir\chain.cer" 
  }
 Else { 
   $SSLCert = "$Cert_Dir\root64.cer"
  }

ForEach ($SSOService in $SSOServices) {

if ($SSOService -eq "gc") {
   $SSOFriendly = "The group check interface of the SSO server"
   $SSOType = "groupcheck"
   $SSODescription = "The group check interface of the SSO server"
   $SSOProtocol = "vmomi"
   $SVCURI = "sso-adminserver/sdk/vsphere.local"
   }

if ($SSOService -eq "admin") {
   $SSOFriendly = "The administrative interface of the SSO server"
   $SSOType = "admin"
   $SSODescription = "The administrative interface of the SSO server"
   $SSOProtocol = "vmomi"
   $SVCURI = "sso-adminserver/sdk/vsphere.local"
   }

if ($SSOService -eq "sts") {
   $SSOFriendly = "STS for Single Sign On"
   $SSOType = "sts"
   $SSODescription = "The Security Token Service of the Single Sign On server."
   $SSOProtocol = "wsTrust"
   $SVCURI = "sts/STSService/vsphere.local"
   }

$SSOTemplate = "[service]
friendlyName=$SSOFriendly
version=1.5
ownerId=
productId=product:sso
type=urn:sso:$SSOType
description=$SSODescription

[endpoint0]
uri=https://FQDN:7444/$SVCURI
ssl=$SSLCert
protocol=$SSOProtocol
"

$Out = $SSOTemplate -replace "FQDN", $FQDN | Out-File "$Cert_Dir\vCenterSSO\$SSOService.properties" -Encoding Default -Force
}

# Create the three SSO ID files

write-host "Connecting to Lookup Service..."
$output = &"$ssodir\ssolscli.cmd" listServices "$lookupServiceURL"

foreach ($line in $output) {
		if ($line.StartsWith("Service ")) {
			$linenum = ($output | Select-String $line).LineNumber
			if ($linenum -is [int32]) { 
			
                $serviceId = $output | Select-Object -Index ($linenum+1)
				$type = $output | Select-Object -Index ($linenum+3)

                if ($type -like '*sts*') {
                 $serviceidfilename = "$Cert_Dir\vCenterSSO\sts_id" 
                 Set-Content $serviceidfilename  $serviceid.TrimStart("serviceId=")
                 write-host "Created sts files..."
                 }
                
                elseif ($type -like '*admin*') {
                 $serviceidfilename = "$Cert_Dir\vCenterSSO\admin_id"
                 Set-Content $serviceidfilename  $serviceid.TrimStart("serviceId=")
                 write-host "Created admin files..."
                  }
                   
                elseif ($type -like '*group*') {
                 $serviceidfilename = "$Cert_Dir\vCenterSSO\gc_id"
                 Set-Content $serviceidfilename  $serviceid.TrimStart("serviceId=")
                 write-host "Created groupcheck files..." 
                 }
			
				}
			}
		}

   If(!(Test-Path "$Cert_Dir\vCenterSSO\gc_id")) {
     Write-host "Unable to connect to Lookup service at $lookupserviceurl. " -ForegroundColor Red
   } 

}

Function CreateBat {
# Create batch template file for VMware vCenter certificate automation tool

$BatchTemplate = "
@echo off
set sso_cert_chain=$Cert_Dir\vCenterSSO\chain.pem
set sso_private_key=$Cert_Dir\vCenterSSO\ssoserver.key
set sso_node_type=single
set is_cert_chain=$Cert_Dir\vCenterInventoryService\chain.pem
set is_private_key_new=$Cert_Dir\vCenterInventoryService\rui.key
set vc_cert_chain=$Cert_Dir\vCenterServer\chain.pem
set vc_private_key=$Cert_Dir\vCenterServer\rui.key
set ngc_cert_chain=$Cert_Dir\vCenterWebClient\chain.pem
set ngc_private_key=$Cert_Dir\vCenterWebClient\rui.key
set logbrowser_cert_chain=$Cert_Dir\vCenterLogBrowser\chain.pem
set logbrowser_private_key=$Cert_Dir\vCenterLogBrowser\rui.key
set vco_cert_chain=$Cert_Dir\VMwareOrchestrator\chain.pem
set vco_private_key=$Cert_Dir\VMwareOrchestrator\rui.key
set vum_cert_chain=$Cert_Dir\VMwareUpdateManager\chain.pem
set vum_private_key=$Cert_Dir\VMwareUpdateManager\rui.key
set sso_admin_user=$sso_admin
set vc_username=$vc_admin
set last_error=
set ROLLBACK_BACKUP_FOLDER=%~dp0backup
set LOGS_FOLDER=%~dp0logs
set CSR_OUTPUT_FOLDER=%~dp0requests
"
$Out = $BatchTemplate | Out-File "$Cert_Dir\ssl-environment.bat" -Encoding Default -Force
Write-host "Batch file written to $Cert_Dir. Copy over VMware tool file." -ForegroundColor Yellow
}

