1

I am a bit confused on how to configure certificate for my local host. My scenario is like:

We've two windows 2012 servers (not joined in a domain) and I need to execute a powershell script remotely from one machine. This has to be done using the IP of the other machine. I've tried a bit and could finally know that the protocol should be HTTPS when using IP and it requires a server certificate.

Reading so many blogs and posts made me confused me and using powershell in both the servers I have installed self signed cert created using powershell. The certs are named as computername.workgroup and is located in Personal in local computer certificate store.

But when I try winrm qc -transport:https Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate certificate.

Can someone please help me at the earliest? How I can solve this error, by creating the required cert.? Any help would be really really appreciated.

2 Answers 2

2

From https://support.microsoft.com/en-us/kb/2019527 :

The purpose of configuring WinRM for HTTPS is to encrypt the data being sent across the wire.

WinRM HTTPS requires a local computer "Server Authentication" certificate with a CN matching the hostname, that is not expired, revoked, or self-signed to be installed.

So you need to install a valid certificate on the machine first. This means it needs to come from a certification authority. Not self-signed. This could be a CA that is internal to your organization, or it could be a global CA like Godaddy or Cybertrust or something.

This also means that using the IP address of the machine instead of its name will not work, unless you can get a certificate that has that has the IP address of the machine as a Subject Alternate Name (SAN.)

0

There's no problem with using a self-signed cert for WinRM https, but when connecting to that computer's endpoint you need to specify that the (winRM) client should skip cert checks. You can do this using:

$options = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck

and then set up the session like this:

$session = New-PSSession -UseSSL -SessionOption $options

I'm guessing the cert you're trying to use doesn't contain a private key, that should be the only requirement for the cert.

1
  • I'm not disagreeing there Ryan. I'm just pointing out that it's technically possible to use non-trusted certs with WinRM.
    – Trondh
    Mar 29, 2015 at 19:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .