1

I am a bit confused on how to configure certificate for my local host. My scenario is like:

We've two windows 2012 servers (not joined in a domain) and I need to execute a powershell script remotely from one machine. This has to be done using the IP of the other machine. I've tried a bit and could finally know that the protocol should be HTTPS when using IP and it requires a server certificate.

Reading so many blogs and posts made me confused me and using powershell in both the servers I have installed self signed cert created using powershell. The certs are named as computername.workgroup and is located in Personal in local computer certificate store.

But when I try winrm qc -transport:https Cannot create a WinRM listener on HTTPS because this machine does not have an appropriate certificate.

Can someone please help me at the earliest? How I can solve this error, by creating the required cert.? Any help would be really really appreciated.

2

From https://support.microsoft.com/en-us/kb/2019527 :

The purpose of configuring WinRM for HTTPS is to encrypt the data being sent across the wire.

WinRM HTTPS requires a local computer "Server Authentication" certificate with a CN matching the hostname, that is not expired, revoked, or self-signed to be installed.

So you need to install a valid certificate on the machine first. This means it needs to come from a certification authority. Not self-signed. This could be a CA that is internal to your organization, or it could be a global CA like Godaddy or Cybertrust or something.

This also means that using the IP address of the machine instead of its name will not work, unless you can get a certificate that has that has the IP address of the machine as a Subject Alternate Name (SAN.)

0

There's no problem with using a self-signed cert for WinRM https, but when connecting to that computer's endpoint you need to specify that the (winRM) client should skip cert checks. You can do this using:

$options = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck

and then set up the session like this:

$session = New-PSSession -UseSSL -SessionOption $options

I'm guessing the cert you're trying to use doesn't contain a private key, that should be the only requirement for the cert.

  • I'm not disagreeing there Ryan. I'm just pointing out that it's technically possible to use non-trusted certs with WinRM. – Trondh Mar 29 '15 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.