Function SQLDB {

# Creates a generic SQL database creation script.

$VCDB = Read-Host "Enter vCenter Database Name"
$VUMDB = Read-Host "Enter VUM Database Name"
$Account = Read-Host "Enter vCenter service account (domain\account)"

$SQLTemplate = "

/* Creates vCenter server and VUM databases. */
/* Change login name to vCenter service account */
/* Modify paths, DB, log sizes as needed */

EXEC('CREATE LOGIN [$Account]FROM WINDOWS')

USE MSDB
EXEC sp_grantdbaccess ""$Account""
EXEC sp_addrolemember db_owner, ""$Account""

USE master
create database ""$VCDB""
on
( name = '$VCDB',
   filename = 'F:\SQLData1\$VCDB.mdf',
   size = 4096MB,
   filegrowth = 512MB )
   log on
( name = '$VCDB log',
   filename = 'F:\SQLLogs1\$VCDB.ldf',
   size = 384MB,
   filegrowth = 128MB )

COLLATE SQL_Latin1_General_CP1_CI_AS;

create database ""$VUMDB""
on
( name = '$VUMDB',
   filename = 'F:\SQLData1\$VUMDB.mdf',
   size = 1024MB,
   filegrowth = 128MB )
   log on
( name = '$VUMDB log',
   filename = 'F:\SQLLogs1\$VUMDB.ldf',
   size = 256MB,
   filegrowth = 64MB )

COLLATE SQL_Latin1_General_CP1_CI_AS;

EXEC('ALTER AUTHORIZATION ON DATABASE::""$VCDB"" TO [$Account]')
EXEC('ALTER AUTHORIZATION ON DATABASE::""$VUMDB"" TO [$Account]')

GO
"
$Out = $SQLTemplate | Out-File "$Cert_Dir\vCenter-VUM-DB.sql" -Encoding Default -Force
Write-host "vCenter-VUM-DB.sql written to $Cert_Dir. Modify and run in SQL Manager Studio." -ForegroundColor Yellow

}

Function VCDSN {

$SQLServer = Read-Host "Enter SQL server FQDN"
$DBName = Read-Host "Enter vCenter Database Name"
$Version = Read-Host "What version of SQL server? (2008 or 2012)"
$Encrypt = Read-Host "Do you want SQL SSL encryption? (yes or no)"

$HKLMPath1 = "HKLM:\SOFTWARE\ODBC\ODBC.INI\" + $DBName
$HKLMPath2 = "HKLM:\SOFTWARE\ODBC\ODBC.INI\ODBC Data Sources"
md $HKLMPath1 -ErrorAction silentlycontinue

set-itemproperty -path $HKLMPath1 -name Description -value $DBName
set-itemproperty -path $HKLMPath1 -name Server -value $SQLServer
set-itemproperty -path $HKLMPath1 -name LastUser -value "Administrator"
set-itemproperty -path $HKLMPath1 -name Trusted_Connection -value "Yes"
set-itemproperty -path $HKLMPath1 -name Encrypt -value $Encrypt
set-itemproperty -path $HKLMPath1 -name Database -value $DBName

md $HKLMPath2 -ErrorAction silentlycontinue

if ($version -eq 2008) {
   set-itemproperty -path $HKLMPath2 -name "$DBName" -value "SQL Server Native Client 10.0"
   set-itemproperty -path $HKLMPath1 -name Driver -value "C:\WINDOWS\system32\sqlncli10.dll"
   If(!(test-path "C:\WINDOWS\system32\sqlncli10.dll")) {
     Write-Host -Foreground "DarkBlue" -Background "White" "Downloading SQL 2008 R2 SP2 Native Client.."
	 $SQLurl = "http://download.microsoft.com/download/F/7/B/F7B7A246-6B35-40E9-8509-72D2F8D63B80/sqlncli_amd64.msi"
	 $SQLexe = "$env:temp\sqlncli.msi"
	 $wc.DownloadFile($SQLurl,$SQLexe)
	 $env:path = $env:path + ";$SQLdir"
	 Write-Host -Foreground "DarkBlue" -Background "White" "Installing SQL 2008 R2 SP2 native client..."
     cmd /c msiexec /i $SQLexe /qn IACCEPTSQLNCLILICENSETERMS=YES
	 Remove-Item $SQLexe
   }   
 }

