Configuring AppViewX Posh-ACME Client

1. Run the following command to import Posh-ACME:

   Import-Module Posh-ACME -Force

2. Open PowerShell with admin privileges.
3. Ensure that you are in the POSHACME_AVX directory before you run the http-01 and dns-01 based challenge validation commands (described below) to enroll a certificate.

New-PACertificate <Domain_Name> -AcceptTOS -Plugin WebSelfHost -Verbose -Force -retryCount <retryCount> -retryInterval <retryInterval> -location <ACME server endpoint URL> -attributes <Attributes> -attributesType <AttributesType> -AlwaysNewKey

A sample certificate enrollment command for HTTP validation is as shown:

Default DNS Challenge

New-PACertificate <Domain_Name> -AcceptTOS  -Contact <mail.id> -Plugin <Plugin_Name> -PluginArgs $pArgs -verbose -retryCount <retryCount> -retryInterval <retryInterval> -location <ACME server endpoint URL> -attributes <Attributes> -attributesType <AttributesType> -AlwaysNewKey -Force

A sample certificate enrollment for DNS validation using route53 is as shown. Similarly other DNS plugins can be used.

Set-AWSCredential Command

Purpose: This command stores AWS credentials under a named profile poshacme.

Parameters:

• -StoreAs 'poshacme': The name under which the AWS credentials are stored. This profile name is referenced later when configuring the Route 53 plugin.
• -AccessKey '***********': The AWS Access Key ID.
• -SecretKey '***********': The AWS Secret Access Key.

Plugin Arguments Configuration

Purpose: This command sets up a hashtable $pArgs to store the Route 53 plugin arguments.

Key:

• R53ProfileName='poshacme': Specifies the AWS profile name (poshacme) to be used by the Route 53 plugin for authentication.

Enrollment Command

DNS Challenge

$pArgs==@{vendor='infoblox';vendorAccountName='infoblox'}
New-PACertificate <FQDN> -AcceptTOS -Contact <EMAIL> -Plugin Appviewx -PluginArgs $pArgs -retryInterval 30 -location <ACME_URL> -AlwaysNewKey -Force -verbose

where the vendor value must be the DNS vendor name such as infoblox, vendorAccountName value must be the same as that configured in the AppViewX Integration Hub DNS Vendor settings, the -Plugin value must always be Appviewx.

$pArgs=@{}
New-PACertificate <FQDN> -AcceptTOS -Contact <EMAIL> -Plugin Appviewx -PluginArgs $pArgs -retryInterval 30 -location <ACME_URL> -AlwaysNewKey -Force -verbose

where the pArgs will be empty as there is no DNS vendor involved, the Plugin value must always be Appviewx.

For more information on the keywords used in the Posh-ACME commands, see Keywords in Posh-ACME commands.

Get-PACertificate <Main_Domain_Name> | Set-IISCertificate -SiteName '<Site_Name>' -Verbose

Table 2. Parameters used in the http-01 and dns-01 based challenge validation

Parameter	Mandatory	Description
<Main_Domain_Name>	Yes	Enter a valid main domain name of the certificate to be bound.
<Site_Name>	Yes	Enter a valid IIS site name as shown:

A sample command to bind a certificate to the IIS server is as shown:

For more information on the keywords used in the Posh-ACME commands, see Keywords in Posh-ACME commands.

A single scheduled task runs every day at a specified time and checks the validity of all the certificates to determine if any of them should be renewed based on the threshold renewalDaysThreshold specified.

(crontab -l ; echo "MM HH * * * <path to renewal.sh file> -retryCount <retryCount> -retryInterval <retryInterval> -renewalDaysThreshold <renewalDaysThreshold> -poshACMEDirectoryPath <poshACMEDirectoryPath> >> <path_to_renewal_log_file> 2>&1") | crontab -

For more information on the keywords used in the Posh-ACME commands, see Keywords in Posh-ACME commands.

A single scheduled task runs every day at a specified time and checks the validity of all the certificates to determine if any of them should be renewed based on the threshold renewalDaysThreshold specified.

.\renewal_schedule_windows.ps1 -retryCount <retryCount> -retryInterval <retryInterval> -renewalDaysThreshold <renewalDaysThreshold> -time HH:MM

For more information on the keywords used in the Posh-ACME commands, see Keywords in Posh-ACME commands.

• Successful Renewal: When the renewal of a domain certificate is successfully completed, the older certificate cannot be used and is backed up as a .bak file and is then replaced with the newly generated certificate. This ensures that a copy of the older certificate is preserved while the updated certificate takes its place.
• Interrupted Renewal: If the renewal process is prematurely interrupted, the older certificates may not be successfully renewed. In such cases, the older certificates become unusable and they are deleted and backed up as a result of the interrupted renewal process.

-attributes @{'id'='1098';'environment'='development';'Director'='director_id'}

The -attributesType <AttributesType> parameter must be accompanied with the -attributes <Attributes> parameter which takes in one of the following inputs cert/custom/both.

-attributesType custom

• When attributesType is passed as cert, the attributes from the attributes field are taken as certificate attributes.

  Sample certificate attributes input: -attributes @{'Id'='1';'eai'='test';'inScope'='yes';'environment'='envi1'} -attributesType cert

  The image shows the certificate attributes defined in the Posh-ACME command:
  The following image shows the certificate attributes and custom attributes sent as part of the request:
• When attributesType is passed as custom, the attributes from the attributes field are taken as custom attributes.

  Sample custom attributes input: -attributes @{'cust_id'='123';'name'='appviewx'} -attributesType custom

  The image shows the certificate attributes defined in the Posh-ACME command:

  The following image shows the certificate attributes and custom attributes sent as part of the request:

  
• When attributesType is passed as both, a JSON mapping is expected by the AppViewX Posh-ACME. A json file in the name attributesMapping.json needs to be created inside the POSHACME_AVX directory. There is a template file named attributesMappingTemplate.json present within the POSHACME_AVX directory, which can also be renamed to attributesMapping.json.
  A sample attributesMapping.json is as shown:

  {
  "senior_director" : "Sr Director",
  "intermediate_director" : "Intermediate Director"
  }
  

  • The key [in the key:value pair from attributesMapping.json] refers to the certificate attribute key provided in the command, while the value corresponds to the custom attribute key where the value of the certificate attribute must be passed.
  • The attributes passed as input are sent as certificate attributes and for the attributes present in the attributesMapping.json, the mapped value is being used as attribute name and sent as custom attribute.

  Sample certificate attributes input: -attributes @{'cust_id'='123';'name'='appviewx';'senior_director':'srDirector_id_1','intermediate_director':'IntDirector_2'} -attributesType both

  The image shows the attributes defined in the Posh-ACME command:
  The following image shows the certificate attributes and custom attributes sent as part of the request: