3.第三方提供的腳本
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 |
$subscriptionId = "yoursubscriptionID" Login-AzureRmAccount Set-AzureRmContext -SubscriptionId $subscriptionId #Set variables for getting and exporting $pfxpassword = "password" $keyVaultName = "keyvaultname" $keyVaultSecretName = "secretName" $secret = Get-AzureKeyVaultSecret -VaultName $keyVaultName -Name $keyVaultSecretName $pfxCertObject= New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 -ArgumentList @([Convert]::FromBase64String($secret.SecretValueText),"", [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable) $currentDirectory = (Get-Location -PSProvider FileSystem).ProviderPath [Environment]::CurrentDirectory = (Get-Location -PSProvider FileSystem).ProviderPath [io.file]::WriteAllBytes(".\appservicecertificate.pfx", $pfxCertObject.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pkcs12, $pfxpassword)) Write-Host "Created an App Service Certificate copy at: $currentDirectory\appservicecertificate.pfx" Write-Warning "For security reasons, do not store the PFX password. Use it directly from the console as required." Write-Host "PFX password: $pfxpassword" |
需要調整的變數為
1.訂閱的ID
2.金鑰保管庫的名字
3.金鑰保管庫中 秘密 的id
4.憑證的密碼，預設為password，可自行調整
修改完畢後在powershell中執行，本例密碼我設定為lucasyupw
小叮嚀：
1.執行腳本的帳號建議使用AAD全域管理員帳號，否則可能會提示一些權限的錯誤
2.匯出的不會包含中間憑證，雖然一般不會影響使用，但如果可以，最好是將根憑證及中間憑證一起匯出、匯入，godaddy的根及中間憑證下載地址是https://certs.godaddy.com/repository，網站的ssl評分可以通過一些網站來檢測，可以參考https://www.ssllabs.com/ssltest 和https://myssl.com/ 等，在https://geekflare.com/ssl-test-certificate/上有提供多個類似網站。