Else {
   set-itemproperty -path $HKLMPath2 -name "$DBName" -value "SQL Server Native Client 11.0"
   set-itemproperty -path $HKLMPath1 -name Driver -value "C:\WINDOWS\system32\sqlncli11.dll"
   If(!(test-path "C:\WINDOWS\system32\sqlncli11.dll")) {
     Write-Host -Foreground "DarkBlue" -Background "White" "Download and install ENU\x64\sqlncli.msi from http://www.microsoft.com/en-us/download/details.aspx?id=35580"
   }
 }
}


Function VUMDSN {

$SQLServer = Read-Host "Enter SQL server FQDN"
$DBName = Read-Host "Enter VUM Database Name"
$Version = Read-Host "What version of SQL server? (2008 or 2012)"
$Encrypt = Read-Host "Do you want SQL SSL encryption? (yes or no)"

$HKLMPath1 = "HKLM:\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\" + $DBName
$HKLMPath2 = "HKLM:\SOFTWARE\Wow6432Node\ODBC\ODBC.INI\ODBC Data Sources"
md $HKLMPath1 -ErrorAction silentlycontinue

set-itemproperty -path $HKLMPath1 -name Description -value $DBName
set-itemproperty -path $HKLMPath1 -name Server -value $SQLServer
set-itemproperty -path $HKLMPath1 -name LastUser -value "Administrator"
set-itemproperty -path $HKLMPath1 -name Trusted_Connection -value "Yes"
set-itemproperty -path $HKLMPath1 -name Encrypt -value $Encrypt
set-itemproperty -path $HKLMPath1 -name Database -value $DBName

md $HKLMPath2 -ErrorAction silentlycontinue

if ($version -eq 2008) {
   set-itemproperty -path $HKLMPath2 -name "$DBName" -value "SQL Server Native Client 10.0"
   set-itemproperty -path $HKLMPath1 -name Driver -value "C:\WINDOWS\system32\sqlncli10.dll"
   If(!(test-path "C:\WINDOWS\system32\sqlncli10.dll")) {Write-host "Don't forget to install the SQL 2008 client." -ForegroundColor Yellow}
   }

Else {
   set-itemproperty -path $HKLMPath2 -name "$DBName" -value "SQL Server Native Client 11.0"
   set-itemproperty -path $HKLMPath1 -name Driver -value "C:\WINDOWS\system32\sqlncli11.dll"
   If(!(test-path "C:\WINDOWS\system32\sqlncli11.dll")) {Write-host "Don't forget to install the SQL 2012 client." -ForegroundColor Yellow}
   }
}

Function GetESXHost {

# Construct ESXi Hostname

[int]$xMenuChoiceA = 0
while ( $xMenuChoiceA -lt 1 -or $xMenuChoiceA -gt 3 ){
Write-host ""
Write-host "Note: If you are resuming a manual/offline request, enter the same"
Write-host "hostname(s) or CSV file as the original request."
Write-host ""
Write-host "1. Manually enter ESXi host(s)"
Write-host "2. Read ESXi hosts from CSV file"
Write-host "3. Quit"

[Int]$xMenuChoiceA = read-host "Please enter an option 1 to 3" }
Write-Host
Switch( $xMenuChoiceA ){
  1{ESXHost}
  2{ESXCSV}
  3{Exit}
default{Exit}
 }

}

Function ESXHost {

$Script:Services = (Read-Host "Enter each ESXi FQDN (separate with comma)").split(',') | % {$_.trim()}
}

