certificate – A Geeks World

Error 500 in Azure Pack when using ADFS

I’ve had a couple of customers lately who’s had sudden issues with Azure Pack reporting a error 500 when used in combination with ADFS after logging on.

It’s because the ADFS Certificate has been updated and the thumbprint in WAP doesn’t match the one presented from ADFS anymore.

Mark has made a great post about it here (all credits to him for the solution): Error 500 Azure Pack tenant portal – Jwt10329 Error

I’ve modified Mark’s script a little bit so I can easily run it at various customers without modifying the URL’s. It will basically read the old value from the config and re-use that hostname for the ADFS dns entry.

This script assumes you are using ADFS for both the tenant and admin sites.

Import-Module -Name MgmtSvcConfig

$DBHOST = "MSSQL01"
$DBUSER = "SA"
$DBPASS = "Password"

$connectionstring = "Server=$DBHOST;Initial Catalog=Microsoft.MgmtSvc.Store;User ID=$DBUSER;Password=$DBPASS"
Test-MgmtSvcDatabase -ConnectionString $ConnectionString -Schema Config

$TargetTenant = Get-MgmtSvcRelyingPartySettings -ConnectionString $connectionstring -Target Tenant
$TargetAdmin = Get-MgmtSvcRelyingPartySettings -ConnectionString $connectionstring -Target Admin
$TargetMembership = get-MgmtSvcIdentityProviderSettings -ConnectionString $connectionstring -Target Membership
$TargetWindows = get-MgmtSvcIdentityProviderSettings -ConnectionString $connectionstring -Target Windows

Set-MgmtSvcRelyingPartySettings -Target Admin -MetadataEndpoint ("https://"+$TargetAdmin.Endpoint.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation
Set-MgmtSvcIdentityProviderSettings -Target Windows -MetadataEndpoint ("https://"+$TargetWindows.ReplyTo.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation
Set-MgmtSvcRelyingPartySettings -Target Tenant -MetadataEndpoint ("https://"+$TargetTenant.Endpoint.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation
Set-MgmtSvcIdentityProviderSettings -Target Membership -MetadataEndpoint ("https://"+$TargetMembership.ReplyTo.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation

Import-Module -Name MgmtSvcConfig

$DBHOST = "MSSQL01"

$DBUSER = "SA"

$DBPASS = "Password"

$connectionstring = "Server=$DBHOST;Initial Catalog=Microsoft.MgmtSvc.Store;User ID=$DBUSER;Password=$DBPASS"

Test-MgmtSvcDatabase -ConnectionString $ConnectionString -Schema Config

$TargetTenant = Get-MgmtSvcRelyingPartySettings -ConnectionString $connectionstring -Target Tenant

$TargetAdmin = Get-MgmtSvcRelyingPartySettings -ConnectionString $connectionstring -Target Admin

$TargetMembership = get-MgmtSvcIdentityProviderSettings -ConnectionString $connectionstring -Target Membership

$TargetWindows = get-MgmtSvcIdentityProviderSettings -ConnectionString $connectionstring -Target Windows

Set-MgmtSvcRelyingPartySettings -Target Admin -MetadataEndpoint ("https://"+$TargetAdmin.Endpoint.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation

Set-MgmtSvcIdentityProviderSettings -Target Windows -MetadataEndpoint ("https://"+$TargetWindows.ReplyTo.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation

Set-MgmtSvcRelyingPartySettings -Target Tenant -MetadataEndpoint ("https://"+$TargetTenant.Endpoint.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation

Set-MgmtSvcIdentityProviderSettings -Target Membership -MetadataEndpoint ("https://"+$TargetMembership.ReplyTo.Host+"/FederationMetadata/2007-06/FederationMetadata.xml") -ConnectionString $ConnectionString #-DisableCertificateValidation

Just update the HOST, Username and Password and run the script on the AdminSite server. When done, logon to AzurePack as normal.

List all expiring certificates on all domain joined servers

A colleague asked me if I could list all expiring certificates on all Domain Joined servers in the environment.
– Sure!

A few minutes later, a script that will connect to all Servers and list certificates that will expire in less than 90 days. I’m sure there are a thousand of scripts out there who does the same, and here is script number 1001.

Invoke-Command -ComputerName (get-adcomputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*)(!serviceprincipalname=*MSClusterVirtualServer*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" -Property name | sort-object Name).Name -Command {
   get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90  
  }

Invoke-Command -ComputerName (get-adcomputer -LDAPFilter "(&(objectCategory=computer)(operatingSystem=Windows Server*)(!serviceprincipalname=*MSClusterVirtualServer*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" -Property name | sort-object Name).Name -Command {

get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90

}

The script will get all Windows Server Computer Accounts, that are not expired and is not a virtual object (like a Cluster Service).
It will then connect to those servers and list all Certificates that will expire in less than 90 days.

Short and easy to use, and we did find 2 certificates that need to be replaced ASAP!

Import a Cryptographic New Generation (CNG) certificate as a Legacy cert to use with ADFS

The current version of ADFS (Active Directory Federation Services for Windows Server 2012 R2) unfortunately does not support Cryptographic New Generation (CNG) Certificates.
Though if you already have a CNG cert, and does not want to re-request a legacy cert from your provider, it’s possible to import a CNG as a Legacy cert by using this command.

certutil.exe -csp "Microsoft Enhanced RSA and AES Cryptographic Provider" -importpfx c:\temp\cng_cerficiate_file.pfx

1	certutil.exe -csp "Microsoft Enhanced RSA and AES Cryptographic Provider" -importpfx c:\temp\cng_cerficiate_file.pfx

And ADFS will then be able to use that certificate.

A Huge thanks to my colleague and security expert Hasain Alshakarti (Twitter: @Alshakarti Blog: http://secadmins.com/) for providing me with the solution.

List computer certificates that will expire with Powershell

Just a small simple script that will list all Computer Cerificates that will expire in 90 days, to give you a heads up and time to renew them.

To list computer certificates that will expire in 90 days:

# Show computer certificates that will expire in 90 days 
get-childitem cert:LocalMachine\My -recurse | where-object {$_.NotAfter -gt (get-date)} | select Subject,FriendlyName,Thumbprint,@{Name="Expires in (Days)";Expression={($_.NotAfter).subtract([DateTime]::Now).days}} | where "Expires in (Days)" -lt 90 | Sort "Expires in (Days)"

# Show computer certificates that will expire in 90 days

Just change “-lt 90” to some other value to adjust the expiry period.