Function ESXCSV {

# Reads CSV input file of ESXi FQDNs

$CSVFile = Read-Host "Full path to CSV file"; 
	If ( !(Test-Path $CSVFile) )
	{
		Write-Host "$CSVfile not found" -ForegroundColor Red
        ESXCSV
    }

    else {
    $Script:Services = get-content $CSVFile
    } 
}


Function getWebClient {

# Used for PUTing SSL Certificates on ESXi host

$Provider=New-Object Microsoft.CSharp.CSharpCodeProvider
$Compiler=$Provider.CreateCompiler()
$Params=New-Object System.CodeDom.Compiler.CompilerParameters
$Params.GenerateExecutable=$False
$Params.GenerateInMemory=$True
$Params.IncludeDebugInformation=$False
$Params.ReferencedAssemblies.Add("System.DLL") | out-null

$TASource=@'
  namespace Com.Marchview.Net.CertificatePolicy {
    public class TrustAll : System.Net.ICertificatePolicy {
      public TrustAll() { 
      }
      public bool CheckValidationResult(System.Net.ServicePoint sp,
        System.Security.Cryptography.X509Certificates.X509Certificate cert, 
        System.Net.WebRequest req, int problem) {
        return true;
      }
    }
  }
'@ 
$TAResults=$Provider.CompileAssemblyFromSource($Params,$TASource)
$TAAssembly=$TAResults.CompiledAssembly

# We now create an instance of the TrustAll and attach it to the ServicePointManager

$TrustAll=$TAAssembly.CreateInstance("Com.Marchview.Net.CertificatePolicy.TrustAll")
[System.Net.ServicePointManager]::CertificatePolicy=$TrustAll

$WCSource=@'
  namespace Com.Marchview.Net {
    class WebClient : System.Net.WebClient {
      protected override System.Net.WebRequest GetWebRequest(System.Uri uri) {
        System.Net.WebRequest webRequest = base.GetWebRequest(uri);
        webRequest.PreAuthenticate = true;
        webRequest.Timeout = 10000;
        return webRequest;
      }
    }
  }
'@
$WCResults=$Provider.CompileAssemblyFromSource($Params,$WCSource)
$WCAssembly=$WCResults.CompiledAssembly
$WebClient=$WCAssembly.CreateInstance("Com.Marchview.Net.WebClient")

$WebClient

}

Function GetCredential {
# Used for PUTing SSL Certificates on ESXi host

param(
	  [String]$UserName,
	  $Password    
	  )

	$CredentialCache=New-Object System.Net.CredentialCache
	if ($Password.getType().FullName -eq "System.Security.SecureString") {
	  $Credential=New-Object System.Net.NetworkCredential($UserName,  
	    [System.Runtime.InteropServices.Marshal]::PtrToStringAuto( 
	    [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($Password)))
	}
	else {
	  $Credential=New-Object System.Net.NetworkCredential($UserName,$Password)
}

$Credential
}

Function getCredentialCache {
# Used for PUTing SSL Certificates on ESXi host

param(
  [String]$URIName,
  [System.Net.NetworkCredential]$Credential
  )

$CredentialCache=New-Object System.Net.CredentialCache

$URI=New-Object System.URI($URIName)
$CredentialCache.Add($URI,"Basic",$Credential)

$CredentialCache
}

Function UploadESXCert {

   if ($Script:CertsWaitingForApproval) {EXIT}

ForEach ($Service in $Services) {

	# Get password for root account or read from file

	$ESXPassFile = $ESXUser + "-credentials"
    $ESXPassFile = "$Cert_Dir\$ESXPassFile"
	If ( !(Test-Path $ESXPassFile) )
	{
		Write-Host "No credentials found for " $ESXUser
		$Prompt = "Please enter the password for " + $ESXUser
		Read-Host -prompt $Prompt -assecurestring | ConvertFrom-SecureString | Out-File $ESXPassFile
	}
	$ESXPassword = Get-Content $ESXPassFile| ConvertTo-SecureString

	# Set directories

	$ESXCertFile = "$Cert_Dir\$Service" + "\" + "rui.crt"
	$ESXKeyFile = "$Cert_Dir\$Service" + "\" + "rui.key"
	
	# Check if SSL certificate and key exist
	If (-not (Test-Path ($ESXKeyFile))) {
	  "ERROR: Failed to locate the SSL key file at $Cert_Dir\$Service"
	  exit
	}
	If (-not (Test-Path ($ESXCertFile))) {
	  "ERROR: Failed to locate the SSL crt file at $Cert_Dir\$Service"
	  exit
	}

	# Set URLs
	
	$ESXiURL = "https://" + $Service

	# Create WebClient for uploading the SSL certificate / key
	$WebClient=getWebClient
	$HostCredential=getCredential $ESXUser $ESXPassword
	$HostCredentialCache=getCredentialCache $ESXiURL $HostCredential
	$WebClient.Credentials=$HostCredentialCache
	
	# Upload SSL keys
    Try 
    {
    	$WebClient.UploadFile(($ESXiURL + "/host/ssl_key"),"PUT",$ESXKeyFile)
	    $WebClient.UploadFile(($ESXiURL + "/host/ssl_cert"),"PUT", $ESXCertFile)
    }
    Catch
    {
        $UploadError = $_.Exception.Message  
        write-host "Upload error occurred for $Service. Check hostname and credentials." -ForegroundColor Red
        write-host $_.Exception.Message -ForegroundColor Red
    }

    if (!$UploadError) {write-host "Certificates uploaded to $Service" -ForegroundColor Yellow }
 }
}


### Main ###

[int]$xMenuChoiceA = 0
while ( $xMenuChoiceA -lt 1 -or $xMenuChoiceA -gt 14 ){
Write-host ""
Write-host "Welcome to the vCenter 5.5 Toolkit" -foregroundcolor Yellow
Write-host "Derek Seaman, VCDX #125, derekseaman.com" -ForegroundColor Yellow
Write-host "vSphere 5.5 series: vexpert.me\Derek55" -ForegroundColor Yellow
Write-host "Use at your own risk; no warranty implied or stated" -ForegroundColor Yellow
Write-host ""
Write-host "Windows vCenter only:"
Write-host ""
Write-host "1. Mint vCenter SSL certs with an online Microsoft CA"
Write-host "2. Create vCenter CSRs for an offline or non-Microsoft CA"
Write-host "3. Process manually downloaded certificates or resume a pending online request"
Write-host "4. Create vCenter Certificate Automation Batch file"
Write-host "5. Create vCenter and VUM SQL database file"
Write-host "6. Create vCenter DSN"
Write-host "7. Create VUM DSN"
write-host ""
Write-host "Linux vCenter Server Appliance (VCSA) only:"
Write-host ""
Write-host "8. Mint VCSA SSL certs with an online Microsoft CA"
Write-host "9. Resume a pending online Microsoft CA request"
Write-host "10. Create VCSA CSRs for an offline or non-Microsoft CA"
Write-host ""
Write-host "ESXi Hosts"
Write-host ""
Write-host "11. Mint ESXi SSL certificate with an online Microsoft CA"
Write-host "12. Create ESXi CSRs for an offline or non-Microsoft CA"
Write-host "13. Install manually downloaded certificates or resume a pending online request"
Write-host ""
Write-host "14. Quit"

[Int]$xMenuChoiceA = read-host "Please enter an option 1 to 14" }
Write-Host
Switch( $xMenuChoiceA ){
  1{$Script:Services = $WServices; CheckOpenSSL; WinVCCheck; DownloadRoot; DownloadSub; VCFQDN; CreateCSR; OnlineMint; CAHashes; CreatePEMFiles; CreateSSOFiles}
  2{$Script:Services = $WServices; CheckOpenSSL; WinVCCheck; VCFQDN; CreateCSR}
  3{$Script:Services = $WServices; CheckOpenSSL; WinVCCheck; DownloadRoot; DownloadSub; VCFQDN; OnlineMintResume; CAHashes; CreatePemFiles; CreateSSOFiles}
  4{CreateBat}
  5{SQLDB}
  6{VCDSN}
  7{VUMDSN}
  8{$Script:Services = $LServices; CheckOpenSSL; VCFQDN; DownloadRoot; DownloadSub; CreateCSR; OnlineMint }
  9{$Script:Services = $LServices; CheckOpenSSL; VCFQDN; DownloadRoot; DownloadSub; OnlineMintResume}
  10{$Script:Services = $LServices; CheckOpenSSL; VCFQDN; CreateCSR}
  11 {CheckOpenSSL; GetESXHost; CreateESXCSR; OnlineMint; UploadESXCert}
  12 {CheckOpenSSL; GetESXHost; CreateESXCSR}
  13 {CheckOpenSSL; GetESXHost; OnlineMintResume; UploadESXCert}
  14{Exit}
default{Exit}
}